LeadMailbox: durable leader-to-leader mailbox over a shared coordination vhost

Adds the broker-side mechanism for lead-to-lead messages across daemons/hosts
(unit 1 of 2): a LeadMessage envelope carrying from/to coord-ids, an
AMQP-backed LeadMailbox modeled closely on AmqpReplyInbox (consume-and-hold,
deferred manual ack, confirm-mode publish, recovery handling), and a new
optional coordinator: config block (separate vhost from broker:, leader
traffic only). Config parsing + accessors only — FleetMcp/Fleetd/Injector/
MessageService and the send path are untouched; wiring is a separate ticket.

.claude-plugin/marketplace.json

@@ -0,0 +1,18 @@
+{
+  "name": "claude-bridge",
+  "description": "Tooling for orchestrating a fleet of delegated coding agents through the bridged MCP gateway.",
+  "owner": {
+    "name": "LTMS"
+  },
+  "plugins": [
+    {
+      "name": "claude-bridge",
+      "source": "./plugin",
+      "description": "Make a project bridge-ready: mount the bridged MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
+      "version": "0.1.0",
+      "author": {
+        "name": "LTMS"
+      }
+    }
+  ]
+}

.claude/agents/architect.md

@@ -0,0 +1,24 @@
+---
+name: architect
+description: Refine work into clear, independent units before implementation.
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You are an architect in this fleet. You refine work before anyone builds it: scope,
+acceptance criteria, risks, and a unit split. You read the repo and write analysis.
+You never commit production code and never open a pull request.
+
+A design task is worked by two architects. Design alone first, then exchange and
+say plainly where you disagree. Do not concede just to agree.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Report only work you actually did and the real output of checks you ran. Do not
+claim a result from a tool you could not use. The primary's IDE tools are not yours.
+A mounted forge tool may use a blocked credential and fail by design.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/dev.md

@@ -0,0 +1,29 @@
+---
+name: dev
+description: Implement one assigned unit, test it, and open a pull request.
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You implement the one unit you were given and nothing else. Work in your assigned
+git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
+the worktree root and branch before you edit. Use only paths under that root.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Implement the change and run the full required build in your worktree. Read the
+complete output and report its real result. Do not hide failures with a pipe. State
+only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
+tool may use a blocked credential and fail by design.
+
+Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
+`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
+own pull request against `main`. Never merge.
+
+Your handoff must name the pull request or why it was not created, the branch, the
+files changed, the build result, and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/reviewer.md

@@ -0,0 +1,34 @@
+---
+name: reviewer
+description: Review one assigned scope and report the most important real issue.
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You review the diff you were given. Report bugs, risks, and missing tests. You do
+not change code.
+
+Read the whole assigned scope before judging it. Review only that scope. If you see
+something outside it, note it in one line and do not investigate it further. Do not
+run the build. The owner makes changes and runs checks.
+
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
+unclear requirement or two defensible fixes. Do not ask about something you can
+decide by reading more code.
+
+Report the single most important real issue in this form:
+
+```
+1. <path>:<line>
+2. issue: <one sentence: what is wrong and why it matters>
+3. fix: <one line: the concrete change>
+4. severity: high | medium | low
+```
+
+If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
+is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
+or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
+risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
+with no current failure.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/skills/implementer/SKILL.md

@@ -0,0 +1,137 @@
+---
+name: implementer
+description: Implementer-role procedure for a bridged worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over bridged.
+---
+
+# Implementer worker — procedure
+
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
+never merge, never commit `.mcp.json` or `wiki/`) is in **`CLAUDE.md` → Bridge communication →
+Worker** and already applies. This skill is only the *implement-and-hand-off procedure*.
+
+You run in an **isolated git worktree on your own branch** — a full peer of the primary (same repo,
+`CLAUDE.md`, skills), differing in the model behind you and the branch you sit on. Your MCP surface
+is **only what your launcher mounted** (the bridge): the primary's IDE and forge servers are not
+yours, and the worktree's `.mcp.json` is deliberately emptied so you cannot inherit them.
+The worktree model is documented in [`docs/Worker-Git-Workflow.md`](../../../docs/Worker-Git-Workflow.md).
+
+## 1. Confirm where you are — then never leave
+
+Before touching anything:
+
+```bash
+git rev-parse --show-toplevel   # your worktree root — NOT the primary's main tree
+git branch --show-current       # your dedicated branch: worker/<ticket>-<nonce>
+git status                      # should be clean at the start
+```
+
+Do **all** work here, on this branch. Never `git checkout main`, never rebase onto or push to
+`main`. The branch is your isolation — respect it.
+
+**Every path you read, edit, or build is relative to that root.** Work from `$PWD`; if a tool, a
+brief, or your own memory hands you an absolute path, check it starts with your worktree root
+before you touch it, and stop if it doesn't. An absolute path pointing anywhere else is the
+primary's checkout — editing there while building here means **every build you run is of code that
+does not contain your changes**, and it passes while your work goes nowhere. This has happened:
+a worker made all 59 of its edits in the primary's tree and never noticed.
+
+```bash
+test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-toplevel)"
+```
+
+## 2. Implement
+
+- Implement exactly the scope the lead named. Keep the diff focused; note anything out of scope
+  in your reply instead of widening it.
+- Match the surrounding code's style, naming, and idioms.
+
+**Acceptance criterion — a green build, quoted.** Your work is not done until this passes *inside
+your worktree*:
+
+```bash
+cd "$(git rev-parse --show-toplevel)/bridged" && mvn clean install
+echo "exit=$?"
+```
+
+Read its **full** output — never pipe it through `tail`/`head`/`grep`, which hide a failure behind
+a zero exit. Then quote the real `Tests run: … Failures: … Errors: …` line and the
+`BUILD SUCCESS`/`FAILURE` verbatim in your reply. If it does not go green, say so with the actual
+error; a failing build honestly reported is a usable result, a claimed-green one is not. You have
+no IDE MCP tools, so `mvn` is your only verification — never claim a check you had no way to run.
+
+## 3. Commit
+
+```bash
+git add <the files you changed>     # explicitly — never `git add -A` / `git add .`
+git commit -m "<ticket>: <clear one-line summary>"
+```
+
+`.mcp.json` is neutralized and `--skip-worktree` in your worktree — never `git add` it, and never
+"restore" it from the primary's copy. Same for `wiki/` (a submodule with its own remote).
+
+## 4. Push
+
+```bash
+git push -u origin HEAD
+```
+
+Push is over SSH as the same user — no extra credential needed. Never force-push over anything
+you did not create.
+
+## 5. Open your own PR to `main`
+
+Via the gitea REST API. The daemon injected a **repo-scoped token** (`GITEA_TOKEN`) and the forge
+host (`GITEA_HOST`) into your env for exactly this — the token can create a PR but **cannot
+merge**.
+
+```bash
+API="${GITEA_HOST%/}/api/v1/repos/fleet/fleetd/pulls"
+BRANCH="$(git branch --show-current)"
+curl -sS -X POST "$API" \
+  -H "Authorization: token ${GITEA_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "$(cat <<JSON
+{"head": "${BRANCH}", "base": "main",
+ "title": "<ticket>: <concise change summary>",
+ "body": "<what changed and why; reference the ticket; note tests run and their result>"}
+JSON
+)"
+```
+
+The response JSON carries `"html_url"` — that is your PR URL. On a non-2xx, read the error body,
+fix it if the cause is yours (e.g. branch not pushed yet), and report the failure rather than
+inventing a URL. If `GITEA_TOKEN` is unset your profile was not granted PR-create: push the branch
+and report its name so the lead opens the PR.
+
+## 6. Hand off — what goes in `fleet_reply`
+
+The reply is the entire handoff; the lead cannot see your terminal.
+
+```
+PR:      <html_url from step 5, or "not created: <reason>" + branch name>
+branch:  <your branch>
+root:    <git rev-parse --show-toplevel — proves you worked in your own worktree>
+files:   <worktree-relative paths you changed>
+build:   <the verbatim "Tests run: …" and BUILD SUCCESS/FAILURE lines — or "not run: <why>">
+summary: <2-3 lines: what you implemented and any caveat the reviewer needs>
+```
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant L as Lead
+    participant I as Implementer (you)
+    participant G as git / gitea
+
+    L->>I: delegated task (you are in a worktree on your branch)
+    I->>I: "implement here — every path under $PWD"
+    I->>I: "mvn clean install in this worktree, unpiped, until green"
+    I->>G: git commit (never .mcp.json / wiki)
+    I->>G: git push -u origin HEAD
+    I->>G: POST /pulls (GITEA_TOKEN) — open PR to main
+    G-->>I: html_url
+    I->>L: fleet_reply(PR url, branch, files, tests)
+    Note over L,G: the lead reviews the PR and merges on green — you never merge
+```
+
+*The implement turn: work in the worktree, commit → push → open the PR, hand off the URL.*

.claude/skills/port-to-opencode/SKILL.md

@@ -0,0 +1,180 @@
+---
+name: port-to-opencode
+description: Make an OpenCode session a first-class participant in a Claude Code workspace — instructions, MCP servers, and secrets — without duplicating config. Use when onboarding opencode to a project that already has CLAUDE.md and .mcp.json, or when an opencode peer needs the same tools and rules as the Claude session.
+---
+
+# Porting a Claude Code workspace to OpenCode
+
+**The headline: there is almost nothing to port.** OpenCode reads `CLAUDE.md` natively. The only
+artifact you create is one `opencode.json` mapping MCP servers. Do not translate instructions, do
+not generate a second rules file, and do not install a sync tool — every one of those makes the
+workspace worse.
+
+Everything below was verified against `opencode 1.18.16` and the OpenCode docs.
+
+## 1. Know what you get for free
+
+OpenCode's instruction search order:
+
+```
+1. walking up from cwd:   AGENTS.md , then CLAUDE.md
+2. global:                ~/.config/opencode/AGENTS.md
+3. Claude Code global:    ~/.claude/CLAUDE.md          (unless disabled)
+```
+
+*"The first matching file wins in each category."*
+
+Consequences that decide the whole procedure:
+
+- **A project `CLAUDE.md` is already read.** No port needed.
+- **Your user-level `~/.claude/CLAUDE.md` is already read too.** Global preferences carry over.
+- **An `AGENTS.md` in the repo SHADOWS `CLAUDE.md`.** If one exists from a previous Codex port,
+  **delete it** — otherwise opencode reads the stale translated copy instead of the real rules.
+  This is the single most likely way to get this wrong.
+
+## 2. Create `opencode.json` for MCP servers only
+
+Project config lives at `opencode.json` in the repo root; the global one is
+`~/.config/opencode/opencode.json`. **Configs merge, they do not replace** — so machine-local
+servers belong in the global file and shared ones in the project file.
+
+Map each entry from `.mcp.json`:
+
+| `.mcp.json` | `opencode.json` |
+|---|---|
+| `"type": "http"` / `"sse"` | `"type": "remote"`, `"url"` |
+| `"type": "stdio"` | `"type": "local"`, `"command": ["bin", "arg"]` |
+| `"command"` + `"args"` | single `"command"` array |
+| `"env"` | `"environment"` |
+| `"headers"` | `"headers"` |
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "instructions": ["CLAUDE.md"],
+  "mcp": {
+    "fleetd":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
+    "context7": { "type": "remote", "url": "https://example.dev/mcp", "enabled": true,
+                  "headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" } },
+    "gitea":    { "type": "local", "command": ["gitea-mcp", "-t", "stdio"], "enabled": true,
+                  "environment": { "GITEA_ACCESS_TOKEN": "{env:GITEA_ACCESS_TOKEN}" } }
+  }
+}
+```
+
+Set `instructions` explicitly even though `CLAUDE.md` is found anyway — the fallback only applies
+while no `AGENTS.md` exists, and being explicit survives someone adding one later.
+
+## 3. Reference secrets, never embed them
+
+OpenCode substitutes at load time, in both `headers` and `environment`:
+
+```
+{env:VARIABLE_NAME}      value from the environment
+{file:~/.secrets/token}  value read from a file
+```
+
+**No credential ever belongs in `opencode.json`.** With `{env:…}` there is no reason to write one,
+which is what makes this file safe to commit — and it must be committable, because a peer running
+in a git worktree receives tracked files only.
+
+**But `{env:…}` reads OpenCode's *process* environment — and OpenCode has no env store of its
+own.** A Claude Code `env` block in `~/.claude/settings.json` or `.claude/settings.local.json` does
+**not** reach it: those files are Claude Code's, and the variables exist only inside processes
+Claude Code spawned. Verify with a clean login shell, not the shell your agent hands you:
+
+```bash
+env -u MY_TOKEN zsh -lc 'echo "${MY_TOKEN:-NOT IN PROFILE}"'
+```
+
+So `{env:…}` only works if something puts the variable in the environment first. Pick the supply
+route by who launches opencode:
+
+| Launcher | Route |
+|---|---|
+| a human, from a terminal | one central store, sourced by the login shell |
+| a spawner (bridge, CI, IDE) | `{env:…}`, with the spawner injecting the variable |
+
+**For the human case, keep every credential in one file the login shell sources.** Here that file
+is `${SHARED_ENV}/tools/secrets.sh`, sourced from `${SHARED_ENV}/.ltms`, kept at mode 600 and never
+committed. `opencode.json` then names variables and holds no values:
+
+```json
+"headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" }
+```
+
+Both routes end at the same syntax, and that is the point. The file does not change when a human
+launches opencode instead of the bridge.
+
+**`{file:…}` also works, and this project moved away from it.** Opencode resolves a relative
+`{file:}` path against the project root, so a gitignored `.secrets/` beside `opencode.json` needs no
+shell setup at all. It did not fail; the problem is that it makes a second copy of the token. The
+same secret then lives in two places, and the copy you forget is the one that leaks or goes stale.
+One store with many references is easier to rotate and to audit.
+
+**One catch survives either choice, so state it out loud:** what a human's shell exports does not
+reach a spawned peer, and neither does a gitignored `.secrets/` — a git worktree receives tracked
+files only. Spawned peers must be fed through `{env:…}` by whatever launches them. Check the
+variable *names* match: a spawner often injects under a different name than your shell uses, and
+the config has no fallback. In this repo the bridge goes further: it neutralizes a worktree's
+`opencode.json`, so a member cannot inherit the primary's credentials by accident.
+
+## 4. Do not port machine-local MCP servers
+
+IDE indexes, language servers, editor bridges — anything bound to *your* checkout — stay out of the
+project file. Put them in `~/.config/opencode/opencode.json` if you want them personally.
+
+A committed project config reaches every worktree. A worker that mounts servers whose paths point
+into the primary's checkout will edit the primary's files while building in its own — every build
+passes, every change lands in the wrong tree.
+
+Port the servers the work needs. Leave the rest.
+
+## 5. Verify against the running agent, not the file
+
+A file on disk proves nothing about what the agent loaded.
+
+```bash
+opencode run "In one line: state a rule from this project's instructions."
+```
+
+The answer must reflect the actual `CLAUDE.md`. If it answers generically, the instructions did not
+reach the model and everything after this is built on sand.
+
+Then confirm the tools are mounted:
+
+```bash
+opencode mcp list
+```
+
+**"connected" does not mean "working".** A stdio server with a missing credential still completes
+the MCP handshake and reports green; only a real tool call reveals it. Verified: `gitea` showed
+`✓ connected` with no token, then failed the first call with `token is required`. A remote server
+is more honest (`⚠ needs authentication`), but do not rely on that difference — **exercise one
+authenticated tool per server**:
+
+```bash
+opencode run "Call <server>'s <tool>. Report the result or the exact error. One line."
+```
+
+Check too that no server you deliberately withheld is present.
+
+## 6. Report
+
+State what you changed, which servers crossed and which you withheld and why, and quote the
+verification answer verbatim. If any server failed to connect, say so plainly — a partially mounted
+peer is worse than a missing one, because it looks configured.
+
+## Gotchas
+
+- **A leftover `AGENTS.md` silently wins over `CLAUDE.md`.** Check for one before anything else.
+- **`opencode.json` is merged, not overridden** — a global entry and a project entry with the same
+  server name both matter; keep names distinct unless you intend to layer them.
+- **`enabled: false`** turns a server off without deleting its config — prefer it over removal when
+  you may want the server back.
+- **OAuth-based servers** store tokens in `~/.local/share/opencode/mcp-auth.json` after
+  `opencode mcp auth <server>`; that is machine state, never config to commit.
+- **Skills and subagents do not port.** OpenCode uses its own agent markdown under
+  `.opencode/agents/`; `.claude/skills/**` is not read. If a delegation brief tells a peer to load a
+  skill by name, that instruction has no effect on an opencode peer — spell the procedure out in the
+  brief, or author the equivalent agent file.

.claude/skills/reviewer/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: reviewer
+description: Reviewer-role procedure for a bridged worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over bridged.
+---
+
+# Reviewer worker — procedure
+
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
+never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies. This
+skill is only the *review procedure*: how to work the scope, and the exact shape of what you
+send back.
+
+## 1. Read the whole scope before you judge
+
+The delegation names your scope — a file, a diff, a PR, a function. **Read all of it first.**
+A review that fires on a snippet misses the caller that makes it safe (or the one that makes it
+a bug). Reviewing part of the scope and guessing the rest is the most common way a reviewer is
+wrong.
+
+## 2. Stay in the scope
+
+- Review **only** what you were assigned. Something elsewhere looks wrong? One line in your
+  reply — do not go hunt it. Wandering is how two reviewers report the same thing and neither
+  covers what it was given.
+- Do **not** edit files or run the build. You review; the owner acts.
+
+## 3. Reach for `fleet_ask` only for a genuine fork
+
+Ambiguous requirement, a missing acceptance criterion, "intended or a bug?", or two defensible
+fixes with different consequences — those are the lead's call, and guessing produces a
+confident-but-wrong finding. Anything you could settle by reading more code is yours to settle.
+
+## 4. The finding — what goes in `fleet_reply`
+
+Report the **single most important** real issue in the scope, in these four lines, under
+~90 words:
+
+```
+1. <path>:<line>
+2. issue: <one sentence — what is wrong and why it matters>
+3. fix: <one line — the concrete change>
+4. severity: high | medium | low
+```
+
+- **Nothing real after reading?** Reply `NO ISSUE` and one line saying why. A clean review is a
+  valid result; a fabricated issue is worse than none.
+- **Severity:** `high` = wrong result, data loss, security, or a hang/crash on a real path ·
+  `medium` = a real bug on an edge path, or a correctness risk under load/concurrency ·
+  `low` = clarity, a latent foot-gun, or a smell with no current failure.
+- Be specific and verifiable: a line number and a one-line repro beat an adjective. If you can't
+  point at where it goes wrong, you haven't found it yet.

.gitea/workflows/ci.yml

@@ -0,0 +1,105 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      # The wiki submodule is docs only and is not needed to build — leave it unfetched so CI
+      # does not depend on the wiki repo being reachable.
+      - uses: actions/checkout@v4
+
+      # The runner image ships an older default-jdk; bridged sets maven.compiler.release=25, so
+      # provision the JDK explicitly rather than apt-installing whatever "default" means today.
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+
+      # setup-java provisions the JDK only — it does NOT install Maven, and the runner image has
+      # no mvn on PATH (a bare `mvn` exits 127). Install it separately. apt pulls a default JRE as
+      # a dependency; JAVA_HOME from setup-java still wins, which the version check below proves.
+      - name: Install Maven
+        run: |
+          apt-get update && apt-get install -y --no-install-recommends maven
+          mvn -version
+
+      - name: Build and test
+        working-directory: bridged
+        # This IS the mock-socket surface CB-503 asks for: the pom's `default-excludes` profile
+        # already sets excludedGroups=contract, so the @Tag("contract") tests — which need a live
+        # herdr socket and a RabbitMQ container — are excluded without any flag here. Everything
+        # that runs does so against the fake UDS herdr and fake ccs/claude stubs.
+        run: mvn -B clean install
+
+      # Deliberately NOT actions/upload-artifact: this Gitea instance presents as GHES, and
+      # @actions/artifact v2+ (i.e. upload-artifact@v4) refuses to run there —
+      # "GHESNotSupportedError ... not currently supported on GHES", which red-Xes an otherwise
+      # green build. Since the artifact could not be retrieved anyway, dump the failing tests into
+      # the log instead, where they are actually readable.
+      - name: Failing test output
+        if: failure()
+        working-directory: bridged
+        run: |
+          for f in target/surefire-reports/*.txt; do
+            [ -f "$f" ] || continue
+            grep -qE "Failures: [1-9]|Errors: [1-9]" "$f" && { echo "===== $f ====="; cat "$f"; }
+          done
+          exit 0
+
+  # CB-521 — actually run the AMQP contract test in CI, against a REAL broker. The broker is a
+  # RabbitMQ SERVICE CONTAINER, not Testcontainers-with-Docker: the runner image has no Docker, so
+  # AmqpReplyInboxContractTest reads AMQP_URI (set below to the service's network alias) and binds
+  # straight to it — no Docker, no skipped tests. This separation (build job hermetic and
+  # Docker-free; contract job broker-provided) is deliberate — see the default-excludes/contract
+  # profiles in bridged/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
+  # exactly as in the build job above.
+  contract:
+    runs-on: ubuntu-latest
+    services:
+      rabbitmq:
+        image: rabbitmq:3.13          # same AMQP 0-9-1 engine the local Testcontainers fixture uses
+        env:
+          RABBITMQ_DEFAULT_USER: guest
+          RABBITMQ_DEFAULT_PASS: guest
+    env:
+      # Service containers are reachable from the job by their network alias on their internal port.
+      AMQP_URI: amqp://guest:guest@rabbitmq:5672
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+
+      - name: Install Maven
+        run: |
+          apt-get update && apt-get install -y --no-install-recommends maven
+          mvn -version
+
+      # The `contract` profile clears the default-excludes group, so the @Tag("contract") AMQP test
+      # runs against the RabbitMQ service container (AMQP_URI). Pinned to the one contract test to
+      # avoid re-running the unit suite already covered by the `build` job.
+      - name: Contract tests
+        working-directory: bridged
+        run: mvn -B -Pcontract test -Dtest=AmqpReplyInboxContractTest
+
+      - name: Failing test output
+        if: failure()
+        working-directory: bridged
+        run: |
+          for f in target/surefire-reports/*.txt; do
+            [ -f "$f" ] || continue
+            grep -qE "Failures: [1-9]|Errors: [1-9]" "$f" && { echo "===== $f ====="; cat "$f"; }
+          done
+          exit 0

.gitignore

@@ -0,0 +1,21 @@
+# No secret belongs in this repo any more: every credential lives in one shell-level store
+# (${SHARED_ENV}/tools/secrets.sh), and opencode.json reads it as {env:...}. This line stays as a
+# backstop, so a workspace-scoped copy that someone re-creates by habit still cannot be committed.
+.secrets/
+
+# Settings backups inherit the env block — and secrets with it.
+.claude/settings.local.json.bak*
+
+# The default profile parityOverlay copies these primary→worktree, so they appear in EVERY worker
+# worktree. Two reasons they must be ignored. They hold environment values, which is reason enough.
+# And since CB-576 a release preserves any worktree that `git status --porcelain` calls dirty —
+# untracked files included, deliberately. An untracked overlay file would therefore make every
+# COMPLETED release preserve its worktree, and worktrees would pile up with no error to notice.
+.env
+.envrc
+
+# Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
+# repo root and bridged/ collect one; neither belongs in git.
+bridged.out
+bridged/bridged.out
+logs/

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "wiki"]
 	path = wiki
-	url = ssh://git@git.ltms.dev:2224/lms/claude-bridge.wiki.git
+	url = ssh://git@git.ltms.dev:2224/fleet/fleetd.wiki.git

.opencode/agent/architect.md

@@ -0,0 +1,24 @@
+---
+description: Refine work into clear, independent units before implementation.
+mode: primary
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You are an architect in this fleet. You refine work before anyone builds it: scope,
+acceptance criteria, risks, and a unit split. You read the repo and write analysis.
+You never commit production code and never open a pull request.
+
+A design task is worked by two architects. Design alone first, then exchange and
+say plainly where you disagree. Do not concede just to agree.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Report only work you actually did and the real output of checks you ran. Do not
+claim a result from a tool you could not use. The primary's IDE tools are not yours.
+A mounted forge tool may use a blocked credential and fail by design.
+
+The launcher provides the required bridge reply instructions for every member.

.opencode/agent/dev.md

@@ -0,0 +1,29 @@
+---
+description: Implement one assigned unit, test it, and open a pull request.
+mode: primary
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You implement the one unit you were given and nothing else. Work in your assigned
+git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
+the worktree root and branch before you edit. Use only paths under that root.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Implement the change and run the full required build in your worktree. Read the
+complete output and report its real result. Do not hide failures with a pipe. State
+only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
+tool may use a blocked credential and fail by design.
+
+Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
+`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
+own pull request against `main`. Never merge.
+
+Your handoff must name the pull request or why it was not created, the branch, the
+files changed, the build result, and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.opencode/agent/reviewer.md

@@ -0,0 +1,34 @@
+---
+description: Review one assigned scope and report the most important real issue.
+mode: primary
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You review the diff you were given. Report bugs, risks, and missing tests. You do
+not change code.
+
+Read the whole assigned scope before judging it. Review only that scope. If you see
+something outside it, note it in one line and do not investigate it further. Do not
+run the build. The owner makes changes and runs checks.
+
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
+unclear requirement or two defensible fixes. Do not ask about something you can
+decide by reading more code.
+
+Report the single most important real issue in this form:
+
+```
+1. <path>:<line>
+2. issue: <one sentence: what is wrong and why it matters>
+3. fix: <one line: the concrete change>
+4. severity: high | medium | low
+```
+
+If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
+is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
+or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
+risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
+with no current failure.
+
+The launcher provides the required bridge reply instructions for every member.

CLAUDE.md

@@ -1,7 +1,313 @@
 # claude-bridge — project instructions
 
+## Bridge communication (enforced — read this first)
+
+> **Canonical block.** Everything down to §Layering is the portable bridge charter, copied verbatim
+> into every project that mounts the bridge MCP. Keep it byte-identical with the template in the
+> wiki ([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable
+> CLAUDE.md block*); improvements go to the template first, then out to each project. Anything
+> specific to *this* repo lives under §Project addendum below, never inline above it.
+
+If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.
+
+`bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
+**primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
+through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.
+
+### Which role am I? — settle this before acting
+
+**Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
+this `CLAUDE.md` verbatim, and every rule below is role-conditional.
+
+**Call `fleet_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
+your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
+carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
+was bound to. Don't infer what you can ask.
+
+Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
+fires: the reply charter in your system prompt (*"You are a spawned member in the
+claude-bridge fleet"*) ⇒ **spawned member**; fleet tools prefixed `mcp__fleet__*` ⇒ **spawned
+member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
+`.mcp.json`, so it varies — and a member spawned before CB-632 still says `mcp__bridge__*`); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
+on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
+only `fleet_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
+loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
+and the sender silently receives nothing. Fail toward the recoverable error.
+
+### Invariants — both roles, no exceptions
+
+1. **Never set, export, or forward `ANTHROPIC_BASE_URL`** (or `ANTHROPIC_AUTH_TOKEN`). The primary
+   stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
+   never move a session across that boundary.
+2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
+   side cannot see your screen. An answer that isn't in a `fleet_*` call is silently discarded.
+3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
+   cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
+   reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
+   outside your role is refused, not queued.
+4. **Delivery is status-gated: one message per turn.** Don't busy-poll a peer's terminal and don't
+   re-send because a call looks slow — the bridge delivers when the peer is `idle`, `blocked` or
+   `done`. A spawned member must **also** have mounted the bridge MCP: until it has, it is not
+   deliverable, and a send waits on that gate for ~60s and then fails without ever reaching its pane.
+5. **Never drive the terminal multiplexer directly** (no `herdr` CLI, no socket). The bridge owns
+   policy; the multiplexer owns PTYs. Going around the bridge bypasses every rule above.
+
+### Primary (lead) — run this on every task, in order
+
+**Delegate by default — that is the job.** With the bridge mounted you are an orchestrator on a
+metered subscription, and workers are cheap, parallel, and disposable. The default answer to "who
+does this?" is **a worker**, not you. Reach for `fleet_send` before you reach for `Edit`. The steps
+below are the procedure — run them in order, every task, not only the big ones.
+
+0. **Know your role** — `fleet_whoami`, once per session, before anything else.
+1. **Split.** Write the unit list. Every unit carries: scope · the files or PR in question ·
+   acceptance criteria · exactly what to report back. A unit with no acceptance criteria is not
+   ready to delegate — refine it or keep it.
+2. **Gate each unit** on one question: **"can I write a brief good enough for a worker to
+   succeed?"** — *not* "could I do this faster myself?" (usually you could; doing it yourself costs
+   your context and your subscription, while a wasted worker turn costs a worker turn). Yes ⇒
+   delegate. The keep-list is closed: the conversation with the user, decomposition and planning,
+   the final judgment call, verification, merges, and anything that depends on context only you
+   hold. Nothing else is yours by default.
+3. **Spawn every delegated unit first** — `fleet_spawn{profile, worktree:true, ticket}`, one per
+   unit, *before* sending any. Pass `profile` explicitly: profiles differ in model and cost, not in
+   tier, so the default is rarely what you want.
+4. **Then send them all** — `fleet_send{sessionId, content, wait:false}`. Line 1 of every brief is
+   `Load the <name> skill.` naming the worker's playbook; those skills are opt-in and that line is
+   what makes them reliable. Where the project ships no such skill, spell the procedure out in the
+   brief instead. The brief is self-contained — the worker sees your message and the repo, nothing
+   of your context, your plan, or your screen.
+5. **Collect** — `fleet_poll{ticket}` → `fleet_ack{target, msgId}`. Answer a worker's `fleet_ask`
+   with `fleet_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
+   `fleet_status`, never by reading its terminal; it also reports an open question and the `turnId`
+   that answers it. **A worker's ask waits ~55 seconds, and no nudge makes that longer** — so never
+   brief a worker to "ask me". Decide before you delegate, or give it an explicit default.
+6. **Verify yourself.** Re-run the build and the checks. A worker cannot run your IDE tooling, any
+   forge tools it appears to have hold a blocked credential and fail, and a piped command
+   (`… | tail`) hides failures behind a zero exit — never promote a worker's "clean" to a fact.
+7. **Review — fan out.** Spawn reviewers against the diff, one per dimension or per file, with
+   `wait:false`. Never the implementer of the scope it reviews, and brief them from the diff — not
+   from the implementer's rationale, which carries its own blind spot. Dispatch each PR's reviewers
+   as it lands; don't wait for the last implementer. Under ~50 changed lines, skip the fan-out and
+   read it yourself.
+8. **Adjudicate, merge, tear down — yours alone.** Read the diff yourself: fully if it is small,
+   targeted at the reported findings and the risky paths if it is large. Reviewer findings direct
+   your attention; they never substitute for it. Then merge, then `fleet_stop{paneId}`.
+
+**Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
+silently becomes serial, and it is the most common way this layer is wasted. For the same reason,
+prefer `wait:false` + `fleet_poll` for anything non-trivial: a blocking `fleet_send` is capped by
+*your own* MCP client call timeout (~60s), well below the task's real runtime.
+
+**Delegating does not delegate responsibility.** Workers open PRs; you are the gate. Never delegate
+the merge — and merging on a reviewer's word is delegating it by proxy.
+
+| Intent | Tool |
+|---|---|
+| Confirm your own role | `fleet_whoami` |
+| See backends available | `fleet_profiles` |
+| Start a member | `fleet_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
+| See the fleet | `fleet_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `fleet_status{sessionId}` |
+| Delegate (blocking) | `fleet_send{sessionId, content}` |
+| Delegate (long task) | `fleet_send{sessionId, content, wait:false}` → ticket → `fleet_poll{ticket}` |
+| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
+| Message a **peer lead** | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
+| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
+| Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
+| Tear down a member | `fleet_stop{paneId}` |
+
+### Lead ↔ lead — coordinate, never delegate
+
+`fleet_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
+is a peer — an orchestrator with its own context, its own members, and its own judgment. An empty
+`members` array means no members are spawned; it says nothing about peers.
+
+**A lead never assigns a task to another lead.** Work goes to members — only ever downward, never
+sideways. Sending a peer a brief with acceptance criteria is a category error: a brief is a member's
+artefact, and a peer is not yours to task. If a unit needs doing and it falls in your area, spawn a
+member and delegate it yourself; if it falls in the peer's area, say so and let the peer assign it.
+The traffic between leads is coordination and nothing else:
+
+1. **Divide the map, not the work.** Agree who owns which area, then each of you assigns inside your
+   own. Split by **context ownership** — whoever already holds the context owns that area — and say
+   who takes what, in one message, before either of you starts. Two leads silently working the same
+   unit is the failure mode here, and neither notices until the merge.
+2. **Share findings, hazards, and corrections.** What you have already discovered, what broke, what
+   the next person will trip on. This is the traffic that actually pays for the channel: it costs one
+   message and saves a peer a rediscovery.
+3. **Verify a peer exactly as you verify yourself.** Peer status buys nothing: check the claim
+   against the code, and re-run the build. A peer's correction gets the same treatment — right or
+   wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
+
+Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
+the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
+you.
+
+### Member (worker or architect) — the turn contract
+
+1. **Load the playbook skill the lead named** before doing anything else.
+2. **Do the assigned scope only.** Note anything you spot outside it in one line; don't go hunt it.
+3. **`fleet_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
+   defensible fixes, "bug or intended?"). It blocks and you resume the *same* turn with the answer.
+   Don't ask what you could decide yourself.
+4. **End the turn with exactly one `fleet_reply{content}`**, carrying your complete answer. This is
+   the whole handoff. No `fleet_reply` ⇒ the sender gets nothing and the exchange stalls.
+   Do **not** lean on the completion fallback to carry your answer for you: when you end a turn
+   without replying, the bridge scrapes your pane, and it can return only the last 4000 characters.
+   A clipped scrape is marked as partial, but the missing text is gone — your report reaches the
+   lead with its end cut off.
+5. **Report honestly.** State only what you actually ran and its real output, including failures,
+   and never claim the result of a check you had no way to run. **Measure your own tools; do not
+   assume them.** What you mount depends on your backend: an opencode member gets the bridge and
+   nothing else, while a Claude Code member also inherits the operator's user-scope MCP servers,
+   which the bridge never chose for you. Two rules follow. The primary's IDE tooling is still not
+   yours, whatever you see. And **a mounted tool is not a working tool** — the forge server you may
+   find there holds a deliberately blocked credential and fails every call, by design.
+6. **Never merge.** Stage files explicitly — never `git add -A` — and leave alone anything the
+   project marks as not-yours-to-commit.
+
+### Where each rule lives (don't duplicate — extend the right layer)
+
+| Layer | Scope | Reaches |
+|---|---|---|
+| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `fleet_reply`* | every spawned member, at launch, every peer kind — never a lead |
+| **this section** | protocol + orchestration policy | primary **and** every member that reads the repo — tracked in git, so worktrees inherit it |
+| role agent definition files | role contract and per-job procedure | a member whose launcher binds its role to the matching file in its worktree |
+| role playbook skills | per-job procedure (commit/PR recipe, finding format) | a member told to load one |
+| the bridge's own docs | design detail, flows, error model | on demand |
+
+A rule belongs in **exactly one** layer — the outermost one that must obey it. A member without a
+repo checkout still gets the launcher's reply charter, which is why that one rule stays there.
+Peers that don't read `CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they*
+must obey belongs in the charter, not here.
+
+## Project addendum — claude-bridge (not part of the canonical block)
+
+- **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
+  and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
+  `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
+- **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
+  `reviewer` (scoped review → one structured finding). Name one in every delegation.
+- **Primary-side skills** (not delegation playbooks — a worker cannot use them):
+  `port-to-opencode` (make an OpenCode session a participant in this workspace).
+- **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
+  (a submodule with its own remote).
+- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, turn-done fallback —
+  are diagrammed in `docs/MCP-Contract.md` **§6 only**. The rest of that page is a pre-build design
+  doc whose tool names, parameter names and REST paths never caught up with the code, so do not use
+  it as the tool reference (CB-609). Section 6 is kept out of this file because this file loads into
+  every session's context.
+
+### Redeploying the daemon — the lead may do this (primary only)
+
+**A merge is not a deployment.** The running `bridged` holds the jar it was started with, so a
+feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
+about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
+rather than hand the job back to the operator.
+
+Workers must never do this. A worker has no business restarting the daemon it is talking through,
+and stopping it kills the worker's own channel mid-turn.
+
+**Use the script — do not hand-roll the steps.**
+
+```bash
+scripts/redeploy-bridged.sh --check   # report state, change nothing
+scripts/redeploy-bridged.sh           # build, confirm drain, restart, verify
+scripts/redeploy-bridged.sh --yes     # skip the drain prompt (fleet already checked)
+```
+
+It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
+old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a
+line marker taken before the restart, so old errors cannot be misread as new ones. Run `--check`
+first — it is read-only and reports whether the forge token resolves, which nothing else tells you.
+
+The script encodes the five things below, each of which has gone wrong here before. Read them anyway:
+if the script is unavailable or a step fails, this is what it was protecting you from.
+
+1. **Login shell, or workers silently lose their forge token.** The daemon inherits
+   `WORKER_GITEA_TOKEN` from the shell that starts it, and that comes from
+   `${SHARED_ENV}/tools/secrets.sh`. Start it from a non-login shell and the variable is empty, the
+   daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
+   logs this at startup — the script's `--check` is the only thing that reports it, and it checks
+   whether the name resolves without ever printing the value.
+2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
+   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
+   rendezvous, and a member's report is not recoverable once its ticket is gone.
+3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
+   it. The startup log names which keys it accepted and which it deferred — read those lines rather
+   than assuming.
+4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
+   lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
+   demoted to worker, which refuses every orchestration call.
+5. **Prove the new jar is the one running.** Confirm a *fresh* `bridged listening` line at the end of
+   `bridged/bridged.out`, dated after the restart. An old daemon that never died looks identical from
+   the outside.
+
+**Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
+refuses a bare `kill` on the daemon whatever this file says. The script is the seam that fixes that:
+it is one auditable command, so the operator allow-lists it once instead of approving a stop and a
+start every time. The rule lives in the operator's Claude Code settings:
+
+```json
+{ "permissions": { "allow": ["Bash(scripts/redeploy-bridged.sh:*)"] } }
+```
+
+Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
+running the stop and start as separate commands — that is exactly the approval the script replaced.
+Say what you were going to run and why, and let the operator decide.
+
+### The prompt is part of the product — update it with the code (mandatory)
+
+This repo *is* the bridge, so the canonical block above is not documentation about someone else's
+system: it is the instruction surface this codebase ships. **Every change here must end by asking
+whether the block still tells the truth.** A code change that silently invalidates it is an
+incomplete change — the agents reading it have no other source.
+
+Before you call any work done, check the row that matches what you touched:
+
+| You changed… | Re-read and update… |
+|---|---|
+| a `fleet_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
+| `Authz` / the role table | invariant 3, and the primary-only vs worker-only claims |
+| `ConnectionIdentity` / how a caller is resolved | the `fleet_whoami` paragraph and the fallback ladder |
+| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__fleet__*`), and the layering table's top row |
+| the injector / status gating | invariant 4 |
+| worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
+| `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
+| a new peer kind (non-Claude adapter) | what that peer can read — anything it must obey belongs in its charter, not in the block |
+| **anything an operator can use, configure, or observe** — an MCP tool, a `bridged.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
+
+That last row is not bookkeeping. Chapters 1–10 answer *how is this built* and *why this way*;
+none of them has a home for *what can it do and how do I turn it on*, so for twenty tickets a
+shipped capability landed nowhere and the Roadmap went on claiming the stage was finished. The
+*why* line is the one that matters — without it a decision gets re-litigated from scratch a month
+later. Internal contract changes go to `wiki/9-Implementation.md` instead; test and coverage work
+is a Roadmap line. A change that touches none of the three earns no entry, and that is a normal
+outcome rather than an omission.
+
+Then **propagate**: the block in this file and the template in the wiki
+([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
+block*) must stay byte-identical, and other projects carrying the block need the same edit. Verify
+rather than trust:
+
+```bash
+python3 - <<'PY'
+import pathlib
+c = pathlib.Path("CLAUDE.md").read_text()
+w = pathlib.Path("wiki/7-Use-Cases.md").read_text()
+S, E = "## Bridge communication (enforced", "## Project addendum — claude-bridge"
+block = c[c.index(S):c.index(E)].rstrip() + "\n"
+i = w.index("```markdown\n") + len("```markdown\n")
+print("in sync:", w[i:w.index("\n```\n", i) + 1] == block)
+PY
+```
+
 ## IDE MCP tools & validation workflow (enforced)
 
+> **Primary only.** Workers have no IDE MCP mount — if you are a worker, skip this section and
+> report the build/test output you actually ran (see §Bridge communication → Worker).
+
 Two IDE MCP servers are connected: **intellij-index** (semantic code intelligence) and
 **jetbrains** (file problems, reformat, debugger). IntelliJ has multiple projects open; our
 module is **`bridged`**. Always pass these to IDE MCP tools:
@@ -20,6 +326,15 @@ module is **`bridged`**. Always pass these to IDE MCP tools:
    test run). A per-file-clean file can still break the build or another module. This is the
    whole-project gate before declaring work done or committing.
 
+**Whenever dependencies change (or a `pom.xml` edit), validate CVEs with
+`jetbrains get_file_problems{filePath: "bridged/pom.xml"}`** — its Mend.io check reflects the
+dependencies on disk. (Note: `ide_diagnostics` / intellij-index does NOT re-resolve dependencies
+after a pom edit without a full Maven reimport, so it reports stale CVE results — don't trust it
+for this.) Treat a CVE warning like any other: bump to a patched version and confirm
+`mvn clean install` still passes. If the latest available version is still flagged (EOL line,
+"insufficient information", or config-file-only advisories), document it as accepted in the pom
+rather than chasing a fix that doesn't exist.
+
 ### Use IDE MCP tools for navigation, refactoring, and diagnostics only
 
 - **Navigate (prefer over Grep/Read for symbols):** `ide_find_definition`, `ide_find_class`,

README.md

@@ -9,32 +9,33 @@ Sibling of [`crush-bridge`](https://git.ltms.dev/systems/vms) (which drives a he
 process*, so it inherits `CLAUDE.md`, hooks, skills, and MCP — just pointed at a
 cheaper/local model.
 
-## Leading approach — herdr-centric message server (`bridged`)
+## Leading approach — herdr-centric message server (`fleetd`)
 
-A small always-on message server, **`bridged`**, controls
+A small always-on message server, **`fleetd`**, controls
 [herdr](https://herdr.dev) (an agent multiplexer) over its Unix-socket API and exposes a
 clean 2-way messaging API as an **MCP server that both the primary and the workers mount** —
 one unified Claude setup and the **sole communication gateway** (REST/SSE stays for non-Claude
-clients; any broker is `bridged`-internal, below the gateway).
-herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `bridged` owns
+clients; any broker is `fleetd`-internal, below the gateway).
+herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `fleetd` owns
 policy (subscription boundary, session lifecycle, status-gated delivery) and the client
-contract. The worker `claude` launches with `ANTHROPIC_BASE_URL=https://ollama.ltms.dev` + a
-bearer token; the primary Opus stays env-clean and calls `bridged`'s MCP tools.
+contract. A Claude member launches with `ANTHROPIC_BASE_URL` pointed at the gateway,
+`https://llm.ltms.dev/anthropic`, plus a bearer token; the lead stays env-clean and calls
+`fleetd`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.
 
 ```mermaid
 flowchart LR
     OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["bridged — standalone daemon (not a claude process)"]
+    subgraph BD["fleetd — standalone daemon (not a claude process)"]
         SRV["SERVER face<br/>MCP · REST/SSE · policy"]
         CLI["CLIENT face<br/>status-gated injector · herdr socket"]
         SRV --> CLI
     end
     HERDR["herdr<br/>panes · agent-status"]
     W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
-    M["ollama.ltms.dev<br/>(worker model)"]
+    M["llm.ltms.dev<br/>(the one gateway)"]
 
-    OPUS -->|"MCP bridge_send (blocks)"| SRV
-    W -.->|"MCP bridge_reply"| SRV
+    OPUS -->|"MCP fleet_send (blocks)"| SRV
+    W -.->|"MCP fleet_reply"| SRV
     CLI -->|"Unix socket<br/>send_text · events.subscribe"| HERDR
     HERDR -->|"drives PTY"| W
     W -->|"inference"| M
@@ -46,23 +47,27 @@ flowchart LR
 ```
 
 - **Subscription boundary:** the *primary* never sets `ANTHROPIC_BASE_URL` (stays on
-  Pro/Max). Only the *secondary* process is off-subscription — and `bridged` itself is a
+  Pro/Max). Only the *secondary* process is off-subscription — and `fleetd` itself is a
   plain daemon (no Anthropic quota), so it may poll/subscribe freely.
-- **One gateway (unified MCP setup):** `bridged` is the **sole communication path** for every
+- **One gateway (unified MCP setup):** `fleetd` is the **sole communication path** for every
   Claude session. Primary and workers each mount it as an MCP server (one `claude mcp add`
-  line, same on both) and talk over MCP tools — `bridge_send` / `bridge_reply` / `bridge_ask` /
-  `bridge_status`. **No Claude session ever addresses a broker, a peer, or the network
-  directly**; any queue is `bridged`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
-  mounting the bridge is subscription-safe by construction.
-- **How the primary consumes a reply:** a single **blocking MCP call** (`bridge_send`);
-  `bridged` holds it open until the worker calls `bridge_reply` or its turn hits
+   line, same on both) and talk over MCP tools — `fleet_send` / `fleet_reply` /
+   `fleet_status` (with `fleet_ask` planned for the blocked-worker path). **No Claude session
+   ever addresses a broker, a peer, or the network
+   directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
+   mounting the bridge is subscription-safe by construction.
+   **Tool naming:** the tools were renamed from `bridge_*` to `fleet_*` (CB-622). The daemon
+   still answers the old `bridge_*` names for one release, but they are deprecated — use the
+   `fleet_*` names.
+- **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
+  `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
   `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so
   no quota burn. SSE is an optional side-channel for humans/dashboards watching status.
-- **Worker → primary** rides `bridged`'s **MCP rendezvous** — the reply resolves the primary's
-  blocking call (or, for detached work, `bridged` **injects the primary's idle pane** when it's
+- **Worker → primary** rides `fleetd`'s **MCP rendezvous** — the reply resolves the primary's
+  blocking call (or, for detached work, `fleetd` **injects the primary's idle pane** when it's
   ready), so *no keystroke-into-primary and no broker are involved, even single-host*. The one
   exception: a split-host primary that isn't a herdr pane wakes via its own `Stop`-hook, which
-  polls **`bridged`** (never a broker). See the wiki for the two topologies.
+  polls **`fleetd`** (never a broker). See the wiki for the two topologies.
 - **Different model per process** sidesteps Claude Code's lack of per-subagent provider
   routing — the worker isn't a subagent, it's its own configured process.
 - **AgentAPI** ([`coder/agentapi`](https://github.com/coder/agentapi)) is retained only as a
@@ -71,11 +76,11 @@ flowchart LR
 
 ## Docs
 
-Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/lms/claude-bridge/wiki)**,
+Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/fleet/fleetd/wiki)**,
 vendored here as a submodule under [`wiki/`](./wiki):
 
 ```bash
-git clone --recurse-submodules ssh://git@git.ltms.dev:2224/lms/claude-bridge.git
+git clone --recurse-submodules ssh://git@git.ltms.dev:2224/fleet/fleetd.git
 # or, after a plain clone:
 git submodule update --init
 ```
@@ -85,6 +90,38 @@ Gitea wiki.
 
 ## Status
 
-🟢 Design — herdr-centric **`bridged`** message server selected as the primary approach
-(2026-07-11), superseding the AgentAPI plan (2026-07-08). AgentAPI retained as fallback
-injector.
+🟢 **Implemented & dogfooded** — the herdr-centric **`fleetd`** message server is built and in
+real use: an Opus primary delegates tasks to off-subscription workers that reply through the
+bridge (code reviews delegated this way have produced committed bug fixes). Selected as the
+primary approach 2026-07-11, superseding the AgentAPI plan (2026-07-08); AgentAPI retained as a
+fallback injector.
+
+**Shipped** (Java 25 · Maven · 266 unit/acceptance tests green; the live-herdr and broker contract
+tests run separately via `mvn test -Pcontract`):
+
+- **Core gateway** — herdr socket client (contract-tested vs live 0.7.0); guard-checked worker
+  spawn with `ANTHROPIC_BASE_URL` injected only into the worker's env; status-gated injector;
+  blocking `fleet_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
+- **MCP tools** — `fleet_send` / `fleet_reply` / `fleet_status` (messaging) and `fleet_spawn`
+  / `fleet_list` / `fleet_stop` / `fleet_profiles` / `fleet_poll` (fleet). Caller identity is
+  connection-based (loopback peer PID → herdr pane), so the same mount serves primary and workers.
+- **Delivery reliability** — completion fallback (a confirmed `working→idle` turn resolves a
+  send); async fire-and-poll (beats the caller's MCP call timeout for long tasks); and failure
+  detection for wedged (`unknown`), vanished, and never-ready workers so a send never hangs.
+- **Fleet** — multiple worker profiles, each with an independent base_url guard check; workers
+  inherit the primary's working directory (never `$HOME`); a readiness gate holds delivery until
+  a worker's Claude has connected the bridge MCP (no paste lost into its boot window).
+- **Blocked-worker path** — `fleet_ask` reverse rendezvous: a worker pauses its delegated turn to
+  ask the primary and resumes the *same* turn with the answer (CB-205).
+- **Session lifecycle** — session manager with spawn/reuse/recycle, `idle_ttl` reaper, `context_cap`,
+  and graceful drain on shutdown (CB-301/CB-303); per-worker git worktrees on their own branch with
+  a config-parity overlay, so parallel implementers never stomp each other (CB-301-ext).
+- **Reliable worker→primary delivery** — a durable `ReplyInbox` (in-memory by default, AMQP/LavinMQ
+  for cross-restart durability) holds a reply that arrives with no open send, and an active
+  status-gated push loop nudges the primary to drain it (CB-307).
+- **Pluggable peers** — a `PeerLauncher` SPI with two in-tree adapters, `claude-code` and `opencode`,
+  routed by a `kind:` discriminator (CB-401/CB-402).
+
+**Next** (see the [roadmap](wiki/8-Roadmap.md)) — Stage 5 hardening (auth/TLS, `/metrics`, CI,
+service supervision, per-session authz + audit), then cross-host: CB-308 multi-host federation and
+CB-500 multi-tier coordination.

bridged/.gitignore

@@ -2,9 +2,14 @@
 target/
 dependency-reduced-pom.xml
 
-# Local runtime config (copy from bridged.example.yaml)
+# Local runtime config (copy from fleetd.example.yaml). Both names: the live file is still
+# bridged.yaml until the cutover, and Fleetd reads either one.
+fleetd.yaml
 bridged.yaml
 
+# CB-505 audit trail + daemon stdout/stderr — runtime records, never source
+logs/
+
 # Editor / OS
 *.iml
 .idea/

bridged/bridged.example.yaml

@@ -1,33 +0,0 @@
-# bridged configuration (example). Copy to bridged.yaml and adjust.
-#
-# bridged is the sole gateway between primary/worker Claude sessions and herdr.
-# It is NOT a Claude process and must never carry ANTHROPIC_BASE_URL.
-
-# REST + MCP listen address. Keep it on loopback — bridged is same-host in Stage-1.
-bind:
-  host: 127.0.0.1
-  port: 8080
-
-# herdr Unix socket. Omit to use the client default
-# (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
-herdrSocket: ~/.config/herdr/herdr.sock
-
-# How a worker session is spawned. Stage-1 uses the existing ccs `ltms-local`
-# profile, whose .claude.json routes to the gx00 vLLM below.
-worker:
-  profile: ltms-local
-  baseUrl: http://gx00.gw:8000     # the gx00 vLLM (models: coder / deepseek-v4-flash)
-  model: coder
-  # Placement: each worker lands in its OWN tab inside a dedicated worker space, so it
-  # never splits or clutters your real work spaces. Use `pane` for the legacy behaviour
-  # (split the currently-focused tab).
-  placement: tab                   # tab | pane
-  workspace: bridged-workers       # the dedicated worker space (found-or-created, shared)
-  tabLabel: "worker: {profile} #{n}"  # {profile}/{model}/{n} substituted; {n} keeps sibling tabs distinct
-
-# Subscription boundary. A worker's base_url host MUST be one of these; the primary
-# must carry none. Grounded in ltms-local's real endpoints.
-guard:
-  offSubscriptionHosts:
-    - gx00.gw
-    - ollama.ltms.dev

bridged/docs/CB-307-Push-Loop.md

@@ -0,0 +1,142 @@
+# CB-307 — Active push-to-primary + reminder loop (the reliability layer)
+
+**Status:** design (2026-07-19). Builds directly on the shipped durable landing zone
+(`AmqpReplyInbox`, main `2bc5f3a`, dogfooded live). gitea #5.
+
+## Why this exists
+
+Stage 2 gave a worker→primary reply a **durable place to wait** when no `fleet_send` is
+open: it lands in `agent.<target>.inbox` on the broker and survives a daemon bounce. But
+delivery is still **pull** — the primary only sees the reply if it happens to call
+`fleet_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
+the primary works on something else.
+
+This layer makes delivery **active**: the bridge *pushes* a nudge to the primary the moment
+a reply lands, and keeps reminding (bounded) until the primary drains it. At-least-once,
+dedup by `msgId`, and — critically — it never loses the reply even if every push fails,
+because the durable inbox is the backstop.
+
+## The hard constraint it works around
+
+The bridge is an MCP **server**; the primary is an MCP **client**. A server cannot call
+into a client. So "push to the primary" cannot be an MCP response — it needs a *sideband*
+channel. The chosen channel: **inject a synthetic user-turn into the primary's own herdr
+terminal pane** — the same mechanism the bridge already uses to deliver tasks to workers,
+pointed at the primary's pane instead.
+
+```mermaid
+flowchart LR
+    W["worker"] -->|"fleet_reply (no open send)"| MS["MessageService.reply"]
+    MS -->|"inbox.publish"| INBOX[("agent.&lt;target&gt;.inbox<br/>(durable, LavinMQ)")]
+    MS -->|"notify"| LOOP["ReplyPushLoop"]
+    LOOP -->|"status-gated inject"| PANE["primary's herdr pane"]
+    PANE -->|"primary drains"| DRAIN["fleet_poll(target)<br/>= peek + ack"]
+    DRAIN -->|"inbox now empty"| LOOP
+    LOOP -.->|"still non-empty →<br/>re-inject on backoff"| PANE
+    classDef store fill:#2c5282,stroke:#1a365d,color:#ffffff;
+    class INBOX store
+```
+
+*Figure 1 — a reply lands in the durable inbox; the push loop nudges the primary's pane;
+the primary's drain acks it; a still-full inbox triggers a bounded re-nudge.*
+
+## Three increments
+
+### Increment 1 — learn & store the primary's terminal_id
+
+**Finding (seam map):** `ConnectionIdentity.resolve(remoteAddr, remotePort)` already returns
+the caller's herdr `terminal_id` for *every* MCP call, via `PaneLocator.terminalForPid`
+(walks `pane.list`, matches the caller PID to a pane's process tree). It is non-null whenever
+the caller runs in a herdr pane on this host. Today it's discarded for the primary
+(`presence.markPresent` is a no-op on it).
+
+**Plan:** a single-slot `PrimaryRegistry` (thread-safe) holding the primary's `terminal_id`.
+Populate it from the **orchestration-side** MCP tools — `fleet_send`, `fleet_spawn`,
+`fleet_poll`, `fleet_list`, `fleet_status`, `fleet_profiles` — capturing
+`callerTerminal(exchange)` when it is (a) non-null and (b) **not** a registered worker
+session in `SessionManager`. That caller is, by construction, the primary. Worker-side tools
+(`fleet_reply`, `fleet_ask`) never set it.
+
+- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `FleetConfig`
+  (nested record, same shape as `Broker`). Lets an operator pin it, or supply it when
+  derivation can't (see degrade case).
+- **Degrade:** if the primary is off-host or in a non-herdr terminal, `terminalForPid`
+  returns null and no override is set → **the registry stays empty → the push loop is a
+  no-op and we fall back to pull** (today's behaviour). The reply is never lost; it's just
+  not actively pushed. This is a safe, explicit degradation, not a failure.
+
+### Increment 2 — the push loop
+
+A `ReplyPushLoop` component, notified at the single no-waiter call site
+(`MessageService.reply` → the `inbox.publish` branch, `MessageService.java:192`).
+
+- **Inject a nudge, not the payload.** The injected turn tells the primary *to drain*
+  (e.g. "Worker `<target>` returned a reply — run `fleet_poll(target=<target>)` to collect
+  it"), it does **not** carry the reply text. Rationale: replies can be large/multiline and
+  terminal injection would mangle them; the drain response is the clean transport. Keeps the
+  push idempotent — re-nudging is harmless.
+- **Ack = drain.** The primary draining (`drainReplies` = peek + ack) is the acknowledgement.
+  The loop's **stop condition is `inbox.peek(target).isEmpty()`** — the reply is gone from the
+  inbox because it was acked. No new `fleet_ack` tool needed for v1 (see Increment 3).
+- **Status-gated injection (mechanism (b), chosen).** A dedicated lightweight scheduled loop,
+  **not** the worker `Injector`. It injects via `AgentControl.send(primaryTerminal, nudge)`
+  (the same herdr `agent.send` = `pane send-text` + submit that delivers to workers) only when
+  `AgentControl.status(primaryTerminal).injectable()` (IDLE/BLOCKED) — never mid-turn. This keeps
+  the primary path fully isolated from `WorkerPresence`/`StatusPoller` (which are worker-scoped),
+  and makes it unit-testable with a fake `AgentControl` + an injected clock (per the CB-306
+  `LongSupplier` clock + `Runnable` sleeper seam). Rejected (a) reuse-the-Injector: it would force
+  the primary terminal into the worker poller set and couple to worker-presence semantics — more
+  integration surface, harder to test, no real gain for a bounded reminder.
+- **Bounded reminder / backoff.** While `peek(target)` stays non-empty, re-inject on a
+  backoff schedule up to a cap (N reminders or a max duration; config
+  `primary.push_reminders` / `primary.push_backoff_ms`). After the cap, **stop reminding** —
+  the reply remains in the durable inbox and the next natural poll (or a later worker reply's
+  nudge) still surfaces it. Bounded so the bridge never spams the primary.
+
+### Increment 3 — optional per-`msgId` `fleet_ack` tool (deferred)
+
+Drain-as-ack is coarse: it clears *all* pending replies for a target at once. If finer
+control is ever needed (ack one reply, leave others held), add a `fleet_ack(msgId)` tool
+mapping to `inbox.ack(target, msgId)` — the port already supports per-`msgId` ack. Not built
+in v1; the stop-on-empty loop is sufficient.
+
+## The two subtleties (decided here)
+
+1. **Which caller is "the primary"?** Connection-derived, not self-reported: the caller whose
+   resolved terminal is non-null **and not a registered worker session**, seen on an
+   orchestration-side tool. This never mislabels a worker (workers are in `SessionManager`)
+   and needs no new env var or argument (identity stays connection-derived, per the existing
+   `FleetMcp` invariant).
+
+2. **Readiness-gate mismatch → dedicated loop.** The existing `Injector` gates delivery on
+   `ready.test(target)` = `WorkerPresence` (the *worker's* MCP connected). The primary is not
+   in `WorkerPresence`, so reusing `Injector` would mean forcing the primary terminal into the
+   worker `StatusPoller` set and swapping the `ready` predicate — extra integration surface with
+   worker-scoped machinery. Decision: **mechanism (b)** — a small dedicated scheduled loop that
+   calls `AgentControl.status(primaryTerminal).injectable()` then `AgentControl.send(...)`, with
+   an injected clock. Isolated from worker presence, trivially unit-testable, sufficient for a
+   bounded reminder. (Verified live: this primary resolves to `term_656c8cc03e1f0b1`, pane
+   `w2:pY` — the primary genuinely runs in a herdr pane on this host, so the path is exercisable.)
+
+## Boundary note
+
+This is the first time the bridge **writes into the primary's pane** — a new direction of
+control. It stays within the communication-bus identity: the injection is a **nudge** (a
+synthetic "go drain your replies" turn), **status-gated** so it never interrupts a turn,
+**bounded** so it never spams, carries **no env** and **never crosses the subscription
+boundary**. The bridge is signalling the primary that it has mail — not driving its work.
+
+## Test plan
+
+- **Unit (hermetic):** `PrimaryRegistry` set/clear/override; the "caller is primary iff
+  non-null terminal AND not a registered session" predicate; the loop's stop-on-empty and
+  bounded-reminder logic with an injected clock + a fake injector (no real herdr).
+- **Live dogfood (primary-side):** with the daemon on the broker jar + a real worker,
+  delegate a task, let the worker reply after the `fleet_send` window closes, and observe the
+  bridge inject a drain nudge into *this* primary pane; confirm draining stops the reminders;
+  confirm an unreachable primary (registry empty) degrades to pull with no loss.
+
+## Out of scope
+
+Multi-host (CB-308) — the push loop is local-only; a remote primary is reached by its own
+local gateway, not cross-host injection. Federation reuses this loop per-gateway.

bridged/fleetd.example.yaml

@@ -0,0 +1,696 @@
+# bridged configuration (example). Copy to bridged.yaml and adjust.
+#
+# bridged is the sole gateway between primary/worker Claude sessions and herdr.
+# It is NOT a Claude process and must never carry ANTHROPIC_BASE_URL.
+
+# REST + MCP listen address. Keep it on loopback unless you also switch auth.mode to `token`
+# below — bridged REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
+bind:
+  host: 127.0.0.1
+  port: 8765
+
+# API authentication (CB-501). Governs how a caller that is NOT an on-host worker pane proves it
+# is the primary. Worker identity never depends on this: a loopback peer PID that maps to a herdr
+# pane is unforgeable and is always honoured, so turning auth on cannot lock the fleet out.
+#
+#   mode: loopback-trust  → DEFAULT, and the historical behaviour: any loopback caller that is not
+#                           a worker is the primary, no credential needed. Sound ONLY because the
+#                           OS refuses remote connections to a loopback socket.
+#   mode: token           → such a caller must send `Authorization: Bearer <token>`; without it it
+#                           is anonymous and authorized for nothing. REQUIRED for a non-loopback
+#                           bind — the daemon fails fast otherwise, because "unauthenticated ⇒
+#                           primary" on a reachable port would hand spawn/stop/send to anyone.
+#   tokenEnv              → host env var holding the token (never the literal value). Default
+#                           BRIDGED_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
+#
+# TLS is deliberately NOT terminated in the daemon (CB-501 D3): run a reverse proxy in front and
+# let it own certificate lifecycle, e.g.
+#     location / { proxy_pass http://127.0.0.1:8765; proxy_set_header Authorization $http_authorization; }
+# The broker link gets TLS from its own URI (amqps://…) — see `broker` below.
+# auth:
+#   mode: token
+#   tokenEnv: BRIDGED_API_TOKEN
+
+# Optional pinned primary terminal (CB-307). Names the herdr pane the PRIMARY itself runs in:
+# a caller whose connection maps to this pane resolves as the primary (no credential needed —
+# the pane mapping is as unforgeable as a worker's), and reply nudges are pushed to it.
+# REQUIRED when the primary runs inside a herdr pane — without it the pane match reads the
+# primary as a worker and refuses spawn/send/stop. Get the id from fleet_whoami; re-pin if
+# the primary moves panes.
+# primary:
+#   terminal: term_0123456789abcd
+#   pushReminders: 5      # max nudges before giving up (default 5)
+#   pushBackoffMs: 15000  # delay between nudges (default 15000)
+
+# CB-530: MORE THAN ONE LEAD. `primary:` above is singular by construction — every other pane
+# resolves as a worker — which is right for one lead driving a fleet and wrong the moment two leads
+# (say a Claude lead and an opencode lead) work as peers: the second is silently demoted and refused
+# every orchestration call. List each lead's pane here and all of them resolve as leads.
+#
+#   tab → the ONLY field identity depends on (CB-579); the exact label of the tab hosting the lead.
+#         Label the tab yourself, or let bridged label one it launches — see `fleet.leaders:` below.
+#   kind/model → descriptive; they document what runs in the pane and are echoed by fleet_whoami
+#
+# A lead's tab must already carry its label (or be launched by bridged, which labels it) — there is
+# no terminal id to paste in and nothing to re-pin when the session restarts: the tab survives, so
+# the same label resolves the same lead again on the next scan.
+# `fleet_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
+# IS a primary for authorization, so nothing that keys on the role breaks.
+#
+# KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
+# destination for its nudges, and is a separate mechanism from lead identity — see `fleet.leaders:`.
+#
+# Leads are configured under `fleet.leaders:` — see THE FLEET further down.
+#
+# Two things stop the tab-name convention from becoming a way to claim leadership: the configured
+# member spaces are excluded from the scan, so nothing bridged places can land in a matching tab;
+# and startup REFUSES a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel`
+# override, also matches — so the two namespaces cannot overlap by accident. The label is a NAME,
+# never a capability: what a pane may do is decided by the role the daemon resolves for it.
+
+# CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
+# idle (no open fleet_send driving it) past the quiet period. The fleet is one lead + architects +
+# workers, so a lead that stalls is a single point of failure; the ReplyPushLoop only nudges when a
+# reply lands, and this timer catches the gap where nothing lands and the lead just sits idle.
+#
+# Opt-in on purpose — it SPENDS the operator's subscription on its own initiative (each nudge starts
+# a lead turn nobody asked for), so upgrading the daemon must never switch it on for you. Absent
+# block = feature off, exactly as before.
+#
+# Three knobs, each with a default that errs on the side of not burning context:
+#   idleAfterSeconds: 300   # how long the lead must stay idle before the FIRST nudge (default 300 —
+#                           # absorbs normal post-turn pauses; re-prompting every pause burns context)
+#   backoffMs: 60000        # re-check cadence / spacing between nudges past the quiet period (default 60000)
+#   quietNudgeCap: 3        # cap on consecutive nudges that find NOTHING pending, then it stops
+#                           # until real state appears (default 3 — never nag an empty fleet forever)
+# leadHeartbeat:
+#   idleAfterSeconds: 300
+#   backoffMs: 60000
+#   quietNudgeCap: 3
+
+# Fleet health detection is dormant unless enabled (CB-573). It reads one whole-fleet agent list
+# per tick.
+#   intervalSeconds → how often a tick runs (default 30). ENFORCED floor of 15: the code computes
+#                      Math.max(15, intervalSeconds), so a lower value is silently raised, not
+#                      rejected.
+#   workingSuspectAfterSeconds, paneProbeIntervalSeconds → accepted and parsed, but NOT YET READ by
+#                      anything — the dormant monitor only consumes intervalSeconds today (CB-573
+#                      shipped ahead of the evidence publishers these two knobs are for). Setting
+#                      them changes nothing right now, and no minimum is enforced on either, because
+#                      nothing reads them to enforce one. They exist so a later build can start
+#                      honouring them without another config-shape change.
+#   notifications.mode → "webhook" flips what fleet_list REPORTS (healthCoverage: "full" instead
+#                      of "detection-only") — it does NOT make bridged send any webhook call; no
+#                      delivery mechanism is implemented yet. Any other value, or omitting the
+#                      block, reports "detection-only".
+# health:
+#   enabled: true
+#   intervalSeconds: 30
+#   workingSuspectAfterSeconds: 600
+#   paneProbeIntervalSeconds: 60
+#   notifications:
+#     mode: disabled
+
+# herdr Unix socket. Omit to use the client default
+# (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
+herdrSocket: ~/.config/herdr/herdr.sock
+
+# How member sessions are spawned. Define one or more named profiles (backends) under
+# `profiles`; each key is the profile name (also the ccs profile). A profile says only WHICH
+# BACKEND — model, CLI adapter, credentials, cost. It says nothing about what a member spawned on
+# it is for; that is the member's role, and roles live under `fleet:` below. Which profile an
+# unqualified spawn lands on comes from that role's pool, not from a global default.
+#
+# Shared knobs (placement/workspace) can be repeated per profile; they usually match.
+#   placement: tab   → each worker lands in its OWN tab in a dedicated worker space (default).
+#                      Use `pane` for the legacy behaviour (split the focused tab).
+#   mcpUrl           → bridged mounts the bridge MCP (--mcp-config, inline) + reply charter
+#                      (--append-system-prompt) as launch flags; nothing is written to the profile.
+#   ideMcpUrl        → opt-in (CB-634), default off. When set, bridged mounts the IDE Index MCP as a
+#                      second inline server named `intellij`, and adds an IDE charter that pins every
+#                      ide_* call to the member's own worktree. A URL, not a boolean — host and port
+#                      are host-specific. Set it only on a host where the IDE actually runs.
+#   ideProjectDir    → repo-relative module dir the IDE opens and the overlay pins (CB-634). Only read
+#                      when ideMcpUrl is set. This repo's Maven pom lives in `bridged/`, not at the
+#                      worktree root, so opening the root imports no module and ide_* resolves nothing;
+#                      set this to `bridged`. Omit for a repo whose project is the worktree root.
+#   ideOpenCommand   → host command that opens ideProjectDir in the IDE at spawn (CB-634 auto-open).
+#                      Only read when ideMcpUrl is set. `{dir}` is replaced with the absolute module
+#                      dir and the command runs through `/bin/sh -c`, so set env inline if needed —
+#                      e.g. `env DISPLAY=:10.0 idea {dir}`. Best-effort: a failure is logged, never
+#                      fails the spawn. Omit to open the member's module by hand. There is no close
+#                      half yet — an opened module stays open until the operator closes it.
+#   tokenEnv         → host env var holding the worker's auth token (value never stored in config);
+#                      omit for a backend that needs no token (e.g. a local ollama).
+#   cwd              → pin this profile's working directory (CB-112). Omit to inherit the primary's
+#                      cwd on an MCP spawn, else the daemon's cwd — never $HOME. See
+#                      docs/Worker-Startup-and-Trust.md.
+#   configDir        → CLAUDE_CONFIG_DIR for the worker, so it inherits that profile's
+#                      skills/MCP/hooks. Omit to leave the worker on the host default.
+#   parityOverlay    → repo-relative paths copied primary→worktree so a worker in a provisioned
+#                      worktree sees the same local config (CB-301-ext). Omit for the default set:
+#                      [.env, .envrc]. (.claude/settings.local.json is NOT in the default — it
+#                      pre-approves IDE/tool grants a member must not hold ambiently; CB-525/CB-634.)
+#
+#                      Do NOT add .mcp.json (CB-525). A worker's tools are whatever its launcher
+#                      mounts — the bridge, and nothing else. Replicating the primary's MCP config
+#                      handed a worker the primary's IDE servers, which are bound to the primary's
+#                      checkout, so its navigation returned paths OUTSIDE its own worktree: one
+#                      worker made all 59 of its edits in the primary tree while compiling its
+#                      worktree, and every build it ran was of code that did not contain them.
+#                      bridged neutralizes a provisioned worktree's .mcp.json for this reason;
+#                      listing it here would copy the primary's back over that.
+#   gitTokenEnv      → host env var holding the git-forge API token. When set, its value is injected
+#                      as GITEA_TOKEN so the worker can open its OWN PR at checkpoint (CB-302).
+#                      Opt-in by design — omit and the worker gets no PR-create grant (push over
+#                      SSH is unaffected). The token value itself is never stored in this file.
+#   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
+#                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
+#   exhaustedPattern → regex matched against a completion-fallback scrape (CB-578 stage A) to
+#                      classify a turn that ended with no fleet_reply as the backend having
+#                      refused on a subscription usage limit, rather than a real answer. Opt-in —
+#                      omit and this profile's completion fallback behaves exactly as before.
+#                      Every backend words its refusal differently, so this is config, never a
+#                      vendor string baked into bridged itself.
+#                      DEFERRED: compiled once into a startup pattern map — editing it needs a
+#                      daemon restart, same as this profile's model/baseUrl/argv.
+#   credentialId     → CB-578 stage B: the credential this profile quarantines WITH when a
+#                      BACKEND_EXHAUSTED classification fires. Two profiles that set the SAME
+#                      credentialId share one quarantine — the case this exists for is two models
+#                      on one account (e.g. sol and terra both billing one OpenAI credential): an
+#                      exhaustion on either one must lock out both, or the fleet just walks onto
+#                      the same dead account under the sibling's name. Opt-in — omit and this
+#                      profile quarantines alone, under its own name, exactly as if the field did
+#                      not exist. Cooldown length is the top-level quarantineCooldownSeconds below.
+#                      HOT: read live at every spawn/exhaustion check — no restart needed.
+#   env              → extra environment for this profile's workers, as a literal key/value map
+#                      (CB-511). Use it to give workers a toolchain.
+#
+#                      A worker's environment does NOT come from your shell. bridged hands herdr an
+#                      explicit env map and herdr merges it into ITS OWN process env — so before
+#                      CB-511 a worker inherited whatever PATH the herdr server happened to be
+#                      started with, which on a long-lived herdr can predate your toolchain entirely
+#                      and leave workers unable to run `mvn` or `java` at all.
+#                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
+#                      only to override that or add more (JAVA_HOME, …). Since the default is the
+#                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
+#                      lines in deploy/dev.ltms.fleet.plist and deploy/bridged.service.
+#
+#                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
+#                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
+#                      entry cannot repoint a worker past the SubscriptionGuard — which is checked
+#                      against `baseUrl` alone.
+# Put `defaultMode: "auto"` in each ccs profile so the worker runs autonomously.
+profiles:
+  gx10:                              # ccs profile name (NOT a hostname)
+    kind: claude-code                # which adapter spawns this profile (default; may omit)
+    baseUrl: http://gx01.gw:8000     # the vLLM host this profile targets (gx00.gw / gx01.gw)
+    model: coder
+    placement: tab
+    workspace: bridged-workers
+    # tabLabel: an optional per-profile override; the fleet template usually covers it
+    mcpUrl: http://127.0.0.1:8765/mcp
+    tokenEnv: BRIDGED_WORKER_TOKEN
+    argv: ["ccs", "gx10"]
+    # weight: relative selection weight for automatic placement (weighted, round-robin, and
+    # fixed's fallback walk). Absent defaults to 1.0. An explicit 0 or negative value means
+    # "never auto-select this profile" (CB-554) — it stays reachable via an explicit
+    # `fleet_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
+    # selection skips it.
+    weight: 0.5
+    # maxLoad: max live workers on this profile. Omit for unlimited. An explicit 0 (CB-585) caps
+    # the profile at zero live members — it is excluded from automatic placement and an explicit
+    # `fleet_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
+    # is named directly. Negative is refused at config load — there is no sane meaning for it.
+    maxLoad: 2
+    # subscription: true
+    #   THE KNOB THAT DECIDES WHO PAYS (CB-539). Default false. When true, this profile's members
+    #   run on the OPERATOR'S OWN Claude subscription instead of a metered endpoint — every spawn
+    #   bills your plan and eats your usage limit. Off-subscription is the whole point of this
+    #   daemon, so treat `true` as a deliberate exception, not a convenience.
+    #
+    #   What changes when it is set (ClaudeCodeLauncher):
+    #     - no ANTHROPIC_BASE_URL and no ANTHROPIC_AUTH_TOKEN are injected — the member inherits
+    #       the operator's own Claude Code auth, which is exactly why it bills the plan;
+    #     - SubscriptionGuard never vets it, because there is no baseUrl to vet;
+    #     - no token is required, so `tokenEnv` is irrelevant here.
+    #
+    #   MUTUALLY EXCLUSIVE with `baseUrl` — setting both is refused at config load (CB-542). On the
+    #   subscription path no guard would vet the URL, so allowing both would be a way around the
+    #   guard rather than a configuration.
+    #
+    #   GOTCHA 1 — it is invisible to the startup secret check. `Fleetd.reportRequiredSecrets`
+    #   skips subscription profiles on purpose (they need no token), so a boot log that reports
+    #   every secret as fine says nothing about these profiles.
+    #
+    #   GOTCHA 2 — `maxLoad` is the ONLY throttle you have here. There is no metering, no budget
+    #   and no refusal on cost; the cap on live members is the single thing standing between a
+    #   fan-out and your monthly limit. Set it deliberately and keep it small.
+    # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
+    # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
+    # exhaustedPattern: "usage limit has been reached"   # opt-in: classify a usage-limit refusal (CB-578)
+    # credentialId: shared-openai   # opt-in: quarantine together with every other profile sharing this id (CB-578)
+    # configDir: /Users/me/.ccs/instances/gx10   # CLAUDE_CONFIG_DIR — inherit that profile's skills/MCP
+    # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
+    # parityOverlay: [".env", ".envrc"]   # the default; never add .mcp.json or .claude/settings.local.json — see above
+    # ideMcpUrl: http://127.0.0.1:29170/index-mcp/streamable-http   # opt-in (CB-634): IDE code intelligence, pinned to the worktree
+    # ideProjectDir: bridged          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in bridged/)
+    # ideOpenCommand: env DISPLAY=:10.0 idea {dir}   # CB-634 auto-open: opens {dir} in the IDE at spawn; omit to open by hand
+  gx11:                              # a second backend, so `placement: weighted` has a choice
+    baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
+    placement: tab
+    workspace: bridged-workers
+    # tabLabel: an optional per-profile override; the fleet template usually covers it
+    mcpUrl: http://127.0.0.1:8765/mcp
+    argv: ["ccs", "gx11"]
+    weight: 0.5
+    maxLoad: 2
+    # Pin an auto-compact window BELOW the served model's context ceiling. The global
+    # ~/.claude/settings.json value is shared by every ccs instance and the primary, so the
+    # per-profile override belongs here. Equal to the ceiling means auto-compact never fires
+    # before the server rejects the prompt, which kills a worker mid-turn (CB-523).
+    env:
+      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "280000"
+  # CB-402: a second coding-agent kind, proving the PeerLauncher SPI is provider-neutral.
+  # opencode is provider-agnostic and uses NONE of Claude's private seams: no ANTHROPIC_BASE_URL /
+  # SubscriptionGuard (so it needs no `guard` host entry), no --mcp-config / --append-system-prompt.
+  # The bridge MCP + reply charter mount via a generated OPENCODE_CONFIG file, and the model is a
+  # `provider/model` selector. Placement, tabs, cwd, and the readiness gate are shared with Claude.
+  #
+  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → fleet_send →
+  # structured fleet_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
+  # and need NO credentials — check `opencode models` for the current free list, since the names
+  # change. That also makes the worker off-subscription by construction.
+  #   opencode-free:
+  #     kind: opencode
+  #     model: opencode/north-mini-code-free  # `provider/model` selector, injected as `-m`
+  #     placement: tab
+  #     workspace: bridged-workers
+  #     tabLabel: "opencode: {profile} #{n}"
+  #     mcpUrl: http://127.0.0.1:8765/mcp
+  #     argv: ["opencode"]
+  #
+  # CB-508: point an opencode profile at your OWN OpenAI-compatible endpoint (local vLLM, llama.cpp,
+  # LM Studio, TGI…) instead of opencode's gateway. Setting `baseUrl` on a `kind: opencode` profile
+  # makes the bridge emit a custom `provider` block into the generated opencode.json — opencode has
+  # no ANTHROPIC_BASE_URL seam, so this is how the endpoint is pinned.
+  #   baseUrl → a bare host:port gets `/v1` appended (where these servers mount the API); a URL that
+  #             already has a path is used verbatim, so a custom mount point still works.
+  #   model   → MUST be "<provider>/<model>". The provider half names the generated block; the model
+  #             half must match an id the server reports at /v1/models. One field drives both the
+  #             declaration and the `-m` flag, so they cannot drift apart. A bare model name with a
+  #             baseUrl set is rejected at spawn rather than silently using the default gateway.
+  #   tokenEnv → optional; its value becomes the provider apiKey. Most local servers ignore the key,
+  #             so a placeholder is used when unset (the AI SDK still requires a non-empty one).
+  # NOTE: no `guard` entry is needed even with a baseUrl set. The SubscriptionGuard exists to stop a
+  # worker borrowing the primary's Anthropic subscription, and an opencode process has no Anthropic
+  # credential path at all.
+  #   opencode-local:
+  #     kind: opencode
+  #     baseUrl: http://127.0.0.1:8000
+  #     model: local-vllm/deepseek-v4-flash
+  #     placement: tab
+  #     workspace: bridged-workers
+  #     tabLabel: "opencode: {profile} #{n}"
+  #     mcpUrl: http://127.0.0.1:8765/mcp
+  #     argv: ["opencode"]
+# How an unqualified spawn chooses a profile: fixed (default, reproduces pre-CB-518 behaviour),
+# round-robin, or weighted. Omitting this key is a strict no-op for existing configs.
+#
+# `weighted` IS NOT "cheapest first" — read this before you set weights (CB-589).
+# It is smooth weighted round-robin: it spreads spawns across EVERY profile that has a free slot,
+# in weight ratio. It has no idea which profile costs money. So with local:10 / paid:2 you do not
+# get "use local, overflow to paid" — you get roughly one spawn in six going to the paid profile
+# while the local box still has a free slot.
+#
+# There is a sharper second effect. The policy's running score map lives for the daemon's whole
+# life. While a profile is at maxLoad it is filtered out and its score FREEZES, so the paid
+# profiles keep accumulating against it. When the local slot frees up it returns with a stale
+# score and can LOSE the next pick — a paid spawn while the free box sits idle.
+#
+# Until a real cost-first policy exists, the workaround is to make the ratio decisive rather than
+# proportional: give the free profile a weight so large that it wins every pick it is eligible
+# for, and paid profiles only ever take genuine overflow. On this host that is local weight 100
+# against paid weights of ~1.
+#
+# The gotcha with that workaround: it expresses a PREFERENCE ORDER through a RATIO knob. Add a
+# future profile at weight 150 and it silently outranks the free box, with nothing to warn you.
+# Re-check the weights whenever you add a profile.
+placement: weighted
+
+# How long a credential sits out after a BACKEND_EXHAUSTED classification (CB-578 stage B), in
+# seconds, before a spawn may land on it again. Applies to every profile's effective credential
+# (its own name, or its credentialId if set above) — there is no per-profile override. Default
+# 1800 (30 minutes) when omitted or non-positive.
+# DEFERRED: baked once into the BackendQuarantine built at startup — a running quarantine keeps
+# its original cooldown regardless; a new value only applies to a quarantine that starts after a
+# restart. Editing this needs a daemon restart to take effect.
+# quarantineCooldownSeconds: 1800
+
+# Re-read this file without restarting the daemon (CB-559). Off unless you add this block, so an
+# upgraded bridged keeps the old behaviour: the file is read once at boot and never again.
+#   enabled          → turn the watch on. bridged checks the file's modified time on a timer and
+#                      reloads when it moves.
+#   intervalSeconds  → how often to check (default 10). One `stat` per tick, so this is cheap.
+#
+# Not every key can move under a running daemon, and the difference is about what already exists
+# when the reload happens — not about how important the key is:
+#   HOT       → takes effect on the next spawn: the whole `fleet:` block (every role pool,
+#               `charters`, and `tabLabel`), `placement:`, and an existing profile's weight / maxLoad
+#               / credentialId. Those are hot because the placement policy (and, for credentialId,
+#               the CB-578 stage B quarantine check) reads them through a supplier — being config is
+#               not by itself enough to make a key hot.
+#               EXCEPT `fleet.leaders`: Fleetd.main reads it once at startup to build the lead tab
+#               scanner and launcher, and neither is rebuilt on reload. A changed/added/removed
+#               `fleet.leaders` entry is silently accepted — the reload reports "config reloaded"
+#               with nothing in the deferred list — but has NO effect until you restart. Treat it
+#               as deferred in practice, even though today's reload output does not say so.
+#   DEFERRED  → accepted into the new config, but the wiring built at startup keeps the old value
+#               until you restart: `lifecycle:`, `leadHeartbeat:`, `guard:`, `worktreeRoot:`,
+#               `spawnReadyTimeoutMs` / `spawnReadyPollMs`, `quarantineCooldownSeconds` (CB-578
+#               stage B — baked once into the quarantine tracker built at startup), ADDING or
+#               REMOVING a profile (a new backend needs its own launcher, and launchers are built
+#               once), AND an existing profile's launch settings — model, baseUrl, argv, env,
+#               configDir, mcpUrl, tabLabel, exhaustedPattern. The launcher takes a copy of
+#               `profiles:` at startup and resolves every spawn out of that copy, so those never
+#               reach a launch until you restart. The reload logs them by name rather than
+#               pretending they applied.
+#   COLD      → cannot change at all: `bind:`, `herdrSocket:`, `broker:` and `auth:`. The socket is
+#               bound, the broker connection is open, and the auth mode decides who may reach the
+#               port that is already listening.
+#
+# A changed COLD key refuses the WHOLE reload — not the hot half applied and the cold half warned
+# about. A half-applied reload would leave the daemon matching no file on disk, which is the worst
+# thing a reload can do to an operator debugging one. A file that fails to parse or fails a startup
+# validator is refused the same way, and the running config stays live.
+# configReload:
+#   enabled: true
+#   intervalSeconds: 10
+
+# THE FLEET (CB-557) — who the daemon may run, and under which role. This one block replaced four
+# older keys: `leaders:`, `members:`, `leadScan:` and `defaultProfile:`.
+#
+# A member is anything a lead spawns, and every member has two INDEPENDENT attributes:
+#   role    — which contract: architect, dev or reviewer. It picks the launch charter, the role
+#             file, the playbook skill and the authz row.
+#   profile — which backend: one of the `profiles:` keys above (model, CLI adapter, cost).
+# They vary on their own. A reviewer may run on the same profile as the dev whose diff it reads,
+# which is why the two cannot be one field.
+#
+# The ROLE IS THE CONTAINING KEY, not a `role:` field. That is not only tidier: a misspelled role
+# used to parse into a member with no contract at all, while a misspelled pool name here simply
+# declares nothing.
+#
+# Each pool lists the profiles that role MAY run on — these are pools, not identities. That is also
+# what replaced `defaultProfile:`: an unqualified spawn names a role, and that role's pool supplies
+# the candidates, in definition order. A dev and a reviewer staying anonymous is exactly compatible
+# with being listed here; the entry key just names the entry.
+fleet:
+  # Optional launch-charter text, keyed only by the singular role wire names: architect, dev,
+  # reviewer. Changes are HOT and reach the next spawn without a daemon restart. Do not put secrets
+  # here: a later launch step writes this text to a world-readable temp file, and ${ENV} interpolation
+  # is deliberately not supported.
+  charters:
+    architect: |-
+      You are an architect in this fleet. You refine work before anyone builds it:
+      scope, acceptance criteria, risks, and a unit split. You read the repo and
+      write analysis. You never commit production code and never open a PR.
+      A design task is worked by two architects. Design alone first, then exchange
+      and say plainly where you disagree. Do not concede just to agree.
+    dev: |-
+      You implement the one unit you were given, and nothing else. You test it,
+      commit it, and open your own pull request. You never merge.
+    reviewer: |-
+      You review the diff you were given. You report bugs, risks and missing tests.
+      You do not change code.
+
+  # Optional. Template for a member tab's label; {role}, {profile}, {model} and {n} are substituted.
+  # {n} counts per role+profile, so `dev: sonnet #2` really is the second sonnet dev. Because {role}
+  # comes from a closed enum, a generated label can never begin with a lead's tabPrefix.
+  # tabLabel: "{role}: {profile} #{n}"
+
+  # Panes that orchestrate rather than are orchestrated. A lead may now be CREATED as well as
+  # recognised: give it a `profile:` and the daemon launches the shortfall when fewer than
+  # `instances` are live. Omit `profile:` and it is recognise-only, as before.
+  #
+  # `tab:` (CB-579) is REQUIRED and is the only field identity depends on — the exact label of the
+  # tab hosting the lead, matched case-insensitively. Label the tab yourself and put that same
+  # string here, and the pane is recognised on the next rescan. Reopen the tab later, or the session
+  # inside it restarts — the terminal id changes; the tab, and its label, do not, so no config edit
+  # follows a restart.
+  #
+  # A lead the daemon launches is labelled BY the daemon with this same `tab:` value, so it is found
+  # by the same scan. A lead counts as live only when herdr also reports a running agent in that
+  # tab — a label left behind by a session that died does not block the relaunch, and a tab that is
+  # gone entirely drops out of the next scan rather than being remembered forever.
+  #
+  # An auto-launched lead is NOT a member: it gets no worker reply charter, is never registered with
+  # the session lifecycle (the idle reaper would kill your orchestrator), and stays on the
+  # subscription — ANTHROPIC_BASE_URL/AUTH_TOKEN are stripped from its env whatever the profile says.
+  #
+  # GET THE `tab:` VALUE RIGHT. A pane that does not match any configured `tab:` (a typo, a renamed
+  # tab, a pane no entry names at all) is not recognised as a lead — it resolves as an ordinary
+  # WORKER instead, silently, and every orchestration call it makes (spawn/stop/send/drain) is
+  # refused. There is no error at startup for this: an unmatched pane is simply not a lead. If your
+  # primary suddenly can't spawn or send, check this section first.
+  # leaders:
+  #   opus-5.0:
+  #     profile: opus                # omit to never create this lead, only recognise it
+  #     instances: 1                 # desired live count; only the shortfall is launched. 0 = off
+  #     tab: "lead: opus-5.0"        # REQUIRED — the exact tab label this lead lives in
+  #     tabPrefix: "lead:"           # only used to guard against a worker tabLabel colliding with
+  #                                  # this convention at startup; plays no part in matching a lead
+  #     scanIntervalSeconds: 10      # rescan cadence, and the worst case before a new tab is seen
+  #     workspace: leads             # where a launched lead's tab is created (default "leads").
+  #                                  # MUST NOT be a member workspace — those are excluded from the
+  #                                  # scan, so a lead placed in one is never found again.
+  #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
+  #     kind: claude                 # descriptive; reported by fleet_whoami
+  #   gpt-sol-5.6:
+  #     tab: "lead: gpt-sol-5.6"
+  #     kind: opencode
+  #     model: openai/gpt-5.6-terra
+
+  # architects:
+  #   architect-1:
+  #     profile: opus                # a strong model, on the operator's subscription
+  #   architect-2:
+  #     profile: sol                 # a different vendor on purpose — two architects that share a
+  #                                  # model share its blind spots
+  developers:
+    gx10:
+      profile: gx10
+  # reviewers:
+  #   gx10:
+  #     profile: gx10                # the same backend may serve two roles; that is the point
+
+# Subscription boundary. A worker's base_url host MUST be one of these; the primary
+# must carry none. Every profile above must have its host listed here.
+guard:
+  offSubscriptionHosts:
+    - gx00.gw
+    - gx01.gw
+
+# Member credential policy (CB-596, gitea issue #82). A herdr pane runs a LOGIN shell, and that
+# shell re-sources the operator's own secret store — so a spawned member inherits every credential
+# the operator's shell holds, not just the ones bridged means to give it. Measured on this host:
+# 31 credential names, all set, with only ONE (GITEA_ACCESS_TOKEN) blocked before this — and that
+# block was a single name hardcoded in HerdrPeerLauncher.java, not driven by this file. This block
+# replaces that hardcoded shadow with a config-driven list of names.
+#
+# ROUND-2 CORRECTION, measured live: the pane-creation env overlay below (applied at tab.create /
+# pane.split, BEFORE the pane's login shell runs) does NOT survive that login shell for any name
+# secrets.sh actually exports — the shell re-exports it afterwards and overwrites the sentinel.
+# Proof: GITEA_ACCESS_TOKEN comes back blocked only because secrets.sh itself carries a guarded
+# export (`[ -n "${BRIDGED_MEMBER:-}" ] || export GITEA_ACCESS_TOKEN=...`) — that guard, not this
+# file, is what wins. No other name in `known` below has a matching guard in secrets.sh yet (1
+# guard measured against 33 export lines there). So today this block's overlay is REAL protection
+# only for a name secrets.sh does not export, or a peer kind whose pane never runs a login shell —
+# for everything secrets.sh exports and guards, the guard in secrets.sh (out of scope for this
+# ticket) is what actually blocks it, not this list. An exec-time fix (winning after the login
+# shell finishes, before the agent process starts) was attempted and found to have no seam in the
+# current herdr protocol — AgentControl.start takes a fixed `kind` (herdr resolves the executable)
+# plus trailing CLI args for that binary, not an arbitrary argv or an env map; only tab.create /
+# pane.split accept `env`, and that is this same pane-creation overlay. See gitea #82 for the open
+# design question this leaves.
+#
+# DENY-BY-DEFAULT, NOT A DENY-LIST. A deny-list (name the bad ones, let everything else through) is
+# silently wrong the moment the operator's store gains a new secret — nothing would ever report it.
+# Deny-by-default inverts that: `known` bounds the blast radius to names actually enumerated below,
+# and EVERY one of them is blocked UNLESS it is also in `allow`. Omitting this block entirely (the
+# shipped default) blocks NOTHING — unlike most optional blocks in this file, absence here is a real
+# gap, not a safe "feature off". A name that is neither `known` nor `allow`-ed is not silently let
+# through either: the daemon logs a WARN naming any credential-shaped env var it finds on neither
+# list (never its value), so a secret added to the store later does not go unnoticed forever.
+#
+#   policy → "deny-by-default" (the default; also accepted spelled "deny-list") overlays each
+#            known-but-not-allowed name BEFORE the pane's login shell runs — real protection only
+#            where that shell does not re-export the name (see ROUND-2 CORRECTION above). An
+#            unrecognized value refuses to start, naming it.
+#   policy → "allow-list" (CB-633) moves the control to a per-spawn ZDOTDIR directory the daemon
+#            generates and passes through tab.create's env map. Each generated startup file sources
+#            its ~/ counterpart FIRST and then runs the scrub, so the scrub happens after the
+#            operator's whole chain and no sourced file can undo it.
+#            The scrub is sourced from BOTH the generated .zshrc and the generated .zlogin, because
+#            herdr does not open the same kind of shell everywhere: macOS panes run a LOGIN zsh (so
+#            .zlogin runs), Linux panes run a plain interactive zsh (so .zlogin never runs at all).
+#            A scrub in .zlogin alone would be a control that silently does nothing on Linux.
+#            The allow-list is DERIVED, never typed:
+#            every profile's tokenEnv/gitTokenEnv/gitHostEnv values and env-map keys, plus an
+#            infrastructure set (PATH HOME SHELL TERM LANG LC_* TMPDIR USER LOGNAME PWD SHLVL EDITOR
+#            PAGER JAVA_HOME XDG_* ZDOTDIR), plus whatever keys this spawn's own env overlay carries.
+#            Adding a profile can therefore only widen the list, never break another spawn's scrub.
+#            Under this policy `known`/`allow` below become REPORTING ONLY — they feed the gap WARN,
+#            they are no longer a control. If the member's login shell is NOT zsh, the daemon logs a
+#            loud WARN saying protection is off and falls back to deny-by-default's overlay.
+#            Each pane writes a scrub-report.txt naming how many variables it kept of how many it
+#            saw; the daemon logs that "allowed N of M" line when the pane stops. If the report is
+#            MISSING the daemon logs a WARN instead — the scrub cannot then be confirmed to have
+#            run, and a silently-dead control is exactly what this policy exists to prevent.
+#   allow  → credential names a member legitimately needs. Under deny-by-default, left OUT of the
+#            pane's env overlay entirely, so the value the pane's own (login) shell exports passes
+#            through untouched. Under allow-list: reporting only.
+#   known  → every credential name the operator's store is known to export. Under deny-by-default,
+#            every name here NOT also in `allow` is overlaid with a non-secret sentinel value before
+#            the pane's login shell runs — real protection only for names that shell does not itself
+#            re-export (see the ROUND-2 CORRECTION note above). Under allow-list: reporting only.
+#   sshAuthSock → whether SSH_AUTH_SOCK may pass through under allow-list ("allow") or must be
+#            blanked like any other non-derived name ("block", the default). This is a decision you
+#            have to make explicitly: SSH_AUTH_SOCK is a handle to YOUR ssh-agent, and a member
+#            holding it can sign with your keys — it sits in no secret file and looks like no
+#            credential, which is why it slipped past three earlier tickets (gitea #110). Blocking
+#            it breaks git over SSH inside members (push/fetch authenticate as you); use HTTPS
+#            remotes or scoped deploy keys instead of allowing it lightly.
+#
+# HOT-RELOADABLE the same way `fleet:` is (CB-559): read fresh on every spawn, so editing this list
+# and reloading config (or restarting) changes what the NEXT spawn inherits; already-running members
+# are unaffected either way.
+# memberCredentials:
+#   policy: deny-by-default        # or "deny-list", or "allow-list" (CB-633) — see above
+#   sshAuthSock: block             # allow-list only; see the sshAuthSock note above
+#   allow:
+#     - AI_GATEWAY_TOKEN     # named in a profile's tokenEnv (local/gx) — a member reaching the
+#                            # gateway is by design, not a leak
+#     - WORKER_GITEA_TOKEN   # the repo-scoped forge token a member needs to open its own PR (CB-302)
+#     - CONTEXT7_TOKEN       # already decided as allowed by CB-593
+#     - GITEA_HOST           # not a credential — a hostname, paired with the forge token above
+#   known:
+#     - AI_GATEWAY_TOKEN
+#     - BESZEL_ADMIN_EMAIL
+#     - BESZEL_ADMIN_PASSWORD
+#     - BESZEL_HUB_URL
+#     - BESZEL_KEY
+#     - BESZEL_UNIVERSAL_TOKEN
+#     - BRAIN_MCP_TOKEN
+#     - CF_ACCOUNT_ID
+#     - CF_API_TOKEN
+#     - CF_USER_TOKEN
+#     - CONFLUENCE_API_TOKEN
+#     - CONFLUENCE_USERNAME
+#     - CONTEXT7_TOKEN
+#     - GITEA_ACCESS_TOKEN
+#     - GITEA_HOST
+#     - GITLAB_OAUTH_CLIENT_SECRET
+#     - GITLAB_PERSONAL_ACCESS_TOKEN
+#     - GRAFANA_ADMIN_PASSWORD
+#     - GRAFANA_ADMIN_USER
+#     - HASS_TOKEN
+#     - HW_PASSWORD
+#     - HW_USER
+#     - LTMS_API_KEY
+#     - MEMORY_MCP_TOKEN
+#     - METRICS_PUSH_TOKEN
+#     - OPENCODE_AUTOMODE_MODEL
+#     - TELEGRAM_BOT_TOKEN
+#     - TELEGRAM_CHAT_ID
+#     - TS_API_KEY
+#     - TS_AUTHKEY
+#     - WORKER_GITEA_TOKEN
+
+# Spawn-readiness gate (CB-306). The launcher blocks until the worker's herdr status is
+# injectable (IDLE/BLOCKED/DONE) or the timeout elapses. 0 disables the gate.
+# NOTE: keys are camelCase — config is bound by plain Jackson with no naming strategy and
+# unknown keys are ignored, so a snake_case key would be silently dropped (default kept).
+# spawnReadyTimeoutMs: 20000
+# spawnReadyPollMs: 300
+
+# Worktree provisioning root (CB-301-ext). Where per-worker git worktrees are checked out so
+# each worker owns an isolated branch instead of sharing the primary's tree. Omit to default
+# to a sibling directory of the repo root.
+# worktreeRoot: /Users/me/src/.bridged-worktrees
+
+# Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
+# the feature disabled. By default the daemon never reaps, caps, or drains sessions.
+#   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)
+#   contextCap         → force-release a session after this many delegated turns
+#   drainTimeoutSeconds → seconds to wait for BUSY sessions on shutdown before forced teardown
+#   clearAfterTurn     → whether a reusable worker discards its conversation context after every
+#                        completed delegated turn (default false). Works for claude-code workers
+#                        only — any other peer kind (e.g. opencode) logs "context reset is
+#                        unsupported for peer kind …" once and the reset is a no-op.
+# lifecycle:
+#   idleTtlSeconds: 300
+#   contextCap: 10
+#   drainTimeoutSeconds: 5
+#   clearAfterTurn: false
+
+# Durable reply delivery (CB-307 Stage 2). OMIT this block entirely to keep the default
+# in-memory, soft-state reply inbox (late worker replies are held only until a daemon bounce).
+# Set a broker uri to swap in the AMQP-backed inbox: worker replies with no open send are held
+# on a durable per-target queue (agent.<target>.inbox) and survive a restart — the broker
+# redelivers anything the primary had not yet drained. Production default is LavinMQ; a stock
+# RabbitMQ speaks the same AMQP 0-9-1, so it is a URI-only swap.
+#   uri      → AMQP connection URI. No trailing slash ⇒ the default vhost "/"; an empty path ("/")
+#              is vhost "" and will NOT connect. Encode a named vhost as .../%2Fmyvhost.
+#   uriEnv   → CB-151: name of a host env var holding the AMQP URI, preferred over `uri` (wins
+#              whenever set). The URI carries `user:pass@` inline, so naming a variable keeps the
+#              password out of fleetd.yaml — same pattern as auth.tokenEnv/Profile.tokenEnv. A
+#              uriEnv that resolves to an unset or blank variable is treated as NOT configured and
+#              the daemon falls back to the in-memory inbox, warning loudly.
+#   prefetch → CB-527: consumer basicQos, capping how many unacked messages the inbox holds
+#              in-heap per owned target (the rest sits on the broker's durable queue instead of
+#              growing the JVM heap). Default 32 when omitted.
+# broker:
+#   uriEnv: LAVINMQ_URI
+#   prefetch: 32
+
+# Shared cross-host LEADER coordination broker. OMIT this block to leave lead-to-lead messaging
+# off entirely (config-only in this ticket — nothing here wires it into a live LeadMailbox yet).
+# This is a SEPARATE AMQP vhost from `broker:` above: member/worker inboxes always stay on the
+# per-fleet `broker:` vhost, and this vhost carries only leader-to-leader traffic, so two fleets
+# whose members must never see each other can still share one coordination vhost for their leads.
+#   uriEnv   → name of a host env var holding the coordination AMQP URI, same convention as
+#              broker.uriEnv (keeps the credential out of fleetd.yaml). Wins over `uri` when set.
+#   selfId   → this daemon's own lead coord-id — the name its mailbox is owned under
+#              (lead.<selfId>.inbox), e.g. "mac-opus" or "fleet01-lead". Must be globally unique
+#              across every daemon sharing this vhost.
+#   prefetch → consumer basicQos, capping how many unacked messages the mailbox holds in-heap.
+#              Default 32 when omitted.
+# coordinator:
+#   uriEnv: LEAD_COORD_URI
+#   selfId: mac-opus
+#   prefetch: 32
+
+# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open fleet_send,
+# the ReplyPushLoop injects a *drain nudge* (never the payload) into the primary's own herdr
+# pane — status-gated (only when injectable, never mid-turn) and bounded. Ack = drain: the loop
+# stops as soon as the primary's inbox is empty.
+#   terminal       → pin the primary's herdr terminal id. Omit to learn it from the connection on
+#                    the first orchestration-side MCP call (the normal case). An off-host or
+#                    non-herdr primary leaves this unresolved → the loop is a no-op and delivery
+#                    degrades to pull; the reply is still never lost.
+#
+#                    REQUIRED (CB-522) if the primary itself runs inside a herdr pane. Caller
+#                    identity resolves a loopback PID to its herdr pane, and PaneLocator scans
+#                    EVERY pane — not just bridged-spawned ones — so such a primary is otherwise
+#                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
+#                    self-locking: the learned terminal is populated by the very orchestration
+#                    calls being refused, so only this pinned value can break the cycle. Read the
+#                    id off fleet_whoami (it reports the current terminal even while
+#                    misclassified) and re-pin whenever the primary moves panes.
+#   pushReminders  → max nudges before giving up (default 5)
+#   pushBackoffMs  → delay between nudges in ms (default 15000)
+# primary:
+#   terminal: term_65619bd6174568
+#   pushReminders: 5
+#   pushBackoffMs: 15000

bridged/pom.xml

@@ -5,25 +5,86 @@
     <modelVersion>4.0.0</modelVersion>
 
     <groupId>dev.ltms</groupId>
-    <artifactId>bridged</artifactId>
-    <version>0.1.0-SNAPSHOT</version>
+    <artifactId>fleetd</artifactId>
+    <version>1.0.0</version>
     <packaging>jar</packaging>
 
-    <name>bridged</name>
-    <description>claude-bridge message server: sole gateway between primary/worker Claude sessions and herdr</description>
+    <name>fleetd</name>
+    <description>fleet message server: sole gateway between a lead session, its members, and herdr</description>
 
     <properties>
         <maven.compiler.release>25</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <mainClass>dev.ltms.bridged.Bridged</mainClass>
+        <mainClass>dev.ltms.fleet.Fleetd</mainClass>
 
-        <jackson.version>2.18.2</jackson.version>
-        <javalin.version>6.3.0</javalin.version>
+        <jackson.version>2.19.0</jackson.version>
+        <javalin.version>6.7.0</javalin.version>
+        <jetty.version>11.0.25</jetty.version>
+        <mcp.version>2.0.0</mcp.version>
         <slf4j.version>2.0.16</slf4j.version>
-        <logback.version>1.5.15</logback.version>
+        <logback.version>1.5.18</logback.version>
         <junit.version>5.11.4</junit.version>
+        <amqp.version>5.22.0</amqp.version>
+        <testcontainers.version>1.20.4</testcontainers.version>
+        <commons-compress.version>1.27.1</commons-compress.version>
+        <commons-lang3.version>3.18.0</commons-lang3.version>
     </properties>
 
+    <!--
+      Dependency security (validate with the JetBrains analyzer's Mend.io check on this pom).
+      Deps are pinned to the latest available versions. Residual advisories with NO upstream fix,
+      accepted for this loopback-bound daemon that processes no untrusted config:
+        - jetty-http 11.0.25 (via Javalin): CVE-2026-2332, CVE-2025-11143 — Jetty 11 is EOL;
+          fixed only in Jetty 12, which needs a Javalin major (6.x rides Jetty 11).
+        - logback-core 1.5.18: CVE-2025-11226, CVE-2026-1225 — both require a MALICIOUS
+          logback.xml (attacker with config write already has code execution); ours is trusted.
+        - jackson-core 2.19.0: WS-2026-0003 — "insufficient information", no fixed version published.
+        - tools.jackson.core (Jackson 3) 3.0.3 via the MCP SDK: CVE-2026-29062 (nesting-depth
+          resource exhaustion). The SDK 2.0.0 is pinned to Jackson 3.0.3 + jackson-annotations
+          3.0-rc5; bumping Jackson 3 to the patched 3.2.x breaks the SDK (annotation mismatch).
+          Only the loopback /mcp endpoint parses this JSON, from trusted local Claude clients.
+      The 11.0.23 -> 11.0.25 bump did clear jetty CVE-2024-8184 (5.9) and CVE-2024-6763.
+    -->
+
+    <!-- Force the latest patched Jetty 11.x across all Javalin-pulled Jetty modules (no version
+         skew). Javalin 6.x rides Jetty 11; a move to Jetty 12 needs a Javalin major. -->
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.eclipse.jetty</groupId>
+                <artifactId>jetty-bom</artifactId>
+                <version>${jetty.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <!-- The MCP SDK (Jackson 3) needs jackson-annotations with JsonFormat.Shape.POJO
+                 (the 3.0 line); it shares the com.fasterxml.jackson.annotation package with our
+                 Jackson 2.19 databind, so both must resolve to the same jar. 3.0 is built to work
+                 with Jackson 2.19 databind too — pin it to reconcile the two. -->
+            <dependency>
+                <groupId>com.fasterxml.jackson.core</groupId>
+                <artifactId>jackson-annotations</artifactId>
+                <version>3.0-rc5</version>
+            </dependency>
+            <!-- Testcontainers 1.20.4 pulls commons-compress 1.24.0 (test scope), which carries
+                 CVE-2024-25710 (8.1) + CVE-2024-26308 — both fixed in 1.26.0. Pin the patched line.
+                 Test-scope only (never shipped in the jar), but bumped per the CVE policy. -->
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-compress</artifactId>
+                <version>${commons-compress.version}</version>
+            </dependency>
+            <!-- Testcontainers 1.20.4 also pulls commons-lang3 3.16.0 (test scope): CVE-2025-48924
+                 (uncontrolled recursion in ClassUtils), fixed in 3.18.0. Pin the patched line.
+                 Test-scope only (never shipped in the jar), bumped per the CVE policy. -->
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-lang3</artifactId>
+                <version>${commons-lang3.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <!-- JSON + YAML (config, herdr wire format, REST bodies) -->
         <dependency>
@@ -44,6 +105,24 @@
             <version>${javalin.version}</version>
         </dependency>
 
+        <!-- MCP server: the SERVER face. Streamable-HTTP servlet mounted on Javalin's Jetty at
+             /mcp, exposing bridge_send/bridge_reply/bridge_status as thin adapters over REST. -->
+        <dependency>
+            <groupId>io.modelcontextprotocol.sdk</groupId>
+            <artifactId>mcp</artifactId>
+            <version>${mcp.version}</version>
+        </dependency>
+
+        <!-- Broker client (CB-307 Stage 2): AMQP 0-9-1. Default deploy targets LavinMQ; this same
+             client speaks to RabbitMQ unchanged (URI-only swap), so integration tests run against a
+             stock RabbitMQ container. Only wired when a broker: block is present in config; absent →
+             the in-memory ReplyInbox. -->
+        <dependency>
+            <groupId>com.rabbitmq</groupId>
+            <artifactId>amqp-client</artifactId>
+            <version>${amqp.version}</version>
+        </dependency>
+
         <!-- Logging -->
         <dependency>
             <groupId>org.slf4j</groupId>
@@ -63,9 +142,28 @@
             <version>${junit.version}</version>
             <scope>test</scope>
         </dependency>
+
+        <!-- Testcontainers RabbitMQ: spins a real broker for the @Tag("contract") AMQP integration
+             test only. Excluded from the default build (contract group), so `mvn clean install`
+             stays hermetic and green without Docker; run under -Pcontract with Docker present. -->
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>rabbitmq</artifactId>
+            <version>${testcontainers.version}</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.testcontainers</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <version>${testcontainers.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
+        <!-- CB-632: stays 'bridged' until the cutover renames the module dir and the launchd
+         plist together. The installed plist names bridged/target/bridged.jar and
+         KeepAlive is armed, so renaming the jar alone strands a restart. -->
         <finalName>bridged</finalName>
         <plugins>
             <plugin>
@@ -74,6 +172,30 @@
                 <version>3.14.0</version>
             </plugin>
 
+            <!--
+              Coverage (CB-509). Build-time tooling only — never a compile/runtime dependency, so
+              it adds nothing to the shipped jar. Report lands at target/site/jacoco/index.html and
+              target/site/jacoco/jacoco.csv. No `check` rule / threshold is wired: a coverage gate
+              rewards writing tests that execute lines, which is the failure mode this project is
+              trying to avoid, not encourage.
+            -->
+            <plugin>
+                <groupId>org.jacoco</groupId>
+                <artifactId>jacoco-maven-plugin</artifactId>
+                <version>0.8.13</version>
+                <executions>
+                    <execution>
+                        <id>prepare-agent</id>
+                        <goals><goal>prepare-agent</goal></goals>
+                    </execution>
+                    <execution>
+                        <id>report</id>
+                        <phase>test</phase>
+                        <goals><goal>report</goal></goals>
+                    </execution>
+                </executions>
+            </plugin>
+
             <!-- Unit tests run by default; contract tests (live herdr) are tag-excluded. -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -116,7 +238,27 @@
         </profile>
         <profile>
             <id>contract</id>
-            <properties><excludedGroups></excludedGroups></properties>
+            <properties><excludedGroups/></properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <configuration>
+                            <!-- Docker-engine compat (see "Running the contract tests" in
+                                 docs/CB-307-Reliable-Delivery.md): Testcontainers 1.20.4's docker-java
+                                 client defaults to Docker API 1.32 when no version is set, but modern
+                                 engines (OrbStack on this dev host, min 1.40) reject that as too old —
+                                 which surfaces as "Could not find a valid Docker environment". Pinning
+                                 api.version=1.43 works on OrbStack and Docker 24+, and is overridable
+                                 per-host via -Dapi.version. Only active under -Pcontract, so the
+                                 default hermetic build never sets it. -->
+                            <systemPropertyVariables>
+                                <api.version>1.43</api.version>
+                            </systemPropertyVariables>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
         </profile>
     </profiles>
 </project>

bridged/src/main/java/dev/ltms/bridged/Bridged.java

@@ -1,64 +0,0 @@
-package dev.ltms.bridged;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.inject.StatusPoller;
-import dev.ltms.bridged.rest.BridgedApp;
-import dev.ltms.bridged.worker.WorkerService;
-import io.javalin.Javalin;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.nio.file.Path;
-
-/**
- * {@code bridged} entry point. Wires the real herdr socket client to the REST app and
- * starts listening. Before anything else it asserts its own environment is clean —
- * {@code bridged} is not a Claude process and must never carry a base_url.
- */
-public final class Bridged {
-
-    private static final Logger log = LoggerFactory.getLogger(Bridged.class);
-
-    /** How often the injector samples a busy worker's status while it has queued work. */
-    private static final long INJECT_POLL_MILLIS = 250;
-
-    static void main(String[] args) {
-        Path configPath = Path.of(args.length > 0 ? args[0] : "bridged.yaml");
-        BridgedConfig cfg = BridgedConfig.load(configPath);
-
-        // The primary/host env that launched bridged must not be tainted.
-        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
-        guard.assertPrimaryClean(System.getenv());
-
-        Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
-                ? Path.of(cfg.herdrSocket())
-                : UnixSocketHerdrClient.defaultSocketPath();
-
-        UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect(socket, new com.fasterxml.jackson.databind.ObjectMapper());
-        Runtime.getRuntime().addShutdownHook(new Thread(herdr::close));
-
-        AgentControl agents = new AgentControl(herdr);
-        WorkspaceControl spaces = new WorkspaceControl(herdr);
-        WorkerService workers = new WorkerService(agents, spaces, guard, cfg.worker(), System::getenv);
-
-        // Status-gated injector (CB-103): the single writer into workers, fed by a poller.
-        // The blocking message endpoint (CB-104) is the producer; the poller is inert until then.
-        Injector injector = new Injector(agents);
-        StatusPoller poller = new StatusPoller(agents, injector, INJECT_POLL_MILLIS);
-        poller.start();
-        Runtime.getRuntime().addShutdownHook(new Thread(poller::stop));
-
-        Javalin app = new BridgedApp(herdr, workers).build();
-        app.start(cfg.bind().host(), cfg.bind().port());
-        log.info("bridged listening on {}:{}, herdr socket {}",
-                cfg.bind().host(), cfg.bind().port(), socket);
-    }
-
-    private Bridged() {
-    }
-}

bridged/src/main/java/dev/ltms/bridged/config/BridgedConfig.java

@@ -1,121 +0,0 @@
-package dev.ltms.bridged.config;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
-
-import java.io.IOException;
-import java.io.UncheckedIOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Set;
-
-/**
- * {@code bridged} configuration, loaded from a YAML file (see
- * {@code bridged.example.yaml}). Unknown keys are ignored so config can grow ahead
- * of the code.
- *
- * @param bind         REST/MCP listen host:port
- * @param herdrSocket  path to herdr's Unix socket ({@code null} → client default)
- * @param worker       worker-spawn settings
- * @param guard        subscription-boundary allowlist
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public record BridgedConfig(
-        Bind bind,
-        String herdrSocket,
-        Worker worker,
-        Guard guard) {
-
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Bind(String host, int port) {
-        public Bind {
-            if (host == null || host.isBlank()) host = "127.0.0.1";
-            if (port <= 0) port = 8080;
-        }
-    }
-
-    /**
-     * @param profile   ccs profile a worker is spawned under (Stage-1: {@code ltms-local})
-     * @param baseUrl   the off-subscription endpoint injected as {@code ANTHROPIC_BASE_URL}
-     * @param model     model alias, injected as {@code ANTHROPIC_MODEL} (may be {@code null})
-     * @param configDir {@code CLAUDE_CONFIG_DIR} so the worker inherits the profile's
-     *                  skills/MCP/hooks (may be {@code null})
-     * @param tokenEnv  name of the host env var holding the worker's auth token; its value
-     *                  is injected as {@code ANTHROPIC_AUTH_TOKEN} (never stored in config)
-     * @param argv      launch command; defaults to {@code ["claude"]}
-     * @param placement where a worker lands: {@code "tab"} (default — its own tab in the
-     *                  worker space) or {@code "pane"} (legacy — split the focused tab)
-     * @param workspace label of the dedicated worker space; found-or-created on first
-     *                  spawn (default {@code "bridged-workers"}). A future per-session
-     *                  layout is just a distinct label here — the shared space is default.
-     * @param tabLabel  template for a worker tab's label; {@code {profile}}/{@code {model}}
-     *                  and {@code {n}} (per-worker number, to keep sibling tabs distinct)
-     *                  are substituted (default {@code "worker: {profile} #{n}"})
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Worker(String profile, String baseUrl, String model,
-                         String configDir, String tokenEnv, List<String> argv,
-                         String placement, String workspace, String tabLabel) {
-        public Worker {
-            argv = (argv == null || argv.isEmpty()) ? List.of("claude") : List.copyOf(argv);
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_WORKER_TOKEN" : tokenEnv;
-            placement = (placement == null || placement.isBlank()) ? "tab" : placement.toLowerCase();
-            workspace = (workspace == null || workspace.isBlank()) ? "bridged-workers" : workspace;
-            tabLabel = (tabLabel == null || tabLabel.isBlank()) ? "worker: {profile} #{n}" : tabLabel;
-        }
-
-        /** True when workers should land in their own tab in the worker space. */
-        public boolean tabPlacement() {
-            return "tab".equals(placement);
-        }
-
-        /**
-         * Render {@link #tabLabel} for the {@code n}-th worker (substitutes
-         * {@code {profile}}/{@code {model}}/{@code {n}}), so sibling worker tabs are distinct.
-         */
-        public String renderTabLabel(long n) {
-            return tabLabel
-                    .replace("{profile}", profile == null ? "" : profile)
-                    .replace("{model}", model == null ? "" : model)
-                    .replace("{n}", Long.toString(n));
-        }
-    }
-
-    /**
-     * Subscription boundary. Only these hosts may back a worker's
-     * {@code ANTHROPIC_BASE_URL}; the primary must carry none.
-     *
-     * @param offSubscriptionHosts hostnames allowed for worker base_urls
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Guard(List<String> offSubscriptionHosts) {
-        public Guard {
-            offSubscriptionHosts = offSubscriptionHosts == null ? List.of() : List.copyOf(offSubscriptionHosts);
-        }
-
-        public Set<String> hostSet() {
-            return Set.copyOf(offSubscriptionHosts);
-        }
-    }
-
-    private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());
-
-    /** Load and validate config from {@code path}. */
-    public static BridgedConfig load(Path path) {
-        try {
-            BridgedConfig cfg = YAML.readValue(Files.readString(path), BridgedConfig.class);
-            return cfg.withDefaults();
-        } catch (IOException e) {
-            throw new UncheckedIOException("cannot read bridged config at " + path, e);
-        }
-    }
-
-    /** Fill in nested defaults so callers never see nulls for structural fields. */
-    public BridgedConfig withDefaults() {
-        Bind b = bind != null ? bind : new Bind(null, 0);
-        Guard g = guard != null ? guard : new Guard(List.of());
-        return new BridgedConfig(b, herdrSocket, worker, g);
-    }
-}

bridged/src/main/java/dev/ltms/bridged/herdr/AgentControl.java

@@ -1,95 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-
-/**
- * Domain layer over herdr's native {@code agent.*} namespace — the worker south side.
- * Chosen in the CB-102 spike over the pane + {@code send_text} fallback because
- * {@code agent.start} takes a first-class {@code env} map (clean, guard-checked
- * subscription injection) and herdr tracks each worker's Claude session UUID itself.
- *
- * <p>Every method is one herdr call through the injected {@link HerdrClient}, so this
- * layer is unit-testable with a fake and contract-tested against a live daemon.
- */
-public final class AgentControl {
-
-    private final HerdrClient herdr;
-
-    public AgentControl(HerdrClient herdr) {
-        this.herdr = herdr;
-    }
-
-    /**
-     * Spawn an agent. {@code env} is applied to the process environment verbatim — this
-     * is where a worker's {@code ANTHROPIC_BASE_URL} lives, and the ONLY place it should.
-     *
-     * @param name label/kind for herdr status detection (e.g. {@code "claude"})
-     * @param argv launch command, e.g. {@code ["claude"]}
-     * @param env  process environment additions ({@code ANTHROPIC_BASE_URL}, token, …)
-     */
-    public Agent start(String name, List<String> argv, Map<String, String> env) {
-        return start(name, argv, env, null);
-    }
-
-    /**
-     * Spawn an agent into a specific tab. With a non-null {@code tabId} the worker lands
-     * in that tab (the placement policy's dedicated worker tab); with {@code null} herdr
-     * splits the currently-focused tab (legacy pane placement).
-     */
-    public Agent start(String name, List<String> argv, Map<String, String> env, String tabId) {
-        Map<String, Object> params = new LinkedHashMap<>();
-        params.put("name", name);
-        params.put("argv", argv);
-        params.put("env", env);
-        if (tabId != null) {
-            params.put("tab_id", tabId);
-        }
-        JsonNode result = herdr.call("agent.start", params);
-        return Agent.from(result.get("agent"));
-    }
-
-    /** Deliver {@code text} to an agent (its next prompt input). */
-    public void send(String target, String text) {
-        herdr.call("agent.send", Map.of("target", target, "text", text));
-    }
-
-    /**
-     * Read an agent's terminal.
-     *
-     * @param source one of {@code visible|recent|recent_unwrapped|detection}
-     */
-    public String read(String target, String source) {
-        JsonNode result = herdr.call("agent.read", Map.of("target", target, "source", source));
-        return result.path("read").path("text").asText("");
-    }
-
-    /** Current agent record (status, session UUID, pane). */
-    public Agent get(String target) {
-        return Agent.from(herdr.call("agent.get", Map.of("target", target)).get("agent"));
-    }
-
-    /** Just the lifecycle status — what the status-gated injector checks before send. */
-    public AgentStatus status(String target) {
-        return get(target).status();
-    }
-
-    /** All agents herdr tracks — the discovery surface ("what workers exist"). */
-    public List<Agent> list() {
-        JsonNode result = herdr.call("agent.list");
-        List<Agent> out = new ArrayList<>();
-        for (JsonNode a : result.path("agents")) {
-            out.add(Agent.from(a));
-        }
-        return out;
-    }
-
-    /** Tear a worker down (there is no agent.stop — close its pane). */
-    public void close(String paneId) {
-        herdr.call("pane.close", Map.of("pane_id", paneId));
-    }
-}

bridged/src/main/java/dev/ltms/bridged/herdr/AgentStatus.java

@@ -1,29 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-/**
- * A herdr agent's lifecycle state, as reported by {@code agent_status}. Drives the
- * status-gated injector: a worker is safe to inject into only when {@link #IDLE} or
- * {@link #BLOCKED}, never mid-turn ({@link #WORKING}).
- */
-public enum AgentStatus {
-    IDLE,
-    WORKING,
-    BLOCKED,
-    UNKNOWN;
-
-    /** Map herdr's wire string ({@code idle|working|blocked|unknown}) to the enum. */
-    public static AgentStatus fromWire(String s) {
-        if (s == null) return UNKNOWN;
-        return switch (s.toLowerCase()) {
-            case "idle" -> IDLE;
-            case "working" -> WORKING;
-            case "blocked" -> BLOCKED;
-            default -> UNKNOWN;
-        };
-    }
-
-    /** Whether {@code bridged} may inject a message now without stepping on a live turn. */
-    public boolean injectable() {
-        return this == IDLE || this == BLOCKED;
-    }
-}

bridged/src/main/java/dev/ltms/bridged/inject/Injector.java

@@ -1,182 +0,0 @@
-package dev.ltms.bridged.inject;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayDeque;
-import java.util.ArrayList;
-import java.util.Deque;
-import java.util.List;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.stream.Collectors;
-
-/**
- * The status-gated injector (CB-103): the single writer that delivers a message into a
- * worker only when it is safe — {@code idle} or {@code blocked}, never mid-turn.
- *
- * <p>Per target it holds a FIFO queue and delivers <strong>at most one message per turn</strong>:
- * after a send it waits for the worker to pick the message up (go {@code working}) before
- * delivering the next, so two rapid deliveries never interleave into one turn. Each
- * status-check-then-send for a target is serialized on the target's monitor, closing the
- * TOCTOU window between "is it idle?" and "send" — one writer per worker.
- *
- * <p><strong>Polling caveat.</strong> This is driven by {@link #onStatus} sampling (a
- * {@code StatusPoller}), not by reliable status <em>edges</em>. A turn can begin and end
- * entirely between two polls, so the {@code working} pickup may never be sampled. To avoid
- * wedging a queue forever, an awaited pickup is released after {@link #PICKUP_GRACE_POLLS}
- * consecutive injectable samples (the worker has plainly moved on). Only {@code working} — not
- * a transient {@code unknown} — counts as a real pickup, so a detection glitch can't prematurely
- * release the latch. Perfectly reliable turn boundaries require a herdr {@code events.subscribe}
- * stream; that is the intended upgrade and would replace only the sampling, not this queue.
- */
-public final class Injector {
-
-    private static final Logger log = LoggerFactory.getLogger(Injector.class);
-
-    /**
-     * How many consecutive injectable samples (with no {@code working} in between) after a send
-     * before we assume the turn completed unobserved and release the pickup latch. At the
-     * default 250ms poll interval this is a ~2s grace — far longer than a worker takes to start
-     * a turn, so it only fires on a genuinely missed pickup edge.
-     */
-    private static final int PICKUP_GRACE_POLLS = 8;
-
-    private final AgentControl agents;
-    private final ConcurrentHashMap<String, Target> targets = new ConcurrentHashMap<>();
-
-    public Injector(AgentControl agents) {
-        this.agents = agents;
-    }
-
-    /** A pending message and the future that completes when it has been delivered. */
-    private record Pending(String text, CompletableFuture<Void> delivered) {
-    }
-
-    /** Per-worker delivery state, guarded by its own monitor (single writer per worker). */
-    private static final class Target {
-        final Deque<Pending> queue = new ArrayDeque<>();
-        boolean awaitingPickup;   // sent a message, waiting for the worker to pick it up
-        int injectableSincePickup; // consecutive injectable samples while awaitingPickup
-
-        synchronized void add(Pending p) {
-            queue.add(p);
-        }
-    }
-
-    /**
-     * Queue {@code text} for delivery to {@code target} (a herdr {@code terminal_id}). Returns
-     * immediately with a future that completes when the message is actually sent — the worker
-     * may be mid-turn, in which case delivery waits for the next injectable window.
-     *
-     * <p>Uses an atomic map update so a concurrent {@link #drop} cannot slip between "find the
-     * target" and "queue the message" and orphan it in a target it just removed.
-     */
-    public CompletableFuture<Void> enqueue(String target, String text) {
-        CompletableFuture<Void> delivered = new CompletableFuture<>();
-        Pending p = new Pending(text, delivered);
-        targets.compute(target, (_, existing) -> {
-            Target t = (existing != null) ? existing : new Target();
-            t.add(p); // synchronized on the Target monitor — atomic with a concurrent drop
-            return t;
-        });
-        return delivered;
-    }
-
-    /**
-     * Feed a fresh status observation for {@code target}. Delivers the head of the queue iff the
-     * worker is injectable and no earlier message is still awaiting pickup. Serialized per target
-     * so the check and the send cannot race another delivery to the same worker; the delivered
-     * future is completed <em>after</em> the monitor is released so a caller's continuation never
-     * runs on the poller thread while it holds the lock.
-     */
-    public void onStatus(String target, AgentStatus status) {
-        Target t = targets.get(target);
-        if (t == null) return;
-
-        Pending sent = null;
-        RuntimeException sendError = null;
-        synchronized (t) {
-            if (status == AgentStatus.WORKING) {
-                // Definitive pickup: the worker is busy on our last message.
-                t.awaitingPickup = false;
-                t.injectableSincePickup = 0;
-            } else if (status.injectable()) { // IDLE or BLOCKED
-                if (t.awaitingPickup && ++t.injectableSincePickup >= PICKUP_GRACE_POLLS) {
-                    // Pickup edge was never sampled (turn faster than the poll, or status lag).
-                    // The worker has plainly moved on — release the latch rather than wedge.
-                    t.awaitingPickup = false;
-                    t.injectableSincePickup = 0;
-                }
-                if (!t.awaitingPickup) {
-                    Pending p = t.queue.peek();
-                    if (p != null) {
-                        try {
-                            agents.send(target, p.text());
-                            t.queue.poll();
-                            t.awaitingPickup = true;
-                            t.injectableSincePickup = 0;
-                            sent = p;
-                        } catch (RuntimeException e) {
-                            // Delivery failed at herdr; drop the poisoned message and surface it
-                            // rather than blocking the queue behind it.
-                            t.queue.poll();
-                            sent = p;
-                            sendError = e;
-                        }
-                    }
-                }
-            }
-            // UNKNOWN (and any other non-injectable, non-working): do nothing — neither a safe
-            // window nor a reliable pickup signal, so we must not deliver or release the latch.
-
-            // Reclaim the entry once the worker is fully quiescent, so the map cannot grow without
-            // bound across many short-lived workers.
-            if (t.queue.isEmpty() && !t.awaitingPickup) {
-                targets.remove(target, t);
-            }
-        }
-
-        if (sent != null) {
-            if (sendError != null) {
-                log.warn("inject to {} failed, dropped message: {}", target, sendError.getMessage());
-                sent.delivered().completeExceptionally(sendError);
-            } else {
-                sent.delivered().complete(null);
-            }
-        }
-    }
-
-    /** Targets the poller must keep sampling: those with a queued message or an awaited pickup. */
-    public Set<String> activeTargets() {
-        return targets.entrySet().stream()
-                .filter(e -> {
-                    synchronized (e.getValue()) {
-                        return !e.getValue().queue.isEmpty() || e.getValue().awaitingPickup;
-                    }
-                })
-                .map(java.util.Map.Entry::getKey)
-                .collect(Collectors.toSet());
-    }
-
-    /**
-     * Forget a target whose worker is gone, failing every still-queued message so awaiting
-     * callers unblock instead of hanging forever. Futures are completed after the monitor is
-     * released.
-     */
-    public void drop(String target, Throwable cause) {
-        Target t = targets.remove(target);
-        if (t == null) return;
-        List<Pending> pending;
-        synchronized (t) {
-            pending = new ArrayList<>(t.queue);
-            t.queue.clear();
-        }
-        for (Pending p : pending) {
-            p.delivered().completeExceptionally(cause);
-        }
-    }
-}

bridged/src/main/java/dev/ltms/bridged/rest/BridgedApp.java

@@ -1,112 +0,0 @@
-package dev.ltms.bridged.rest;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import dev.ltms.bridged.guard.GuardException;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.worker.WorkerService;
-import io.javalin.Javalin;
-import io.javalin.http.Context;
-
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-
-/**
- * The REST surface — {@code bridged}'s contract and its testability seam. Every
- * feature is reachable here without Claude or MCP in the loop, so each is an
- * acceptance test against plain HTTP. MCP tools (later) are thin adapters over these
- * same endpoints and are validated by parity, not by re-implementing behaviour.
- *
- * <p>Built from injected collaborators so tests supply fakes and run on an ephemeral
- * port; {@code main} supplies the real Unix-socket client and worker service.
- */
-public final class BridgedApp {
-
-    private final HerdrClient herdr;
-    private final WorkerService workers;
-
-    public BridgedApp(HerdrClient herdr, WorkerService workers) {
-        this.herdr = herdr;
-        this.workers = workers;
-    }
-
-    /** Wire routes onto a fresh, unstarted Javalin instance. Caller starts it. */
-    public Javalin build() {
-        Javalin app = Javalin.create(cfg -> cfg.showJavalinBanner = false);
-        app.get("/healthz", this::healthz);
-        app.get("/sessions", this::sessions);
-        app.get("/agents", this::agents);
-        app.post("/workers", this::spawnWorker);
-        app.delete("/workers/{paneId}", this::stopWorker);
-        return app;
-    }
-
-    /** Liveness + herdr reachability. 200 when herdr answers ping, 503 otherwise. */
-    private void healthz(Context ctx) {
-        try {
-            JsonNode pong = herdr.call("ping");
-            ctx.status(200).json(Map.of(
-                    "status", "ok",
-                    "herdr", Map.of(
-                            "version", pong.path("version").asText(""),
-                            "protocol", pong.path("protocol").asInt())));
-        } catch (HerdrException e) {
-            ctx.status(503).json(Map.of(
-                    "status", "degraded",
-                    "herdr", "unreachable",
-                    "detail", e.getMessage()));
-        }
-    }
-
-    /** Sessions view derived from herdr {@code workspace.list} (one workspace → one row). */
-    private void sessions(Context ctx) {
-        JsonNode result = herdr.call("workspace.list");
-        List<Map<String, Object>> out = new ArrayList<>();
-        for (JsonNode w : result.path("workspaces")) {
-            out.add(Map.of(
-                    "id", w.path("workspace_id").asText(""),
-                    "label", w.path("label").asText(""),
-                    "focused", w.path("focused").asBoolean(false),
-                    "paneCount", w.path("pane_count").asInt(),
-                    "agentStatus", w.path("agent_status").asText("unknown")));
-        }
-        ctx.status(200).json(Map.of("sessions", out));
-    }
-
-    /** Discovery: every agent herdr tracks, keyed by its Claude session UUID. */
-    private void agents(Context ctx) {
-        ctx.status(200).json(Map.of("agents", workers.list().stream().map(BridgedApp::view).toList()));
-    }
-
-    /** Spawn a guard-checked worker. 403 if the base_url would breach the subscription boundary. */
-    private void spawnWorker(Context ctx) {
-        try {
-            Agent worker = workers.spawn();
-            ctx.status(201).json(view(worker));
-        } catch (GuardException e) {
-            ctx.status(403).json(Map.of("error", "subscription_boundary", "detail", e.getMessage()));
-        }
-    }
-
-    /** Tear a worker down by pane id. */
-    private void stopWorker(Context ctx) {
-        workers.stop(ctx.pathParam("paneId"));
-        ctx.status(204);
-    }
-
-    /** Stable JSON projection of an agent (null-safe for the start-time shape). */
-    private static Map<String, Object> view(Agent a) {
-        Map<String, Object> m = new LinkedHashMap<>();
-        m.put("terminalId", a.terminalId());
-        m.put("paneId", a.paneId());
-        m.put("workspaceId", a.workspaceId());
-        m.put("tabId", a.tabId());
-        m.put("sessionId", a.sessionId());
-        m.put("agentType", a.agentType());
-        m.put("status", a.status().name().toLowerCase());
-        return m;
-    }
-}

bridged/src/main/java/dev/ltms/bridged/worker/WorkerService.java

@@ -1,206 +0,0 @@
-package dev.ltms.bridged.worker;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.security.SecureRandom;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.function.Function;
-
-/**
- * Spawns and lists worker sessions — the safe path from a delegation request to a
- * running off-subscription Claude.
- *
- * <p>The spawn sequence encodes the subscription boundary: build the worker env with
- * {@code ANTHROPIC_BASE_URL}, assert that host is on the allowlist <em>before</em>
- * touching herdr, and only then {@code agent.start}. A worker's base_url lives in the
- * env map handed to herdr and nowhere else; {@code bridged}'s own environment is never
- * mutated.
- *
- * <p>Placement: in the default {@code tab} policy a worker lands in its own tab inside a
- * dedicated worker space (found-or-created once, then shared), so workers never split or
- * clutter the user's real work spaces. Teardown removes the worker's pane <em>and</em> its
- * now-empty tab, tolerating an already-gone worker so a repeated DELETE is harmless.
- */
-public final class WorkerService {
-
-    private static final Logger log = LoggerFactory.getLogger(WorkerService.class);
-
-    /** herdr rejects a duplicate agent {@code name}; we retry a bumped name this many times. */
-    private static final int NAME_RETRIES = 8;
-
-    private final AgentControl agents;
-    private final WorkspaceControl spaces;
-    private final SubscriptionGuard guard;
-    private final BridgedConfig.Worker cfg;
-    private final Function<String, String> env; // host env lookup (injectable for tests)
-    private final AtomicLong nameSeq = new AtomicLong(); // per-worker counter (also the tab #)
-    // Per-process token mixed into each worker name so a fresh process (nameSeq back at 0)
-    // cannot collide with same-profile workers that outlived a restart. See startUniquelyNamed.
-    private final String nameNonce = String.format("%06x", new SecureRandom().nextInt(1 << 24));
-
-    public WorkerService(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                         BridgedConfig.Worker cfg, Function<String, String> env) {
-        this.agents = agents;
-        this.spaces = spaces;
-        this.guard = guard;
-        this.cfg = cfg;
-        this.env = env;
-    }
-
-    /** Spawn a worker for the configured profile. Guard runs before any herdr call. */
-    public Agent spawn() {
-        String baseUrl = cfg.baseUrl();
-        guard.assertWorker(baseUrl); // hard stop before we spawn anything
-
-        Map<String, String> workerEnv = new LinkedHashMap<>();
-        workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
-        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
-        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
-        String token = env.apply(cfg.tokenEnv());
-        putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", token);
-
-        return cfg.tabPlacement() ? spawnInTab(workerEnv) : spawnAsPane(workerEnv);
-    }
-
-    /** Dedicated worker space → own tab → drop the placeholder shell so only the worker remains. */
-    private Agent spawnInTab(Map<String, String> workerEnv) {
-        Workspace space = spaces.ensureWorkspace(cfg.workspace());
-        Tab.Created tab = spaces.createTab(space.workspaceId());
-        log.info("spawning worker profile={} base_url={} space={} tab={}",
-                cfg.profile(), cfg.baseUrl(), space.workspaceId(), tab.tab().tabId());
-
-        Started started;
-        try {
-            started = startUniquelyNamed(workerEnv, tab.tab().tabId());
-        } catch (RuntimeException e) {
-            // The worker never started — don't leave the tab we just created orphaned.
-            // Best-effort cleanup; never let it mask the real spawn failure.
-            try {
-                spaces.closeTab(tab.tab().tabId());
-            } catch (RuntimeException cleanup) {
-                log.warn("failed to close orphaned tab {} after spawn error: {}",
-                        tab.tab().tabId(), cleanup.getMessage());
-            }
-            throw e;
-        }
-
-        // The worker is LIVE now. The remaining steps are cosmetic (drop herdr's seed shell
-        // so the tab holds only the worker; label the tab). They must not fail the spawn or
-        // orphan the running worker — on error we log and still return it so the caller gets
-        // its paneId and can tear it down.
-        if (tab.rootPaneId() != null) {
-            tidy("close seed pane " + tab.rootPaneId(), () -> agents.close(tab.rootPaneId()));
-        } else {
-            log.warn("tab {} had no seed pane in the create response; worker tab may hold an extra pane",
-                    tab.tab().tabId());
-        }
-        tidy("label tab " + tab.tab().tabId(),
-                () -> spaces.renameTab(tab.tab().tabId(), cfg.renderTabLabel(started.seq())));
-        log.info("worker started pane={} tab={} terminal={}",
-                started.agent().paneId(), started.agent().tabId(), started.agent().terminalId());
-        return started.agent();
-    }
-
-    /** Run a best-effort post-start cleanup step, logging (not throwing) on failure. */
-    private void tidy(String what, Runnable step) {
-        try {
-            step.run();
-        } catch (RuntimeException e) {
-            log.warn("post-start step failed ({}) — worker is running regardless: {}", what, e.getMessage());
-        }
-    }
-
-    /** Legacy placement: herdr splits the currently-focused tab. */
-    private Agent spawnAsPane(Map<String, String> workerEnv) {
-        log.info("spawning worker (pane placement) profile={} base_url={} argv={}",
-                cfg.profile(), cfg.baseUrl(), cfg.argv());
-        Agent worker = startUniquelyNamed(workerEnv, null).agent();
-        log.info("worker started pane={} terminal={}", worker.paneId(), worker.terminalId());
-        return worker;
-    }
-
-    /** A started worker together with the sequence its unique name/label used. */
-    private record Started(Agent agent, long seq) {
-    }
-
-    /**
-     * Start the worker under a unique herdr agent name. herdr requires each running
-     * agent's {@code name} to be distinct (a 2nd {@code name:"claude"} fails
-     * {@code agent_name_taken}) — the exact case that makes multiple workers useful. The name
-     * is {@code claude-<profile>-<nonce>-<seq>}: {@code seq} distinguishes workers within this
-     * process, and the per-process {@code nonce} keeps a fresh process (whose {@code seq}
-     * restarts at 0) from colliding with same-profile workers that outlived a restart. The
-     * retry is a belt-and-braces backstop for the astronomically unlikely nonce+seq clash;
-     * the name is a label only — herdr detects kind and status from terminal output, not it.
-     */
-    private Started startUniquelyNamed(Map<String, String> workerEnv, String tabId) {
-        HerdrException last = null;
-        for (int attempt = 0; attempt < NAME_RETRIES; attempt++) {
-            long seq = nameSeq.incrementAndGet();
-            String name = "claude-" + cfg.profile() + "-" + nameNonce + "-" + seq;
-            try {
-                return new Started(agents.start(name, cfg.argv(), workerEnv, tabId), seq);
-            } catch (HerdrException e) {
-                if (!"agent_name_taken".equals(e.code())) throw e;
-                log.debug("worker name '{}' taken, retrying", name);
-                last = e;
-            }
-        }
-        throw last;
-    }
-
-    /** All herdr-tracked agents — discovery for "what workers exist". */
-    public List<Agent> list() {
-        return agents.list();
-    }
-
-    /**
-     * Tear a worker down by pane id: close the pane, and close its tab <em>only</em> when the
-     * worker is that tab's sole occupant. The single-pane check is what makes this safe
-     * regardless of how the worker was placed (or a placement-config change across a restart):
-     * a pane-placement worker sitting in one of the user's shared tabs has siblings, so its
-     * tab is never closed — we only ever remove a tab we created to hold one worker.
-     *
-     * <p>Resolves the tab from the pane <em>before</em> closing it. An already-gone pane/tab
-     * (repeated DELETE, crashed worker) is treated as success; any other failure propagates so
-     * a genuinely failed teardown is not reported as done.
-     */
-    public void stop(String paneId) {
-        WorkspaceControl.PaneLocation loc = cfg.tabPlacement() ? spaces.locatePane(paneId) : null;
-        try {
-            agents.close(paneId);
-        } catch (HerdrException e) {
-            if (!isAlreadyGone(e)) throw e;
-            log.debug("pane.close({}) ignored — already gone: {}", paneId, e.getMessage());
-        }
-        if (loc != null && loc.tabPaneCount() == 1) {
-            spaces.closeTab(loc.tabId());
-        } else if (loc != null) {
-            log.debug("not closing tab {} — it holds {} panes (not a dedicated worker tab)",
-                    loc.tabId(), loc.tabPaneCount());
-        }
-    }
-
-    /** True when a herdr error means the target is already gone (safe to treat as done). */
-    private static boolean isAlreadyGone(HerdrException e) {
-        return e.code() != null && e.code().endsWith("_not_found");
-    }
-
-    private static void putIfPresent(Map<String, String> m, String k, String v) {
-        if (v != null && !v.isBlank()) {
-            m.put(k, v);
-        }
-    }
-}

bridged/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -0,0 +1,788 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.ConfigWatcher;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.lead.LeadLauncher;
+import dev.ltms.fleet.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.UnixSocketHerdrClient;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.CompletionResolver;
+import dev.ltms.fleet.inject.ExhaustedPatternLookup;
+import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.StatusPoller;
+import dev.ltms.fleet.inject.TurnListener;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.health.FleetHealthMonitor;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.mcp.LsofPeerPidLookup;
+import dev.ltms.fleet.mcp.LsofProcessCwdLookup;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.msg.LeadHeartbeatLoop;
+import dev.ltms.fleet.msg.ReplyPushLoop;
+import dev.ltms.fleet.rest.FleetApp;
+import dev.ltms.fleet.session.GitWorktrees;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.session.SessionReaper;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.member.HerdrPeerLauncher;
+import dev.ltms.fleet.member.OpenCodeLauncher;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import io.javalin.Javalin;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Function;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+
+/**
+ * {@code bridged} entry point. Wires the real herdr socket client to the REST app and
+ * starts listening. Before anything else it asserts its own environment is clean —
+ * {@code bridged} is not a Claude process and must never carry a base_url.
+ */
+public final class Fleetd {
+
+    private static final Logger log = LoggerFactory.getLogger(Fleetd.class);
+
+    /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
+    private static final long HERDR_WAIT_SECONDS = 30;
+    private static final long HERDR_WAIT_POLL_MILLIS = 500;
+
+    /**
+     * CB-632: prefer {@code fleetd.yaml} in {@code dir}; fall back to {@code bridged.yaml} when
+     * the new name is not there. The operator's live file is still named {@code bridged.yaml},
+     * so the old name keeps working until that file moves.
+     */
+    static Path chooseDefaultConfigFile(Path dir) {
+        Path fleetd = dir.resolve("fleetd.yaml");
+        if (Files.exists(fleetd)) {
+            return fleetd;
+        }
+        return dir.resolve("bridged.yaml");
+    }
+
+    static void main(String[] args) {
+        Path configPath = args.length > 0 ? Path.of(args[0]) : chooseDefaultConfigFile(Path.of(""));
+        // CB-632: the config file is being renamed bridged.yaml -> fleetd.yaml. Name the file we
+        // actually loaded, whichever of the two names it carries.
+        log.info("Using configuration file {}", configPath);
+        FleetConfig cfg = FleetConfig.load(configPath);
+        // CB-594: report which secret env vars the config actually needs, by name, before anything
+        // else can fail on a silently-empty one. A daemon started without a login shell (launchd)
+        // boots fine either way — this is the only thing that says so out loud.
+        reportRequiredSecrets(cfg);
+        // CB-596: an absent (or empty) memberCredentials: block blocks NOTHING — no credential
+        // name is hardcoded any more to fall back on. Say so loudly, the same way a missing
+        // secret is reported above, so upgrading past this commit never silently drops CB-592's
+        // protection.
+        reportMemberCredentialsGap(cfg);
+        // CB-559: `cfg` stays the startup snapshot — every validation and every piece of one-time
+        // wiring below reads it, and must, because those decisions cannot be unmade. `config` is the
+        // live reference the hot paths read per use. Which keys can actually move is ConfigRef's
+        // contract; adding a reader here does not make a key reloadable by itself.
+        ConfigRef config = new ConfigRef(configPath, cfg);
+
+        // The primary/host env that launched bridged must not be tainted.
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        guard.assertPrimaryClean(System.getenv());
+
+        // CB-501: refuse to start if the bind is wider than the auth mode can defend. Under
+        // loopback-trust, "not a known worker" means "the primary" — sound only because the OS
+        // refuses remote connections to a loopback socket. This throws rather than warns so the
+        // dangerous configuration cannot be reached by ignoring a log line.
+        cfg.validateAuthExposure();
+        cfg.validateLeadTabPrefixes();
+        // CB-542: a subscription:true profile whose env: reseats ANTHROPIC_BASE_URL/AUTH_TOKEN would
+        // reach an unguarded endpoint (the launcher skips SubscriptionGuard for it). Refuse at load.
+        cfg.validateSubscriptionProfiles();
+        cfg.validateCharters();
+        // CB-548: every architect slot must name a configured workers: profile — the strong-model
+        // backend the future spawn lifecycle would read. A stale reference dies here, not later.
+        cfg.validateMembers();
+
+        Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
+                ? Path.of(cfg.herdrSocket())
+                : UnixSocketHerdrClient.defaultSocketPath();
+
+        UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect(socket, new com.fasterxml.jackson.databind.ObjectMapper());
+
+        AgentControl agents = new AgentControl(herdr);
+        WorkspaceControl spaces = new WorkspaceControl(herdr);
+        // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
+        // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
+        // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
+        Map<String, FleetConfig.Profile> claudeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
+        cfg.profiles().forEach((name, w) -> {
+            if (w.isOpenCode()) {
+                opencodeProfiles.put(name, w);
+            } else {
+                claudeProfiles.put(name, w);
+            }
+        });
+        List<HerdrPeerLauncher> adapters = new ArrayList<>();
+        // The claude-code adapter is the always-present default; keep it even with no profiles (so a
+        // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
+        // unless opencode is the only kind configured.
+        if (!claudeProfiles.isEmpty() || opencodeProfiles.isEmpty()) {
+            adapters.add(new ClaudeCodeLauncher(agents, spaces, guard,
+                    claudeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
+                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
+                    () -> config.get().fleet(),
+                    () -> config.get().memberCredentials()));
+        }
+        if (!opencodeProfiles.isEmpty()) {
+            adapters.add(new OpenCodeLauncher(agents, spaces,
+                    opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
+                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
+                    () -> config.get().fleet(),
+                    () -> config.get().memberCredentials()));
+        }
+        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
+        // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
+        // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
+        // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
+        // here, at startup, and a config reload only changes it for a daemon restart.
+        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
+                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
+        PeerLauncher workers = new CompositePeerLauncher(
+                adapters,
+                cfg.effectiveDefaultProfile(),
+                config,
+                profileName -> liveCountRef.get().apply(profileName),
+                quarantine);
+        // CB-504: under supervision (launchd/systemd) bridged can start before herdr's socket
+        // exists. The client itself is lazy — it connects per call — but the orphan reap below is
+        // the first thing that actually talks to herdr, so without this wait a boot-order race
+        // would crash the daemon into a restart loop. Wait, then degrade rather than die: serving
+        // with /healthz reporting "degraded" is strictly more useful than exiting.
+        boolean herdrUp = awaitHerdr(herdr);
+        if (herdrUp) {
+            // CB-117: herdr keeps worker panes alive across a daemon restart, and their ids died
+            // with the previous process — reap those leaked orphans now, before we start serving.
+            workers.reapOrphanWorkers();
+        } else {
+            log.warn("herdr did not answer within {}s — starting anyway; /healthz will report "
+                    + "degraded until it comes up. Orphaned worker panes (if any) were NOT reaped.",
+                    HERDR_WAIT_SECONDS);
+        }
+
+        // CB-301: authoritative session registry + lifecycle FSM on top of ClaudeCodeLauncher.
+        // CB-301-ext: worktree provisioning seam, optionally rooted at a configured directory.
+        // CB-303 part 2: context cap is opt-in and disabled (0) when absent/null.
+        int contextCap = 0;
+        if (cfg.lifecycle() != null && cfg.lifecycle().contextCap() != null
+                && cfg.lifecycle().contextCap() > 0) {
+            contextCap = cfg.lifecycle().contextCap();
+        }
+        boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
+                System::nanoTime, contextCap, clearAfterTurn);
+        liveCountRef.set(profileName -> (int) sessions.roster().stream()
+                .filter(s -> profileName.equals(s.profile()))
+                .count());
+
+        // CB-303 part 1: idle-ttl reaper — only when configured, defaults to disabled.
+        final SessionReaper reaper;
+        if (cfg.lifecycle() != null
+                && cfg.lifecycle().idleTtlSeconds() != null
+                && cfg.lifecycle().idleTtlSeconds() > 0) {
+            reaper = new SessionReaper(sessions, cfg.lifecycle().idleTtlSeconds());
+            reaper.start();
+        } else {
+            reaper = null;
+        }
+
+        // CB-530: every pane the config names as a lead, merged from `leaders:` and the legacy
+        // singular pin. PrimaryRegistry below still tracks ONE terminal — it addresses the push
+        // loop's nudges, which need a single destination — so it keeps the legacy pin.
+        Map<String, String> leadTerminals = cfg.leaderTerminals();
+        if (leadTerminals.size() > 1) {
+            log.info("leads: {} panes recognised {}", leadTerminals.size(), leadTerminals.values());
+        }
+        // CB-531: on top of the legacy primary.terminal pin, discover leads by the tab labels the
+        // operator writes. CB-557 moved the settings onto the lead they describe, so scanning is on
+        // whenever a `fleet.leaders:` entry exists — with no leads configured the supplier is a
+        // constant and never touches herdr, exactly as a missing `leadScan:` block used to behave.
+        // CB-579: each lead now names its own exact `tab:` label, so one scanner discovers every
+        // configured lead regardless of how differently their tabs are labelled — the old
+        // single-shared-tabPrefix limitation (and its warning) is gone.
+        final Supplier<Map<String, String>> leads;
+        var leaders = cfg.fleet().leaders();
+        if (!leaders.isEmpty()) {
+            Set<String> memberSpaces = cfg.profiles().values().stream()
+                    .map(FleetConfig.Profile::workspace)
+                    .filter(Objects::nonNull)
+                    .collect(Collectors.toSet());
+            Map<String, String> tabToName = new LinkedHashMap<>();
+            leaders.forEach((name, leader) -> {
+                if (leader != null && leader.tab() != null && !leader.tab().isBlank()) {
+                    tabToName.put(leader.tab(), name);
+                }
+            });
+            // One shared rescan cadence: still taken from the first entry, as before — it is an
+            // operational cadence, not identity, so there is no correctness reason to give every
+            // lead its own scanner.
+            int scanIntervalSeconds = leaders.values().iterator().next().scanIntervalSeconds();
+            leads = new LeadTabScanner(herdr, tabToName, memberSpaces,
+                    TimeUnit.SECONDS.toNanos(scanIntervalSeconds), System::nanoTime);
+            log.info("lead scan: tabs {} host a lead (rescan every {}s, member spaces {} excluded)",
+                    tabToName.keySet(), scanIntervalSeconds, memberSpaces);
+        } else {
+            leads = () -> leadTerminals;
+        }
+
+        // CB-558: start any declared lead that is not already running. After the scanner is built,
+        // because both read the same tab labels and the ordering makes that dependency visible; and
+        // only when herdr answered, because the launcher's whole safety property is that it can
+        // count live leads first — it must never guess and risk a second orchestrator.
+        if (herdrUp && !leaders.isEmpty()) {
+            int launched = new LeadLauncher(agents, spaces, cfg).ensureLeads();
+            if (launched > 0) {
+                log.info("lead auto-launch: {} lead(s) started", launched);
+            }
+        }
+
+        // CB-548: config-declared architect slots. Config supplies only the stable name → profile
+        // map; the terminal → slot binding is owned by the registry and is empty at startup, so no
+        // pane resolves to an architect until the later spawn lifecycle binds one. The registry is
+        // what CallerResolver resolves against and what that lifecycle will read profiles from;
+        // nothing here spawns a slot.
+        MemberRegistry members = new MemberRegistry(cfg.fleet());
+        sessions.setMemberLifecycle(members);
+        if (!members.slots().isEmpty()) {
+            log.info("member slots: {} configured {} — none bound yet (a slot is idle until the "
+                            + "spawn lifecycle binds a live terminal to it)",
+                    members.slots().size(), members.slots().keySet());
+        }
+
+        // Status-gated injector (CB-103): the single writer into workers, fed by a poller.
+        // The blocking message endpoint (CB-104) is the producer; the poller is inert until then.
+        // CB-106: a confirmed turn completion resolves a blocked send whose worker never replied.
+        Rendezvous rendezvous = new Rendezvous();
+        // CB-578 stage A: classify a completion-fallback scrape that matches a profile's configured
+        // usage-limit refusal as BACKEND_EXHAUSTED rather than handing it back as a real answer.
+        // Compiled once at startup, keyed by profile name; a profile with no exhaustedPattern is
+        // simply absent here, so its workers keep today's completion-fallback behaviour unchanged.
+        Map<String, Pattern> exhaustedPatternsByProfile = new LinkedHashMap<>();
+        cfg.profiles().forEach((name, profile) -> {
+            if (profile.hasExhaustedPattern()) {
+                exhaustedPatternsByProfile.put(name, Pattern.compile(profile.exhaustedPattern()));
+            }
+        });
+        ExhaustedPatternLookup exhaustedPatterns = target -> sessions.roster().stream()
+                .filter(session -> target.equals(session.terminalId()))
+                .findFirst()
+                .map(session -> exhaustedPatternsByProfile.get(session.profile()))
+                .orElse(null);
+        log.info("backend-exhausted classification (CB-578 stage A): {}",
+                CompletionResolver.coverage(cfg.profiles().keySet(), exhaustedPatternsByProfile.keySet()));
+        // CB-578 stage B: on a classification that actually wins, quarantine the exhausted profile's
+        // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
+        // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
+        // the profile config live off `config`, so a credentialId edit is hot: no restart needed.
+        ExhaustionSink exhaustionSink = (target, reason) -> sessions.roster().stream()
+                .filter(session -> target.equals(session.terminalId()))
+                .findFirst()
+                .map(MemberSession::profile)
+                .map(profileName -> config.get().profiles().get(profileName))
+                .ifPresent(profile -> {
+                    String credentialId = profile.effectiveCredentialId();
+                    quarantine.quarantine(credentialId);
+                    log.warn("credential '{}' quarantined for {}s (profile '{}' classified "
+                                    + "BACKEND_EXHAUSTED): {}", credentialId,
+                            cfg.quarantineCooldownSeconds(), profile.profile(), reason);
+                });
+        CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns, exhaustionSink);
+        // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
+        // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
+        MemberPresence presence = sessions.asPresence();
+        TurnListener turnListener = new TurnListener() {
+            @Override
+            public void onTurnComplete(String target) {
+                completion.onTurnComplete(target);
+                sessions.onTurnComplete(target);
+            }
+
+            @Override
+            public boolean hasPostTurnAction(String target) {
+                return sessions.hasPostTurnAction(target);
+            }
+
+            @Override
+            public boolean onTurnCompleteWithPostAction(String target) {
+                completion.resolveBeforePostAction(target);
+                return sessions.onTurnCompleteWithPostAction(target);
+            }
+
+            @Override
+            public void onDelivered(String target, dev.ltms.fleet.msg.TurnToken token) {
+                completion.onDelivered(target, token);
+                sessions.onDelivered(target, token);
+            }
+
+            @Override
+            public void onTurnFailed(String target) {
+                completion.onTurnFailed(target);
+                sessions.onTurnFailed(target);
+            }
+
+            @Override
+            public void onTurnFailed(String target, String reason) {
+                completion.onTurnFailed(target, reason);
+                sessions.onTurnFailed(target);
+            }
+        };
+        Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
+                presence::forget);
+        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
+        poller.start();
+
+        // CB-307: reply inbox. A broker: block selects the AMQP-backed durable adapter; absent (or
+        // unusable), bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
+        // connection, so keep the reference to close it in the ordered shutdown hook.
+        final ReplyInbox replyInbox = selectReplyInbox(cfg.broker(), System.getenv(), AmqpReplyInbox::open);
+        // CB-307: learn the primary's terminal from orchestration tool calls (or pin from config).
+        // The pin also feeds CallerResolver below: a primary running inside a herdr pane would
+        // otherwise resolve as a worker and be refused every orchestration tool.
+        String pinnedPrimaryTerminal = cfg.primary() != null ? cfg.primary().terminal() : null;
+        PrimaryRegistry primaryRegistry = new PrimaryRegistry(pinnedPrimaryTerminal);
+        // CB-532: `primary.terminal` is superseded and no longer needed for either of its jobs —
+        // identity comes from `leaders:`/`leadScan:`, and reply nudges now follow the delegating
+        // lead. Say so once at startup rather than leaving a redundant pin to look load-bearing.
+        if (pinnedPrimaryTerminal != null && !pinnedPrimaryTerminal.isBlank()) {
+            log.warn("primary.terminal is DEPRECATED (CB-532) and can be deleted: identity now comes "
+                    + "from leaders:/leadScan:, and reply nudges follow the lead that delegated. "
+                    + "It still works, and is still the fallback nudge destination when a restart "
+                    + "has lost the delegation map. Its pushReminders/pushBackoffMs stay valid.");
+        }
+        // CB-307: active push-to-primary loop — nudge the primary when replies land without an
+        // open fleet_send. Uses its own lightweight scheduled executor, separate from the injector.
+        int maxReminders = cfg.primary() != null ? cfg.primary().remindersOrDefault() : 5;
+        long backoffMs = cfg.primary() != null ? cfg.primary().backoffMsOrDefault() : 15_000L;
+        var pushScheduler = Executors.newSingleThreadScheduledExecutor(r ->
+                Thread.ofVirtual().name("bridge-push-").unstarted(r));
+        // CB-502: the registry is built before the service and the push loop so send/reply outcomes
+        // are counted at their single funnel rather than at each of the two caller-facing surfaces.
+        // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
+        Metrics metrics = FleetMetrics.create(sessions, replyInbox);
+        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
+                pushScheduler, maxReminders, backoffMs, metrics);
+        // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
+        // an upgraded daemon cannot silently start spending subscription on nudging an idle lead.
+        // It has its own single-thread scheduler and holds its own scheduler shutdown via close().
+        final LeadHeartbeatLoop heartbeat;
+        var heartbeatScheduler = Executors.newSingleThreadScheduledExecutor(r ->
+                Thread.ofVirtual().name("bridge-heartbeat-").unstarted(r));
+        if (cfg.leadHeartbeat() != null) {
+            var hb = cfg.leadHeartbeat();
+            heartbeat = new LeadHeartbeatLoop(primaryRegistry, agents, replyInbox, sessions::roster,
+                    pushLoop, heartbeatScheduler, System::nanoTime,
+                    TimeUnit.SECONDS.toNanos(hb.idleAfterSeconds()), hb.backoffMs(), hb.quietNudgeCap(),
+                    metrics);
+            heartbeat.start();
+        } else {
+            heartbeat = null;
+            heartbeatScheduler.shutdownNow();
+        }
+        MessageService messages = new MessageService(agents, injector, rendezvous, replyInbox,
+                pushLoop, metrics);
+
+        // Health is a slow whole-fleet observer. Keep it separate from the 250ms delivery poller.
+        final FleetHealthMonitor healthMonitor;
+        var healthScheduler = Executors.newSingleThreadScheduledExecutor(r ->
+                Thread.ofVirtual().name("bridge-health-").unstarted(r));
+        if (cfg.health() != null && cfg.health().isEnabled()) {
+            // CB-580: a member found GONE/NEVER_READY must fail whatever ticket is waiting on it,
+            // through the same idempotent target-wide operation CB-516 already uses on release.
+            healthMonitor = new FleetHealthMonitor(agents, sessions::roster, messages, healthScheduler,
+                    System::nanoTime, cfg.health().intervalOrDefault(), messages::abandon);
+            String coverage = FleetHealthMonitor.coverage(true,
+                    cfg.health().notifications() != null && cfg.health().notifications().configured());
+            if ("detection-only".equals(coverage)) {
+                log.warn("fleet health: {} (no notification sink configured)", coverage);
+            } else {
+                log.info("fleet health: {}", coverage);
+            }
+            healthMonitor.start();
+        } else {
+            healthMonitor = null;
+            healthScheduler.shutdownNow();
+        }
+
+        // CB-520: the reply inbox only consumes for agents this gateway owns. own on acquire,
+        // release on teardown. Do this before CB-516 so the inbox is owned before any reply can land.
+        sessions.onAcquire(replyInbox::own);
+        // CB-516: releasing a worker must fail whatever send was waiting on it. Without this a
+        // torn-down delegation kept reporting PENDING until the 30-minute async timeout, and never
+        // reached /metrics — the delegation was unresolvable and nothing said so.
+        sessions.onRelease(detail -> {
+            // CB-578 stage C, acceptance criterion 10: a failed ticket's detail should tell a lead
+            // where to re-dispatch onto the same tree, not just that the worker vanished.
+            String reason = "the worker session was released before it replied";
+            if (detail.worktreePath() != null) {
+                reason += "; worktree=" + detail.worktreePath() + " branch=" + detail.branch()
+                        + " snapshot=" + (detail.snapshotRef() != null ? detail.snapshotRef() : "none");
+            }
+            // CB-584 (issue #65 criterion 5): also name the agent session, so a lead can resume the
+            // member's conversation instead of only re-dispatching a fresh one onto the same files.
+            if (detail.agentSessionId() != null) {
+                reason += " agentSessionId=" + detail.agentSessionId();
+            }
+            messages.abandon(detail.terminalId(), reason);
+            replyInbox.release(detail.terminalId());
+            primaryRegistry.forgetDelegation(detail.terminalId()); // CB-532: don't leak the lead binding
+        });
+
+        // MCP server face (CB-105): fleet_send/fleet_reply/fleet_status, mounted at /mcp.
+        // Caller identity is resolved from the connection (peer PID → herdr pane), not arguments.
+        ConnectionIdentity identity = new ConnectionIdentity(
+                new PaneLocator(herdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
+
+        // CB-501: one resolver behind both entry paths. Worker identity still comes from the
+        // connection and is never token-gated, so enabling token mode cannot lock the fleet out.
+        final CallerResolver callers;
+        if (cfg.auth().tokenMode()) {
+            String token = System.getenv(cfg.auth().tokenEnv());
+            if (token == null || token.isBlank()) {
+                throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
+                        + " is unset or empty — export it before starting bridged");
+            }
+            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
+            log.info("auth: token mode (bearer required for non-worker callers, env {})",
+                    cfg.auth().tokenEnv());
+        } else {
+            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members);
+            log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
+        }
+
+        FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
+                primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
+                profile -> {
+                    var configured = config.get().profiles().get(profile);
+                    return configured == null ? null : configured.maxLoad();
+                }, () -> config.get().profiles().keySet(), System::nanoTime),
+                new FleetMcp.HealthCoverageSource(() -> {
+                    var health = config.get().health();
+                    return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
+                            health != null && health.notifications() != null && health.notifications().configured());
+                }),
+                new FleetMcp.QuarantineSource(profile -> {
+                    var configured = config.get().profiles().get(profile);
+                    return configured == null ? null : configured.effectiveCredentialId();
+                }, quarantine));
+
+        // CB-559: opt-in config reload. With no `configReload:` block nothing is constructed, so an
+        // upgraded daemon behaves exactly as before — the file is read once at boot and never again.
+        final ConfigWatcher configWatcher;
+        if (cfg.configReload() != null && cfg.configReload().isEnabled()) {
+            configWatcher = new ConfigWatcher(config, cfg.configReload().intervalSeconds());
+            configWatcher.start();
+        } else {
+            configWatcher = null;
+        }
+
+        // CB-303 part 3: single ordered shutdown hook. Drain sessions first while herdr is still
+        // open (so releases reach the daemon), then stop poller/message/mcp/reaper, and close herdr
+        // last. This replaces the earlier independent hooks that could race and close herdr early.
+        Runtime.getRuntime().addShutdownHook(new Thread(() -> {
+            sessions.close(cfg.lifecycle() != null ? cfg.lifecycle().drainTimeoutSeconds() : null);
+            poller.stop();
+            messages.close();
+            pushLoop.close();
+            if (heartbeat != null) heartbeat.close(); // CB-551: stop the idle-lead heartbeat scheduler
+            if (healthMonitor != null) healthMonitor.stop();
+            if (configWatcher != null) configWatcher.stop(); // CB-559: stop polling the config file
+            mcp.close();
+            if (reaper != null) reaper.stop();
+            // Release the broker connection last among message resources (no-op for the in-memory inbox).
+            if (replyInbox instanceof AutoCloseable closeable) {
+                try {
+                    closeable.close();
+                } catch (Exception e) {
+                    log.debug("reply inbox close: {}", e.toString());
+                }
+            }
+            herdr.close();
+        }));
+
+        Javalin app = new FleetApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
+                callers, metrics).build();
+        app.start(cfg.bind().host(), cfg.bind().port());
+        log.info("bridged listening on {}:{}, herdr socket {}",
+                cfg.bind().host(), cfg.bind().port(), socket);
+    }
+
+    /**
+     * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a spawned
+     * member whose agent has connected the bridge MCP, <em>or</em> a lead.
+     *
+     * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> member's boot
+     * window, where herdr already reports {@code idle} but the TUI would drop an injected paste. That
+     * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
+     * (or labelled its tab) only once it was up, so there is no boot window to guard.
+     *
+     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code FleetMcp} marks presence
+     * for every spawned member (worker and architect), deliberately, since that map doubles as the
+     * member roster's availability signal and a lead counted there would show up as an available
+     * member. So without the second disjunct a lead is permanently un-deliverable: every
+     * lead→lead send sat on the gate for {@code READINESS_GRACE_POLLS} (~60s) and then failed
+     * having never been typed into the pane.
+     *
+     * <p>The lead set is read through the supplier on each call rather than snapshotted, so a lead
+     * discovered by {@code leadScan} after startup becomes deliverable without a restart.
+     */
+    static Predicate<String> deliverableTo(MemberPresence presence, Supplier<Map<String, String>> leads) {
+        return target -> presence.isPresent(target) || leads.get().containsKey(target);
+    }
+
+    /** Injection seam for {@link #selectReplyInbox}: production binds {@link AmqpReplyInbox#open}. */
+    @FunctionalInterface
+    interface AmqpOpener {
+        ReplyInbox open(String uri, int prefetch);
+    }
+
+    /**
+     * CB-151/152: pick the reply inbox. A usable broker — a literal {@code uri}, or a {@code
+     * uriEnv} whose variable resolves (both read from {@code env}) — selects the durable AMQP inbox.
+     * Everything else falls back to the in-memory inbox: no broker block, a blank {@code uri}, a
+     * {@code uriEnv} whose variable is unset or blank, or a broker unreachable at boot. The two
+     * lossy paths warn <em>loudly</em> — never silently — because what is lost is durable,
+     * cross-restart reply delivery. Package-private and env-injected so the selection is testable
+     * without a real broker or a mutable process environment.
+     */
+    static ReplyInbox selectReplyInbox(FleetConfig.Broker broker, Map<String, String> env, AmqpOpener amqp) {
+        if (broker == null) {
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+        if (broker.hasUriEnv()) {
+            // uriEnv is authoritative whenever set (CB-151): the operator moved off clear text, so
+            // it must not quietly fall back onto a stale literal uri.
+            if (broker.uri() != null && !broker.uri().isBlank()) {
+                log.info("broker.uri is ignored because broker.uriEnv={} is set", broker.uriEnv());
+            }
+            String effectiveUri = broker.effectiveUri(env);
+            if (effectiveUri == null) {
+                log.warn("broker.uriEnv={} is unset or blank — durable AMQP reply inbox DISABLED. "
+                                + "Replies are soft-state and will not survive a restart. Set {} in the "
+                                + "daemon's environment (see scripts/redeploy-bridged.sh) and restart to "
+                                + "use the durable broker inbox.",
+                        broker.uriEnv(), broker.uriEnv());
+                log.info("reply inbox: in-memory (soft-state)");
+                return new InMemoryReplyInbox();
+            }
+            log.info("reply inbox: AMQP broker (durable) via env var {} (prefetch={})",
+                    broker.uriEnv(), broker.prefetchOrDefault());
+            return openAmqpOrFallback(effectiveUri, broker.prefetchOrDefault(), "uriEnv " + broker.uriEnv(), amqp);
+        }
+        // No uriEnv: the literal uri path (existing behaviour).
+        if (broker.effectiveUri(env) == null) {
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+        log.info("reply inbox: AMQP broker (durable) (prefetch={})", broker.prefetchOrDefault());
+        return openAmqpOrFallback(broker.uri(), broker.prefetchOrDefault(), "uri", amqp);
+    }
+
+    /**
+     * Open the AMQP inbox, falling back to the in-memory inbox for this process lifetime if the
+     * broker cannot be reached at boot (CB-152). Not silent: the warning says durable delivery is
+     * off, replies are soft-state and will not survive a restart, plus the source that failed and
+     * the URI <em>with credentials stripped</em>. Never retries in the background — a broker that
+     * drops <em>after</em> startup already self-heals via the connection factory's automatic
+     * recovery; only the boot path is changed here.
+     */
+    private static ReplyInbox openAmqpOrFallback(String effectiveUri, int prefetch, String source,
+                                                 AmqpOpener amqp) {
+        try {
+            return amqp.open(effectiveUri, prefetch);
+        } catch (IllegalStateException e) {
+            log.warn("cannot reach AMQP broker ({}, {}) — falling back to the in-memory reply inbox "
+                            + "for this process lifetime. Durable, cross-restart reply delivery is OFF; "
+                            + "replies are soft-state and will not survive a restart. Reason: {}",
+                    source, stripCredentials(effectiveUri), reasonOf(e));
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+    }
+
+    /** An AMQP URI carries {@code user:pass@} inline — show the host/port, never the credentials. */
+    static String stripCredentials(String uri) {
+        return uri == null ? null : uri.replaceAll("://[^@/]*@", "://");
+    }
+
+    /** The deepest cause's class and message — the outermost {@code IllegalStateException} echoes the URI (with password). */
+    private static String reasonOf(Throwable e) {
+        Throwable t = e;
+        while (t.getCause() != null && t.getCause() != t) {
+            t = t.getCause();
+        }
+        String msg = t.getMessage();
+        return t.getClass().getSimpleName() + (msg == null || msg.isBlank() ? "" : ": " + msg);
+    }
+
+    /**
+     * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
+     * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
+     * {@link FleetConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
+     * where set (opt-in), plus a configured {@code broker.uriEnv} (CB-151). Derived from the
+     * config, not hard-coded, so a new profile is covered for free. A var required by more than one
+     * profile is one entry naming every profile that needs it. Deliberately excludes {@code
+     * auth.tokenEnv}: that one is already enforced loudly, by a startup throw in {@code main()} —
+     * about 370 lines <em>below</em> this method's call site
+     * ({@link #reportRequiredSecrets(FleetConfig)}), not a few lines above it. That throw only
+     * fires when {@code auth.mode: token} is configured; under the default loopback-trust mode it
+     * never runs, and {@code auth.tokenEnv} is simply not required.
+     *
+     * <p>Package-private and pure (no I/O, no logging) so the derivation is unit-testable without
+     * capturing log output; {@link #reportRequiredSecrets(FleetConfig)} is the logging caller.
+     */
+    static Map<String, List<String>> requiredSecretEnvVars(FleetConfig cfg) {
+        Map<String, List<String>> requiredBy = new LinkedHashMap<>();
+        cfg.profiles().forEach((name, profile) -> {
+            if (!profile.isSubscription()) {
+                requiredBy.computeIfAbsent(profile.tokenEnv(), _ -> new ArrayList<>())
+                        .add("profile '" + name + "' tokenEnv");
+            }
+            if (profile.hasGitToken()) {
+                requiredBy.computeIfAbsent(profile.gitTokenEnv(), _ -> new ArrayList<>())
+                        .add("profile '" + name + "' gitTokenEnv");
+            }
+        });
+        FleetConfig.Broker broker = cfg.broker();
+        if (broker != null && broker.hasUriEnv()) {
+            requiredBy.computeIfAbsent(broker.uriEnv(), _ -> new ArrayList<>())
+                    .add("broker uriEnv");
+        }
+        return requiredBy;
+    }
+
+    /**
+     * CB-594: log, by name only, which required env vars (see {@link #requiredSecretEnvVars}) are
+     * set in the daemon's own process environment — the environment every profile's {@code
+     * tokenEnv}/{@code gitTokenEnv} is read from at spawn time (see
+     * {@code HerdrPeerLauncher.resolveEnv}). Never logs a value, a prefix, or a length.
+     *
+     * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
+     * what is wrong is strictly more useful than one that will not boot at all.
+     */
+    private static void reportRequiredSecrets(FleetConfig cfg) {
+        Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
+        if (requiredBy.isEmpty()) {
+            log.info("startup secrets: no profile references a token env var — nothing to check");
+            return;
+        }
+        Map<String, String> env = System.getenv();
+        requiredBy.forEach((varName, sources) -> {
+            String value = env.get(varName);
+            if (value != null && !value.isBlank()) {
+                log.info("startup secret {}: set ({})", varName, String.join(", ", sources));
+            } else {
+                log.warn("startup secret {}: MISSING ({}) — the daemon will start anyway, and this "
+                                + "failure stays invisible until a worker actually needs it. Fix "
+                                + "${SHARED_ENV}/tools/secrets.sh and restart bridged from a LOGIN "
+                                + "shell (see scripts/redeploy-bridged.sh).",
+                        varName, String.join(", ", sources));
+            }
+        });
+    }
+
+    /**
+     * CB-596: {@code known:} empty (block absent entirely, or present but empty) means {@link
+     * FleetConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
+     * operator's whole secret store, unblocked, exactly the defect this ticket fixes. Unlike a
+     * missing token ({@link #reportRequiredSecrets}), there is no name to point at: the point is
+     * that the block itself is missing. Warn once at startup and say what to add; never refuse to
+     * start over it — see {@link #reportRequiredSecrets} for why a daemon that boots and says
+     * what is wrong beats one that will not boot at all.
+     *
+     * <p>Package-private so the test can capture the log directly, the same way {@link
+     * #requiredSecretEnvVars} is exposed for {@link #reportRequiredSecrets}'s own test.
+     */
+    static void reportMemberCredentialsGap(FleetConfig cfg) {
+        FleetConfig.MemberCredentials creds = cfg.memberCredentials();
+        if (creds != null && !creds.known().isEmpty()) {
+            log.info("memberCredentials: policy={}, {} known name(s), {} allowed — blocking {} on "
+                            + "every spawn{}",
+                    creds.policy(), creds.known().size(), creds.allow().size(), creds.blockedSet().size(),
+                    creds.isAllowList()
+                            ? " (allow-list: known/allow are reporting only — the control is the derived ZDOTDIR scrub)"
+                            : "");
+            return;
+        }
+        log.warn("memberCredentials: absent or empty — the daemon will start anyway, and every "
+                + "member pane inherits the operator's WHOLE secret store, unblocked (CB-592's "
+                + "protection is lost). Add a memberCredentials: block (policy/allow/known) to "
+                + "bridged.yaml — see fleetd.example.yaml — and restart.");
+    }
+
+    /**
+     * Poll herdr's {@code ping} until it answers or {@link #HERDR_WAIT_SECONDS} elapses (CB-504).
+     *
+     * @return true if herdr answered, false if it never did
+     */
+    private static boolean awaitHerdr(HerdrClient herdr) {
+        long deadline = System.nanoTime() + HERDR_WAIT_SECONDS * 1_000_000_000L;
+        boolean waited = false;
+        while (true) {
+            try {
+                herdr.call("ping");
+                if (waited) {
+                    log.info("herdr is up");
+                }
+                return true;
+            } catch (HerdrException e) {
+                if (System.nanoTime() >= deadline) {
+                    return false;
+                }
+                if (!waited) {
+                    log.info("waiting up to {}s for the herdr socket…", HERDR_WAIT_SECONDS);
+                    waited = true;
+                }
+                try {
+                    Thread.sleep(HERDR_WAIT_POLL_MILLIS);
+                } catch (InterruptedException ie) {
+                    Thread.currentThread().interrupt();
+                    return false;
+                }
+            }
+        }
+    }
+
+    private Fleetd() {
+    }
+}

bridged/src/main/java/dev/ltms/fleet/auth/AuditLog.java

@@ -0,0 +1,72 @@
+package dev.ltms.fleet.auth;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+
+/**
+ * Append-only record of privileged actions (CB-505).
+ *
+ * <p>Writes JSON lines to a dedicated {@code audit} logger — its own appender, separate from the
+ * chatty app log — so the trail stays greppable and can later be shipped without dragging debug
+ * noise along.
+ *
+ * <p><strong>Message content is never recorded.</strong> This bridge carries the user's source
+ * code, diffs, and prompts; an audit trail that quietly accumulated them would be a transcript
+ * archive wearing a security control's clothing. Records carry <em>who / what / against what /
+ * outcome</em> and correlation ids only.
+ */
+public final class AuditLog {
+
+    private static final Logger AUDIT = LoggerFactory.getLogger("audit");
+    private static final DateTimeFormatter TS =
+            DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSSXXX").withZone(ZoneOffset.UTC);
+
+    private AuditLog() {
+    }
+
+    /** Record an allowed action. */
+    public static void allowed(Principal caller, Authz.Action action, String target) {
+        write(caller, action, target, "allowed", null);
+    }
+
+    /** Record a refused action and why. */
+    public static void denied(Principal caller, Authz.Action action, String target, String reason) {
+        write(caller, action, target, "denied", reason);
+    }
+
+    /** Record an action that was authorized but then failed downstream (guard, timeout, herdr). */
+    public static void failed(Principal caller, Authz.Action action, String target, String reason) {
+        write(caller, action, target, "failed", reason);
+    }
+
+    private static void write(Principal caller, Authz.Action action, String target,
+                              String outcome, String reason) {
+        Principal c = caller != null ? caller : Principal.anonymous();
+        StringBuilder sb = new StringBuilder(200);
+        // The timestamp is built here rather than by the appender pattern: a pattern that wrapped
+        // literal braces around the message collides with logback's own variable substitution.
+        sb.append("{\"ts\":\"").append(TS.format(Instant.now())).append('"')
+                .append(",\"role\":\"").append(c.role()).append('"')
+                .append(",\"actor\":\"").append(esc(c.describe())).append('"')
+                .append(",\"pid\":").append(c.pid())
+                .append(",\"action\":\"").append(action).append('"')
+                .append(",\"target\":").append(target == null ? "null" : '"' + esc(target) + '"')
+                .append(",\"outcome\":\"").append(outcome).append('"');
+        if (reason != null) {
+            sb.append(",\"reason\":\"").append(esc(reason)).append('"');
+        }
+        sb.append('}');
+        // The appender supplies the timestamp, so it cannot disagree with the app log's clock.
+        AUDIT.info(sb.toString());
+    }
+
+    /** Minimal JSON string escaping — these values are ids and short reasons, never free text. */
+    private static String esc(String s) {
+        return s.replace("\\", "\\\\").replace("\"", "\\\"")
+                .replace("\n", "\\n").replace("\r", "\\r").replace("\t", "\\t");
+    }
+}

bridged/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -0,0 +1,82 @@
+package dev.ltms.fleet.auth;
+
+/**
+ * The authorization table (CB-505), stated once and enforced on both entry paths.
+ *
+ * <p>Most of these rules are already true de facto — {@code FleetMcp} derives a worker's identity
+ * from the connection rather than reading it from an argument, so a worker has never been able to
+ * reply <em>as</em> another worker over MCP. What was missing is that the REST surface trusted the
+ * session id in the URL path, and neither surface checked role at all. This class makes the
+ * invariant explicit and testable rather than emergent.
+ */
+public final class Authz {
+
+    private Authz() {
+    }
+
+    /** A privileged operation, named for the audit trail. */
+    public enum Action {
+        /** Spawn a worker peer. */
+        SPAWN,
+        /** Tear a worker peer down. */
+        STOP,
+        /** Deliver a turn to a session (or answer a worker's question). */
+        SEND,
+        /** A worker's terminal reply for its own turn. */
+        REPLY,
+        /** A worker's mid-turn question to the primary. */
+        ASK,
+        /** Collect held replies from a session's inbox. */
+        DRAIN,
+        /** Read-only observation: status, roster, profiles, task polling. */
+        READ,
+        /** Scrape the metrics endpoint. */
+        METRICS
+    }
+
+    /**
+     * Whether {@code caller} may perform {@code action} against {@code targetSession}.
+     *
+     * @param targetSession the session id in the request path; only consulted for the worker-scoped
+     *                      actions ({@code REPLY}, {@code ASK}), ignored otherwise, may be
+     *                      {@code null}
+     */
+    public static boolean permits(Principal caller, Action action, String targetSession) {
+        if (caller == null || caller.isAnonymous()) {
+            return false; // authenticated as nothing ⇒ authorized for nothing
+        }
+        return switch (action) {
+            // Fleet lifecycle is the primary's alone — spawn, stop, drain. An architect
+            // deliberately does NOT get these (CB-548), so it cannot tear down or stand up workers
+            // even though it coordinates them; and a worker driving any of these would be a worker
+            // escalating into the orchestrator role.
+            case SPAWN, STOP, DRAIN -> caller.isPrimary();
+
+            // Delivering a turn is open to the primary and the architect: an architect delegates
+            // to workers (that is the role's point) but still has no lifecycle rights. A worker is
+            // excluded — sending would be it escalating.
+            case SEND -> caller.isPrimary() || caller.isArchitect();
+
+            // The load-bearing rule: a caller acts only as the pane it occupies. CB-532 widened who
+            // that can be — a lead answering another lead is replying for its OWN terminal, which
+            // this already permits — while the rule itself is unchanged, and is what stops anyone
+            // forging a reply for a rendezvous someone else is waiting on. An architect's own pane
+            // passes through the same check, so it can answer a funnel that delegated to it. An
+            // unnamed primary (token/loopback, no pane) owns nothing and is still excluded.
+            case REPLY, ASK -> caller.ownsSession(targetSession);
+
+            // Observation is open to every authenticated role: a worker legitimately polls its own
+            // status, and the roster carries no secrets.
+            case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
+        };
+    }
+
+    /**
+     * Why a request was refused, for the error body. Distinguishes "you are nobody" from "you are
+     * somebody, but not the right somebody" — the first is a credential problem (401), the second
+     * an authorization one (403).
+     */
+    public static boolean isUnauthenticated(Principal caller) {
+        return caller == null || caller.isAnonymous();
+    }
+}

bridged/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -0,0 +1,272 @@
+package dev.ltms.fleet.auth;
+
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.peer.MemberRole;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.function.Supplier;
+
+/**
+ * Resolves every caller to a {@link Principal}, for both entry paths into the core (CB-501).
+ *
+ * <p>There are two of them and they are not layered the way the docs suggest: {@code FleetMcp}
+ * calls the service layer directly and is mounted as a raw servlet (so it never passes through a
+ * Javalin filter), while the REST routes historically resolved no identity at all. Both now
+ * delegate here, so the authorization rules are stated once instead of drifting apart.
+ *
+ * <p><strong>Resolution order</strong> — connection identity first, token second, nothing third:
+ * <ol>
+ *   <li>A loopback peer PID that maps to a pane named by {@code leaders:}, by the legacy
+ *       {@code primary.terminal} pin, or by an operator-labelled lead tab (CB-307, CB-530, CB-531)
+ *       ⇒ {@link Role#PRIMARY}, carrying that lead's
+ *       name. The pane mapping is as unforgeable as a worker's, and the config explicitly names
+ *       that pane as a lead's own — without this rule a lead running <em>inside</em> a herdr pane
+ *       is misread as a worker and locked out of orchestration. More than one pane may be named,
+ *       so two leads can work as peers rather than one being demoted.</li>
+ *   <li>A loopback peer PID that maps to a pane bound to a CB-548 architect slot ⇒
+ *       {@link Role#ARCHITECT}, carrying the slot name. Just unforgeable as a worker's, and
+ *       resolved from the <em>live</em> terminal→slot binding (never a request argument), before
+ *       the generic worker fallback.</li>
+ *   <li>A loopback peer PID that maps to any other herdr pane ⇒ {@link Role#WORKER}. This is
+ *       unforgeable (the OS reports the PID, herdr owns the PID→pane map) and is honoured
+ *       regardless of auth mode, so enabling auth never breaks the fleet.</li>
+ *   <li>Otherwise, under {@code token} mode, a valid bearer token ⇒ {@link Role#PRIMARY}.</li>
+ *   <li>Otherwise, under {@code loopback-trust}, a loopback caller ⇒ {@link Role#PRIMARY}
+ *       (the historical behaviour, now an explicit configured choice).</li>
+ *   <li>Otherwise {@link Role#ANONYMOUS}.</li>
+ * </ol>
+ */
+public final class CallerResolver {
+
+    private final ConnectionIdentity identity;
+    private final boolean tokenMode;
+    private final byte[] expectedToken; // null unless tokenMode
+    /**
+     * terminal_id → lead name; empty when nothing is pinned. CB-530.
+     *
+     * <p>A supplier rather than a map because the registry is no longer fixed at startup: CB-531
+     * discovers leads by scanning herdr for operator-labelled tabs, so a lead that opens its tab
+     * after the daemon booted must still be recognised. Consulted per resolve; the scanner behind
+     * it is TTL-cached, so this is a map lookup in the common case.
+     */
+    private final Supplier<Map<String, String>> leadTerminals;
+    /**
+     * terminal_id → architect slot name; empty when nothing is configured. CB-548.
+     *
+     * <p>Like {@link #leadTerminals}, a supplier rather than a fixed map, so a binding injected
+     * after startup — when the later spawn lifecycle establishes a live architect session, or an
+     * operator pins one — takes effect without a restart. Consulted per resolve; today's wiring
+     * in {@code Fleetd} reads a constant from config, which is the degenerate live case.
+     */
+    private final Supplier<Map<String, String>> architectTerminals;
+    private final Function<String, MemberRole> memberSlotRoles;
+    private final Function<String, String> memberSlotNames;
+
+    /** Loopback-trust resolver: no token required, historical behaviour. Test-only. */
+    CallerResolver(ConnectionIdentity identity) {
+        this(identity, false, null, Map.of());
+    }
+
+    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. Test-only. */
+    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
+        this(identity, tokenMode, token, Map.of());
+    }
+
+    /**
+     * Single-pin form for the legacy {@code primary.terminal}-only configuration — one lead, named
+     * {@code primary}.
+     *
+     * <p>A static factory rather than a fourth constructor overload on purpose: {@code String} and
+     * {@code Map} overloads are ambiguous for a literal {@code null} argument, which is a compile
+     * error at the call site and exactly the shape "unpinned" is written in.
+     *
+     * @param pinnedPrimaryTerminal the primary's own herdr {@code terminal_id}
+     *                              ({@code null}/blank = unpinned)
+     */
+    static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
+                                   String token, String pinnedPrimaryTerminal) {
+        return new CallerResolver(identity, tokenMode, token,
+                pinnedPrimaryTerminal == null || pinnedPrimaryTerminal.isBlank()
+                        ? Map.of() : Map.of(pinnedPrimaryTerminal, "primary"));
+    }
+
+    /**
+     * @param identity       connection-based worker identification
+     * @param tokenMode      when true, a non-worker caller must present a valid bearer token
+     * @param token          the expected bearer token; required (non-blank) when {@code tokenMode}
+     * @param leadTerminals  herdr {@code terminal_id} → lead name for every configured lead
+     *                       (CB-530). A caller resolving to one of these panes is that lead — a
+     *                       {@link Role#PRIMARY} — rather than a worker. Empty = nothing pinned,
+     *                       so every pane resolves as a worker.
+     */
+    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                   Map<String, String> leadTerminals) {
+        this(identity, tokenMode, token, fixed(leadTerminals), null);
+    }
+
+    /**
+     * Live-registry form: {@code leadTerminals} is consulted on every resolve, so leads discovered
+     * after startup (CB-531's tab scan) take effect without a restart.
+     *
+     * <p>A static factory rather than a fourth constructor overload, for the same reason as
+     * {@link #pinnedTo}: {@code Map} and {@code Supplier} overloads are ambiguous for a literal
+     * {@code null}.
+     */
+    static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
+                                    String token,
+                                    Supplier<Map<String, String>> leadTerminals) {
+        return new CallerResolver(identity, tokenMode, token, leadTerminals, null);
+    }
+
+    /**
+     * Live registry form that can confirm a bound slot is an architect slot.
+     *
+     * <p>This is the only public construction path. It keeps terminal bindings and slot roles in
+     * the same {@link MemberRegistry}, so a configured architect can resolve as an architect.
+     */
+    public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
+                                                       boolean tokenMode, String token,
+                                                       Supplier<Map<String, String>> leadTerminals,
+                                                       MemberRegistry members) {
+        return new CallerResolver(identity, tokenMode, token, leadTerminals,
+                members == null ? null : members::snapshot,
+                members == null ? null : members::roleForSlot,
+                members == null ? null : members::nameForSlot);
+    }
+
+    private static Supplier<Map<String, String>> fixed(Map<String, String> leadTerminals) {
+        Map<String, String> snapshot = leadTerminals == null ? Map.of() : Map.copyOf(leadTerminals);
+        return () -> snapshot;
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals) {
+        this(identity, tokenMode, token, leadTerminals, architectTerminals, null);
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals,
+                           Function<String, MemberRole> memberSlotRoles) {
+        this(identity, tokenMode, token, leadTerminals, architectTerminals, memberSlotRoles, null);
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals,
+                           Function<String, MemberRole> memberSlotRoles,
+                           Function<String, String> memberSlotNames) {
+        if (tokenMode && (token == null || token.isBlank())) {
+            throw new IllegalArgumentException(
+                    "auth.mode=token requires a non-empty token; check that the env var named by "
+                            + "auth.tokenEnv is exported to the daemon's environment");
+        }
+        this.identity = identity;
+        this.tokenMode = tokenMode;
+        this.expectedToken = tokenMode ? token.getBytes(StandardCharsets.UTF_8) : null;
+        this.leadTerminals = leadTerminals == null ? Map::of : leadTerminals;
+        this.architectTerminals = architectTerminals == null ? Map::of : architectTerminals;
+        this.memberSlotRoles = memberSlotRoles == null ? _ -> null : memberSlotRoles;
+        this.memberSlotNames = memberSlotNames == null ? Function.identity() : memberSlotNames;
+    }
+
+    /**
+     * The currently-recognised leads, {@code terminal_id → name} (CB-535).
+     *
+     * <p>Deliberately read from the same supplier {@link #resolve} consults, rather than from a
+     * second copy handed to the roster: a lead that is <em>listed</em> but would not <em>resolve</em>
+     * (or the reverse) is an address a peer cannot actually reach, and the two answers drifting apart
+     * is precisely the confusion this exists to end. Live, so a lead discovered by the tab scan after
+     * startup appears without a restart.
+     */
+    public Map<String, String> leads() {
+        return leadTerminals.get();
+    }
+
+    /**
+     * The currently-recognised architect slots, {@code terminal_id → slot name} (CB-548).
+     *
+     * <p>Read from the same supplier {@link #resolve} consults, so a slot that is <em>listed</em>
+     * here but would not <em>resolve</em> (or the reverse) cannot drift apart. Live for the same
+     * reason as {@link #leads()}.
+     */
+    public Map<String, String> members() {
+        return architectTerminals.get();
+    }
+
+    /**
+     * Resolve the caller of a request.
+     *
+     * @param remoteAddr           the connection's remote address
+     * @param remotePort           the connection's remote port (used for the peer-PID lookup)
+     * @param authorizationHeader  the raw {@code Authorization} header, or {@code null}
+     */
+    public Principal resolve(String remoteAddr, int remotePort, String authorizationHeader) {
+        ConnectionIdentity.Caller c = identity.resolve(remoteAddr, remotePort);
+        if (c.terminal() != null) {
+            String lead = leadTerminals.get().get(c.terminal());
+            if (lead != null) {
+                // The config names this pane as a lead's own. The pane mapping is exactly as
+                // unforgeable as a worker's, so it outranks the token path — no credential needed.
+                // Checked before the architect registry so a pane named in BOTH is still the lead
+                // (CB-548 preserves every existing leader behaviour).
+                return Principal.leader(lead, c.terminal(), c.pid());
+            }
+            String slot = architectTerminals.get().get(c.terminal());
+            if (slot != null && memberSlotRoles.apply(slot) == MemberRole.ARCHITECT) {
+                // The config/live binding names this pane as an architect slot's own. Same
+                // unforgeable pane mapping; the live binding, never a request argument, decides.
+                // Check the slot role too: this defence in depth prevents a bad lifecycle bind from
+                // escalating a dev or reviewer into an architect. Checked before the worker fallback.
+                return Principal.architect(memberSlotNames.apply(slot), c.terminal(), c.pid());
+            }
+            return Principal.worker(c.terminal(), c.pid()); // unforgeable; never token-gated
+        }
+
+        if (tokenMode) {
+            return presentedTokenMatches(authorizationHeader)
+                    ? Principal.primary(c.pid())
+                    : Principal.anonymous();
+        }
+
+        // loopback-trust: same-host callers that are not workers are the primary. A non-loopback
+        // caller is anonymous even here — and startup refuses that combination anyway
+        // (FleetConfig.validateAuthExposure), so this is defence in depth, not the control.
+        return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
+    }
+
+    private boolean presentedTokenMatches(String authorizationHeader) {
+        String presented = bearerValue(authorizationHeader);
+        if (presented == null) {
+            return false;
+        }
+        // Constant-time: MessageDigest.isEqual does not short-circuit on the first differing byte,
+        // so a token cannot be recovered a byte at a time by timing the response.
+        return MessageDigest.isEqual(presented.getBytes(StandardCharsets.UTF_8), expectedToken);
+    }
+
+    /** Extract the credential from {@code Authorization: Bearer <token>}, or {@code null}. */
+    private static String bearerValue(String header) {
+        if (header == null) {
+            return null;
+        }
+        String h = header.trim();
+        if (h.length() < 7 || !h.regionMatches(true, 0, "Bearer ", 0, 7)) {
+            return null;
+        }
+        String token = h.substring(7).trim();
+        return token.isEmpty() ? null : token;
+    }
+
+    private static boolean isLoopback(String remoteAddr) {
+        if (remoteAddr == null) {
+            return false;
+        }
+        return remoteAddr.equals("127.0.0.1") || remoteAddr.equals("::1")
+                || remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.startsWith("127.");
+    }
+}

bridged/src/main/java/dev/ltms/fleet/auth/MemberLifecycle.java

@@ -0,0 +1,21 @@
+package dev.ltms.fleet.auth;
+
+import dev.ltms.fleet.peer.MemberRole;
+
+/** Optional session lifecycle hook for live member-slot bindings. */
+public interface MemberLifecycle {
+
+    MemberLifecycle NONE = new MemberLifecycle() {
+        @Override
+        public void acquired(MemberRole role, String profile, String terminal) {
+        }
+
+        @Override
+        public void released(String terminal) {
+        }
+    };
+
+    void acquired(MemberRole role, String profile, String terminal);
+
+    void released(String terminal);
+}

bridged/src/main/java/dev/ltms/fleet/auth/MemberRegistry.java

@@ -0,0 +1,232 @@
+package dev.ltms.fleet.auth;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.peer.MemberRole;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Objects;
+
+/**
+ * The architect-slot registry (CB-548): every gateway-local architect name and the strong-model
+ * profile it points at, plus the <em>live</em> bindings from a live architect's herdr terminal to
+ * its slot.
+ *
+ * <p>Two halves, split by who owns each:
+ * <ul>
+ *   <li><b>slots</b> — configured once, keyed by the gateway-local unique name; each carries the
+ *       {@code profile} reference the spawn lifecycle reads when it stands the slot up. A read-only
+ *       snapshot taken at construction.</li>
+ *   <li><b>terminal bindings</b> — owned by this registry and initially <em>empty</em>. Config
+ *       declares no architect terminal, so at startup every slot is idle and nothing resolves to an
+ *       architect; a session only becomes one when the spawn lifecycle {@linkplain #bind(String,
+ *       String) binds} its terminal to a slot. {@link CallerResolver} reads this through
+ *       {@link #snapshot()} to turn a pane into an {@link Role#ARCHITECT}.</li>
+ * </ul>
+ *
+ * <p>Spawning/lifecycle is deliberately a separate unit: this class only owns the bindings and
+ * exposes the map the resolver resolves against plus the profile lookup lifecycle will call.
+ * Nothing here creates or manages an architect session.
+ */
+public final class MemberRegistry implements MemberLifecycle {
+
+    private static final Logger log = LoggerFactory.getLogger(MemberRegistry.class);
+
+    /**
+     * One flattened {@code fleet:} entry.
+     *
+     * <p>Flattened because a slot name is unique only <em>within</em> its pool — {@code sonnet} may
+     * legitimately be both a developer and a reviewer — while a terminal binds to exactly one thing.
+     * The qualified {@link #key()} is what that binding uses.
+     *
+     * @param name    the slot's key inside its pool
+     * @param role    the pool it came from
+     * @param profile the backend it runs on
+     */
+    public record Entry(String name, MemberRole role, String profile) {
+        /** {@code "architect:opus"} — unique across pools, unlike {@link #name()}. */
+        public String key() {
+            return role.wireName() + ":" + name;
+        }
+    }
+
+    private final Map<String, Entry> slots;
+    /** Live {@code terminal_id → qualified slot key}; guarded by {@code this}. */
+    private final Map<String, String> terminalToSlot = new HashMap<>();
+
+    /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
+    public MemberRegistry(FleetConfig.Fleet fleet) {
+        Map<String, Entry> flat = new LinkedHashMap<>();
+        if (fleet != null) {
+            for (MemberRole role : MemberRole.values()) {
+                fleet.pool(role).forEach((name, slot) -> {
+                    if (slot != null) {
+                        Entry e = new Entry(name, role, slot.profile());
+                        flat.put(e.key(), e);
+                    }
+                });
+            }
+        }
+        this.slots = Collections.unmodifiableMap(flat);
+    }
+
+    /** The configured slots, keyed by qualified {@link Entry#key()}. Unmodifiable snapshot. */
+    public Map<String, Entry> slots() {
+        return slots;
+    }
+
+    /** The slots belonging to {@code role}, in definition order. */
+    public Map<String, Entry> slotsFor(MemberRole role) {
+        Map<String, Entry> out = new LinkedHashMap<>();
+        slots.forEach((key, e) -> {
+            if (e.role() == role) {
+                out.put(key, e);
+            }
+        });
+        return Collections.unmodifiableMap(out);
+    }
+
+    /**
+     * An immutable copy of the live {@code terminal_id → slot name} bindings.
+     *
+     * <p>Passed to {@link CallerResolver} as the source of architect identity, and what
+     * {@code fleet_whoami}/the roster will read to say which slot a pane hosts. Empty until the
+     * spawn lifecycle binds a slot.
+     */
+    public Map<String, String> snapshot() {
+        synchronized (terminalToSlot) {
+            return Map.copyOf(terminalToSlot);
+        }
+    }
+
+    /** The slot a live terminal is bound to, or {@code null} if it is not an architect slot. */
+    public String slotForTerminal(String terminal) {
+        if (terminal == null) {
+            return null;
+        }
+        synchronized (terminalToSlot) {
+            return terminalToSlot.get(terminal);
+        }
+    }
+
+    /**
+     * The strong-model profile a slot runs under — what the spawn lifecycle reads.
+     *
+     * @return the slot's configured {@code profile}, or {@code null} if the slot is unknown or
+     *         declares none
+     */
+    public String profileForSlot(String slotName) {
+        Entry e = slots.get(slotName);
+        return (e == null || e.profile() == null) ? null : e.profile();
+    }
+
+    /** The role a qualified slot key belongs to, or {@code null} when the key is unknown. */
+    public MemberRole roleForSlot(String slotName) {
+        Entry e = slots.get(slotName);
+        return e == null ? null : e.role();
+    }
+
+    /** The unqualified configured name for a slot, or {@code null} if it is unknown. */
+    public String nameForSlot(String slotName) {
+        Entry e = slots.get(slotName);
+        return e == null ? null : e.name();
+    }
+
+    /** True when {@code slotName} is a configured architect slot. */
+    public boolean isSlot(String slotName) {
+        return slots.containsKey(slotName);
+    }
+
+    /**
+     * Bind {@code terminal} to {@code slot} (CB-548).
+     *
+     * <p>The spawn lifecycle calls this when it stands a slot up. The bind is atomic and preserves
+     * the two cardinality invariants: a terminal may occupy at most one slot, and a slot may host at
+     * most one terminal. Binding the same terminal to the same slot again is a harmless no-op.
+     *
+     * @param slot     a configured slot name, or the bind is refused
+     * @param terminal the pane that will act as this architect
+     * @return {@code true} if the binding is now {@code terminal → slot}; {@code false} if it was
+     *         refused — an unknown slot, a terminal already bound to a different slot, or a slot
+     *         already hosting a different terminal
+     */
+    public boolean bind(String slot, String terminal) {
+        if (slot == null || terminal == null || terminal.isBlank()) {
+            return false;
+        }
+        synchronized (terminalToSlot) {
+            if (!isSlot(slot)) {
+                return false; // unknown slot — nothing to bind to
+            }
+            String existingSlot = terminalToSlot.get(terminal);
+            if (existingSlot != null) {
+                return slot.equals(existingSlot); // already this slot (idempotent) or a different one
+            }
+            if (terminalToSlot.containsValue(slot)) {
+                return false; // slot already hosts a terminal — no second one
+            }
+            terminalToSlot.put(terminal, slot);
+            return true;
+        }
+    }
+
+    /**
+     * Compare-safe unbind of {@code expectedTerminal} from {@code slot} (CB-548).
+     *
+     * <p>The spawn lifecycle calls this when it tears a slot down. Only the exact binding
+     * {@code expectedTerminal → slot} is removed; if that terminal was since rebound to a different
+     * slot (or the slot to a different terminal), the call is a no-op returning {@code false} — a
+     * stale unbind must never remove a replacement.
+     *
+     * @param slot             the slot the caller believes the terminal is bound to
+     * @param expectedTerminal the terminal it expects to be bound there
+     * @return {@code true} if {@code expectedTerminal → slot} was removed; {@code false} if nothing
+     *         was (no such binding, or the binding had already moved)
+     */
+    public boolean unbind(String slot, String expectedTerminal) {
+        if (slot == null || expectedTerminal == null) {
+            return false;
+        }
+        synchronized (terminalToSlot) {
+            String current = terminalToSlot.get(expectedTerminal);
+            if (current == null || !slot.equals(current)) {
+                return false; // absent, or a replacement/moved binding — leave it in place
+            }
+            terminalToSlot.remove(expectedTerminal);
+            return true;
+        }
+    }
+
+    /**
+     * Bind only architect sessions to a free slot with the resolved profile.
+     *
+     * <p>The role check is lifecycle policy. {@link CallerResolver} repeats it when resolving a
+     * binding, so a later lifecycle regression cannot turn a worker into an architect.
+     */
+    @Override
+    public void acquired(MemberRole role, String profile, String terminal) {
+        if (role != MemberRole.ARCHITECT || terminal == null || terminal.isBlank()) {
+            return;
+        }
+        // slotsFor preserves definition order, so duplicate-profile slots use the first free one.
+        for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
+            if (Objects.equals(profile, entry.profile()) && bind(entry.key(), terminal)) {
+                return;
+            }
+        }
+        log.info("member slot: no free architect slot for profile={}; session remains a worker", profile);
+    }
+
+    /** Unbind a released terminal using the compare-safe registry operation. */
+    @Override
+    public void released(String terminal) {
+        String slot = slotForTerminal(terminal);
+        if (slot != null) {
+            unbind(slot, terminal);
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/auth/Principal.java

@@ -0,0 +1,127 @@
+package dev.ltms.fleet.auth;
+
+/**
+ * A resolved caller: its {@link Role}, and — for a worker — the herdr {@code terminal_id} that
+ * identifies which worker it is (CB-501).
+ *
+ * @param role     what this caller is authorized to act as
+ * @param terminal the herdr {@code terminal_id} of the pane this caller occupies — a worker's, or
+ *                 (since CB-532) a named lead's; {@code null} for an unnamed primary resolved off a
+ *                 token or loopback trust, and for {@code ANONYMOUS}
+ * @param pid      the connecting process id, or {@code -1} when not resolvable (audit context)
+ * @param name     for a lead resolved from the CB-530 {@code leaders:} registry, which lead it is;
+ *                 for an architect resolved from the CB-548 {@code architects:} registry, which
+ *                 slot it occupies; {@code null} for every other caller, including an unnamed primary
+ */
+public record Principal(Role role, String terminal, long pid, String name) {
+
+    /**
+     * Three-arg form for the callers that have no name to carry (workers, anonymous, and the
+     * token/loopback primary paths). Kept so adding CB-530's {@code name} did not churn every
+     * construction site — and so a reconstructed principal without a stashed name still works.
+     */
+    public Principal(Role role, String terminal, long pid) {
+        this(role, terminal, pid, null);
+    }
+
+    /** A caller authenticated as nothing — the default when no check establishes anything else. */
+    public static Principal anonymous() {
+        return new Principal(Role.ANONYMOUS, null, -1);
+    }
+
+    /** The orchestrating session, unnamed (token or loopback-trust path). */
+    public static Principal primary(long pid) {
+        return new Principal(Role.PRIMARY, null, pid);
+    }
+
+    /**
+     * A named lead from the {@code leaders:} registry (CB-530).
+     *
+     * <p>Carries {@link Role#PRIMARY}: a lead <em>is</em> a primary as far as authorization goes,
+     * so every existing {@code isPrimary()} gate keeps working unchanged and the role table needed
+     * no new entry. The name is reporting only — it lets {@code fleet_whoami} say <em>which</em>
+     * lead is asking once more than one is configured.
+     *
+     * <p><strong>CB-532: a lead now carries the terminal it was matched by.</strong> Under CB-530 it
+     * deliberately did not, because {@code terminal} meant "which worker pane" everywhere and a
+     * non-null one would have enrolled the lead in the worker presence map. That reading was what
+     * made a lead unaddressable: {@link #ownsSession} could never be true for it, so
+     * {@code fleet_reply} was refused and one lead could send to another but never be answered.
+     * The terminal now means "which pane is this caller", the presence map keys on
+     * {@link #isSpawnedMember()} instead, and a lead is a peer that can both send and receive.
+     */
+    public static Principal leader(String name, String terminal, long pid) {
+        return new Principal(Role.PRIMARY, terminal, pid, name);
+    }
+
+    /** A worker peer, identified by its herdr pane. */
+    public static Principal worker(String terminal, long pid) {
+        return new Principal(Role.WORKER, terminal, pid);
+    }
+
+    /**
+     * An architect (CB-548), identified by the slot it occupies and the pane bound to it.
+     *
+     * <p>Carries {@link Role#ARCHITECT}. {@code slotName} is reporting only — it lets
+     * {@code fleet_whoami} say <em>which</em> architect slot is asking, and it is the key the
+     * (future) spawn lifecycle reads a profile back from. Identity is the {@code terminal}: like a
+     * worker's it comes from the connection and the live terminal→slot binding, so
+     * {@code ownsSession} works exactly as it does for a worker — an architect acts as its own
+     * pane and no other.
+     */
+    public static Principal architect(String slotName, String terminal, long pid) {
+        return new Principal(Role.ARCHITECT, terminal, pid, slotName);
+    }
+
+    public boolean isPrimary() {
+        return role == Role.PRIMARY;
+    }
+
+    public boolean isArchitect() {
+        return role == Role.ARCHITECT;
+    }
+
+    public boolean isWorker() {
+        return role == Role.WORKER;
+    }
+
+    /**
+     * Whether this caller is a spawned member with its own pane.
+     *
+     * <p>Both workers and architects are spawned members. A lead is excluded because recording it
+     * as present would count it as an available member in the roster.
+     */
+    public boolean isSpawnedMember() {
+        return role == Role.WORKER || role == Role.ARCHITECT;
+    }
+
+    public boolean isAnonymous() {
+        return role == Role.ANONYMOUS;
+    }
+
+    /**
+     * Whether this caller may act <em>as</em> {@code sessionId} — the "own session only" rule that
+     * keeps one peer from replying or asking on another's behalf.
+     *
+     * <p>The rule is about <em>identity</em>, not rank: a caller may act as the pane it demonstrably
+     * occupies, and as no other. CB-532 dropped the extra {@code isWorker()} conjunct that used to
+     * be here. It was not what enforced the rule — {@code terminal.equals(sessionId)} is, and that
+     * terminal comes from the connection, so it cannot be forged either way. All the conjunct did
+     * was make a lead permanently unable to answer anyone, since a lead's terminal was null and a
+     * lead is not a worker. A caller with no terminal at all (an off-host or token-authenticated
+     * primary) still owns nothing, which is the case the null check covers.
+     */
+    public boolean ownsSession(String sessionId) {
+        return terminal != null && terminal.equals(sessionId);
+    }
+
+    /** Short, non-sensitive description for audit lines and error details. */
+    public String describe() {
+        return switch (role) {
+            case WORKER -> "worker:" + terminal;
+            case ARCHITECT -> "architect:" + name;
+            case PRIMARY -> name == null ? "primary" : "leader:" + name;
+            case ANONYMOUS -> "anonymous";
+        };
+    }
+}

bridged/src/main/java/dev/ltms/fleet/auth/Role.java

@@ -0,0 +1,39 @@
+package dev.ltms.fleet.auth;
+
+/**
+ * What a caller is allowed to be on the bus (CB-501).
+ *
+ * <p>The ordering matters conceptually: {@link #PRIMARY} is the <em>most</em> privileged role
+ * (it spawns, stops, sends to any session, and drains any inbox), not the least. Before CB-501
+ * the daemon reached {@code PRIMARY} by <em>failing</em> every other check — any caller that did
+ * not resolve to a known worker pane was treated as the primary. That is inverted here:
+ * {@link #ANONYMOUS} is the fallback, and {@code PRIMARY} must be established.
+ */
+public enum Role {
+
+    /**
+     * The orchestrating session. Established either by being a loopback caller that is not a
+     * worker pane (under {@code loopback-trust}) or by presenting a valid bearer token (under
+     * {@code token} mode).
+     */
+    PRIMARY,
+
+    /**
+     * A worker peer, identified by its herdr pane. Unforgeable: derived from the connection's
+     * loopback peer PID via herdr's PID→pane map, never from a request argument.
+     */
+    WORKER,
+
+    /**
+     * A config-declared architect slot (CB-548): a gateway-local named session on a strong-model
+     * profile that coordinates and delegates turns but does not own the fleet. Unforgeable like a
+     * worker's — derived from the connection's pane and the live terminal→slot binding, never from
+     * a request argument. May {@code SEND} a turn, {@code REPLY}/{@code ASK} only as its own pane,
+     * and {@code READ}/{@code METRICS}; may <em>not</em> {@code SPAWN}/{@code STOP}/{@code DRAIN}
+     * (those stay the primary's, to keep lifecycle in one pair of hands).
+     */
+    ARCHITECT,
+
+    /** Authenticated as nothing. Authorized for nothing but {@code /healthz}. */
+    ANONYMOUS
+}

bridged/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -0,0 +1,294 @@
+package dev.ltms.fleet.config;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Supplier;
+
+/**
+ * The daemon's live configuration, re-readable without a restart (CB-559).
+ *
+ * <p>Consumers hold this, not a {@link FleetConfig}, and read through {@link #get()} at the point
+ * of use. A component that captures {@code ref.get()} into a field at construction has opted out of
+ * reload — which is sometimes right (see <em>deferred</em> below), but it must then be a deliberate
+ * choice rather than an accident of where the field was initialised.
+ *
+ * <h2>Not every key can change under a running daemon</h2>
+ * Keys fall into three classes, and the difference is about what already exists when the reload
+ * happens — not about how important the key is.
+ *
+ * <ul>
+ *   <li><strong>Hot</strong> — re-read per use, so a reload takes effect on the next spawn:
+ *       {@code fleet:} (every role pool, {@code charters}, and {@code tabLabel}),
+ *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those
+ *       three are read through a supplier on {@code CompositePeerLauncher}, which is what makes
+ *       them hot — not the fact that they are config. <strong>This does NOT include
+ *       {@code fleet.leaders}</strong>: {@code Fleetd.main} reads {@code cfg.fleet().leaders()}
+ *       once at startup to build the {@code LeadTabScanner} and the {@code LeadLauncher}, and
+ *       neither is reconstructed on reload — so a lead added, removed, or re-{@code tab}'d under
+ *       {@code fleet.leaders} needs a restart, the same as any deferred key below.</li>
+ *   <li><strong>Deferred</strong> — accepted into the new snapshot, but the wiring built at startup
+ *       keeps the old value until a restart: {@code lifecycle:}, {@code leadHeartbeat:},
+ *       {@code spawnReadyTimeoutMs} / {@code spawnReadyPollMs}, {@code quarantineCooldownSeconds}
+ *       (CB-578 stage B — baked once into the {@code BackendQuarantine} built at startup),
+ *       {@code guard:}, {@code worktreeRoot:}, adding or removing a profile (a new backend needs its own launcher,
+ *       which is constructed once), <em>and an existing profile's launch settings</em> —
+ *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
+ *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
+ *       pattern map at startup), and the rest. {@code credentialId} (CB-578 stage B) is NOT on
+ *       this list — it is read live off the config supplier at every quarantine check and
+ *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
+ *       {@code HerdrPeerLauncher} takes {@code Map.copyOf(profiles)} at construction and resolves
+ *       each spawn out of that copy, so those never reach a launch until the daemon restarts. A
+ *       reload logs these rather than pretending they applied.</li>
+ *   <li><strong>Cold</strong> — cannot change at all under a running daemon: {@code bind:},
+ *       {@code herdrSocket:}, {@code broker:} and {@code auth:}. The socket is bound, the broker
+ *       connection is open, and the auth mode decides who may reach the port that is already
+ *       listening.</li>
+ * </ul>
+ *
+ * <p><strong>A cold change refuses the whole reload.</strong> Not the hot half applied and the cold
+ * half warned about: that would leave the running daemon in a state matching no file on disk, which
+ * is the worst thing a reload can do to an operator debugging one. Refusing keeps the invariant that
+ * the live config is always some version of the file, and the message names the keys that must
+ * change through a restart.
+ *
+ * <p>A reload that fails to parse or fails validation is also refused, and the previous config keeps
+ * running. A config file being edited is normally read once mid-save; degrading a working daemon
+ * because it caught a half-written file would be a bad trade.
+ */
+public final class ConfigRef implements Supplier<FleetConfig> {
+
+    private static final Logger log = LoggerFactory.getLogger(ConfigRef.class);
+
+    /** Keys that cannot change under a running daemon — see the class doc. */
+    private static final Set<String> COLD_KEYS =
+            Set.of("bind", "herdrSocket", "broker", "auth");
+
+    private final Path path;
+    private final AtomicReference<FleetConfig> current;
+
+    public ConfigRef(Path path, FleetConfig initial) {
+        this.path = path;
+        this.current = new AtomicReference<>(Objects.requireNonNull(initial, "initial config"));
+    }
+
+    /** A fixed reference that never reloads — for tests and for wiring built from a config in code. */
+    public static ConfigRef fixed(FleetConfig cfg) {
+        return new ConfigRef(null, cfg);
+    }
+
+    /** The live configuration. Read this per use; do not cache it in a field. */
+    @Override
+    public FleetConfig get() {
+        return current.get();
+    }
+
+    /** The file this ref reloads from, or {@code null} for a {@link #fixed} ref. */
+    public Path path() {
+        return path;
+    }
+
+    /**
+     * What a reload attempt did.
+     *
+     * @param applied  true when the new config is now live
+     * @param coldKeys cold keys whose value changed, which is why an unapplied reload was refused
+     * @param deferred keys that changed and were accepted, but whose effect waits for a restart
+     * @param error    the parse or validation failure that refused the reload, else {@code null}
+     */
+    public record Outcome(boolean applied, List<String> coldKeys, List<String> deferred,
+                          String error) {
+
+        public Outcome {
+            coldKeys = List.copyOf(coldKeys);
+            deferred = List.copyOf(deferred);
+        }
+
+        static Outcome refusedCold(List<String> keys) {
+            return new Outcome(false, keys, List.of(), null);
+        }
+
+        static Outcome failed(String error) {
+            return new Outcome(false, List.of(), List.of(), error);
+        }
+
+        /** A one-line summary for the operator — the reason, not just the verdict. */
+        public String summary() {
+            if (error != null) {
+                return "config reload refused — " + error;
+            }
+            if (!applied) {
+                return "config reload refused — these keys cannot change under a running daemon: "
+                        + String.join(", ", coldKeys) + ". Restart bridged to apply them.";
+            }
+            if (!deferred.isEmpty()) {
+                return "config reloaded; these changes need a restart to take effect: "
+                        + String.join(", ", deferred);
+            }
+            return "config reloaded";
+        }
+    }
+
+    /**
+     * Re-read the file, validate it, and swap it in when nothing cold changed.
+     *
+     * <p>Never throws: a reload is a best-effort operation on a daemon that is already serving, and
+     * a bad edit must not take it down. Every failure path leaves the previous config live and is
+     * reported through the returned {@link Outcome}.
+     */
+    public Outcome reload() {
+        if (path == null) {
+            return Outcome.failed("this config was built in code and has no file to reload from");
+        }
+        FleetConfig old = current.get();
+        FleetConfig fresh;
+        try {
+            fresh = FleetConfig.load(path);
+            // The same gate startup runs. A config that would have refused to boot must not be able
+            // to slip in through a reload — that is how a daemon ends up in a state it could never
+            // have started in, which is the hardest kind to debug.
+            fresh.validateAuthExposure();
+            fresh.validateLeadTabPrefixes();
+            fresh.validateSubscriptionProfiles();
+            fresh.validateCharters();
+            fresh.validateMembers();
+        } catch (RuntimeException e) {
+            String msg = e.getMessage() == null ? e.toString() : e.getMessage();
+            log.warn("config reload from {} refused, keeping the running config: {}", path, msg);
+            return Outcome.failed(msg);
+        }
+
+        List<String> cold = changedColdKeys(old, fresh);
+        if (!cold.isEmpty()) {
+            Outcome out = Outcome.refusedCold(cold);
+            log.warn(out.summary());
+            return out;
+        }
+
+        List<String> deferred = changedDeferredKeys(old, fresh);
+        current.set(fresh);
+        Outcome out = new Outcome(true, List.of(), deferred, null);
+        log.info(out.summary());
+        return out;
+    }
+
+    /** Cold keys whose value differs between the running config and the candidate. */
+    private static List<String> changedColdKeys(FleetConfig old, FleetConfig fresh) {
+        List<String> changed = new ArrayList<>();
+        if (!Objects.equals(old.bind(), fresh.bind())) {
+            changed.add("bind");
+        }
+        if (!Objects.equals(old.herdrSocket(), fresh.herdrSocket())) {
+            changed.add("herdrSocket");
+        }
+        if (!Objects.equals(old.broker(), fresh.broker())) {
+            changed.add("broker");
+        }
+        if (!Objects.equals(old.auth(), fresh.auth())) {
+            changed.add("auth");
+        }
+        // Kept in step with COLD_KEYS so the doc and the code cannot drift apart silently.
+        assert COLD_KEYS.containsAll(changed) : "a cold key was reported that COLD_KEYS omits";
+        return changed;
+    }
+
+    /** Changed keys that were accepted but whose effect waits for a restart. */
+    private static List<String> changedDeferredKeys(FleetConfig old, FleetConfig fresh) {
+        List<String> changed = new ArrayList<>();
+        if (!Objects.equals(old.lifecycle(), fresh.lifecycle())) {
+            changed.add("lifecycle");
+        }
+        if (!Objects.equals(old.leadHeartbeat(), fresh.leadHeartbeat())) {
+            changed.add("leadHeartbeat");
+        }
+        if (!Objects.equals(old.guard(), fresh.guard())) {
+            changed.add("guard");
+        }
+        if (!Objects.equals(old.worktreeRoot(), fresh.worktreeRoot())) {
+            changed.add("worktreeRoot");
+        }
+        if (!Objects.equals(old.spawnReadyTimeoutMs(), fresh.spawnReadyTimeoutMs())
+                || !Objects.equals(old.spawnReadyPollMs(), fresh.spawnReadyPollMs())) {
+            changed.add("spawnReady*");
+        }
+        // CB-578 stage B: baked once into the BackendQuarantine built at startup — a running
+        // quarantine keeps its original cooldown regardless, and a new cooldown only applies to a
+        // quarantine that starts after a restart.
+        if (!Objects.equals(old.quarantineCooldownSeconds(), fresh.quarantineCooldownSeconds())) {
+            changed.add("quarantineCooldownSeconds");
+        }
+        Map<String, FleetConfig.Profile> before =
+                old.profiles() == null ? Map.of() : old.profiles();
+        Map<String, FleetConfig.Profile> after =
+                fresh.profiles() == null ? Map.of() : fresh.profiles();
+        // Adding or removing a profile is deferred: a new backend needs its own launcher, and
+        // launchers are built once at startup.
+        if (!before.keySet().equals(after.keySet())) {
+            Set<String> diff = new LinkedHashSet<>(before.keySet());
+            diff.addAll(after.keySet());
+            diff.removeIf(p -> before.containsKey(p) && after.containsKey(p));
+            changed.add("profiles (added/removed: " + String.join(", ", diff) + ")");
+        }
+        // An EXISTING profile's launch settings are deferred too, and this is easy to get wrong:
+        // `HerdrPeerLauncher` takes `Map.copyOf(profiles)` at construction and `spawn` resolves the
+        // profile out of that snapshot, so a reloaded model/baseUrl/argv/env never reaches a launch.
+        // Only weight and maxLoad are genuinely hot, because placement reads them through the
+        // supplier on the composite rather than from the adapter's copy. Without this check a
+        // changed model would report "config reloaded" and silently do nothing — the worst outcome
+        // a reload can produce, because the operator has no reason to doubt it.
+        List<String> relaunch = new ArrayList<>();
+        before.forEach((name, was) -> {
+            FleetConfig.Profile now = after.get(name);
+            if (now != null && !sameLaunchSettings(was, now)) {
+                relaunch.add(name);
+            }
+        });
+        if (!relaunch.isEmpty()) {
+            changed.add("profiles." + String.join("/", relaunch) + " launch settings "
+                    + "(model, baseUrl, argv, env, …) — the launcher holds a startup snapshot");
+        }
+        return changed;
+    }
+
+    /**
+     * Whether two versions of a profile would launch a peer identically. Compares every component
+     * the launcher reads at spawn; {@code weight}, {@code maxLoad} and {@code credentialId} are
+     * excluded because those are read live (by the placement policy and, for credentialId, by
+     * {@code CompositePeerLauncher}/the CB-578 stage B exhaustion sink) and really do take effect on
+     * the next spawn.
+     */
+    private static boolean sameLaunchSettings(FleetConfig.Profile a, FleetConfig.Profile b) {
+        return Objects.equals(a.baseUrl(), b.baseUrl())
+                && Objects.equals(a.model(), b.model())
+                && Objects.equals(a.configDir(), b.configDir())
+                && Objects.equals(a.tokenEnv(), b.tokenEnv())
+                && Objects.equals(a.argv(), b.argv())
+                && Objects.equals(a.placement(), b.placement())
+                && Objects.equals(a.workspace(), b.workspace())
+                && Objects.equals(a.tabLabel(), b.tabLabel())
+                && Objects.equals(a.mcpUrl(), b.mcpUrl())
+                // CB-634: the IDE MCP mount is a launch flag, fixed at spawn like mcpUrl — a
+                // reload changes it only for members spawned after, so a changed value is deferred.
+                && Objects.equals(a.ideMcpUrl(), b.ideMcpUrl())
+                && Objects.equals(a.cwd(), b.cwd())
+                && Objects.equals(a.parityOverlay(), b.parityOverlay())
+                && Objects.equals(a.gitTokenEnv(), b.gitTokenEnv())
+                && Objects.equals(a.gitHostEnv(), b.gitHostEnv())
+                && Objects.equals(a.kind(), b.kind())
+                && Objects.equals(a.env(), b.env())
+                && Objects.equals(a.subscription(), b.subscription())
+                // CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map
+                // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
+                // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
+                && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern());
+    }
+}

bridged/src/main/java/dev/ltms/fleet/config/ConfigWatcher.java

@@ -0,0 +1,96 @@
+package dev.ltms.fleet.config;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+
+/**
+ * Polls {@code bridged.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
+ * (CB-559). Opt-in through {@code configReload.enabled}.
+ *
+ * <p><strong>Why polling and not a filesystem watch.</strong> {@code WatchService} on macOS has no
+ * native backend — it falls back to polling internally anyway, at an interval this code does not
+ * control — and editors save config files in ways that produce a different event mix per editor
+ * (write-in-place, write-and-rename, write-temp-and-swap). A modified-time check treats all of them
+ * the same and is a single {@code stat} per tick, which at a ten-second cadence costs nothing worth
+ * measuring.
+ *
+ * <p><strong>A missing or unreadable file is not a reason to act.</strong> Many editors briefly
+ * unlink the file during a save. Reloading on "it vanished" would mean reloading from a file that no
+ * longer exists; reporting an error every tick would bury the log. So an unreadable file is skipped
+ * silently and the next tick tries again — the running config stays live, which is the correct
+ * outcome either way.
+ */
+public final class ConfigWatcher {
+
+    private static final Logger log = LoggerFactory.getLogger(ConfigWatcher.class);
+
+    private final ConfigRef ref;
+    private final long intervalSeconds;
+    private final ScheduledExecutorService scheduler;
+
+    private volatile long lastSeenMillis;
+
+    public ConfigWatcher(ConfigRef ref, long intervalSeconds) {
+        this.ref = ref;
+        this.intervalSeconds = intervalSeconds;
+        this.lastSeenMillis = modifiedMillis(ref.path());
+        this.scheduler = Executors.newSingleThreadScheduledExecutor(r -> {
+            Thread t = new Thread(r, "config-watcher");
+            // A daemon thread: an operator's config watch must never be the reason the JVM refuses
+            // to exit after everything else has shut down.
+            t.setDaemon(true);
+            return t;
+        });
+    }
+
+    /** Begin watching. A ref with no file (a fixed one) is a no-op rather than an error. */
+    public void start() {
+        if (ref.path() == null) {
+            log.debug("config watch not started — this config has no file behind it");
+            return;
+        }
+        scheduler.scheduleWithFixedDelay(this::tick, intervalSeconds, intervalSeconds,
+                TimeUnit.SECONDS);
+        log.info("config watch: {} re-read when it changes (every {}s)", ref.path(), intervalSeconds);
+    }
+
+    /** One poll. Never throws — an exception here would silently cancel the schedule. */
+    void tick() {
+        try {
+            long now = modifiedMillis(ref.path());
+            if (now == 0 || now == lastSeenMillis) {
+                return;
+            }
+            // Stamp BEFORE reloading. A file whose reload is refused (a bad edit, or a cold key)
+            // must not be retried every tick — that would log the same refusal forever. The next
+            // save moves the timestamp again and earns a fresh attempt.
+            lastSeenMillis = now;
+            ref.reload();
+        } catch (RuntimeException e) {
+            log.warn("config watch tick failed, still watching: {}", e.getMessage());
+        }
+    }
+
+    private static long modifiedMillis(Path path) {
+        if (path == null) {
+            return 0;
+        }
+        try {
+            return Files.getLastModifiedTime(path).toMillis();
+        } catch (IOException e) {
+            return 0; // mid-save, or gone: say nothing and try again next tick
+        }
+    }
+
+    /** Stop polling. Called from the daemon's ordered shutdown hook, alongside the other loops. */
+    public void stop() {
+        scheduler.shutdownNow();
+    }
+}

bridged/src/main/java/dev/ltms/fleet/guard/GuardException.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;
 
 /** Thrown when the subscription boundary would be violated. Never swallow this. */
 public class GuardException extends RuntimeException {

bridged/src/main/java/dev/ltms/fleet/guard/SubscriptionGuard.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;
 
 import java.net.URI;
 import java.net.URISyntaxException;

bridged/src/main/java/dev/ltms/fleet/health/FleetHealth.java

@@ -0,0 +1,40 @@
+package dev.ltms.fleet.health;
+
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;
+
+/**
+ * Pure classifier. Collection and repair are deliberately outside this package.
+ * {@link HealthState#ERROR_ON_SCREEN} is not decided yet because it needs a bounded pane detection
+ * read and an adapter-specific fatal signature; status facts alone must not guess it.
+ */
+public final class FleetHealth {
+    private FleetHealth() { }
+
+    public static HealthDecision decide(HealthSnapshot s, HealthPrior prior, long nowNanos) {
+        if (s.controlLinkDown()) return result(HealthState.CONTROL_LINK_DOWN, false);
+        if (s.targetNotFound()) return result(HealthState.GONE, false);
+        if (s.sessionState() == MemberSession.State.SPAWNING && !s.present() && s.readinessGraceElapsed()) {
+            return result(HealthState.NEVER_READY, false);
+        }
+        if (s.orphanedDelegation()) return result(HealthState.DELEGATION_ORPHANED, false);
+        boolean disagreement = s.sessionState() == MemberSession.State.BUSY && s.acceptedDelivery()
+                && (s.liveStatus() == AgentStatus.IDLE || s.liveStatus() == AgentStatus.DONE);
+        if (disagreement && prior.busyButDone()) return result(HealthState.TURN_BOUNDARY_LOST, true);
+        if (s.stalled()) return result(HealthState.STALL_SUSPECTED, disagreement);
+        if (s.replyStranded()) return result(HealthState.REPLY_STRANDED, disagreement);
+        if (s.queuedDelivery() || s.inboxMessage()) return result(HealthState.WORK_PENDING, disagreement);
+        if (s.sessionState() == MemberSession.State.SPAWNING) return result(HealthState.STARTING, disagreement);
+        if (s.acceptedDelivery() && s.liveStatus() == AgentStatus.BLOCKED) {
+            return result(HealthState.BLOCKED_AMBIGUOUS, disagreement);
+        }
+        // An accepted delivery remains bridge work even when herdr is late, unknown, or has already
+        // reported DONE once. It cannot be IDLE until the delegation has resolved.
+        if (s.acceptedDelivery()) return result(HealthState.WORKING, disagreement);
+        return result(HealthState.IDLE, disagreement);
+    }
+
+    private static HealthDecision result(HealthState state, boolean disagreement) {
+        return new HealthDecision(state, new HealthPrior(disagreement));
+    }
+}

bridged/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -0,0 +1,151 @@
+package dev.ltms.fleet.health;
+
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.session.MemberSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.function.BiConsumer;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/** Slow whole-fleet evidence collection. It is deliberately separate from the delivery poller. */
+public final class FleetHealthMonitor {
+    private static final Logger log = LoggerFactory.getLogger(FleetHealthMonitor.class);
+
+    /** Bounded attempts to run {@link #failTarget} for one transition. Never retried tick-to-tick (CB-580). */
+    static final int MAX_FAIL_TARGET_ATTEMPTS = 3;
+
+    private final AgentControl agents;
+    private final Supplier<List<MemberSession>> roster;
+    private final MessageService messages;
+    private final ScheduledExecutorService scheduler;
+    private final LongSupplier clock;
+    private final long intervalSeconds;
+    private final BiConsumer<String, String> failTarget;
+    private final Map<String, HealthPrior> priors = new HashMap<>();
+    private final Map<String, HealthState> states = new HashMap<>();
+
+    // These facts need the evidence publishers introduced by later M4 units. They are not negatives.
+    private static final boolean NOT_YET_OBSERVED = false;
+
+    /**
+     * @param failTarget CB-568's idempotent target-wide failure operation (e.g. {@code messages::abandon}),
+     *                   invoked once when a member transitions into a terminal health state. Required —
+     *                   there is deliberately no defaulting overload; a caller that does not want the
+     *                   fail-tickets-on-terminal-health behavior must pass an explicit inert value (see
+     *                   {@code TestTurnTokens.inert} / {@code FleetMcp.CapacitySource.none()} for the pattern).
+     */
+    public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
+                              ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
+                              BiConsumer<String, String> failTarget) {
+        this.agents = agents;
+        this.roster = roster;
+        this.messages = messages;
+        this.scheduler = scheduler;
+        this.clock = clock;
+        this.intervalSeconds = intervalSeconds;
+        this.failTarget = Objects.requireNonNull(failTarget, "failTarget");
+    }
+
+    /** Pure per-member decision seam. */
+    static HealthDecision decide(HealthSnapshot snapshot, HealthPrior prior, long nowNanos) {
+        return FleetHealth.decide(snapshot, prior, nowNanos);
+    }
+
+    public void start() { scheduler.schedule(this::tick, intervalSeconds, TimeUnit.SECONDS); }
+    public void stop() { scheduler.shutdownNow(); }
+
+    // Package-private so tests can run one tick without waiting.
+    void tick() {
+        try {
+            List<Agent> agentsNow = agents.list(); // Exactly one list call for this complete observation.
+            List<MemberSession> rosterNow = roster.get(); // One in-memory roster snapshot for this tick.
+            Map<String, Agent> live = new HashMap<>();
+            for (Agent agent : agentsNow) live.put(agent.terminalId(), agent);
+            HashSet<String> current = new HashSet<>();
+            for (MemberSession session : rosterNow) {
+                current.add(session.terminalId());
+                Agent agent = live.get(session.terminalId());
+                AgentStatus status = agent == null ? AgentStatus.UNKNOWN : agent.status();
+                boolean accepted = messages.hasAcceptedDelivery(session.terminalId());
+                HealthSnapshot snapshot = new HealthSnapshot(session.state(), status, accepted, NOT_YET_OBSERVED,
+                        messages.hasInboxMessage(session.terminalId()), agent != null, NOT_YET_OBSERVED,
+                        NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED);
+                HealthDecision decision = decide(snapshot, priors.getOrDefault(session.terminalId(), HealthPrior.NONE),
+                        clock.getAsLong());
+                priors.put(session.terminalId(), decision.prior());
+                reportTransition(session.terminalId(), decision.state());
+            }
+            priors.keySet().retainAll(current);
+            states.keySet().retainAll(current);
+        } catch (Throwable error) {
+            // A list failure is health evidence, and must never kill the monitor's only scheduler task.
+            log.warn("fleet health collection failed; will retry next tick", error);
+        } finally {
+            if (!scheduler.isShutdown()) {
+                scheduler.schedule(this::tick, intervalSeconds, TimeUnit.SECONDS);
+            }
+        }
+    }
+
+    void reportTransition(String target, HealthState next) {
+        HealthState previous = states.put(target, next);
+        if (previous == next) return;
+        if (fault(next)) {
+            log.warn("fleet health member={} state={} previous={}", target, next, previous);
+        } else if (previous != null && fault(previous)) {
+            log.info("fleet health member={} recovered state={} previous={}", target, next, previous);
+        }
+        // CB-580: a member entering GONE/NEVER_READY must not leave its waiting tickets pending
+        // forever. Fire exactly once per transition — never on a tick where the state is unchanged,
+        // which is what made the rejected commit call abandon() once per tick for as long as a
+        // member stayed terminal.
+        if (terminal(next)) {
+            failTerminalTarget(target, next);
+        }
+    }
+
+    private void failTerminalTarget(String target, HealthState state) {
+        String reason = "fleet health: member reached terminal state " + state.name();
+        RuntimeException last = null;
+        for (int attempt = 1; attempt <= MAX_FAIL_TARGET_ATTEMPTS; attempt++) {
+            try {
+                failTarget.accept(target, reason);
+                return;
+            } catch (RuntimeException error) {
+                last = error;
+                log.warn("fleet health: failTarget attempt {}/{} failed for member={} state={}",
+                        attempt, MAX_FAIL_TARGET_ATTEMPTS, target, state, error);
+            }
+        }
+        log.warn("fleet health: giving up on failTarget for member={} state={} after {} attempts",
+                target, state, MAX_FAIL_TARGET_ATTEMPTS, last);
+    }
+
+    private static boolean terminal(HealthState state) {
+        return state == HealthState.GONE || state == HealthState.NEVER_READY;
+    }
+
+    private static boolean fault(HealthState state) {
+        return switch (state) {
+            case NEVER_READY, GONE, TURN_BOUNDARY_LOST, ERROR_ON_SCREEN, STALL_SUSPECTED,
+                    MUTE, REPLY_STRANDED, DELEGATION_ORPHANED, CONTROL_LINK_DOWN -> true;
+            default -> false;
+        };
+    }
+
+    public static String coverage(boolean enabled, boolean notificationConfigured) {
+        return !enabled ? "off" : notificationConfigured ? "full" : "detection-only";
+    }
+}

bridged/src/main/java/dev/ltms/fleet/health/HealthDecision.java

@@ -0,0 +1,4 @@
+package dev.ltms.fleet.health;
+
+/** Classification plus the private fact that the next pure decision needs. */
+public record HealthDecision(HealthState state, HealthPrior prior) { }

bridged/src/main/java/dev/ltms/fleet/health/HealthPrior.java

@@ -0,0 +1,6 @@
+package dev.ltms.fleet.health;
+
+/** Private cross-tick observation. It is deliberately not a reported health value. */
+public record HealthPrior(boolean busyButDone) {
+    public static final HealthPrior NONE = new HealthPrior(false);
+}

bridged/src/main/java/dev/ltms/fleet/health/HealthSnapshot.java

@@ -0,0 +1,11 @@
+package dev.ltms.fleet.health;
+
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;
+
+/** Read-only facts from one fleet collection tick. */
+public record HealthSnapshot(MemberSession.State sessionState, AgentStatus liveStatus,
+                             boolean acceptedDelivery, boolean queuedDelivery, boolean inboxMessage,
+                             boolean present, boolean targetNotFound, boolean controlLinkDown,
+                             boolean readinessGraceElapsed, boolean orphanedDelegation,
+                             boolean replyStranded, boolean stalled) { }

bridged/src/main/java/dev/ltms/fleet/health/HealthState.java

@@ -0,0 +1,8 @@
+package dev.ltms.fleet.health;
+
+/** Health classifications reported for a member. */
+public enum HealthState {
+    STARTING, IDLE, WORKING, WORK_PENDING, BLOCKED_AMBIGUOUS,
+    NEVER_READY, GONE, TURN_BOUNDARY_LOST, ERROR_ON_SCREEN, STALL_SUSPECTED,
+    MUTE, REPLY_STRANDED, DELEGATION_ORPHANED, CONTROL_LINK_DOWN
+}

bridged/src/main/java/dev/ltms/fleet/health/MuteCounter.java

@@ -0,0 +1,25 @@
+package dev.ltms.fleet.health;
+
+import dev.ltms.fleet.msg.Rendezvous;
+
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Counts turns that ended via the completion fallback instead of {@code fleet_reply}.
+ * MUTE is an observation by target and profile, not a classifier state and never suppresses faults.
+ */
+public final class MuteCounter {
+    private final Map<String, Integer> byTarget = new ConcurrentHashMap<>();
+    private final Map<String, Integer> byProfile = new ConcurrentHashMap<>();
+
+    /** Record only fallback completion; a structured reply does not make a member mute. */
+    public void observe(String target, String profile, Rendezvous.Kind kind) {
+        if (kind != Rendezvous.Kind.COMPLETION) return;
+        byTarget.merge(target, 1, Integer::sum);
+        byProfile.merge(profile, 1, Integer::sum);
+    }
+
+    public int forTarget(String target) { return byTarget.getOrDefault(target, 0); }
+    public int forProfile(String profile) { return byProfile.getOrDefault(profile, 0); }
+}

bridged/src/main/java/dev/ltms/fleet/health/PaneBudget.java

@@ -0,0 +1,26 @@
+package dev.ltms.fleet.health;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/** Fixed pane-probe limits. Pane content is never retained here. */
+public final class PaneBudget {
+    public static final long COOLDOWN_NANOS = 60_000_000_000L;
+    public static final int MAX_PER_TICK = 2;
+    private final Map<String, Long> lastProbe = new HashMap<>();
+    private int cursor;
+
+    public List<String> choose(List<String> candidates, long nowNanos, long configuredCooldownNanos) {
+        long cooldown = Math.max(COOLDOWN_NANOS, configuredCooldownNanos);
+        List<String> out = new ArrayList<>();
+        for (int n = 0; n < candidates.size() && out.size() < MAX_PER_TICK; n++) {
+            String target = candidates.get((cursor + n) % candidates.size());
+            Long last = lastProbe.get(target);
+            if (last == null || nowNanos - last >= cooldown) { out.add(target); lastProbe.put(target, nowNanos); }
+        }
+        if (!candidates.isEmpty()) cursor = (cursor + 1) % candidates.size();
+        return List.copyOf(out);
+    }
+}

bridged/src/main/java/dev/ltms/fleet/herdr/Agent.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 
@@ -15,6 +15,10 @@ import com.fasterxml.jackson.databind.JsonNode;
  * @param agentType  detected agent kind, e.g. {@code "claude"}, or {@code null} before herdr
  *                   has detected it (the start-time shape)
  * @param status     current lifecycle state
+ * @param name       the unique label the agent was started with — for a bridge worker this is
+ *                   {@code claude-<profile>-<nonce>-<seq>} (CB-117 keys orphan reaping on the
+ *                   nonce); {@code null} for agents the bridge did not start, e.g. a user's own
+ *                   Claude session
  */
 public record Agent(
         String terminalId,
@@ -23,7 +27,8 @@ public record Agent(
         String tabId,
         String sessionId,
         String agentType,
-        AgentStatus status) {
+        AgentStatus status,
+        String name) {
 
     /** Project a herdr {@code agent} node. Tolerates the start-time shape (no session yet). */
     public static Agent from(JsonNode a) {
@@ -42,6 +47,7 @@ public record Agent(
                 a.path("tab_id").asText(null),
                 sessionId,
                 type,
-                AgentStatus.fromWire(a.path("agent_status").asText(null)));
+                AgentStatus.fromWire(a.path("agent_status").asText(null)),
+                a.path("name").asText(null));
     }
 }

bridged/src/main/java/dev/ltms/fleet/herdr/AgentControl.java

@@ -0,0 +1,159 @@
+package dev.ltms.fleet.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Domain layer over herdr's native {@code agent.*} namespace — the worker south side.
+ * Chosen in the CB-102 spike over the pane + {@code send_text} fallback because herdr
+ * tracks each worker's Claude session UUID itself.
+ *
+ * <p>Ported to herdr protocol 19 (herdr 0.8.0, CB-521): {@code agent.start} now starts a
+ * <em>supported</em> agent ({@code kind}) into an <em>existing</em> pane, so the worker's
+ * {@code env}/{@code cwd} move to pane creation ({@code tab.create}/{@code pane.split} — see
+ * {@link WorkspaceControl}), and {@code agent.send} is replaced by {@code agent.prompt}
+ * (which submits in one call) plus {@code agent.send_keys} for the raw Enter nudge.
+ *
+ * <p>Every method is one herdr call through the injected {@link HerdrClient}, so this
+ * layer is unit-testable with a fake and contract-tested against a live daemon.
+ */
+public final class AgentControl {
+
+    private final HerdrClient herdr;
+
+    /**
+     * Protocol 19 dropped {@code terminal_id} as an {@code agent.*} target — herdr now resolves
+     * targets by pane id or agent name only, while the bridge keys every session on the terminal.
+     * This caches the terminal→pane mapping (stable for a worker's lifetime) so callers keep
+     * addressing agents by terminal; entries are invalidated on {@code agent_not_found}.
+     */
+    private final Map<String, String> paneByTerminal = new ConcurrentHashMap<>();
+
+    public AgentControl(HerdrClient herdr) {
+        this.herdr = herdr;
+    }
+
+    /** One agent-targeted call, translating a terminal id to its pane id (retrying once fresh). */
+    private JsonNode agentCall(String method, String target, Map<String, Object> extra) {
+        String resolved = resolveTarget(target);
+        try {
+            return herdr.call(method, withTarget(resolved, extra));
+        } catch (HerdrException e) {
+            if (!"agent_not_found".equals(e.code()) || resolved.equals(target)) throw e;
+            paneByTerminal.remove(target); // the cached pane went away — re-resolve once
+            String fresh = resolveTarget(target);
+            if (fresh.equals(resolved)) throw e;
+            return herdr.call(method, withTarget(fresh, extra));
+        }
+    }
+
+    private static Map<String, Object> withTarget(String target, Map<String, Object> extra) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("target", target);
+        m.putAll(extra);
+        return m;
+    }
+
+    /** The pane id behind a terminal-id target, or the target verbatim for pane ids / names. */
+    private String resolveTarget(String target) {
+        if (target == null || !target.startsWith("term_")) {
+            return target;
+        }
+        String cached = paneByTerminal.get(target);
+        if (cached != null) {
+            return cached;
+        }
+        for (JsonNode a : herdr.call("agent.list").path("agents")) {
+            if (target.equals(a.path("terminal_id").asText(null))) {
+                String pane = a.path("pane_id").asText(null);
+                if (pane != null) {
+                    paneByTerminal.put(target, pane);
+                    return pane;
+                }
+            }
+        }
+        return target; // unknown terminal — let herdr report it against the original target
+    }
+
+    /**
+     * Start an agent into {@code paneId}, which must be sitting at its interactive shell prompt —
+     * the seed pane of a freshly-created worker tab, or a fresh split. The pane's shell already
+     * carries the worker's env ({@code ANTHROPIC_BASE_URL}, token, …) and cwd from pane creation;
+     * herdr resolves the executable from {@code kind} and waits (its default timeout) until the
+     * agent is detected and ready for input.
+     *
+     * @param name unique label for this agent ({@code <kind>-<profile>-<nonce>-<seq>})
+     * @param kind supported agent kind and canonical executable, e.g. {@code "claude"},
+     *             {@code "opencode"}
+     * @param args extra arguments after the executable, e.g. {@code --mcp-config …}
+     * @param paneId the pane to start the agent in
+     */
+    public Agent start(String name, String kind, List<String> args, String paneId) {
+        Map<String, Object> params = new LinkedHashMap<>();
+        params.put("name", name);
+        params.put("kind", kind);
+        params.put("pane_id", paneId);
+        params.put("args", args);
+        JsonNode result = herdr.call("agent.start", params);
+        return Agent.from(result.get("agent"));
+    }
+
+    /**
+     * Deliver {@code text} to an agent as its next prompt <em>and submit it</em> — herdr's
+     * {@code agent.prompt} pastes the text (embedded newlines preserved verbatim) and submits it
+     * in the same call, replacing the pre-protocol-19 two-event {@code agent.send} dance.
+     */
+    public void send(String target, String text) {
+        agentCall("agent.prompt", target, Map.of("text", text));
+    }
+
+    /**
+     * Re-send the submit keystroke (Enter) to {@code target}. The submit that accompanies a
+     * delivery can race the paste — especially right as the worker's TUI becomes interactive —
+     * leaving the text unsubmitted; the injector nudges it with this until the worker actually
+     * picks up (CB-113).
+     */
+    public void submit(String target) {
+        agentCall("agent.send_keys", target, Map.of("keys", List.of("enter")));
+    }
+
+    /**
+     * Read an agent's terminal.
+     *
+     * @param source one of {@code visible|recent|recent_unwrapped|detection}
+     */
+    public String read(String target, String source) {
+        JsonNode result = agentCall("agent.read", target, Map.of("source", source));
+        return result.path("read").path("text").asText("");
+    }
+
+    /** Current agent record (status, session UUID, pane). */
+    public Agent get(String target) {
+        return Agent.from(agentCall("agent.get", target, Map.of()).get("agent"));
+    }
+
+    /** Just the lifecycle status — what the status-gated injector checks before send. */
+    public AgentStatus status(String target) {
+        return get(target).status();
+    }
+
+    /** All agents herdr tracks — the discovery surface ("what workers exist"). */
+    public List<Agent> list() {
+        JsonNode result = herdr.call("agent.list");
+        List<Agent> out = new ArrayList<>();
+        for (JsonNode a : result.path("agents")) {
+            out.add(Agent.from(a));
+        }
+        return out;
+    }
+
+    /** Tear a worker down (there is no agent.stop — close its pane). */
+    public void close(String paneId) {
+        herdr.call("pane.close", Map.of("pane_id", paneId));
+    }
+}

bridged/src/main/java/dev/ltms/fleet/herdr/AgentStatus.java

@@ -0,0 +1,39 @@
+package dev.ltms.fleet.herdr;
+
+/**
+ * A herdr agent's lifecycle state, as reported by {@code agent_status}. Drives the
+ * status-gated injector: a worker is safe to inject into only when {@link #IDLE},
+ * {@link #BLOCKED}, or {@link #DONE}, never mid-turn ({@link #WORKING}).
+ */
+public enum AgentStatus {
+    IDLE,
+    WORKING,
+    BLOCKED,
+    /**
+     * The worker has finished its turn and is settled at an idle prompt. herdr emits this
+     * (observed live alongside {@code idle}) as a turn-complete marker; earlier code mapped the
+     * unrecognized string to {@link #UNKNOWN}, which both wedged delivery (not {@link #injectable})
+     * and mis-fired the CB-109 stall-failure on a worker that had actually answered. It is a
+     * turn-boundary equivalent to {@link #IDLE}: injectable, and a {@code working → done} edge is a
+     * real completion.
+     */
+    DONE,
+    UNKNOWN;
+
+    /** Map herdr's wire string ({@code idle|working|blocked|done|unknown}) to the enum. */
+    public static AgentStatus fromWire(String s) {
+        if (s == null) return UNKNOWN;
+        return switch (s.toLowerCase()) {
+            case "idle" -> IDLE;
+            case "working" -> WORKING;
+            case "blocked" -> BLOCKED;
+            case "done" -> DONE;
+            default -> UNKNOWN;
+        };
+    }
+
+    /** Whether {@code bridged} may inject a message now without stepping on a live turn. */
+    public boolean injectable() {
+        return this == IDLE || this == BLOCKED || this == DONE;
+    }
+}

bridged/src/main/java/dev/ltms/fleet/herdr/HerdrClient.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

bridged/src/main/java/dev/ltms/fleet/herdr/HerdrCodec.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;

bridged/src/main/java/dev/ltms/fleet/herdr/HerdrException.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 /**
  * Raised when a herdr call fails: transport error, or an {@code error} envelope

bridged/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -0,0 +1,188 @@
+package dev.ltms.fleet.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/**
+ * Discovers which panes host a lead by scanning herdr for tabs the operator labelled by convention
+ * (CB-531), and hands {@link dev.ltms.fleet.auth.CallerResolver} the resulting
+ * {@code terminal_id → lead name} map.
+ *
+ * <p><strong>Why scan at all.</strong> A lead is never spawned — a human opens a tab and starts an
+ * agent in it — so the daemon cannot learn a lead's {@code terminal_id} at creation time the way it
+ * does a worker's. CB-530 solved that by having the operator paste each id into {@code leaders:},
+ * which works but costs a config edit and a daemon restart per lead, and the id is only obtainable
+ * by first starting the session and asking it. Scanning closes that loop: label the tab, and the
+ * pane is recognised on the next resolve.
+ *
+ * <p><strong>CB-579 — matched by name, not prefix.</strong> This used to strip one shared
+ * {@code tabPrefix} off a label to derive the lead's name, and merged a config-supplied
+ * {@code terminal_id} pin over every scan result so the pin could never expire. Both are gone: each
+ * lead now configures its own exact {@code tab} label ({@code fleet.leaders.<name>.tab}), so this
+ * class is handed a {@code tab → name} map up front and matches labels against it exactly
+ * (case-insensitively). There is no merge step — a scan result is the whole answer. That is the
+ * fix for the bug this replaces: a {@code terminal_id} pin surviving in config after the pane it
+ * named was gone, so the daemon kept treating a dead session as a live lead forever.
+ *
+ * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
+ * anything a pane could take for itself. Three properties keep that honest:
+ * <ol>
+ *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
+ *       become a lead by being placed — as a split, say — inside a matching tab.</li>
+ *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
+ *       {@link WorkspaceControl}, which no {@code bridge_*} tool exposes. The label is writable by
+ *       the human at the terminal and by nobody the bridge is defending against.</li>
+ *   <li>The label is a <em>name</em>, not a capability. What a pane may do is decided by
+ *       {@code Authz} against the role {@code CallerResolver} returns; a tab that calls itself a
+ *       lead still cannot act as one unless the daemon's own registry agrees.</li>
+ * </ol>
+ *
+ * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
+ * that bridged never renames a lead tab, so the label was always the human's own writing and there
+ * was no round-trip from the daemon's rename back into its next decision.
+ * {@code dev.ltms.fleet.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
+ * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
+ * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
+ * real: a label left behind by a session that has since died would read as a live lead forever.
+ * This scanner does not solve that (its job is naming, and a stale name costs nothing here); the
+ * launcher does, by requiring a running agent in the tab before it counts the lead as live. If you
+ * ever make a decision that <em>removes</em> something based on this map, add the same check.
+ * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
+ * happens to start with the same prefix would promote the whole fleet — and that is refused at
+ * startup by {@code FleetConfig.validateLeadTabPrefixes} rather than documented here.
+ *
+ * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
+ * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps
+ * the previous answer instead of emptying it — a herdr hiccup must not silently demote a live lead
+ * mid-session.
+ */
+public final class LeadTabScanner implements Supplier<Map<String, String>> {
+
+    private static final Logger log = LoggerFactory.getLogger(LeadTabScanner.class);
+
+    private final HerdrClient herdr;
+    private final Map<String, String> tabToName;
+    private final Set<String> excludedWorkspaceLabels;
+    private final long ttlNanos;
+    private final LongSupplier clock;
+
+    private Map<String, String> cached = Map.of();
+    private long scannedAtNanos;
+    private boolean everScanned;
+
+    /**
+     * @param herdr                   the herdr client to query ({@code workspace.list},
+     *                                {@code tab.list}, {@code pane.list} — all read-only)
+     * @param tabToName               every configured lead's exact tab label → its name
+     *                                ({@code fleet.leaders.<name>.tab}), matched case-insensitively
+     * @param excludedWorkspaceLabels workspaces never scanned — the configured worker spaces
+     * @param ttlNanos                how long a scan result is reused before the next one
+     * @param clock                   nanosecond time source ({@code System::nanoTime} in production)
+     */
+    public LeadTabScanner(HerdrClient herdr, Map<String, String> tabToName,
+                          Set<String> excludedWorkspaceLabels, long ttlNanos, LongSupplier clock) {
+        this.herdr = herdr;
+        this.tabToName = normalize(tabToName);
+        this.excludedWorkspaceLabels = excludedWorkspaceLabels == null
+                ? Set.of() : Set.copyOf(excludedWorkspaceLabels);
+        this.ttlNanos = ttlNanos;
+        this.clock = clock;
+    }
+
+    /** Keys stripped and lower-cased once, so every lookup is a plain map hit. */
+    private static Map<String, String> normalize(Map<String, String> tabToName) {
+        if (tabToName == null || tabToName.isEmpty()) {
+            return Map.of();
+        }
+        Map<String, String> out = new LinkedHashMap<>();
+        tabToName.forEach((tab, name) -> {
+            if (tab != null && !tab.isBlank() && name != null && !name.isBlank()) {
+                out.put(tab.strip().toLowerCase(Locale.ROOT), name);
+            }
+        });
+        return Collections.unmodifiableMap(out);
+    }
+
+    /**
+     * The current {@code terminal_id → lead name} map, rescanning when the cache has expired.
+     *
+     * <p>Synchronized so a burst of concurrent calls produces one scan rather than one each; a scan
+     * is a handful of RPCs over a Unix socket and is rate-limited to one per TTL.
+     */
+    @Override
+    public synchronized Map<String, String> get() {
+        long now = clock.getAsLong();
+        if (everScanned && now - scannedAtNanos < ttlNanos) {
+            return cached;
+        }
+        // Stamp before scanning, not after: a herdr that is down must cost one attempt per TTL, not
+        // one per request.
+        scannedAtNanos = now;
+        everScanned = true;
+        try {
+            Map<String, String> fresh = scan();
+            if (!fresh.equals(cached)) {
+                log.info("lead panes: {}", fresh);
+            }
+            cached = fresh;
+        } catch (HerdrException e) {
+            log.warn("lead-tab scan failed, keeping the {} lead(s) already known: {}",
+                    cached.size(), e.getMessage());
+        }
+        return cached;
+    }
+
+    /** One full pass: labelled tabs → their panes → those panes' terminals. */
+    private Map<String, String> scan() {
+        Map<String, String> nameByTab = new LinkedHashMap<>();
+        for (JsonNode w : herdr.call("workspace.list").path("workspaces")) {
+            Workspace ws = Workspace.from(w);
+            if (ws.workspaceId() == null || excludedWorkspaceLabels.contains(ws.label())) {
+                continue;
+            }
+            for (JsonNode t : herdr.call("tab.list", Map.of("workspace_id", ws.workspaceId())).path("tabs")) {
+                Tab tab = Tab.from(t);
+                String name = leadNameOf(tab.label());
+                if (name != null && tab.tabId() != null) {
+                    nameByTab.put(tab.tabId(), name);
+                }
+            }
+        }
+
+        Map<String, String> byTerminal = new LinkedHashMap<>();
+        if (!nameByTab.isEmpty()) {
+            // One pane.list for every tab: panes carry tab_id, so the join is local.
+            for (JsonNode p : herdr.call("pane.list", Map.of()).path("panes")) {
+                String name = nameByTab.get(p.path("tab_id").asText(null));
+                String terminal = p.path("terminal_id").asText(null);
+                if (name != null && terminal != null && !terminal.isBlank()) {
+                    byTerminal.put(terminal, name);
+                }
+            }
+        }
+        return Collections.unmodifiableMap(byTerminal);
+    }
+
+    /**
+     * The lead name a tab label declares, or {@code null} if it names none of the configured leads.
+     *
+     * <p>Exact match (case-insensitive, ends stripped) against {@link #tabToName} — no prefix
+     * stripping, so an operator's {@code "lead: something-else"} tab is never mistaken for a
+     * configured lead just because it shares a prefix.
+     */
+    private String leadNameOf(String label) {
+        if (label == null) {
+            return null;
+        }
+        return tabToName.get(label.strip().toLowerCase(Locale.ROOT));
+    }
+}

bridged/src/main/java/dev/ltms/fleet/herdr/PaneLocator.java

@@ -0,0 +1,59 @@
+package dev.ltms.fleet.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import java.util.Map;
+
+/**
+ * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
+ * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
+ * the agent pane whose process tree contains it, so {@code bridged} can tell <em>which worker</em>
+ * is calling without the worker sending anything spoofable.
+ *
+ * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
+ * and foreground process PIDs. This scans agent panes; a spawn-time {@code pid→terminal} cache is
+ * the obvious optimization once wired into {@code ClaudeCodeLauncher}.
+ */
+public final class PaneLocator {
+
+    private final HerdrClient herdr;
+
+    public PaneLocator(HerdrClient herdr) {
+        this.herdr = herdr;
+    }
+
+    /**
+     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
+     * {@code null} if no agent pane owns it (e.g. the caller is the primary, or off-host).
+     */
+    public String terminalForPid(long pid) {
+        if (pid <= 0) {
+            return null;
+        }
+        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
+            String paneId = pane.path("pane_id").asText(null);
+            if (paneId != null && paneOwnsPid(paneId, pid)) {
+                return pane.path("terminal_id").asText(null);
+            }
+        }
+        return null;
+    }
+
+    private boolean paneOwnsPid(String paneId, long pid) {
+        JsonNode info;
+        try {
+            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
+        } catch (HerdrException e) {
+            return false; // pane vanished mid-scan — just skip it
+        }
+        if (info.path("shell_pid").asLong(-1) == pid) {
+            return true;
+        }
+        for (JsonNode p : info.path("foreground_processes")) {
+            if (p.path("pid").asLong(-1) == pid) {
+                return true;
+            }
+        }
+        return false;
+    }
+}

bridged/src/main/java/dev/ltms/fleet/herdr/Tab.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 
@@ -23,9 +23,9 @@ public record Tab(String tabId, String workspaceId, String label, int paneCount)
     }
 
     /**
-     * A freshly-created tab together with the placeholder shell pane herdr seeds it with.
-     * The caller starts the worker into {@link #tab()} then closes {@link #rootPaneId()} so
-     * only the worker pane remains.
+     * A freshly-created tab together with the shell pane herdr seeds it with. Under protocol 19
+     * the caller starts the worker <em>into</em> {@link #rootPaneId()} — the seed pane's shell
+     * carries the worker's cwd and env from {@code tab.create}, and becomes the worker pane.
      */
     public record Created(Tab tab, String rootPaneId) {
         /** Project a {@code tab_created} result ({@code {tab, root_pane}}). */

bridged/src/main/java/dev/ltms/fleet/herdr/UnixSocketHerdrClient.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;

bridged/src/main/java/dev/ltms/fleet/herdr/Workspace.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

bridged/src/main/java/dev/ltms/fleet/herdr/WorkspaceControl.java

@@ -1,10 +1,11 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -40,6 +41,16 @@ public final class WorkspaceControl {
         return out;
     }
 
+    /** Every tab in {@code workspaceId}, in herdr's order. */
+    public List<Tab> listTabs(String workspaceId) {
+        JsonNode result = herdr.call("tab.list", Map.of("workspace_id", workspaceId));
+        List<Tab> out = new ArrayList<>();
+        for (JsonNode t : result.path("tabs")) {
+            out.add(Tab.from(t));
+        }
+        return out;
+    }
+
     /** The first workspace with this exact label, if any. */
     public Optional<Workspace> findByLabel(String label) {
         return listWorkspaces().stream()
@@ -65,13 +76,37 @@ public final class WorkspaceControl {
     }
 
     /**
-     * A brand-new tab in {@code workspaceId} plus the placeholder shell pane herdr seeds
-     * it with. Start the worker into the tab, then {@code pane.close} the root pane so the
-     * tab holds only the worker.
+     * A brand-new tab in {@code workspaceId} plus the shell pane herdr seeds it with. Under
+     * protocol 19 that seed pane is where the worker <em>starts</em>: its shell carries
+     * {@code cwd} and {@code env} (the worker's {@code ANTHROPIC_BASE_URL} — this is the
+     * subscription-injection seam now), and {@code agent.start} launches the agent into it.
      */
-    public Tab.Created createTab(String workspaceId) {
-        JsonNode result = herdr.call("tab.create", Map.of("workspace_id", workspaceId));
-        return Tab.Created.from(result);
+    public Tab.Created createTab(String workspaceId, String cwd, Map<String, String> env) {
+        Map<String, Object> params = new LinkedHashMap<>();
+        params.put("workspace_id", workspaceId);
+        if (cwd != null && !cwd.isBlank()) {
+            params.put("cwd", cwd);
+        }
+        if (env != null && !env.isEmpty()) {
+            params.put("env", env);
+        }
+        return Tab.Created.from(herdr.call("tab.create", params));
+    }
+
+    /**
+     * Split the currently-focused tab and return the new pane's id — the legacy pane placement's
+     * seed pane, carrying {@code cwd} and {@code env} exactly as {@link #createTab}'s does.
+     */
+    public String splitPane(String cwd, Map<String, String> env) {
+        Map<String, Object> params = new LinkedHashMap<>();
+        params.put("direction", "right");
+        if (cwd != null && !cwd.isBlank()) {
+            params.put("cwd", cwd);
+        }
+        if (env != null && !env.isEmpty()) {
+            params.put("env", env);
+        }
+        return herdr.call("pane.split", params).path("pane").path("pane_id").asText(null);
     }
 
     /** Give a worker's tab a human label in the tab bar. */

bridged/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -0,0 +1,372 @@
+package dev.ltms.fleet.inject;
+
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;
+
+/**
+ * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
+ * {@link Rendezvous} so a blocking {@code fleet_send} resolves even when the worker finishes its
+ * task without ever calling {@code fleet_reply} — the common case for a real delegated coding task.
+ *
+ * <p>On a confirmed {@code working → idle} boundary it scrapes the worker's recent transcript and
+ * resolves the awaiting send with that tail (a {@link Rendezvous.Kind#COMPLETION} resolution, so the
+ * caller can tell a scrape from a structured reply). It scrapes only when a send is actually waiting
+ * — a fleet worker's own turns, or a send that already timed out, cost no herdr traffic. An explicit
+ * {@code fleet_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
+ *
+ * <p>It also handles the CB-109 stall signal ({@link #onTurnFailed}): a worker that ran a turn then
+ * wedged in an {@code unknown} state resolves the send as a failure (with the error screen as
+ * context) rather than leaving it to time out.
+ *
+ * <p>The scrape is cleaned to the last {@code ⏺} assistant block (stripping TUI chrome) and guarded
+ * against misattribution (CB-115): the pane content is baselined on delivery ({@link #onDelivered}),
+ * and a completion whose scrape is unchanged from that baseline — the previous turn's wind-down
+ * sampled as this turn's boundary on a rapid back-to-back send — is suppressed rather than resolving
+ * the send with a stale answer.
+ *
+ * <p><strong>Waiter-specific resolution (CB-116).</strong> On delivery we also capture the exact
+ * {@link Rendezvous} waiter this turn belongs to, and the completion/failure fallbacks resolve
+ * <em>that</em> waiter — never "whatever send is waiting now". A completion fallback runs on a virtual
+ * thread and can land after the worker's {@code fleet_reply} already resolved the turn and the
+ * <em>next</em> send opened its own waiter on the same session; resolving the current waiter would
+ * then deliver turn N's stale scrape as turn N+1's answer. Targeting the captured waiter makes a late
+ * completion a harmless no-op (its waiter is already done) instead of a cross-turn stale reply.
+ *
+ * <p>Wired as the {@link Injector}'s {@link TurnListener}; the handlers hand off to a virtual thread
+ * so the scrape's herdr round-trip never stalls the status poller. The captured waiter is read on the
+ * poller thread (before any next-turn delivery can overwrite it) and passed into the virtual thread.
+ */
+public final class CompletionResolver implements TurnListener {
+
+    private static final Logger log = LoggerFactory.getLogger(CompletionResolver.class);
+
+    /**
+     * herdr {@code agent.read} source for the completion scrape. {@code recent} returns the tail of
+     * the transcript (the worker's last output), which is what a delegator wants when the worker
+     * didn't structure a reply.
+     */
+    static final String SCRAPE_SOURCE = "recent";
+
+    /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
+    static final int MAX_SCRAPE_CHARS = 4000;
+
+    private static final String CLIPPED_PANE_TAIL_MARKER =
+            "[Pane tail clipped: member did not call fleet_reply.]";
+
+    private final AgentControl agents;
+    private final Rendezvous rendezvous;
+    private final ExhaustedPatternLookup exhaustedPatterns;
+    private final ExhaustionSink exhaustionSink;
+
+    /**
+     * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
+     * delivering send opened, plus the assistant block present when it was delivered.
+     *
+     * <p>The {@code waiter} is what makes a late fallback safe (CB-116): we resolve it, not "whoever
+     * is waiting now", so a completion that fires after the next send has opened its own waiter is a
+     * no-op rather than a cross-turn stale reply. The {@code baseline} is the CB-115 staleness
+     * reference: a completion scrape equal to it means the worker produced no new output (the previous
+     * turn's wind-down sampled as this boundary), so it is suppressed. Overwritten on each delivery;
+     * cleared when the turn resolves. Package-private so tests can capture and replay a specific turn.
+     */
+    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
+    }
+
+    private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();
+
+    /**
+     * @param exhaustedPatterns CB-578 stage A: per-target lookup for a profile's configured
+     *                          usage-limit refusal pattern. Required — there is deliberately no
+     *                          defaulting overload; a caller that does not want the classification
+     *                          must pass an explicit inert value ({@link ExhaustedPatternLookup#none()}).
+     * @param exhaustionSink    CB-578 stage B: notified when a {@code BACKEND_EXHAUSTED}
+     *                          classification actually resolves a waiter. Required for the same
+     *                          reason as {@code exhaustedPatterns} — pass {@link ExhaustionSink#none()}
+     *                          to opt out.
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                              ExhaustionSink exhaustionSink) {
+        this.agents = agents;
+        this.rendezvous = rendezvous;
+        this.exhaustedPatterns = Objects.requireNonNull(exhaustedPatterns, "exhaustedPatterns");
+        this.exhaustionSink = Objects.requireNonNull(exhaustionSink, "exhaustionSink");
+    }
+
+    @Override
+    public void onDelivered(String target, TurnToken token) {
+        // Capture the exact waiter this turn belongs to (CB-116) and snapshot the pane's pre-turn
+        // content — what it shows *before* the just-delivered turn produces output — as the staleness
+        // reference (CB-115). Done synchronously (like the delivering send itself) so both are in
+        // place before this turn's completion can fire.
+        captureBaseline(target, token);
+    }
+
+    /** Capture the in-flight turn: its waiter and pre-turn baseline (the testable core of {@link #onDelivered}). */
+    void captureBaseline(String target, TurnToken token) {
+        CompletableFuture<Rendezvous.Resolution> waiter = token.waiter();
+        if (waiter == null) {
+            inFlight.remove(target); // no send is waiting on this delivery — nothing to resolve later
+            return;
+        }
+        String baseline;
+        try {
+            // Clip to the same cap resolve() applies to the tail (line ~134): the CB-115 misattribution
+            // guard compares baseline.equals(tail), so both sides must be the same capped representation.
+            // An unclipped baseline vs a clipped tail would never match for a >MAX_SCRAPE_CHARS block,
+            // defeating the guard and letting a stale completion resolve the send.
+            baseline = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
+        } catch (RuntimeException e) {
+            baseline = null; // fail open: no baseline ⇒ no suppression
+            log.debug("delivery baseline for {} failed: {}", target, e.getMessage());
+        }
+        inFlight.put(target, new InFlight(waiter, baseline));
+    }
+
+    /** The turn currently baselined for {@code target}, or {@code null} — a test hook for the captureBaseline path. */
+    InFlight inFlight(String target) {
+        return inFlight.get(target);
+    }
+
+    @Override
+    public void onTurnComplete(String target) {
+        // Read the in-flight turn on the poller thread — before any next-turn delivery can overwrite
+        // it — then off-load the scrape (a herdr round-trip we must not block polling on) to a vthread.
+        InFlight turn = inFlight.get(target);
+        Thread.ofVirtual().name("completion-" + target).start(() -> resolve(target, turn));
+    }
+
+    /**
+     * Resolve the completed turn before adapter housekeeping can erase its rendered output. This is
+     * intentionally synchronous and used only when a post-turn context reset is enabled; the normal
+     * path remains off-loaded so polling is not blocked by a scrape.
+     */
+    public void resolveBeforePostAction(String target) {
+        resolve(target, inFlight.get(target));
+    }
+
+    @Override
+    public void onTurnFailed(String target) {
+        InFlight turn = inFlight.get(target);
+        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn, null));
+    }
+
+    @Override
+    public void onTurnFailed(String target, String reason) {
+        InFlight turn = inFlight.get(target);
+        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn, reason));
+    }
+
+    /** Synchronous resolve (the unit-testable core of {@link #onTurnComplete}). */
+    void resolve(String target, InFlight turn) {
+        CompletableFuture<Rendezvous.Resolution> waiter = turn == null ? null : turn.waiter();
+        if (waiter == null || waiter.isDone()) {
+            // Nobody is blocked on THIS turn (it had no send, or its fleet_reply already won). Skip
+            // the scrape; resolving the current waiter here would be the CB-116 cross-turn stale reply.
+            inFlight.remove(target, turn);
+            return;
+        }
+        String tail;
+        String assistantBlock = null;
+        int originalLength = 0;
+        boolean clipped = false;
+        boolean scrapeFailed = false;
+        try {
+            assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
+            originalLength = assistantBlock.strip().length();
+            clipped = originalLength > MAX_SCRAPE_CHARS;
+            tail = clip(assistantBlock);
+        } catch (RuntimeException e) {
+            // The worker finished but we couldn't read its screen — still resolve the send so the
+            // caller unblocks; an empty tail beats hanging until the caller's timeout.
+            log.warn("completion scrape for {} failed; resolving with an empty tail: {}",
+                    target, e.getMessage());
+            tail = "";
+            scrapeFailed = true;
+        }
+        // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
+        // delivery, this turn produced no new output — the boundary belongs to the previous turn's
+        // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
+        // a stale answer; the real fleet_reply (or a later genuine completion) resolves it instead.
+        // A scrape that failed to read is exempt — an empty tail there is "couldn't see", not "no change".
+        String baseline = turn.baseline();
+        if (!scrapeFailed && baseline != null && baseline.equals(tail)) {
+            log.debug("suppressing misattributed completion for {} (no output change since delivery)",
+                    target);
+            return; // keep the in-flight record: a later genuine completion still needs it
+        }
+        // CB-578 stage A: a turn that ended with no fleet_reply AND whose scrape matches the
+        // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
+        // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
+        if (!scrapeFailed) {
+            Pattern exhausted = exhaustedPatterns.patternFor(target);
+            String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
+            if (matchedLine != null) {
+                String reason = "backend exhausted (usage limit): " + matchedLine;
+                if (rendezvous.resolveExhausted(waiter, reason)) {
+                    inFlight.remove(target, turn);
+                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no fleet_reply; scrape "
+                            + "matched the profile's exhausted pattern): {}", target, reason);
+                    // CB-578 stage B: only on the resolution that actually won the race — a late
+                    // duplicate must never quarantine a credential twice for one refusal.
+                    exhaustionSink.onExhausted(target, reason);
+                }
+                return;
+            }
+        }
+        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
+        if (rendezvous.resolveCompletion(waiter, completion)) {
+            inFlight.remove(target, turn);
+            if (clipped) {
+                log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
+                                + "member did not call fleet_reply, so the pane tail is partial",
+                        target, originalLength, MAX_SCRAPE_CHARS);
+            }
+            log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
+                    target, tail.length());
+        }
+    }
+
+    /** Synchronous fail (the unit-testable core of {@link #onTurnFailed}). */
+    void fail(String target, InFlight turn) {
+        fail(target, turn, null);
+    }
+
+    /** Synchronous fail with an optional reason supplied by a dropped worker queue. */
+    void fail(String target, InFlight turn, String explicitReason) {
+        // A never-delivered readiness failure has no in-flight record but still has a blocked send;
+        // fall back to the currently-registered waiter (unambiguous — that send never completed, so
+        // no next turn exists to confuse it with).
+        CompletableFuture<Rendezvous.Resolution> waiter =
+                turn != null ? turn.waiter() : rendezvous.currentWaiter(target);
+        if (waiter == null || waiter.isDone()) {
+            inFlight.remove(target, turn); // nobody blocked on this worker — nothing to fail
+            return;
+        }
+        String reason = explicitReason;
+        if (reason == null || reason.isBlank()) {
+            try {
+                reason = clip(agents.read(target, SCRAPE_SOURCE));
+            } catch (RuntimeException e) {
+                reason = "";
+            }
+            if (reason.isBlank()) {
+                // No screen to scrape — either the worker is stuck (CB-109) or gone (CB-110).
+                reason = "worker did not reply; its turn ended in an unrecoverable state "
+                        + "(worker unreachable or stuck)";
+            }
+        }
+        if (rendezvous.resolveFailure(waiter, reason)) {
+            inFlight.remove(target, turn);
+            log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
+        }
+    }
+
+    /**
+     * The first line of {@code text} matching {@code pattern}, stripped — the CB-578 stage A
+     * evidence carried in a {@code BACKEND_EXHAUSTED} reason so the operator sees the real refusal
+     * text, never a generic label. {@code null} if no line matches.
+     */
+    static String firstMatchingLine(String text, Pattern pattern) {
+        if (text == null || text.isEmpty()) return null;
+        for (String line : text.split("\n", -1)) {
+            if (pattern.matcher(line).find()) {
+                return line.strip();
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
+     * the way {@link dev.ltms.fleet.health.FleetHealthMonitor#coverage} is — so an operator can
+     * see whether the classification is on, and for which profiles, without reading every
+     * profile's config by hand.
+     *
+     * @param allProfiles        every configured profile name
+     * @param configuredProfiles the subset of {@code allProfiles} that carry an exhausted pattern
+     */
+    public static String coverage(Set<String> allProfiles, Set<String> configuredProfiles) {
+        if (configuredProfiles.isEmpty()) {
+            return "off (no profile has an exhaustedPattern configured; profiles: " + sorted(allProfiles) + ")";
+        }
+        Set<String> unconfigured = new TreeSet<>(allProfiles);
+        unconfigured.removeAll(configuredProfiles);
+        return unconfigured.isEmpty()
+                ? "full (all profiles configured: " + sorted(allProfiles) + ")"
+                : "partial (configured: " + sorted(configuredProfiles) + "; not configured: " + sorted(unconfigured) + ")";
+    }
+
+    private static List<String> sorted(Set<String> names) {
+        return names.stream().sorted().toList();
+    }
+
+    private static String clip(String s) {
+        if (s == null) return "";
+        String trimmed = s.strip();
+        return trimmed.length() <= MAX_SCRAPE_CHARS
+                ? trimmed
+                : trimmed.substring(trimmed.length() - MAX_SCRAPE_CHARS);
+    }
+
+    /**
+     * Extract the last assistant message from a raw Claude Code pane scrape (CB-115). Claude Code
+     * prefixes each assistant turn with {@code ⏺}; the delegator wants that answer, not the TUI
+     * chrome around it. Take everything from the final {@code ⏺} onward and stop at the <em>first</em>
+     * hard interface boundary below it — the spinner/status line, input box, {@code ❯} prompt (which
+     * may echo the <em>next</em> turn's text), footer, or tips/warnings. Stopping at the first
+     * boundary (rather than trimming only trailing chrome) is what keeps a following turn's echoed
+     * prompt out of this reply. Blank lines are not boundaries, so a multi-paragraph answer survives;
+     * trailing blanks are trimmed at the end. With no {@code ⏺} marker (an unusual render) the whole
+     * text is scanned the same way, so we never lose the reply.
+     *
+     * <p>Package-private and pure so it is unit-testable without herdr.
+     */
+    static String lastAssistantBlock(String raw) {
+        if (raw == null || raw.isBlank()) return "";
+        int marker = raw.lastIndexOf('⏺');
+        String block = marker >= 0 ? raw.substring(marker + 1) : raw;
+        StringBuilder out = new StringBuilder();
+        int kept = 0;
+        for (String line : block.split("\n", -1)) {
+            if (isBoundary(line)) break; // first TUI boundary ends the assistant message
+            if (kept++ > 0) out.append('\n');
+            out.append(line);
+        }
+        return out.toString().strip();
+    }
+
+    /**
+     * A hard TUI boundary line that marks the end of an assistant message and the start of interface
+     * chrome (input box, prompt, spinner, footer, tips/warnings). Blank lines are <em>not</em>
+     * boundaries — an answer may contain them — so they are kept and trimmed only if trailing.
+     */
+    private static boolean isBoundary(String line) {
+        String t = line.strip();
+        if (t.isEmpty()) return false;
+        // A horizontal rule / all box-drawing separators (e.g. "──────").
+        if (t.chars().allMatch(c -> c == '─' || c == '—' || c == '━' || c == '═' || c == '-')) {
+            return true;
+        }
+        String lower = t.toLowerCase();
+        return t.startsWith("╭") || t.startsWith("│") || t.startsWith("╰") || t.startsWith("┌")
+                || t.startsWith("└") || t.startsWith("❯") || t.startsWith("⏵")
+                || t.startsWith("⎿") || t.startsWith("⚠")
+                // Status/spinner lines Claude Code renders below a settled or in-flight turn,
+                // e.g. "✻ Baked for 21s", "✶ Forming…".
+                || t.startsWith("✻") || t.startsWith("✳") || t.startsWith("✽") || t.startsWith("·")
+                || t.startsWith("●") || t.startsWith("◐") || t.startsWith("✢") || t.startsWith("✶")
+                || lower.contains("auto mode") || lower.contains("for shortcuts")
+                || lower.contains("esc to interrupt") || lower.contains("bypass permissions");
+    }
+}

bridged/src/main/java/dev/ltms/fleet/inject/ExhaustedPatternLookup.java

@@ -0,0 +1,27 @@
+package dev.ltms.fleet.inject;
+
+import java.util.regex.Pattern;
+
+/**
+ * Per-target lookup for a profile's configured usage-limit refusal pattern (CB-578 stage A): how
+ * {@link CompletionResolver} tells a backend that refused on a subscription usage limit — the
+ * worker's pane stays healthy, but the account is exhausted — apart from a genuine completion.
+ *
+ * <p>The pattern is always profile config, never a vendor string in Java source: every backend
+ * words its refusal differently, so a hardcoded sentence would only ever match one of them.
+ */
+@FunctionalInterface
+public interface ExhaustedPatternLookup {
+
+    /** The compiled pattern configured for {@code target}'s profile, or {@code null} if none. */
+    Pattern patternFor(String target);
+
+    /**
+     * Inert lookup — no profile has a pattern configured, so the classification never fires and
+     * the completion fallback behaves exactly as before CB-578 stage A. The explicit stand-in a
+     * caller (or a test not exercising this feature) passes instead of a defaulting overload.
+     */
+    static ExhaustedPatternLookup none() {
+        return target -> null;
+    }
+}

bridged/src/main/java/dev/ltms/fleet/inject/ExhaustionSink.java

@@ -0,0 +1,31 @@
+package dev.ltms.fleet.inject;
+
+/**
+ * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
+ * classification to a waiting send (CB-578 stage B) — never on a race that lost (see
+ * {@link CompletionResolver#resolve}, which only calls this after
+ * {@code Rendezvous.resolveExhausted} returns {@code true}).
+ *
+ * <p>{@link CompletionResolver} knows only {@code target} (a herdr terminal id); it has no notion of
+ * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
+ * the sink's job — see {@code Fleetd.main}'s wiring, which resolves target → session → profile →
+ * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
+ */
+@FunctionalInterface
+public interface ExhaustionSink {
+
+    /**
+     * @param target the herdr terminal id whose turn was classified {@code BACKEND_EXHAUSTED}
+     * @param reason the matched-line reason carried by the classification
+     */
+    void onExhausted(String target, String reason);
+
+    /**
+     * Inert sink — nothing happens on exhaustion. The explicit stand-in a caller (or a test not
+     * exercising this feature) passes instead of a defaulting overload, exactly like
+     * {@link ExhaustedPatternLookup#none()}.
+     */
+    static ExhaustionSink none() {
+        return (target, reason) -> { };
+    }
+}

bridged/src/main/java/dev/ltms/fleet/inject/Injector.java

@@ -0,0 +1,418 @@
+package dev.ltms.fleet.inject;
+
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.msg.TurnToken;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayDeque;
+import java.util.ArrayList;
+import java.util.Deque;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.Consumer;
+import java.util.function.Predicate;
+import java.util.stream.Collectors;
+
+/**
+ * The status-gated injector (CB-103): the single writer that delivers a message into a
+ * worker only when it is safe — {@code idle} or {@code blocked}, never mid-turn.
+ *
+ * <p>Per target it holds a FIFO queue and delivers <strong>at most one message per turn</strong>:
+ * after a send it waits for the worker to pick the message up (go {@code working}) before
+ * delivering the next, so two rapid deliveries never interleave into one turn. Each
+ * status-check-then-send for a target is serialized on the target's monitor, closing the
+ * TOCTOU window between "is it idle?" and "send" — one writer per worker.
+ *
+ * <p><strong>Polling caveat.</strong> This is driven by {@link #onStatus} sampling (a
+ * {@code StatusPoller}), not by reliable status <em>edges</em>. A turn can begin and end
+ * entirely between two polls, so the {@code working} pickup may never be sampled. To avoid
+ * wedging a queue forever, an awaited pickup is released after {@link #PICKUP_GRACE_POLLS}
+ * consecutive injectable samples (the worker has plainly moved on). Only {@code working} — not
+ * a transient {@code unknown} — counts as a real pickup, so a detection glitch can't prematurely
+ * release the latch. Perfectly reliable turn boundaries require a herdr {@code events.subscribe}
+ * stream; that is the intended upgrade and would replace only the sampling, not this queue.
+ *
+ * <p><strong>Turn completion (CB-106).</strong> Beyond delivery, the injector reports when a
+ * delegated turn <em>finishes</em>: after a delivery is picked up (a real {@code working} sample),
+ * the next injectable sample is a confirmed {@code working → idle} boundary and fires
+ * {@link TurnListener#onTurnComplete}. Completion is only ever synthesized from a <em>confirmed</em>
+ * turn — the pickup-grace path (a turn too fast to sample) unwedges the queue but does not fire
+ * completion, since without a sampled {@code working} there is no trustworthy "the worker just
+ * finished the task" signal to act on.
+ */
+public final class Injector {
+
+    private static final Logger log = LoggerFactory.getLogger(Injector.class);
+
+    /**
+     * How many consecutive injectable samples (with no {@code working} in between) after a send
+     * before we assume the turn completed unobserved and release the pickup latch. At the
+     * default 250ms poll interval this is a ~2s grace — far longer than a worker takes to start
+     * a turn, so it only fires on a genuinely missed pickup edge.
+     */
+    private static final int PICKUP_GRACE_POLLS = 8;
+
+    /**
+     * How many consecutive {@code unknown} samples while a delegation is outstanding before we
+     * declare it stalled and fire {@link TurnListener#onTurnFailed} (CB-109). A worker wedged in a
+     * state herdr can't classify (e.g. an API-error screen) stays {@code unknown} indefinitely and
+     * would otherwise never resolve; any {@code working}/{@code idle} sample resets the streak, so a
+     * transient detection glitch cannot trip it. At the 250ms poll interval this is ~30s — far longer
+     * than any real detection blip, and still vastly better than the async send's timeout.
+     */
+    private static final int TURN_STALL_GRACE_POLLS = 120;
+
+    /**
+     * How many consecutive injectable samples a queued-but-undelivered message may wait on the
+     * {@link #ready} gate before we give up and fail it (CB-114). The gate holds a message out of a
+     * worker's boot window (herdr reports {@code idle} while its Claude is still starting), but a
+     * worker whose Claude crashes during boot — or never connects the bridge MCP — stays "idle and
+     * not ready" forever: {@link #ready} never accepts it, the message is never delivered, and the
+     * target would be polled indefinitely with its caller's future never completing. After this
+     * grace the queued messages are failed and the target released. At the 250ms poll interval this
+     * is ~60s — deliberately longer than {@link #TURN_STALL_GRACE_POLLS}, since a first boot (spawn
+     * + model load + MCP connect) legitimately takes longer than an in-turn detection blip.
+     */
+    private static final int READINESS_GRACE_POLLS = 240;
+
+    /**
+     * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
+     * {@link #onStatus} at. {@code Fleetd} passes this to every {@link StatusPoller} it constructs,
+     * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
+     * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
+     * that claims a grace duration.
+     */
+    public static final long POLL_INTERVAL_MILLIS = 250;
+
+    private final AgentControl agents;
+    private final TurnListener turnListener;
+    private final Predicate<String> ready; // CB-113: a target is deliverable only when available
+    private final Consumer<String> forget; // CB-114: clear a gone worker's readiness/presence
+    private final ConcurrentHashMap<String, Target> targets = new ConcurrentHashMap<>();
+
+    /** Delivery only; completion signalling is a no-op and every target is treated as available. */
+    public Injector(AgentControl agents) {
+        this(agents, TurnListener.NOOP);
+    }
+
+    /** Delivery plus turn-completion signalling (CB-106); every target is treated as available. */
+    public Injector(AgentControl agents, TurnListener turnListener) {
+        this(agents, turnListener, _ -> true);
+    }
+
+    /**
+     * Delivery, completion signalling (CB-106), and a readiness gate (CB-113): a message is delivered
+     * only when {@code ready} accepts the target — i.e. the worker's Claude has connected the bridge
+     * MCP. This holds the first delivery out of the worker's boot window, where herdr already reports
+     * {@code idle} but the TUI would drop an injected paste.
+     */
+    public Injector(AgentControl agents, TurnListener turnListener, Predicate<String> ready) {
+        this(agents, turnListener, ready, _ -> {
+        });
+    }
+
+    /**
+     * Delivery, completion signalling (CB-106), a readiness gate (CB-113), and readiness cleanup
+     * (CB-114): {@code forget} is invoked with a target when its worker is gone — dropped
+     * (pane crash) or timed out on the readiness gate — so its stale presence/readiness is cleared
+     * and does not linger past the worker's life.
+     */
+    public Injector(AgentControl agents, TurnListener turnListener, Predicate<String> ready,
+                    Consumer<String> forget) {
+        this.agents = agents;
+        this.turnListener = turnListener;
+        this.ready = ready;
+        this.forget = forget;
+    }
+
+    /** A pending message and the future that completes when it has been delivered. */
+    private record Pending(String text, TurnToken token, CompletableFuture<Void> delivered) {
+    }
+
+    /** Per-worker delivery state, guarded by its own monitor (single writer per worker). */
+    private static final class Target {
+        final Deque<Pending> queue = new ArrayDeque<>();
+        boolean awaitingPickup;    // sent a message, waiting for the worker to pick it up
+        int injectableSincePickup; // consecutive injectable samples while awaitingPickup
+        boolean awaitingCompletion; // a delivered message's turn is not yet known-complete
+        boolean turnObserved;      // saw a real `working` sample since that delivery (turn ran)
+        int unknownSinceTurn;      // consecutive `unknown` samples while a delegation is outstanding (CB-109)
+        int notReadySincePoll;     // consecutive injectable samples a queued message waited on the readiness gate (CB-114)
+        boolean postTurnPending;   // completion observed; adapter housekeeping has not started yet
+        boolean awaitingPostTurnPickup;
+        boolean postTurnObserved;
+        int injectableSincePostTurnPickup;
+
+        synchronized void add(Pending p) {
+            queue.add(p);
+        }
+    }
+
+    /**
+     * Queue {@code text} for delivery to {@code target} (a herdr {@code terminal_id}). Returns
+     * immediately with a future that completes when the message is actually sent — the worker
+     * may be mid-turn, in which case delivery waits for the next injectable window.
+     *
+     * <p>Uses an atomic map update so a concurrent {@link #drop} cannot slip between "find the
+     * target" and "queue the message" and orphan it in a target it just removed.
+     */
+    public CompletableFuture<Void> enqueue(String target, String text, TurnToken token) {
+        CompletableFuture<Void> delivered = new CompletableFuture<>();
+        Pending p = new Pending(text, token, delivered);
+        targets.compute(target, (_, existing) -> {
+            Target t = (existing != null) ? existing : new Target();
+            t.add(p); // synchronized on the Target monitor — atomic with a concurrent drop
+            return t;
+        });
+        return delivered;
+    }
+
+    /**
+     * Feed a fresh status observation for {@code target}. Delivers the head of the queue iff the
+     * worker is injectable and no earlier message is still awaiting pickup. Serialized per target
+     * so the check and the send cannot race another delivery to the same worker; the delivered
+     * future is completed <em>after</em> the monitor is released so a caller's continuation never
+     * runs on the poller thread while it holds the lock.
+     */
+    public void onStatus(String target, AgentStatus status) {
+        Target t = targets.get(target);
+        if (t == null) return;
+
+        Pending sent = null;
+        RuntimeException sendError = null;
+        boolean turnCompleted = false;
+        boolean turnFailed = false;
+        boolean resubmit = false;
+        boolean startPostTurn = false;
+        List<Pending> notReady = null; // queued messages failed because the worker never became ready
+        synchronized (t) {
+            if (status == AgentStatus.WORKING) {
+                if (t.awaitingPostTurnPickup) {
+                    t.awaitingPostTurnPickup = false;
+                    t.injectableSincePostTurnPickup = 0;
+                    t.postTurnObserved = true;
+                }
+                // Definitive pickup: the worker is busy on our last message, and (if a delivery is
+                // outstanding) a real turn is now confirmed to be running.
+                t.awaitingPickup = false;
+                t.injectableSincePickup = 0;
+                t.unknownSinceTurn = 0;
+                t.notReadySincePoll = 0;
+                if (t.awaitingCompletion) t.turnObserved = true;
+            } else if (status.injectable()) { // IDLE or BLOCKED
+                t.unknownSinceTurn = 0;
+                if (t.awaitingPostTurnPickup) {
+                    if (++t.injectableSincePostTurnPickup >= PICKUP_GRACE_POLLS) {
+                        t.awaitingPostTurnPickup = false;
+                        t.injectableSincePostTurnPickup = 0;
+                    } else {
+                        resubmit = true;
+                    }
+                } else if (t.postTurnObserved) {
+                    t.postTurnObserved = false;
+                }
+                if (t.awaitingPickup) {
+                    if (++t.injectableSincePickup >= PICKUP_GRACE_POLLS) {
+                        // Pickup edge was never sampled (turn faster than the poll, or status lag).
+                        // Release the latch rather than wedge — and give up on synthesizing a
+                        // completion for this message, since without a confirmed `working` we cannot
+                        // trust that a task-processing turn actually ran.
+                        t.awaitingPickup = false;
+                        t.injectableSincePickup = 0;
+                        t.awaitingCompletion = false;
+                        t.turnObserved = false;
+                    } else {
+                        // Delivered but still idle → the worker hasn't picked it up; the submit
+                        // keystroke likely raced the paste (esp. right as the TUI became ready).
+                        // Re-nudge Enter (CB-113) until the worker starts (WORKING) or the grace ends.
+                        resubmit = true;
+                    }
+                }
+                if (!t.awaitingPickup) {
+                    // A confirmed turn (a `working` sample was seen) that has now returned to idle is
+                    // a trustworthy `working → idle` completion boundary.
+                    if (t.awaitingCompletion && t.turnObserved) {
+                        t.awaitingCompletion = false;
+                        t.turnObserved = false;
+                        turnCompleted = true;
+                        if (turnListener.hasPostTurnAction(target)) {
+                            t.postTurnPending = true;
+                            startPostTurn = true;
+                        }
+                    }
+                    // Deliver the next queued message only once the prior turn is fully settled, so a
+                    // completion is never confused with the pickup of the following message — and only
+                    // once the worker is available (CB-113), so we never paste into its boot window.
+                    if (!t.awaitingCompletion && !t.postTurnPending
+                            && !t.awaitingPostTurnPickup && !t.postTurnObserved) {
+                        Pending p = t.queue.peek();
+                        if (p != null && ready.test(target)) {
+                            t.notReadySincePoll = 0;
+                            try {
+                                agents.send(target, p.text());
+                                t.queue.poll();
+                                t.awaitingPickup = true;
+                                t.awaitingCompletion = true;
+                                t.turnObserved = false;
+                                t.injectableSincePickup = 0;
+                                sent = p;
+                            } catch (RuntimeException e) {
+                                // Delivery failed at herdr; drop the poisoned message and surface it
+                                // rather than blocking the queue behind it.
+                                t.queue.poll();
+                                sent = p;
+                                sendError = e;
+                            }
+                        } else if (p != null && ++t.notReadySincePoll >= READINESS_GRACE_POLLS) {
+                            // The worker has been idle-but-not-ready for the whole grace: its Claude
+                            // never connected the bridge MCP (crashed during boot, or wedged on a
+                            // startup prompt). The readiness gate would hold this message forever, so
+                            // fail every queued message and release the target (CB-114) instead of
+                            // polling it indefinitely with the caller's future never completing.
+                            notReady = new ArrayList<>(t.queue);
+                            log.warn("readiness grace for {} expired after {} polls ({}s): target never "
+                                    + "became deliverable, so failing {} queued message(s) that never "
+                                    + "reached its pane",
+                                    target, READINESS_GRACE_POLLS,
+                                    READINESS_GRACE_POLLS * POLL_INTERVAL_MILLIS / 1000, notReady.size());
+                            t.queue.clear();
+                            t.notReadySincePoll = 0;
+                        }
+                    }
+                }
+            } else {
+                // UNKNOWN (or any other non-injectable, non-working): not a safe window nor a
+                // reliable pickup signal, so we never deliver or release the pickup latch here. But
+                // an outstanding delegation whose worker has gone unresponsive — stuck in a state
+                // herdr can't classify (CB-109) — will never yield a working→idle boundary. After a
+                // sustained streak, declare it failed so the awaiting send resolves rather than
+                // riding out the async timeout. (This also frees a delivery that wedged before it
+                // was ever picked up, which the injectable-only pickup grace could never release.)
+                if (t.awaitingCompletion && ++t.unknownSinceTurn >= TURN_STALL_GRACE_POLLS) {
+                    t.awaitingPickup = false;
+                    t.awaitingCompletion = false;
+                    t.turnObserved = false;
+                    t.unknownSinceTurn = 0;
+                    turnFailed = true;
+                }
+            }
+
+            // Reclaim the entry once the worker is fully quiescent (nothing queued, no pickup or
+            // completion awaited), so the map cannot grow without bound across short-lived workers.
+            if (t.queue.isEmpty() && !t.awaitingPickup && !t.awaitingCompletion
+                    && !t.postTurnPending && !t.awaitingPostTurnPickup && !t.postTurnObserved) {
+                targets.remove(target, t);
+            }
+        }
+
+        // Fire listeners / herdr calls after releasing the monitor so nothing runs on the poller
+        // thread while it holds the target lock.
+        if (resubmit) {
+            try {
+                agents.submit(target); // nudge a raced Enter so the pending paste submits
+            } catch (RuntimeException e) {
+                log.debug("resubmit to {} failed (will retry next poll): {}", target, e.getMessage());
+            }
+        }
+        if (notReady != null) {
+            // Worker never became available: forget its (never-set) readiness, unblock every queued
+            // caller, and route the awaiting send through the same failure path as a stalled turn so
+            // a blocking or async waiter resolves WORKER_FAILED rather than riding out the timeout.
+            forget.accept(target);
+            RuntimeException cause = new IllegalStateException(
+                    target + " never became available (no bridge MCP connection within the boot window)");
+            for (Pending p : notReady) {
+                p.delivered().completeExceptionally(cause);
+            }
+            turnListener.onTurnFailed(target);
+        }
+        if (turnCompleted) {
+            if (startPostTurn) {
+                boolean started = turnListener.onTurnCompleteWithPostAction(target);
+                synchronized (t) {
+                    t.postTurnPending = false;
+                    if (started) {
+                        t.awaitingPostTurnPickup = true;
+                        t.injectableSincePostTurnPickup = 0;
+                    }
+                    if (t.queue.isEmpty() && !t.awaitingPostTurnPickup) {
+                        targets.remove(target, t);
+                    }
+                }
+            } else {
+                turnListener.onTurnComplete(target);
+            }
+        }
+        if (turnFailed) {
+            turnListener.onTurnFailed(target);
+        }
+        if (sent != null) {
+            if (sendError != null) {
+                log.warn("inject to {} failed, dropped message: {}", target, sendError.getMessage());
+                sent.delivered().completeExceptionally(sendError);
+            } else {
+                // Baseline the pane's pre-turn content so a misattributed completion (no new output)
+                // can't resolve this send with the previous turn's stale answer (CB-115).
+                turnListener.onDelivered(target, sent.token());
+                sent.delivered().complete(null);
+            }
+        }
+    }
+
+    /**
+     * Targets the poller must keep sampling: those with a queued message, an awaited pickup, or an
+     * awaited turn completion (so the {@code working → idle} boundary is observed).
+     */
+    public Set<String> activeTargets() {
+        return targets.entrySet().stream()
+                .filter(e -> {
+                    synchronized (e.getValue()) {
+                        Target t = e.getValue();
+                        return !t.queue.isEmpty() || t.awaitingPickup || t.awaitingCompletion
+                                || t.postTurnPending || t.awaitingPostTurnPickup || t.postTurnObserved;
+                    }
+                })
+                .map(java.util.Map.Entry::getKey)
+                .collect(Collectors.toSet());
+    }
+
+    /**
+     * Forget a target whose worker is gone, failing every still-queued message so awaiting callers
+     * unblock instead of hanging forever. If a message had already been <em>delivered</em> but its
+     * turn was not yet resolved (CB-110 — the worker vanished mid-turn, e.g. its pane crashed), fire
+     * {@link TurnListener#onTurnFailed} for it: a delivered message is no longer in the queue, so
+     * failing queued waiters alone would leave that send's rendezvous hanging until the async
+     * timeout. Futures and listeners are completed after the monitor is released.
+     */
+    public void drop(String target, Throwable cause) {
+        Target t = targets.remove(target);
+        if (t == null) return;
+        List<Pending> pending;
+        boolean hadDeliveredTurn;
+        synchronized (t) {
+            pending = new ArrayList<>(t.queue);
+            t.queue.clear();
+            hadDeliveredTurn = t.awaitingCompletion;
+            t.awaitingCompletion = false;
+            t.awaitingPickup = false;
+            t.postTurnPending = false;
+            t.awaitingPostTurnPickup = false;
+            t.postTurnObserved = false;
+        }
+        log.warn("{} is gone, dropping its queue: {} message(s) failed{}; cause: {}", target,
+                pending.size(),
+                hadDeliveredTurn ? " (including one turn already in flight whose completion was never confirmed)" : "",
+                cause.getMessage());
+        forget.accept(target); // the worker is gone — clear its readiness/presence too (CB-114)
+        for (Pending p : pending) {
+            p.delivered().completeExceptionally(cause);
+        }
+        // A queued send has no in-flight record, while a delivered turn does. CompletionResolver
+        // handles both forms and resolves its waiter at most once.
+        turnListener.onTurnFailed(target, cause.getMessage());
+    }
+}

bridged/src/main/java/dev/ltms/fleet/inject/MemberPresence.java

@@ -0,0 +1,38 @@
+package dev.ltms.fleet.inject;
+
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.Set;
+
+/**
+ * Tracks which workers are <em>available</em> — their Claude has booted and connected its MCP client
+ * to the bridge (CB-113). This is the reliable readiness signal, unlike herdr's {@code agent_status},
+ * which reports {@code idle} for a worker whose Claude is still booting. Delivering into that boot
+ * window pastes into a not-yet-ready TUI (the text is lost) and wedges the worker's delivery state,
+ * so the {@link Injector} holds the first delivery until the worker is present here.
+ *
+ * <p>Populated from the MCP transport: any MCP request whose connection resolves to a worker terminal
+ * marks that worker present (its {@code initialize} is the first such contact). A worker that never
+ * mounts the bridge MCP is never marked present — its sends stay queued until they time out, which is
+ * correct (it could not have replied anyway).
+ */
+public class MemberPresence {
+
+    private final Set<String> present = ConcurrentHashMap.newKeySet();
+
+    /** Record that {@code terminal}'s worker has connected its MCP client (is available). */
+    public void markPresent(String terminal) {
+        if (terminal != null && !terminal.isBlank()) {
+            present.add(terminal);
+        }
+    }
+
+    /** Whether {@code terminal}'s worker is available (has been seen on the bridge MCP). */
+    public boolean isPresent(String terminal) {
+        return present.contains(terminal);
+    }
+
+    /** Forget a torn-down worker so its terminal id does not linger as "present". */
+    public void forget(String terminal) {
+        present.remove(terminal);
+    }
+}

bridged/src/main/java/dev/ltms/fleet/inject/StatusPoller.java

@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -23,13 +23,20 @@ public final class StatusPoller {
 
     private final AgentControl agents;
     private final Injector injector;
+    private final StatusRefiner refiner;
     private final long intervalMillis;
     private volatile boolean running;
     private Thread thread;
 
     public StatusPoller(AgentControl agents, Injector injector, long intervalMillis) {
+        this(agents, injector, new StatusRefiner(agents), intervalMillis);
+    }
+
+    public StatusPoller(AgentControl agents, Injector injector, StatusRefiner refiner,
+                        long intervalMillis) {
         this.agents = agents;
         this.injector = injector;
+        this.refiner = refiner;
         this.intervalMillis = intervalMillis;
     }
 
@@ -47,7 +54,9 @@ public final class StatusPoller {
             for (String target : active) {
                 if (!running) return;
                 try {
-                    AgentStatus status = agents.status(target);
+                    // herdr's agent_status can misreport a settled worker as `unknown`; refine it
+                    // against the pane content before it drives delivery/completion (CB-115).
+                    AgentStatus status = refiner.refine(target, agents.status(target));
                     injector.onStatus(target, status);
                 } catch (HerdrException e) {
                     // The worker's agent is gone — stop trying and unblock its waiters.

bridged/src/main/java/dev/ltms/fleet/inject/StatusRefiner.java

@@ -0,0 +1,89 @@
+package dev.ltms.fleet.inject;
+
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Refines an unreliable {@link AgentStatus#UNKNOWN} into a real state by reading the worker's
+ * terminal content (CB-115).
+ *
+ * <p>Some workers' panes are misclassified by herdr as {@code unknown} even when the worker is
+ * plainly settled at an idle prompt (empty {@code ❯}, "auto mode on" footer, a completed
+ * {@code ⏺} answer above). Left as {@code UNKNOWN} that both <em>wedges delivery</em> — the
+ * status-gated {@link Injector} only injects into an {@link AgentStatus#injectable} worker — and
+ * <em>mis-fires the CB-109 stall failure</em> on a worker that has actually answered. herdr's
+ * {@code agent_status} is a heuristic; the pane content is the ground truth.
+ *
+ * <p>The refinement only ever runs on a raw {@code UNKNOWN} sample (every other status is trusted
+ * as-is), so a healthy worker adds zero extra herdr traffic; a persistently-{@code unknown} worker
+ * costs one extra {@code agent.read} per poll while it has work outstanding. Classification is
+ * deliberately conservative — it upgrades {@code UNKNOWN} to {@link AgentStatus#WORKING} or
+ * {@link AgentStatus#IDLE} only on a clear signal, and leaves a genuinely unclassifiable screen
+ * (e.g. a wedged error state) as {@code UNKNOWN} so the CB-109 stall path can still fail it.
+ */
+public final class StatusRefiner {
+
+    private static final Logger log = LoggerFactory.getLogger(StatusRefiner.class);
+
+    /**
+     * herdr {@code agent.read} source used to inspect the pane. {@code detection} is the region
+     * herdr itself uses for status detection (the prompt/footer tail), which is exactly what we
+     * need to tell "idle at prompt" from "mid-turn".
+     */
+    static final String PROBE_SOURCE = "detection";
+
+    private final AgentControl agents;
+
+    public StatusRefiner(AgentControl agents) {
+        this.agents = agents;
+    }
+
+    /**
+     * Return a trustworthy status for {@code target}. Any non-{@code UNKNOWN} {@code raw} is returned
+     * unchanged; an {@code UNKNOWN} triggers a pane read and content classification. A read failure
+     * leaves it {@code UNKNOWN} (the safe default: no delivery, and the stall path still applies).
+     */
+    public AgentStatus refine(String target, AgentStatus raw) {
+        if (raw != AgentStatus.UNKNOWN) return raw;
+        String pane;
+        try {
+            pane = agents.read(target, PROBE_SOURCE);
+        } catch (RuntimeException e) {
+            log.debug("status refine read for {} failed; leaving UNKNOWN: {}", target, e.getMessage());
+            return AgentStatus.UNKNOWN;
+        }
+        AgentStatus refined = classify(pane);
+        if (refined != AgentStatus.UNKNOWN) {
+            log.debug("refined {} from UNKNOWN to {} via pane content", target, refined);
+        }
+        return refined;
+    }
+
+    /**
+     * Classify a Claude Code TUI pane tail. Package-private and pure so it is unit-testable without
+     * herdr.
+     *
+     * <ul>
+     *   <li>An active-generation marker ({@code esc to interrupt}) ⇒ {@link AgentStatus#WORKING} —
+     *       never inject here.</li>
+     *   <li>Otherwise, an interactive input prompt with no active-turn marker ({@code ❯}, the
+     *       {@code │ >} input box, or the idle {@code auto mode} / shortcuts footer) ⇒
+     *       {@link AgentStatus#IDLE} — settled and safe to inject / a completed turn.</li>
+     *   <li>Anything else (blank, or an unrecognizable screen) ⇒ {@link AgentStatus#UNKNOWN}.</li>
+     * </ul>
+     */
+    static AgentStatus classify(String pane) {
+        if (pane == null || pane.isBlank()) return AgentStatus.UNKNOWN;
+        String lower = pane.toLowerCase();
+        // Claude Code shows "(esc to interrupt)" only while a turn is actively generating.
+        if (lower.contains("esc to interrupt")) return AgentStatus.WORKING;
+        // A settled, ready input prompt with no active-turn marker = idle-at-prompt.
+        boolean readyPrompt = pane.contains("❯")
+                || pane.contains("│ >")
+                || lower.contains("auto mode on")
+                || lower.contains("? for shortcuts");
+        return readyPrompt ? AgentStatus.IDLE : AgentStatus.UNKNOWN;
+    }
+}

bridged/src/main/java/dev/ltms/fleet/inject/TurnListener.java

@@ -0,0 +1,68 @@
+package dev.ltms.fleet.inject;
+
+import dev.ltms.fleet.msg.TurnToken;
+
+/**
+ * Notified when a worker's delegated turn is observed to complete — a confirmed
+ * {@code WORKING → IDLE} transition after a delivery. This is the CB-106 completion signal the
+ * {@code CompletionResolver} uses to resolve a blocked send whose worker never called
+ * {@code fleet_reply}. Kept as a seam so the {@link Injector} needs no dependency on the message
+ * layer and stays unit-testable with a capturing fake.
+ */
+@FunctionalInterface
+public interface TurnListener {
+
+    /** A worker's delegated turn finished (worker returned to idle after visibly working). */
+    void onTurnComplete(String target);
+
+    /**
+     * Whether completion must pause ordinary delivery while adapter-specific housekeeping starts.
+     * This is queried before the injector considers the next queued message, closing the same-tick
+     * ordering gap. Implementations must not mutate state here.
+     */
+    default boolean hasPostTurnAction(String target) {
+        return false;
+    }
+
+    /**
+     * Complete the delegated turn and start its non-turn housekeeping operation.
+     *
+     * @return true when the injector must observe that operation settle before the next delivery
+     */
+    default boolean onTurnCompleteWithPostAction(String target) {
+        onTurnComplete(target);
+        return false;
+    }
+
+    /**
+     * A worker that visibly ran a delegated turn then wedged in a non-idle, non-working state
+     * (CB-109) — e.g. an error screen herdr classifies as {@code unknown} — so no
+     * {@code working → idle} completion boundary will ever arrive. A default no-op keeps this a
+     * functional interface; the completion resolver overrides it to fail the awaiting send.
+     */
+    default void onTurnFailed(String target) {
+    }
+
+    /**
+     * As {@link #onTurnFailed(String)}, carrying the reason a worker became unreachable. The default
+     * keeps existing listeners working while allowing the completion resolver to report a useful cause.
+     */
+    default void onTurnFailed(String target, String reason) {
+        onTurnFailed(target);
+    }
+
+    /**
+     * A message was just delivered into {@code target}'s pane (CB-115). Fired so the completion
+     * resolver can snapshot the pane's pre-turn content: a later {@link #onTurnComplete} whose
+     * scrape is unchanged from this baseline is a <em>misattributed</em> boundary (e.g. the prior
+     * turn's wind-down sampled as this turn's completion on rapid back-to-back sends) and must not
+     * resolve the send with the previous turn's stale answer. A default no-op keeps the interface
+     * functional for callers that don't scrape.
+     */
+    default void onDelivered(String target, TurnToken token) {
+    }
+
+    /** No-op default for callers that only need delivery, not completion signalling. */
+    TurnListener NOOP = _ -> {
+    };
+}

bridged/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -0,0 +1,294 @@
+package dev.ltms.fleet.lead;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.Tab;
+import dev.ltms.fleet.herdr.Workspace;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.stream.Collectors;
+import dev.ltms.fleet.peer.PeerLauncher;
+
+/**
+ * Starts the leads {@code fleet.leaders:} declares, when none is already running (CB-558).
+ *
+ * <p><strong>A lead is not a member, and this class exists to keep it that way.</strong> Every other
+ * spawn path in the daemon goes through {@code HerdrPeerLauncher}, which does three things a lead
+ * must never receive:
+ * <ol>
+ *   <li>it appends the <em>reply charter</em> — "you are an off-subscription worker … end every turn
+ *       with {@code fleet_reply}". A lead is the orchestrator; telling it that it is a worker is
+ *       exactly backwards.</li>
+ *   <li>it registers the session with {@code SessionManager}, which subjects it to the idle reaper,
+ *       the context cap and the shutdown drain. An idle lead is the normal state of a lead, so the
+ *       reaper would kill the orchestrator for doing its job.</li>
+ *   <li>it can move a peer off the subscription via {@code ANTHROPIC_BASE_URL}. A lead stays on the
+ *       operator's subscription, always.</li>
+ * </ol>
+ * So this launcher talks to {@link AgentControl}/{@link WorkspaceControl} directly. The duplication
+ * with the member launchers (argv and env assembly) is deliberate and is the cheaper half of the
+ * trade: entangling the worker path with a not-a-worker case is how the three rules above get
+ * broken later, quietly.
+ *
+ * <p><strong>Liveness, and the label round-trip.</strong> {@code LeadTabScanner} used to be able to
+ * promise that bridged never writes a lead label. That is no longer true — an auto-launched lead is
+ * labelled by this class, and the scanner reads that label back. The risk this opens is not
+ * privilege escalation (the tab label never granted anything a pane could take for itself; see that
+ * class's javadoc), but <em>staleness</em>: a label left behind by a crashed session would otherwise
+ * read as a live lead forever, and the lead would never be relaunched. So a lead counts as live only
+ * when herdr also reports a <em>running agent</em> in that tab — see {@link #liveLeads}. A labelled
+ * tab with no agent in it is not a lead.
+ */
+public final class LeadLauncher {
+
+    private static final Logger log = LoggerFactory.getLogger(LeadLauncher.class);
+
+    private final AgentControl agents;
+    private final WorkspaceControl spaces;
+    private final FleetConfig cfg;
+
+    /**
+     * @param agents herdr agent control (start, list)
+     * @param spaces workspace / tab control (ensure, create, label, list)
+     * @param cfg    the loaded config — {@code fleet.leaders}, {@code profiles} and each lead's tab
+     */
+    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, FleetConfig cfg) {
+        this.agents = agents;
+        this.spaces = spaces;
+        this.cfg = cfg;
+    }
+
+    /**
+     * Bring every declared lead up to its {@code instances} count, and return how many were started.
+     *
+     * <p>Never throws: a daemon that cannot start a lead must still serve. herdr being unreachable,
+     * a profile that does not exist, a failed {@code agent.start} — each is logged and skipped, and
+     * the remaining leads are still attempted.
+     */
+    public int ensureLeads() {
+        Map<String, FleetConfig.Leader> leaders = cfg.fleet().leaders();
+        if (leaders.isEmpty()) {
+            return 0;
+        }
+
+        Map<String, Integer> live;
+        try {
+            live = liveLeads(leaders);
+        } catch (HerdrException e) {
+            // Counting is the whole safety mechanism against double-spawning. If we cannot count, we
+            // must not guess — spawning a second orchestrator is worse than starting none.
+            log.warn("lead auto-launch skipped — cannot tell which leads are live: {}", e.getMessage());
+            return 0;
+        }
+
+        int started = 0;
+        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
+            String name = e.getKey();
+            FleetConfig.Leader lead = e.getValue();
+            int running = live.getOrDefault(name, 0);
+            int wanted = lead.instances();
+
+            if (running >= wanted) {
+                log.info("lead '{}': {} live, {} wanted — nothing to start", name, running, wanted);
+                continue;
+            }
+            if (!lead.isCreatable()) {
+                // A lead with a `tab:` but no `profile:` is recognise-only by design: the operator
+                // opens it by hand. Say so once rather than looking like a silent failure.
+                log.info("lead '{}' is not live, and names no profile — it can be recognised but not "
+                        + "launched. Add `profile:` under fleet.leaders.{} to have bridged start it.",
+                        name, name);
+                continue;
+            }
+
+            FleetConfig.Profile profile = cfg.profiles().get(lead.profile());
+            if (profile == null) {
+                log.warn("lead '{}' names profile '{}', which is not configured — not launching",
+                        name, lead.profile());
+                continue;
+            }
+
+            for (int i = running; i < wanted; i++) {
+                if (launch(name, lead, profile)) {
+                    started++;
+                }
+            }
+        }
+        return started;
+    }
+
+    /**
+     * How many live leads exist per configured name: a running agent in a tab labelled with that
+     * lead's exact {@code tab} (CB-579). Member workspaces are excluded, exactly as the scanner
+     * excludes them: a member must not be counted as a lead because it happens to sit in a matching
+     * tab.
+     *
+     * <p>There used to be a second path here — a running agent on the terminal a
+     * {@code fleet.leaders.<name>.terminal} pin named, for a lead opened and pinned by hand. That
+     * pin is retired: {@code tab} is now the only field identity depends on, and {@link Agent}
+     * already carries {@link Agent#tabId()} directly, so a hand-opened lead is found the same way an
+     * auto-launched one is — by labelling its tab to match.
+     */
+    private Map<String, Integer> liveLeads(Map<String, FleetConfig.Leader> leaders) {
+        Set<String> memberSpaces = cfg.profiles().values().stream()
+                .map(FleetConfig.Profile::workspace)
+                .filter(w -> w != null && !w.isBlank())
+                .collect(Collectors.toSet());
+
+        // tabId → the lead name its label declares.
+        Map<String, String> nameByTab = new LinkedHashMap<>();
+        for (Workspace ws : spaces.listWorkspaces()) {
+            if (ws.workspaceId() == null || memberSpaces.contains(ws.label())) {
+                continue;
+            }
+            for (Tab tab : spaces.listTabs(ws.workspaceId())) {
+                String declared = leadNameOf(tab.label(), leaders);
+                if (declared != null && tab.tabId() != null) {
+                    nameByTab.put(tab.tabId(), declared);
+                }
+            }
+        }
+
+        Map<String, Integer> counts = new LinkedHashMap<>();
+        for (Agent a : agents.list()) {
+            String name = nameByTab.get(a.tabId());
+            if (name != null) {
+                counts.merge(name, 1, Integer::sum);
+            }
+        }
+        return counts;
+    }
+
+    /**
+     * The configured lead a tab label names, or {@code null} for a label that names none.
+     *
+     * <p>Matched exactly (case-insensitively) against each lead's configured {@code tab}, so an
+     * operator's {@code "lead: something-else"} tab is not mistaken for a configured lead.
+     */
+    private String leadNameOf(String label, Map<String, FleetConfig.Leader> leaders) {
+        if (label == null) {
+            return null;
+        }
+        String l = label.strip();
+        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
+            String tab = e.getValue().tabLabel();
+            if (tab != null && l.equalsIgnoreCase(tab.strip())) {
+                return e.getKey();
+            }
+        }
+        return null;
+    }
+
+    /** Start one lead. Returns false (having logged) rather than throwing on any failure. */
+    private boolean launch(String name, FleetConfig.Leader lead, FleetConfig.Profile profile) {
+        String label = lead.tabLabel();
+        String cwd = (lead.cwd() == null || lead.cwd().isBlank())
+                ? System.getProperty("user.dir") : lead.cwd();
+
+        Tab.Created tab = null;
+        try {
+            Workspace ws = spaces.ensureWorkspace(lead.workspace());
+            tab = spaces.createTab(ws.workspaceId(), cwd, leadEnv(profile));
+            if (tab.rootPaneId() == null) {
+                throw new IllegalStateException("tab " + tab.tab().tabId()
+                        + " came back with no seed pane — nowhere to start the lead");
+            }
+            // Same shape as the member launchers: herdr resolves the executable from `kind`, so
+            // argv[0] (the configured launcher, e.g. `ccs`) is dropped and only the rest is passed.
+            List<String> argv = leadArgv(profile);
+            Agent started = agents.start("lead-" + name, herdrKind(profile),
+                    argv.isEmpty() ? argv : argv.subList(1, argv.size()), tab.rootPaneId());
+
+            // Label AFTER the start succeeds. A label written before would survive a failed start
+            // and then read back as a live lead on the next boot, which is the exact staleness the
+            // agent-liveness check exists to prevent — no need to create the case ourselves.
+            spaces.renameTab(tab.tab().tabId(), label);
+
+            log.info("lead '{}' launched: profile={} tab={} pane={} terminal={} label='{}' cwd={}",
+                    name, profile.profile(), tab.tab().tabId(), started.paneId(),
+                    started.terminalId(), label, cwd);
+            return true;
+        } catch (RuntimeException e) {
+            log.warn("lead '{}' failed to launch on profile '{}': {}",
+                    name, profile.profile(), e.getMessage());
+            if (tab != null && tab.tab() != null && tab.tab().tabId() != null) {
+                try {
+                    spaces.closeTab(tab.tab().tabId());
+                } catch (RuntimeException cleanup) {
+                    log.warn("could not close the orphaned lead tab {}: {}",
+                            tab.tab().tabId(), cleanup.getMessage());
+                }
+            }
+            return false;
+        }
+    }
+
+    /**
+     * The herdr agent kind for this profile — the same value the matching member adapter passes, so
+     * herdr resolves the same executable for a lead as it does for a member on that backend.
+     */
+    private static String herdrKind(FleetConfig.Profile profile) {
+        return profile.isOpenCode() ? "opencode" : "claude";
+    }
+
+    /**
+     * The lead's argv: the profile's own command, the model pin, and the bridge MCP mount.
+     *
+     * <p>No {@code --append-system-prompt}. That flag carries the worker reply charter, and a lead
+     * is not a worker — it reads its orchestration rules from the project's {@code CLAUDE.md} like
+     * any other primary. This is the single most important difference from the member launchers;
+     * do not "unify" it back.
+     */
+    private List<String> leadArgv(FleetConfig.Profile profile) {
+        List<String> argv = new ArrayList<>(profile.argv());
+        if (profile.hasMcp()) {
+            argv.add("--mcp-config");
+            argv.add("{\"mcpServers\":{\"" + PeerLauncher.MCP_MOUNT_NAME
+                    + "\":{\"type\":\"http\",\"url\":\""
+                    + profile.mcpUrl() + "\"}}}");
+        }
+        // Appended last, for the same reason the member launcher does it (CB-533): the argv is
+        // usually a wrapper such as `ccs <profile>`, which exports its own model family over
+        // whatever it inherited, and --model outranks the environment.
+        if (profile.model() != null && !profile.model().isBlank()) {
+            argv.add("--model");
+            argv.add(profile.model());
+        }
+        return argv;
+    }
+
+    /**
+     * The lead's environment: the profile's {@code env:} block, and nothing that could move it off
+     * the subscription.
+     *
+     * <p>{@code ANTHROPIC_BASE_URL} and {@code ANTHROPIC_AUTH_TOKEN} are stripped unconditionally —
+     * not defaulted, not guarded, stripped. A lead runs on the operator's subscription by
+     * definition, so there is no configuration under which pointing it elsewhere is correct, and a
+     * profile that carries them (a member profile reused as a lead's backend) must not leak them in.
+     */
+    private Map<String, String> leadEnv(FleetConfig.Profile profile) {
+        Map<String, String> out = new LinkedHashMap<>();
+        if (profile.env() != null) {
+            out.putAll(profile.env());
+        }
+        out.remove("ANTHROPIC_BASE_URL");
+        out.remove("ANTHROPIC_AUTH_TOKEN");
+        if (profile.configDir() != null && !profile.configDir().isBlank()) {
+            out.put("CLAUDE_CONFIG_DIR", profile.configDir());
+        }
+        // Deliberately no git token: a lead reviews and merges through the operator's own
+        // credentials, and never needs the scoped write:repository token a member is granted.
+        out.values().removeIf(Objects::isNull);
+        return out;
+    }
+}

bridged/src/main/java/dev/ltms/fleet/logging/McpCancelledNotificationFilter.java

@@ -0,0 +1,30 @@
+package dev.ltms.fleet.logging;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.turbo.TurboFilter;
+import ch.qos.logback.core.spi.FilterReply;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.slf4j.Marker;
+
+/** Suppresses only the SDK warning for the normal MCP cancellation notification. */
+public final class McpCancelledNotificationFilter extends TurboFilter {
+
+    static final String LOGGER = "io.modelcontextprotocol.spec.McpStreamableServerSession";
+    static final String UNHANDLED_NOTIFICATION = "No handler registered for notification method: {}";
+
+    @Override
+    public FilterReply decide(Marker marker, Logger logger, Level level, String format, Object[] params,
+                              Throwable throwable) {
+        if (level == Level.WARN
+                && LOGGER.equals(logger.getName())
+                && UNHANDLED_NOTIFICATION.equals(format)
+                && params != null
+                && params.length == 1
+                && params[0] instanceof McpSchema.JSONRPCNotification notification
+                && "notifications/cancelled".equals(notification.method())) {
+            return FilterReply.DENY;
+        }
+        return FilterReply.NEUTRAL;
+    }
+}

bridged/src/main/java/dev/ltms/fleet/mcp/ConnectionIdentity.java

@@ -0,0 +1,66 @@
+package dev.ltms.fleet.mcp;
+
+import dev.ltms.fleet.herdr.PaneLocator;
+
+/**
+ * Resolves <em>who is calling</em> an MCP tool from the connection alone — the anti-spoofing
+ * identity model of the MCP contract. It ties the connection's loopback peer PID (from the OS)
+ * to a herdr agent pane (from herdr), yielding the caller's worker {@code terminal_id}. A caller
+ * that maps to no worker pane — the primary, or an off-host client — resolves to {@code null}.
+ *
+ * <p>Both sources are authoritative and unforgeable: the OS reports the real connecting PID, and
+ * herdr owns the PID→pane mapping. A worker cannot claim to be another worker, nor the primary.
+ * Single-host only (the herd shares the {@code bridged} host); the token path is the split-host
+ * fallback.
+ */
+public final class ConnectionIdentity {
+
+    private final PaneLocator panes;
+    private final PeerPidLookup pids;
+    private final ProcessCwdLookup cwds;
+
+    /** Identity only (no cwd resolution — {@link #cwdForPid} returns {@code null}). */
+    public ConnectionIdentity(PaneLocator panes, PeerPidLookup pids) {
+        this(panes, pids, _ -> null);
+    }
+
+    /** Identity plus cwd resolution (CB-112 — inherit the primary's directory on spawn). */
+    public ConnectionIdentity(PaneLocator panes, PeerPidLookup pids, ProcessCwdLookup cwds) {
+        this.panes = panes;
+        this.pids = pids;
+        this.cwds = cwds;
+    }
+
+    /**
+     * The caller resolved from the connection: its worker {@code terminal} (or {@code null} for the
+     * primary / an off-host client) and its {@code pid} (or {@code -1} if not resolvable).
+     */
+    public record Caller(String terminal, long pid) {
+    }
+
+    /** Resolve the caller's terminal and PID from one peer-PID lookup. */
+    public Caller resolve(String remoteAddr, int remotePort) {
+        if (!isLoopback(remoteAddr)) {
+            return new Caller(null, -1); // only same-host callers can be workers
+        }
+        long pid = pids.pidForLocalPort(remotePort);
+        return new Caller(panes.terminalForPid(pid), pid);
+    }
+
+    /**
+     * The calling worker's {@code terminal_id}, or {@code null} if the caller is not a known
+     * on-host worker (treat as the primary).
+     */
+    public String callerTerminal(String remoteAddr, int remotePort) {
+        return resolve(remoteAddr, remotePort).terminal();
+    }
+
+    /** The working directory of {@code pid} (the primary's cwd on an MCP spawn), or {@code null}. */
+    public String cwdForPid(long pid) {
+        return pid > 0 ? cwds.cwdForPid(pid) : null;
+    }
+
+    private static boolean isLoopback(String addr) {
+        return "127.0.0.1".equals(addr) || "::1".equals(addr) || "0:0:0:0:0:0:0:1".equals(addr);
+    }
+}

bridged/src/main/java/dev/ltms/fleet/mcp/LsofPeerPidLookup.java

@@ -0,0 +1,58 @@
+package dev.ltms.fleet.mcp;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.TimeUnit;
+
+/**
+ * {@link PeerPidLookup} via {@code lsof} (present on macOS and Linux). For a loopback TCP source
+ * {@code port}, both the client and this daemon appear on that port — so we exclude our own PID
+ * and take the other end, which is the calling process.
+ */
+public final class LsofPeerPidLookup implements PeerPidLookup {
+
+    private static final Logger log = LoggerFactory.getLogger(LsofPeerPidLookup.class);
+
+    private final long selfPid = ProcessHandle.current().pid();
+
+    @Override
+    public long pidForLocalPort(int port) {
+        try {
+            Process p = new ProcessBuilder("lsof", "-nP", "-FpP", "-iTCP:" + port)
+                    .redirectErrorStream(true).start();
+            long found = -1;
+            try (BufferedReader r = new BufferedReader(
+                    new InputStreamReader(p.getInputStream(), StandardCharsets.UTF_8))) {
+                long current = -1;
+                String line;
+                // -Fp emits records: a 'p<pid>' line, then the ports/files under that pid.
+                while ((line = r.readLine()) != null) {
+                    if (line.startsWith("p")) {
+                        current = parse(line.substring(1));
+                    } else if (current > 0 && current != selfPid) {
+                        found = current; // first process on this port that isn't us = the client
+                    }
+                }
+            }
+            if (!p.waitFor(2, TimeUnit.SECONDS)) {
+                p.destroyForcibly();
+            }
+            return found;
+        } catch (Exception e) {
+            log.debug("lsof peer-pid lookup for port {} failed: {}", port, e.getMessage());
+            return -1;
+        }
+    }
+
+    private static long parse(String s) {
+        try {
+            return Long.parseLong(s.trim());
+        } catch (NumberFormatException e) {
+            return -1;
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/mcp/LsofProcessCwdLookup.java

@@ -0,0 +1,48 @@
+package dev.ltms.fleet.mcp;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.TimeUnit;
+
+/**
+ * {@link ProcessCwdLookup} via {@code lsof} (present on macOS and Linux): {@code lsof -a -p <pid>
+ * -d cwd -Fn} prints the process's cwd on the {@code n…} line. Used to inherit the primary's
+ * working directory for a spawned worker (CB-112).
+ */
+public final class LsofProcessCwdLookup implements ProcessCwdLookup {
+
+    private static final Logger log = LoggerFactory.getLogger(LsofProcessCwdLookup.class);
+
+    @Override
+    public String cwdForPid(long pid) {
+        if (pid <= 0) {
+            return null;
+        }
+        try {
+            Process p = new ProcessBuilder("lsof", "-a", "-p", Long.toString(pid), "-d", "cwd", "-Fn")
+                    .redirectErrorStream(true).start();
+            String cwd = null;
+            try (BufferedReader r = new BufferedReader(
+                    new InputStreamReader(p.getInputStream(), StandardCharsets.UTF_8))) {
+                String line;
+                while ((line = r.readLine()) != null) {
+                    if (line.startsWith("n")) { // 'n<path>' is the file-name field for the cwd fd
+                        cwd = line.substring(1);
+                        break;
+                    }
+                }
+            }
+            if (!p.waitFor(2, TimeUnit.SECONDS)) {
+                p.destroyForcibly();
+            }
+            return (cwd == null || cwd.isBlank()) ? null : cwd;
+        } catch (Exception e) {
+            log.debug("lsof cwd lookup for pid {} failed: {}", pid, e.getMessage());
+            return null;
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/mcp/PeerPidLookup.java

@@ -0,0 +1,13 @@
+package dev.ltms.fleet.mcp;
+
+/**
+ * Resolves the OS PID that owns a loopback TCP source port — the OS half of connection-based MCP
+ * identity. Java exposes no peer PID for a TCP socket, so this shells out. Injectable so
+ * {@link ConnectionIdentity} is testable without a real connection.
+ */
+@FunctionalInterface
+public interface PeerPidLookup {
+
+    /** The PID whose socket has local (source) {@code port} on loopback, or {@code -1} if unknown. */
+    long pidForLocalPort(int port);
+}

bridged/src/main/java/dev/ltms/fleet/mcp/PrimaryRegistry.java

@@ -0,0 +1,117 @@
+package dev.ltms.fleet.mcp;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicReference;
+
+/**
+ * Single-slot, thread-safe registry for the primary's herdr {@code terminal_id}.
+ *
+ * <p>Populated from the caller terminal of orchestration-side MCP tools
+ * ({@code fleet_send}, {@code fleet_spawn}) — tools that only the primary calls.
+ * A pinned terminal (from config) seeds the registry at construction and makes
+ * subsequent {@link #record(String)} calls no-ops.
+ *
+ * <p>The push loop ({@code ReplyPushLoop}) uses {@link #isKnown()} to decide
+ * whether active nudging is possible; an empty registry means the primary is
+ * off-host or non-herdr and delivery falls back to pull.
+ */
+public final class PrimaryRegistry {
+
+    private static final Logger log = LoggerFactory.getLogger(PrimaryRegistry.class);
+
+    private final AtomicReference<String> terminal = new AtomicReference<>();
+    private final boolean pinned;
+
+    /**
+     * CB-532: worker terminal → the lead that delegated to it. The single slot above answers "who is
+     * THE primary", a question with no correct answer once two leads orchestrate the same fleet:
+     * whichever called {@code fleet_send} first captured every nudge, including nudges for the
+     * other lead's delegations. This map answers the question that actually matters — "who is
+     * waiting on THIS worker" — and is what lets {@code primary.terminal} be retired.
+     */
+    private final ConcurrentHashMap<String, String> leadByTarget = new ConcurrentHashMap<>();
+
+    /**
+     * @param pinnedTerminal an optional pinned terminal from config ({@code null}/blank = unpinned)
+     */
+    public PrimaryRegistry(String pinnedTerminal) {
+        if (pinnedTerminal != null && !pinnedTerminal.isBlank()) {
+            this.terminal.set(pinnedTerminal);
+            this.pinned = true;
+            log.info("primary terminal pinned: {}", pinnedTerminal);
+        } else {
+            this.pinned = false;
+        }
+    }
+
+    /**
+     * Record a terminal_id. No-op when:
+     * <ul>
+     *   <li>the registry is pinned (config override),
+     *   <li>{@code terminalId} is {@code null} or blank (non-herdr caller).
+     * </ul>
+     */
+    public void record(String terminalId) {
+        if (pinned) return;
+        if (terminalId == null || terminalId.isBlank()) return;
+        String prev = terminal.getAndSet(terminalId);
+        if (prev == null) {
+            log.debug("primary terminal learned: {}", terminalId);
+        } else if (!prev.equals(terminalId)) {
+            log.debug("primary terminal changed: {} -> {}", prev, terminalId);
+        }
+    }
+
+    /**
+     * Record that {@code leadTerminal} owns the accepted delegation of worker {@code target} (CB-532).
+     *
+     * <p>Called from the {@code MessageService} accepted-delivery hook — only after a send has won
+     * the session's send lock and queued delivery — where both halves are known (CB-548). It is
+     * deliberately <em>not</em> called at {@code fleet_send} request time: a concurrent sender that
+     * times out {@code BUSY} must not steal a live delegation's reply routing without ever owning
+     * the turn. Last writer wins — if a second lead's later send is accepted, replies follow the
+     * lead that most recently delegated to it, which is the one waiting.
+     */
+    public void recordDelegation(String target, String leadTerminal) {
+        if (target == null || target.isBlank() || leadTerminal == null || leadTerminal.isBlank()) {
+            return;
+        }
+        leadByTarget.put(target, leadTerminal);
+    }
+
+    /** Forget a worker's delegating lead — call on release, so a torn-down session leaks nothing. */
+    public void forgetDelegation(String target) {
+        if (target != null) {
+            leadByTarget.remove(target);
+        }
+    }
+
+    /**
+     * Where a nudge about {@code target}'s reply should go: the lead that delegated to it, falling
+     * back to the single known primary.
+     *
+     * <p>The fallback matters after a daemon restart, which loses the map while the durable inbox
+     * keeps the reply. With one lead the fallback is unambiguous and correct. With several and no
+     * recorded delegation there is no right answer, so this returns empty rather than guessing —
+     * delivery degrades to pull, which is exactly what the durable inbox is for, instead of
+     * interrupting the wrong lead with someone else's result.
+     */
+    public Optional<String> nudgeTargetFor(String target) {
+        String lead = target == null ? null : leadByTarget.get(target);
+        return lead != null ? Optional.of(lead) : Optional.ofNullable(terminal.get());
+    }
+
+    /** The known primary terminal, or empty if not yet learned (and not pinned). */
+    public Optional<String> primaryTerminal() {
+        return Optional.ofNullable(terminal.get());
+    }
+
+    /** {@code true} once a terminal has been recorded (or was pinned at construction). */
+    public boolean isKnown() {
+        return terminal.get() != null;
+    }
+}

bridged/src/main/java/dev/ltms/fleet/mcp/ProcessCwdLookup.java

@@ -0,0 +1,13 @@
+package dev.ltms.fleet.mcp;
+
+/**
+ * Resolves a process's current working directory from its PID — the OS half of CB-112's
+ * "a worker inherits the primary's directory." Injectable so {@link ConnectionIdentity} stays
+ * testable without shelling out.
+ */
+@FunctionalInterface
+public interface ProcessCwdLookup {
+
+    /** The working directory of {@code pid}, or {@code null} if unknown. */
+    String cwdForPid(long pid);
+}

bridged/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -0,0 +1,522 @@
+package dev.ltms.fleet.member;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.PeerLauncher;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.function.Function;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/**
+ * The {@link HerdrPeerLauncher} adapter for <strong>Claude Code</strong> — the safe path from a
+ * delegation request to a running off-subscription Claude.
+ *
+ * <p>Everything transport-related (tab/pane placement, the CB-306 spawn-readiness gate, unique
+ * naming, CB-117 orphan reap, teardown, listing, cwd resolution) lives in the base. This class
+ * supplies only the two Claude-specific seams:
+ * <ul>
+ *   <li>the {@code claude} name prefix (so reap matches {@code claude-*} panes, never another
+ *       adapter's), and</li>
+ *   <li>{@link #buildLaunch}, which encodes the subscription boundary: build the worker env with
+ *       {@code ANTHROPIC_BASE_URL}, assert that host is on the allowlist <em>before</em> touching
+ *       herdr, and mount the bridge MCP + reply charter as inline launch flags. A worker's base_url
+ *       lives in the env map handed to herdr and nowhere else; {@code bridged}'s own environment is
+ *       never mutated, and nothing is written to the worker's profile.</li>
+ * </ul>
+ */
+public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
+
+    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
+    private static final String NAME_PREFIX = "claude";
+
+    private static final Logger log = LoggerFactory.getLogger(ClaudeCodeLauncher.class);
+
+    private final SubscriptionGuard guard;
+
+    /**
+     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so
+     * existing deployments and tests keep the legacy non-blocking spawn semantics.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env) {
+        this(agents, spaces, guard, profiles, defaultProfile, env, 0,
+                System::currentTimeMillis, () -> sleepUninterruptibly(300));
+    }
+
+    /**
+     * Production constructor with spawn-ready gate enabled. The gate polls {@code agents.status()}
+     * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs, long spawnReadyPollMs) {
+        this(agents, spaces, guard, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, spawnReadyPollMs, null);
+    }
+
+    /**
+     * Production constructor carrying the fleet-wide tab-label template (CB-557). The template comes
+     * from {@code fleet.tabLabel}, which a profile cannot know because it names the member's
+     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                              Supplier<FleetConfig.Fleet> fleet) {
+        this(agents, spaces, guard, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs,
+                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
+                fleet);
+    }
+
+    /**
+     * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
+        this(agents, spaces, guard, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs,
+                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
+                fleet, memberCredentials);
+    }
+
+    /**
+     * Full testability constructor. Every injectable collaborator is explicit so unit tests supply
+     * fakes for the clock ({@code nowMillis}) and poll-loop wait ({@code sleeper}). The
+     * {@code sleeper} is never called when the gate is disabled ({@code spawnReadyTimeoutMs == 0}).
+     *
+     * @param agents               herdr agent control (start, status, close)
+     * @param spaces               workspace / tab control (ensure, create, close)
+     * @param guard                subscription-boundary guard (checked before spawning)
+     * @param profiles             configured worker profiles
+     * @param defaultProfile       profile a no-argument spawn uses (nullable)
+     * @param env                  host env lookup (injectable for tests)
+     * @param spawnReadyTimeoutMs  max ms to wait for injectable state (0 disables the gate)
+     * @param nowMillis            monotonic clock source (e.g. {@code System::currentTimeMillis})
+     * @param sleeper              sleep/wait hook (e.g. {@code () -> Thread.sleep(pollMs)}); it
+     *                             already encodes the poll interval, so the 8th positional argument
+     *                             (poll ms) is accepted for API symmetry but otherwise unused here
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs,
+                              LongSupplier nowMillis, Runnable sleeper) {
+        this(agents, spaces, guard, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, null);
+    }
+
+    /**
+     * Full testability constructor, plus the fleet-wide tab-label template (CB-557).
+     *
+     * @param fleet live fleet config, read once for each spawn
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs,
+                              LongSupplier nowMillis, Runnable sleeper,
+                              Supplier<FleetConfig.Fleet> fleet) {
+        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
+        this.guard = guard;
+    }
+
+    /**
+     * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs,
+                              LongSupplier nowMillis, Runnable sleeper,
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
+        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
+        this.guard = guard;
+    }
+
+    /**
+     * Full testability constructor, plus an injectable host-env-names source for the CB-596
+     * criterion-4 gap detector. Test seam only — every production call site leaves this at the
+     * default (the real {@code System.getenv()} key set) via the constructor above.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs,
+                              LongSupplier nowMillis, Runnable sleeper,
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials,
+                              Supplier<Set<String>> hostEnvNames) {
+        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, hostEnvNames);
+        this.guard = guard;
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The spawn sequence encodes the subscription boundary: assert the profile's base_url is on
+     * the allowlist <em>before</em> any herdr call, then build the worker env with
+     * {@code ANTHROPIC_*}, the parity-neutral git-forge grant, and the bridge MCP + reply charter
+     * mounted as inline launch flags. When the request carries session identity (CB-547a) it is
+     * applied here — see {@link #applySessionIdentity}.
+     */
+    @Override
+    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
+        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
+        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
+        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
+        // requirement is skipped FOR IT ONLY. Every other profile keeps the hard boundary below.
+        boolean onSubscription = cfg.isSubscription();
+        String baseUrl = cfg.baseUrl();
+
+        if (onSubscription) {
+            // NO SILENT CONTRADICTION: subscription:true + a baseUrl state opposite intents; refuse
+            // loudly rather than pick a winner.
+            if (baseUrl != null && !baseUrl.isBlank()) {
+                throw new IllegalStateException("profile '" + cfg.profile()
+                        + "' sets both subscription: true and a baseUrl ('" + baseUrl + "') — the two "
+                        + "are contradictory: a subscription profile must not point at an endpoint. "
+                        + "Drop baseUrl, or drop subscription: true.");
+            }
+            // Visible without anyone going looking for it: this worker bills the subscription.
+            log.warn("spawning profile '{}' on the Claude subscription (subscription: true) — this "
+                    + "worker WILL bill the operator's subscription", cfg.profile());
+        } else {
+            guard.assertWorker(baseUrl); // hard stop before we spawn anything
+        }
+
+        // CB-634: the IDE guidance is delivered as an on-disk CLAUDE.local.md overlay, NOT through
+        // the charter — the charter returns to role -> reply only. Best-effort: a failed overlay
+        // must never fail the spawn, and `writeIdeOverlay` no-ops unless the cwd is a provisioned
+        // worktree (see its .git-file safety gate). The overlay pins, and the auto-open opens, the
+        // module dir (this repo's pom is in `bridged/`, not at the worktree root) — see ideProjectPath.
+        if (cfg.hasIdeMcp()) {
+            String projectPath = PeerLauncher.ideProjectPath(spec.cwd(), cfg.ideProjectDir());
+            writeIdeOverlay(spec.cwd(), projectPath);
+            PeerLauncher.openInIde(projectPath, cfg.ideOpenCommand(), log);
+        }
+
+        Map<String, String> workerEnv = baseEnv(cfg);
+        if (onSubscription) {
+            // CB-542 belt-and-braces: on the subscription path no guard vets these two keys, and the
+            // profile's env: is layered in by baseEnv — so strip any that rode in there. Config load
+            // already rejects this (loudly, naming the profile); this makes the boundary hold even
+            // for a profile built in code that never passed through that validation.
+            workerEnv.remove("ANTHROPIC_BASE_URL");
+            workerEnv.remove("ANTHROPIC_AUTH_TOKEN");
+        } else {
+            workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
+            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
+        }
+        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
+        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
+        applyGitToken(workerEnv, cfg);
+
+        // CB-547a: Claude Code can MINT its own session id, so bridged chooses it — a fresh spawn
+        // gets a UUID we pass as --session-id and return from agentSessionId(), so the resume
+        // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
+        // id via -r and passes no --session-id (the two conflict). Both are injected before the
+        // model flag so --model keeps outranking the operator's own argv.
+        // mutableArgv: argvWithFleet may hand back the profile's own (immutable) List.of when it
+        // has neither MCP nor a charter — session flags must be added into a list we own.
+        List<String> argv = mutableArgv(argvWithFleet(cfg, spec));
+        String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
+        return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
+    }
+
+    /**
+     * Add the Claude-specific session-identity flags to {@code argv} and return the peer's OWN
+     * session id — the resume handle. A resume request passes the prior id via {@code -r} and
+     * returns that id; a fresh named session mints a new UUID, passes it via {@code --session-id},
+     * and returns the mint. The bridge's logical name rides along as {@code -n} when present. When
+     * <em>no</em> identity is requested (sessionName and resumeSessionId both blank) this adds
+     * nothing and returns {@code null}, keeping the legacy no-identity launch byte-identical.
+     */
+    private static String applySessionIdentity(List<String> argv, String sessionName, String resumeSessionId) {
+        boolean resuming = resumeSessionId != null && !resumeSessionId.isBlank();
+        boolean named = sessionName != null && !sessionName.isBlank();
+        if (!resuming && !named) {
+            return null; // no identity requested — keep the legacy launch byte-identical
+        }
+        if (named) {
+            argv.add("-n");
+            argv.add(sessionName);
+        }
+        if (resuming) {
+            argv.add("-r");
+            argv.add(resumeSessionId);
+            return resumeSessionId;
+        }
+        String minted = UUID.randomUUID().toString();
+        argv.add("--session-id");
+        argv.add(minted);
+        return minted;
+    }
+
+    /**
+     * The launch argv, plus an inline {@code --mcp-config} when {@code worker.mcpUrl} is set, the
+     * CB-617 charter flags, and {@code --agent <role>} when the role has an agent-definition file
+     * under the worker's cwd. Neither touches the profile's config; all are pure command-line flags.
+     * This inline-flag mount is Claude Code specific — other adapters mount MCP and instructions
+     * their own way.
+     *
+     * <p>CB-617: the role charter is operator-authored and often multi-line, so it can never be a
+     * single inline argv element — herdr refuses to shell-encode a multi-line argument
+     * ({@code invalid_agent_argument}). It is written to a temp file instead and mounted with
+     * {@code --append-system-prompt-file}, which this host confirms Claude Code accepts for a
+     * multi-line file.
+     *
+     * <p>CB-618: Claude Code refuses to start when BOTH {@code --append-system-prompt} and
+     * {@code --append-system-prompt-file} are on the command line ("Cannot use both ... Please use
+     * only one"), so the two charters can never travel on separate flags. When both are present they
+     * are concatenated into the one file, role charter first and reply charter last — last is where
+     * the reply rule must sit, because it is the rule that must survive. When only the reply charter
+     * is present it keeps its proven inline {@code --append-system-prompt} delivery, which is also
+     * the only form that reaches a member with no repo checkout.
+     */
+    private List<String> argvWithFleet(FleetConfig.Profile cfg, LaunchSpec spec) {
+        String roleCharter = nonBlank(spec.roleCharter());
+        // CB-634: the IDE guidance is delivered as an on-disk overlay (writeIdeOverlay), not through
+        // the charter. The charter file is role -> reply only.
+        String replyCharter = nonBlank(spec.replyCharter());
+        Path agentFile = agentDefinitionFile(spec.cwd(), spec.role(), ".claude", "agents");
+        if (!cfg.mountsAnyMcp() && roleCharter == null
+                && replyCharter == null && agentFile == null) {
+            return cfg.argv();
+        }
+        List<String> argv = mutableArgv(cfg.argv());
+        if (cfg.mountsAnyMcp()) {
+            argv.add("--mcp-config");
+            argv.add(mcpConfigJson(cfg));
+        }
+        // Combine the charters in order role -> reply, dropping any that are absent. When two
+        // or more survive they must ride one --append-system-prompt-file (CB-618 forbids the inline
+        // flag and the file flag together). A lone reply charter keeps its proven inline delivery.
+        List<String> charters = new java.util.ArrayList<>(2);
+        if (roleCharter != null) charters.add(roleCharter);
+        if (replyCharter != null) charters.add(replyCharter);
+        if (charters.size() == 1 && replyCharter != null && roleCharter == null) {
+            argv.add("--append-system-prompt");
+            argv.add(replyCharter);
+        } else if (!charters.isEmpty()) {
+            argv.add("--append-system-prompt-file");
+            argv.add(writeCharterFile(String.join("\n\n", charters)).toString());
+        }
+        if (agentFile != null) {
+            argv.add("--agent");
+            argv.add(spec.role().wireName());
+        }
+        return argv;
+    }
+
+    /**
+     * The {@code --mcp-config} JSON for this member: always the bridge mount when {@link
+     * FleetConfig.Profile#hasMcp()}, plus the IDE Index MCP as a second server named {@code
+     * intellij} when {@link FleetConfig.Profile#hasIdeMcp()} (CB-634). At least one is present —
+     * the caller only reaches here when {@link FleetConfig.Profile#mountsAnyMcp()} is true.
+     */
+    private static String mcpConfigJson(FleetConfig.Profile cfg) {
+        StringBuilder servers = new StringBuilder();
+        if (cfg.hasMcp()) {
+            servers.append('"').append(PeerLauncher.MCP_MOUNT_NAME)
+                    .append("\":{\"type\":\"http\",\"url\":\"").append(cfg.mcpUrl()).append("\"}");
+        }
+        if (cfg.hasIdeMcp()) {
+            if (servers.length() > 0) servers.append(',');
+            servers.append("\"intellij\":{\"type\":\"http\",\"url\":\"")
+                    .append(cfg.ideMcpUrl()).append("\"}");
+        }
+        return "{\"mcpServers\":{" + servers + "}}";
+    }
+
+    /**
+     * Deliver the shared IDE guidance ({@link PeerLauncher#ideOverlayText}) as an on-disk
+     * {@code CLAUDE.local.md} overlay beside the project's own {@code CLAUDE.md} (CB-634), and
+     * register the overlay in the repository's common {@code info/exclude} so it never shows as
+     * untracked (git reads a worktree's excludes from the common dir, not the per-worktree gitdir).
+     *
+     * <p><strong>Safety gate:</strong> the overlay is written ONLY when {@code cwd/.git} is a
+     * <em>regular file</em> — a provisioned worktree keeps a {@code .git} FILE holding a
+     * {@code gitdir: <path>} pointer, while the primary's real checkout has a {@code .git}
+     * DIRECTORY. Returning without writing when {@code .git} is a directory is the whole safety of
+     * the feature: it must never write into a non-worktree cwd, i.e. never clobber a project that
+     * does not want the overlay.
+     *
+     * <p>Best-effort: a failure is logged at debug and swallowed — a failed overlay must never fail
+     * the spawn.
+     *
+     * @param cwd         the member's worktree root, where the {@code CLAUDE.local.md} file is written
+     * @param projectPath the module dir the overlay pins {@code project_path} to (see
+     *                    {@link PeerLauncher#ideProjectPath}); equals {@code cwd} when no module subdir
+     */
+    private static void writeIdeOverlay(String cwd, String projectPath) {
+        try {
+            Path dotGit = Path.of(cwd, ".git");
+            if (!Files.isRegularFile(dotGit)) {
+                // Not a provisioned worktree (primary's real checkout has a .git directory, or the
+                // cwd is not a repo at all). Never write into it.
+                return;
+            }
+            // The overlay FILE lives at the worktree root (claude-code's cwd), but its CONTENT pins
+            // project_path to the module dir the IDE opened (projectPath), not the worktree root.
+            Files.writeString(Path.of(cwd, "CLAUDE.local.md"), PeerLauncher.ideOverlayText(projectPath));
+            String gitdirLine = Files.readString(dotGit).trim();
+            Path gitDir = Path.of(gitdirLine.replaceFirst("^gitdir:\\s*", ""));
+            if (!gitDir.isAbsolute()) {
+                gitDir = Path.of(cwd).resolve(gitDir).normalize();
+            }
+            // git reads info/exclude from the COMMON dir, never the per-worktree gitdir (only
+            // info/sparse-checkout is per-worktree). A provisioned worktree's gitdir is
+            // <common>/worktrees/<name>, so the common dir is two levels up; writing the entry into
+            // the per-worktree gitdir leaves it un-honoured and the overlay shows as untracked.
+            Path commonDir = gitDir;
+            if (gitDir.getParent() != null && gitDir.getParent().getFileName() != null
+                    && "worktrees".equals(gitDir.getParent().getFileName().toString())) {
+                commonDir = gitDir.getParent().getParent();
+            }
+            Path exclude = commonDir.resolve("info").resolve("exclude");
+            Files.createDirectories(exclude.getParent());
+            String overlayLine = "CLAUDE.local.md";
+            if (!Files.exists(exclude) || Files.readAllLines(exclude).stream().noneMatch(overlayLine::equals)) {
+                Files.writeString(exclude, (Files.exists(exclude) ? System.lineSeparator() : "")
+                        + overlayLine + System.lineSeparator());
+            }
+        } catch (Exception e) {
+            log.debug("cannot write IDE overlay into worktree '{}'", cwd, e);
+        }
+    }
+
+    /** {@code s}, or {@code null} when {@code s} is null/blank — the charter-presence test used above. */
+    private static String nonBlank(String s) {
+        return (s == null || s.isBlank()) ? null : s;
+    }
+
+    /**
+     * Write the role charter to a fresh temp file so it can be mounted with
+     * {@code --append-system-prompt-file} instead of riding inline in argv (CB-617). Best-effort
+     * cleaned via {@code deleteOnExit} — the same disposable-worker-config cleanup
+     * {@link OpenCodeLauncher#writeConfig} already uses for its charter file, since the process that
+     * reads this file (the spawned peer) outlives this JVM call and there is no spawn-scoped teardown
+     * hook to delete it synchronously.
+     */
+    private static Path writeCharterFile(String charterText) {
+        try {
+            Path file = Files.createTempFile("bridged-role-charter-", ".md");
+            Files.writeString(file, charterText);
+            file.toFile().deleteOnExit();
+            return file;
+        } catch (IOException e) {
+            throw new UncheckedIOException("cannot write role charter temp file", e);
+        }
+    }
+
+    /**
+     * Pin the model on the command line as well as in {@code ANTHROPIC_MODEL} (CB-533).
+     *
+     * <p>The env var alone is not a reliable pin for this adapter, because the argv is usually a
+     * launcher rather than {@code claude} itself — {@code ["ccs", "<profile>"]} — and {@code ccs}
+     * exports its profile's own model family ({@code ANTHROPIC_MODEL}, {@code DEFAULT_OPUS/SONNET/
+     * HAIKU}, {@code CLAUDE_CODE_SUBAGENT_MODEL}) over whatever it inherited. A worker profile that
+     * set {@code model:} therefore got silently overruled by its own launcher. Claude Code's
+     * {@code --model} flag outranks the environment, and {@code ccs <profile> [claude-args...]}
+     * passes trailing arguments through, so the flag survives the wrapper.
+     *
+     * <p>Appended last so it also outranks anything in the operator's own {@code argv}. Profiles
+     * that deliberately leave {@code model:} unset (letting {@code ccs} own model selection, as
+     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
+     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
+     */
+    private static List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
+        if (cfg.model() == null || cfg.model().isBlank()) {
+            return argv;
+        }
+        List<String> withModel = mutableArgv(argv);
+        withModel.add("--model");
+        withModel.add(cfg.model());
+        return withModel;
+    }
+
+    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
+
+    /** Spawn a worker for the default profile in the resolved default cwd. */
+    public Agent spawn() {
+        return spawnInternal(null, null, null);
+    }
+
+    /** Spawn a worker for a named profile (null → default) in the resolved default cwd. */
+    public Agent spawn(String profileName) {
+        return spawnInternal(profileName, null, null);
+    }
+
+    /** Spawn a worker for a named profile with an explicit requested/caller cwd (CB-112). */
+    public Agent spawn(String profileName, String requestedCwd, String callerCwd) {
+        return spawnInternal(profileName, requestedCwd, callerCwd);
+    }
+
+    // --- capabilities --------------------------------------------------------------------------
+
+    @Override
+    public Set<Capability> capabilities() {
+        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
+                Capability.CONTEXT_RESET, Capability.ORPHAN_REAP,
+                Capability.SESSION_NAME, Capability.SESSION_RESUME);
+        if (hasGitTokenProfile()) {
+            caps.add(Capability.SELF_PR);
+        }
+        return Set.copyOf(caps);
+    }
+
+    @Override
+    public boolean clearContext(String id) {
+        String target = agentTarget(id);
+        if (target == null) {
+            return false;
+        }
+        // This deliberately bypasses Injector: /clear is housekeeping, not a delegated turn.
+        agents().send(target, "/clear");
+        return true;
+    }
+
+    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
+    private boolean hasGitTokenProfile() {
+        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
+    }
+
+    // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------
+
+    /**
+     * Whether {@code name} is a Claude Code bridge worker started by a <em>different</em> process
+     * than {@code currentNonce}. A thin {@code claude}-prefix binding of
+     * {@link HerdrPeerLauncher#isForeignWorker(String, String, String)}.
+     */
+    static boolean isForeignWorker(String name, String currentNonce) {
+        return HerdrPeerLauncher.isForeignWorker(NAME_PREFIX, name, currentNonce);
+    }
+}

bridged/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java

@@ -0,0 +1,510 @@
+package dev.ltms.fleet.member;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementCandidate;
+import dev.ltms.fleet.placement.PlacementContext;
+import dev.ltms.fleet.placement.PlacementException;
+import dev.ltms.fleet.placement.PlacementPolicies;
+import dev.ltms.fleet.placement.PlacementPolicy;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.Function;
+import java.util.function.Supplier;
+import java.util.stream.Collectors;
+
+/**
+ * The {@link PeerLauncher} the core actually holds when more than one adapter is configured — a thin
+ * router in front of one {@link HerdrPeerLauncher} per peer {@code kind} (Claude Code, opencode, …).
+ * It owns no transport of its own; it dispatches each SPI call to the delegate that owns the profile
+ * involved, and fans the fleet-wide queries (list/reap/caps/profiles) across all delegates.
+ *
+ * <p>Routing rules:
+ * <ul>
+ *   <li><strong>By profile</strong> — {@link #spawn}, {@link #effectiveCwd}, {@link #parityOverlay}
+ *       resolve the profile (a null/blank name → the global {@link #defaultProfile}) and delegate to
+ *       the single adapter that declares it. Profiles partition cleanly across adapters: the
+ *       constructor rejects a name claimed by two.</li>
+ *   <li><strong>By pane id</strong> — {@link #stop} routes to the adapter that spawned that pane
+ *       (recorded at spawn time). A pane the composite never spawned (only real for a caller that
+ *       hand-rolls an id) falls back to the first delegate; teardown is pane-id addressed and
+ *       tab cleanup is single-occupant guarded, so it is safe either way.</li>
+ *   <li><strong>Fleet-wide</strong> — {@link #reapOrphanWorkers} and {@link #capabilities} fan out
+ *       and combine. {@link #list} is deduplicated by pane id because every herdr-backed delegate
+ *       shares one herdr connection and so reports the same global agent set.</li>
+ * </ul>
+ *
+ * <p>CB-518: an unqualified spawn is routed through a {@link PlacementPolicy}. The default
+ * {@code fixed} policy reproduces the historical default-profile behaviour; {@code weighted} uses
+ * smooth weighted round-robin with {@code maxLoad} gating. If a chosen profile fails with
+ * {@link PeerUnreachableException}, the composite advances to the next available candidate and
+ * retries, bounded by the number of candidates.
+ */
+public final class CompositePeerLauncher implements PeerLauncher {
+
+    private static final Logger log = LoggerFactory.getLogger(CompositePeerLauncher.class);
+
+    private final List<HerdrPeerLauncher> delegates;
+    private final Map<String, HerdrPeerLauncher> byProfile;
+    private final String defaultProfile;
+
+    /** paneId → the delegate that spawned it, so {@link #stop} tears down through the right adapter. */
+    private final Map<String, HerdrPeerLauncher> spawnedBy = new ConcurrentHashMap<>();
+
+    private final Function<String, Integer> liveCount;
+
+    /**
+     * CB-559: the placement inputs are read <em>per spawn</em>, not captured at construction, so a
+     * config reload changes where the next member lands without a restart. These are the hot keys —
+     * role pools, an existing profile's weight/maxLoad, and the placement policy. What cannot change
+     * this way is the set of adapters ({@link #byProfile}), because a new backend needs a launcher
+     * and launchers are built once; {@code ConfigRef} classifies that as deferred and says so.
+     */
+    private final Supplier<Map<String, FleetConfig.Profile>> profileConfigs;
+    private final Supplier<PlacementPolicy> placementPolicy;
+
+    /** CB-578 stage B: credential cooldown, checked before an explicit spawn and filtered into placement. */
+    private final BackendQuarantine quarantine;
+
+    /**
+     * CB-557: the role pools an unqualified spawn draws its candidates from. A supplier that yields
+     * {@code null}, and an empty pool for a role, both fall back to every configured profile — the
+     * pre-CB-557 behaviour.
+     */
+    private final Supplier<FleetConfig.Fleet> fleet;
+
+    /**
+     * Backward-compatible constructor: fixed placement, no live-counting. Use this for tests and
+     * simple wiring; it preserves the pre-CB-518 behaviour exactly.
+     *
+     * @param delegates      one adapter per configured peer kind; must be non-empty and declare
+     *                       disjoint profile-name sets
+     * @param defaultProfile the profile a no-argument spawn resolves to (may be null)
+     * @throws IllegalArgumentException if {@code delegates} is empty or two adapters claim one profile
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates, String defaultProfile) {
+        this(delegates, defaultProfile, Map.of(), PlacementPolicies.fixed(), _ -> 0);
+    }
+
+    /**
+     * Production constructor with a placement policy and live-worker counter. Quarantine (CB-578
+     * stage B) is off for this constructor — {@link BackendQuarantine#none()} — since it predates
+     * the feature and existing callers of this exact overload never exercised it; use the 7-arg
+     * overload below to wire a real {@link BackendQuarantine}.
+     *
+     * @param delegates      one adapter per configured peer kind; must be non-empty and declare
+     *                       disjoint profile-name sets
+     * @param defaultProfile the profile a no-argument spawn resolves to under {@code fixed} policy
+     * @param profileConfigs all configured worker profiles (used for candidate weights/caps)
+     * @param placementPolicy which policy governs unqualified spawns
+     * @param liveCount      live worker count per profile (must never return {@code null})
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                 String defaultProfile,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
+                                 PlacementPolicy placementPolicy,
+                                 Function<String, Integer> liveCount) {
+        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, null, BackendQuarantine.none());
+    }
+
+    /**
+     * Production constructor with role pools (CB-557). An unqualified spawn draws its candidates from
+     * {@code fleet.<role>} instead of from every configured profile, so a reviewer is placed on a
+     * reviewer backend and never on, say, the architect-only one. Quarantine is off for this
+     * constructor too, for the same reason as the 5-arg overload above.
+     *
+     * @param fleet the configured role pools; {@code null} ⇒ every profile is a candidate for every
+     *              role, which is the pre-CB-557 behaviour
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                 String defaultProfile,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
+                                 PlacementPolicy placementPolicy,
+                                 Function<String, Integer> liveCount,
+                                 FleetConfig.Fleet fleet) {
+        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, fleet, BackendQuarantine.none());
+    }
+
+    /**
+     * Production constructor with role pools and quarantine (CB-578 stage B). The full-featured
+     * non-reloading form; {@link #CompositePeerLauncher(List, String, Supplier, Function, BackendQuarantine)}
+     * is what {@code Fleetd.main} actually wires up.
+     *
+     * @param quarantine required — pass {@link BackendQuarantine#none()} for a caller that does not
+     *                   want the feature, never a defaulting overload (CB-578 stage B's own rule).
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                 String defaultProfile,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
+                                 PlacementPolicy placementPolicy,
+                                 Function<String, Integer> liveCount,
+                                 FleetConfig.Fleet fleet,
+                                 BackendQuarantine quarantine) {
+        // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
+        // policy breaks exact-weight ties on it, so a salted iteration order would make placement
+        // differ from one JVM run to the next.
+        this(delegates, defaultProfile,
+                constant(Collections.unmodifiableMap(new LinkedHashMap<>(profileConfigs))),
+                constant(placementPolicy), liveCount, constant(fleet), quarantine);
+    }
+
+    /**
+     * Production constructor that re-reads its placement inputs per spawn (CB-559), so a config
+     * reload retargets the next member without a restart.
+     *
+     * @param config     the live configuration — read at every spawn, never captured
+     * @param quarantine required — CB-578 stage B; pass {@link BackendQuarantine#none()} to opt out
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                 String defaultProfile,
+                                 Supplier<FleetConfig> config,
+                                 Function<String, Integer> liveCount,
+                                 BackendQuarantine quarantine) {
+        this(delegates, defaultProfile,
+                () -> config.get().profiles(),
+                () -> PlacementPolicies.fromName(config.get().placement()),
+                liveCount,
+                () -> config.get().fleet(),
+                quarantine);
+    }
+
+    /** The all-suppliers form every other constructor funnels into. */
+    private CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                  String defaultProfile,
+                                  Supplier<Map<String, FleetConfig.Profile>> profileConfigs,
+                                  Supplier<PlacementPolicy> placementPolicy,
+                                  Function<String, Integer> liveCount,
+                                  Supplier<FleetConfig.Fleet> fleet,
+                                  BackendQuarantine quarantine) {
+        this.fleet = fleet;
+        this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
+        if (delegates.isEmpty()) {
+            throw new IllegalArgumentException("at least one peer adapter must be configured");
+        }
+        this.delegates = List.copyOf(delegates);
+        this.defaultProfile = defaultProfile;
+        this.profileConfigs = profileConfigs;
+        this.placementPolicy = placementPolicy;
+        this.liveCount = liveCount;
+        Map<String, HerdrPeerLauncher> index = new LinkedHashMap<>();
+        for (HerdrPeerLauncher d : this.delegates) {
+            for (String profile : d.profiles()) {
+                HerdrPeerLauncher prev = index.putIfAbsent(profile, d);
+                if (prev != null) {
+                    throw new IllegalArgumentException(
+                            "worker profile '" + profile + "' is claimed by two peer adapters");
+                }
+            }
+        }
+        // Order-preserving for the same reason, and because profiles() is user-visible (fleet_profiles).
+        this.byProfile = Collections.unmodifiableMap(index);
+    }
+
+    /** A supplier of a value fixed at construction — how the non-reloading constructors funnel in. */
+    private static <T> Supplier<T> constant(T value) {
+        return () -> value;
+    }
+
+    /**
+     * The currently-configured profiles, never null.
+     *
+     * <p>Read fresh on every call so a reload is visible; a caller that needs two consistent reads
+     * takes one local, as {@link #poolFor} does.
+     */
+    private Map<String, FleetConfig.Profile> profiles0() {
+        Map<String, FleetConfig.Profile> m = profileConfigs.get();
+        return m == null ? Map.of() : m;
+    }
+
+    /** The adapter owning {@code profileName} (null/blank → the default). Throws on an unknown profile. */
+    private HerdrPeerLauncher route(String profileName) {
+        String resolved = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
+        if (resolved == null) {
+            // No profile and no default configured — hand to the first delegate so it raises the
+            // same "no default" error it would on its own; keeps the SPI contract single-sourced.
+            return delegates.getFirst();
+        }
+        HerdrPeerLauncher d = byProfile.get(resolved);
+        if (d == null) {
+            throw new IllegalArgumentException("unknown worker profile: " + resolved);
+        }
+        return d;
+    }
+
+    @Override
+    public PeerHandle spawn(SpawnRequest req) {
+        String requestedProfile = req.profileName();
+        if (requestedProfile != null && !requestedProfile.isBlank()) {
+            // An explicit profile bypasses the placement policy, but not the capacity cap: maxLoad
+            // is documented as an unconditional limit on this profile (FleetConfig.Profile), and
+            // the charter makes explicit-profile spawns the normal path — so skipping the check
+            // here would leave the cap dead config in real operation.
+            HerdrPeerLauncher d = route(requestedProfile);
+            enforceNotQuarantined(requestedProfile);
+            enforceMaxLoad(requestedProfile);
+            PeerHandle handle = d.spawn(req);
+            spawnedBy.put(handle.id(), d);
+            return handle;
+        }
+
+        // CB-557: an unqualified spawn is placed inside the pool of the role it asked for, not across
+        // the whole profile list. An EXPLICIT profile (above) is left alone on purpose — it is the
+        // operator overriding, and refusing it would break `fleet_spawn{profile:"opus"}`, which
+        // carries no role and so would be judged against the dev pool it was never meant for.
+        List<PlacementCandidate> candidates = candidates(req.role());
+        String roleDefault = defaultProfileFor(req.role());
+        Set<String> unreachable = new HashSet<>();
+        // CB-578 stage B: computed once up front — a quarantine's expiry cannot pass within one spawn
+        // call, so re-deriving it per retry would only cost work, never change the answer.
+        Set<String> quarantined = quarantinedProfiles(candidates);
+        PlacementContext ctx = new PlacementContext(roleDefault, candidates, liveCount, unreachable, quarantined);
+
+        int maxAttempts = candidates.isEmpty() ? 1 : candidates.size();
+        for (int attempt = 0; attempt < maxAttempts; attempt++) {
+            // Deliberately uncaught: when no candidate is left (all at cap, or all unreachable) the
+            // policy already throws a clear message. Catching it to rethrow a generic
+            // PeerUnreachableException would replace a precise diagnosis with a vague one.
+            PlacementCandidate chosen = placementPolicy.get().select(ctx);
+
+            HerdrPeerLauncher d = byProfile.get(chosen.profile());
+            if (d == null) {
+                // A configured profile with no adapter is a wiring bug; fail fast.
+                unreachable.add(chosen.profile());
+                continue;
+            }
+
+            // CB-547a: route the chosen profile but keep the caller's session identity — dropping it
+            // here would silently sever the resume handle on every policy-routed spawn. CB-557: the
+            // role rides along for the same reason, or a routed spawn would be labelled as a dev.
+            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd(),
+                    req.sessionName(), req.resumeSessionId(), req.role());
+            try {
+                PeerHandle handle = d.spawn(routedReq);
+                spawnedBy.put(handle.id(), d);
+                return handle;
+            } catch (PeerUnreachableException e) {
+                log.warn("spawn on profile {} unreachable, will retry next candidate if any: {}",
+                        chosen.profile(), e.getMessage());
+                unreachable.add(chosen.profile());
+                // Update the context for the next selection so the policy excludes this profile.
+                ctx = new PlacementContext(roleDefault, candidates, liveCount, unreachable, quarantined);
+            }
+        }
+
+        throw new PeerUnreachableException(
+                "no reachable worker profile available after trying " + unreachable.size()
+                        + " candidate(s): " + String.join(", ", unreachable));
+    }
+
+    /**
+     * Refuse an explicit-profile spawn when the profile is at its {@code maxLoad} cap.
+     *
+     * <p>maxLoad is a documented, unconditional capacity limit (see {@code FleetConfig.Profile#maxLoad}),
+     * and the charter makes explicit-profile spawns the normal path — so enforcing it only in placement
+     * ({@code PlacementPolicyUtil}, package-private, hence not linked) would leave the cap dead config
+     * on every call that names a profile. Same rule as placement: {@code live >= cap} is at capacity.
+     *
+     * <p>Deliberately no fallback to another profile: the caller named {@code profile} for a cost/model
+     * reason, and silently re-routing a paid-tier (subscription) request elsewhere is worse than
+     * refusing it. A caller that wants placement should omit the profile and let the policy pick.
+     *
+     * <p>Known TOCTOU limitation — documented, not fixed. {@link #liveCount} is read outside any lock and
+     * {@code SessionManager} registers a session only after {@code launcher.spawn} returns, so two
+     * genuinely concurrent spawns can both pass this check. The race already exists on the placement
+     * path. Closing it needs slot reservation in the registry; serializing spawn here would block on
+     * the readiness gate and is a far worse trade.
+     *
+     * @param profile the profile the caller explicitly named
+     * @throws PlacementException when the profile is at capacity
+     */
+    /**
+     * Refuse an explicit-profile spawn whose credential is quarantined (CB-578 stage B): a prior
+     * {@code BACKEND_EXHAUSTED} classification on this profile, or on another profile sharing its
+     * {@code credentialId}, is still on cooldown.
+     *
+     * <p>Checked before {@link #enforceMaxLoad}, and for the same reason that check exists: an
+     * explicit profile bypasses the placement policy's filtering entirely, so without this the cap
+     * (there, quarantine here) would be dead config on the very path the charter calls normal.
+     * Deliberately no fallback to another profile, matching {@link #enforceMaxLoad}'s own reasoning —
+     * the caller named this profile for a cost/model reason.
+     *
+     * @throws PlacementException naming the profile, its credential, and the remaining cooldown
+     */
+    private void enforceNotQuarantined(String profile) {
+        String credentialId = credentialIdFor(profile);
+        quarantine.remainingSeconds(credentialId).ifPresent(remaining -> {
+            throw new PlacementException("worker profile '" + profile + "' is quarantined "
+                    + "(credential '" + credentialId + "' exhausted; ~" + remaining
+                    + "s remaining) — refusing spawn");
+        });
+    }
+
+    /** {@code profile}'s credential group (CB-578 stage B), or the profile's own name if unconfigured. */
+    private String credentialIdFor(String profile) {
+        FleetConfig.Profile cfg = profiles0().get(profile);
+        return cfg == null ? profile : cfg.effectiveCredentialId();
+    }
+
+    /** The subset of {@code candidates} whose credential is currently quarantined (CB-578 stage B). */
+    private Set<String> quarantinedProfiles(List<PlacementCandidate> candidates) {
+        return candidates.stream()
+                .map(PlacementCandidate::profile)
+                .filter(p -> quarantine.isQuarantined(credentialIdFor(p)))
+                .collect(Collectors.toSet());
+    }
+
+    private void enforceMaxLoad(String profile) {
+        // Absent config, or a config whose maxLoad normalized to null (ABSENT ⇒ unlimited at load),
+        // means no cap — never cap what wasn't configured. Note "non-positive ⇒ unlimited" was true
+        // until CB-585: an explicit `maxLoad: 0` now survives as 0 and is a real cap of zero, so the
+        // check below refuses every spawn on that profile, and a negative value is refused at config
+        // load rather than normalized away.
+        FleetConfig.Profile cfg = profiles0().get(profile);
+        Integer cap = (cfg == null) ? null : cfg.maxLoad();
+        if (cap == null) {
+            return;
+        }
+        int live = liveCount.apply(profile);
+        if (live >= cap) {
+            throw new PlacementException("worker profile '" + profile + "' is at maxLoad: " + live
+                    + " live >= " + cap + " cap; refusing spawn — no fallback to another profile");
+        }
+    }
+
+    /**
+     * The profile names {@code role} may be placed on, in definition order.
+     *
+     * <p>An empty or absent pool means "unconstrained", not "nothing allowed": a config that declares
+     * no pool for a role must keep spawning, so it falls back to every configured profile. Names in a
+     * pool that no adapter declares are dropped here rather than thrown — config load already rejects
+     * a pool entry with no profile, so a survivor is a profile this particular composite does not own.
+     */
+    private List<String> poolFor(MemberRole role) {
+        Map<String, FleetConfig.Profile> configured = profiles0();
+        FleetConfig.Fleet f = fleet.get();
+        List<String> pool = (f == null) ? List.of() : f.profilesFor(role);
+        List<String> known = pool.stream().filter(configured::containsKey).toList();
+        return known.isEmpty() ? List.copyOf(configured.keySet()) : known;
+    }
+
+    /** The profile an unqualified spawn for {@code role} falls back to under {@code fixed} placement. */
+    private String defaultProfileFor(MemberRole role) {
+        List<String> pool = poolFor(role);
+        return pool.isEmpty() ? defaultProfile : pool.getFirst();
+    }
+
+    /** Build the candidate list from {@code role}'s pool, in definition order. */
+    private List<PlacementCandidate> candidates(MemberRole role) {
+        List<PlacementCandidate> out = new ArrayList<>();
+        for (String name : poolFor(role)) {
+            FleetConfig.Profile w = profiles0().get(name);
+            if (w != null) {
+                out.add(new PlacementCandidate(name, null, w.weight(), w.maxLoad()));
+            }
+        }
+        return out;
+    }
+
+    @Override
+    public String effectiveCwd(SpawnRequest req) {
+        return route(req.profileName()).effectiveCwd(req);
+    }
+
+    @Override
+    public List<String> parityOverlay(String profileName) {
+        return route(profileName).parityOverlay(profileName);
+    }
+
+    @Override
+    public void stop(String id) {
+        HerdrPeerLauncher d = spawnedBy.remove(id);
+        if (d == null) {
+            log.debug("stop({}) — no recorded owner, routing to the first adapter (pane-addressed)", id);
+            d = delegates.getFirst();
+        }
+        d.stop(id);
+    }
+
+    @Override
+    public boolean clearContext(String id) {
+        HerdrPeerLauncher delegate = spawnedBy.get(id);
+        if (delegate == null) {
+            log.debug("clearContext({}) ignored — no recorded owning adapter", id);
+            return false;
+        }
+        return delegate.clearContext(id);
+    }
+
+    @Override
+    public Set<String> profiles() {
+        return byProfile.keySet();
+    }
+
+    @Override
+    public String defaultProfile() {
+        return defaultProfile;
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>Routes to the specific delegate {@code profileName} resolves to, not the fleet-wide
+     * union {@link #capabilities()} returns — the whole reason this method exists (CB-584): in a
+     * mixed fleet, one adapter's capability must never be read as every profile's.
+     */
+    @Override
+    public Set<Capability> capabilitiesFor(String profileName) {
+        return route(profileName).capabilities();
+    }
+
+    /** Every herdr agent, deduplicated by pane id (all delegates share one herdr and list globally). */
+    @Override
+    public List<Agent> list() {
+        Map<String, Agent> byPane = new LinkedHashMap<>();
+        for (HerdrPeerLauncher d : delegates) {
+            for (Agent a : d.list()) {
+                if (a.paneId() != null) {
+                    byPane.putIfAbsent(a.paneId(), a);
+                }
+            }
+        }
+        return List.copyOf(byPane.values());
+    }
+
+    @Override
+    public int reapOrphanWorkers() {
+        int reaped = 0;
+        for (HerdrPeerLauncher d : delegates) {
+            reaped += d.reapOrphanWorkers();
+        }
+        return reaped;
+    }
+
+    /** The union of every adapter's capabilities — a capability any adapter offers, the fleet offers. */
+    @Override
+    public Set<Capability> capabilities() {
+        EnumSet<Capability> caps = EnumSet.noneOf(Capability.class);
+        for (HerdrPeerLauncher d : delegates) {
+            caps.addAll(d.capabilities());
+        }
+        return Set.copyOf(caps);
+    }
+}

bridged/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -0,0 +1,276 @@
+package dev.ltms.fleet.member;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Stream;
+
+/**
+ * CB-633: generates the per-spawn {@code ZDOTDIR} directory whose startup files enforce
+ * {@code memberCredentials.policy: allow-list}.
+ *
+ * <p>The seam: zsh reads its startup files from {@code $ZDOTDIR}, and the daemon puts that variable
+ * in the pane-creation env map. The operator's whole chain ({@code ~/.zshrc} → secret store) runs
+ * inside those files, so a scrub appended to the LAST one runs after everything the operator
+ * sourced, and nothing later can re-export over it. This is the property CB-596's env-overlay
+ * control lacked: herdr applies that overlay BEFORE the shell starts, so any sourced file can undo
+ * it — and did.
+ *
+ * <p><b>Which file is last depends on the platform, so the scrub runs from two of them.</b> zsh
+ * reads {@code .zshenv} always, {@code .zprofile} and {@code .zlogin} only for a LOGIN shell, and
+ * {@code .zshrc} only for an INTERACTIVE one. herdr does not open the same kind of shell
+ * everywhere — measured on herdr 0.8.0: macOS panes run {@code -zsh} (login, so {@code .zlogin}
+ * runs), Linux panes run a plain {@code /usr/bin/zsh} (interactive but NOT login, so
+ * {@code .zlogin} never runs at all). A scrub in {@code .zlogin} alone is therefore a control that
+ * silently does nothing on Linux — the exact failure this class exists to remove, one platform
+ * over.
+ *
+ * <p>So both {@code .zshrc} and {@code .zlogin} source the same generated {@code scrub.zsh} after
+ * sourcing their {@code $HOME} counterpart. On Linux only the first fires; on macOS both do, and
+ * the second pass is deliberate rather than merely harmless — it re-scrubs anything the operator's
+ * own {@code ~/.zlogin} exported after {@code .zshrc} had finished. Re-running is idempotent: a
+ * name already blank is blanked again, and the report is rewritten with the same counts.
+ *
+ * <p>Each generated file sources its {@code $HOME} counterpart FIRST, so {@code PATH} and every
+ * toolchain binary still resolve exactly as the operator configured them; only afterwards does
+ * {@code .zlogin} run the scrub: every EXPORTED variable not on the derived allow-list is re-exported
+ * blank. Blank, not credential-shaped-pattern-filtered: a pattern list ({@code *TOKEN*}, …) is an
+ * enumeration and misses what it did not think of — a username is the other half of a credential and
+ * is shaped like none. Credential-SHAPED names among the blanked set go to the WARN log only,
+ * never to the control.
+ *
+ * <p>The scrub also writes {@code scrub-report.txt} into its own directory: one {@code allowed N of
+ * M} line (N = exports left untouched, M = exports present when the scrub ran), then the blanked
+ * NAMES — never values. The launcher reads this back at teardown and logs it, because a blocked
+ * count next to an unknown denominator is not a finding.
+ */
+public final class EnvAllowListScrub {
+
+    private static final Logger log = LoggerFactory.getLogger(EnvAllowListScrub.class);
+
+    /** Name of the report file written into the generated directory by the scrub itself. */
+    static final String REPORT_FILE = "scrub-report.txt";
+
+    /** The scrub body, generated once and sourced from both {@code .zshrc} and {@code .zlogin}. */
+    static final String SCRUB_FILE = "scrub.zsh";
+
+    /** Prefix of every generated directory — also what {@link #reapOrphans} matches on. */
+    static final String DIR_PREFIX = "bridged-zdotdir-";
+
+    /**
+     * How old an orphan must be before {@link #reapOrphans} removes it. Comfortably longer than any
+     * spawn takes, so a directory belonging to a pane that is still starting is never removed.
+     */
+    private static final Duration ORPHAN_AGE = Duration.ofHours(24);
+
+    /** Appended to the two startup files that must run the scrub, after their {@code $HOME} source. */
+    private static final String SOURCE_SCRUB =
+            "source \"$ZDOTDIR/" + SCRUB_FILE + "\"\n";
+
+    private EnvAllowListScrub() {
+    }
+
+    /**
+     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran,
+     * how many were left untouched (allowed), and the NAMES that were blanked. Values never appear.
+     */
+    record ScrubReport(int allowed, int total, List<String> blanked) {
+    }
+
+    /**
+     * Create a fresh ZDOTDIR directory under {@code parentDir} holding the four zsh startup files.
+     * Every file (and the directory) registers {@code deleteOnExit}, next to the existing per-spawn
+     * charter/config temp cleanup; the launcher additionally deletes eagerly at pane release.
+     *
+     * @param allowedNames the DERIVED allow-list — exact variable names that must survive the scrub
+     * @return the directory path (to be passed as the pane's {@code ZDOTDIR})
+     * @throws UncheckedIOException when the directory or any file cannot be written — a spawn whose
+     *                              protection cannot even be materialized must fail loudly rather
+     *                              than start unprotected
+     */
+    public static Path generate(Path parentDir, Set<String> allowedNames) {
+        try {
+            reapOrphans(parentDir);
+            Path dir = Files.createTempDirectory(parentDir, DIR_PREFIX);
+            dir.toFile().deleteOnExit();
+            // The report is written by zsh, after these hooks are registered, so register its path
+            // too — otherwise the directory is non-empty at JVM exit and cannot be removed at all.
+            dir.resolve(REPORT_FILE).toFile().deleteOnExit();
+            write(dir, SCRUB_FILE, scrubScript(allowedNames));
+            write(dir, ".zshenv", homeSourcingFile(".zshenv"));
+            write(dir, ".zprofile", homeSourcingFile(".zprofile"));
+            write(dir, ".zshrc", homeSourcingFile(".zshrc") + SOURCE_SCRUB);
+            write(dir, ".zlogin", homeSourcingFile(".zlogin") + SOURCE_SCRUB);
+            return dir;
+        } catch (IOException e) {
+            throw new UncheckedIOException("cannot generate ZDOTDIR scrub files under " + parentDir, e);
+        }
+    }
+
+    /** One operator-sourcing startup file: source the {@code $HOME} counterpart, change nothing else. */
+    private static String homeSourcingFile(String name) {
+        return """
+                # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
+                # Source the operator's own %s first, so PATH and the agent binaries resolve as usual.
+                [ -r "$HOME/%s" ] && source "$HOME/%s"
+                """.formatted(name, name, name);
+    }
+
+    /**
+     * The generated {@code scrub.zsh} — the scrub body on its own, so the two startup files that
+     * must run it ({@code .zshrc} and {@code .zlogin}) hold one copy between them rather than two
+     * that can drift. Package-private so tests can assert on the exact script handed to zsh — the
+     * artefact here IS a shell file, and a test that checks only the Java string assembly proves
+     * nothing about whether zsh accepts it.
+     */
+    static String scrubScript(Set<String> allowedNames) {
+        StringBuilder names = new StringBuilder();
+        for (String n : allowedNames.stream().sorted().toList()) {
+            if (names.length() > 0) {
+                names.append(' ');
+            }
+            // Names are validated against [A-Za-z_][A-Za-z0-9_]* before they get here; single quotes
+            // keep even a non-conforming name inert rather than executable.
+            names.append('\'').append(n.replace("'", "")).append('\'');
+        }
+        return """
+                # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
+                # Sourced from .zshrc and again from .zlogin, each time AFTER that file has sourced
+                # its $HOME counterpart — so this runs after everything the operator sourced, on a
+                # login shell (macOS panes) and on a plain interactive one (Linux panes) alike.
+                # Running twice is idempotent and deliberate: the second pass catches anything
+                # ~/.zlogin exported after ~/.zshrc had finished.
+
+                typeset -A _cb633_allowed
+                for _cb633_n in %s; do _cb633_allowed[$_cb633_n]=1; done
+
+                # Enumerate EXPORTED variable NAMES from `env` itself. Deliberately NOT the special
+                # `parameters` assoc: its subscript is evaluated arithmetically on this host's zsh
+                # and blows up on some names ("bad math expression"). Names not matching the
+                # identifier pattern (junk from multi-line values) are skipped, never scrubbed.
+                typeset -a _cb633_names
+                _cb633_names=("${(@f)$(command env | command cut -d= -f1)}")
+                typeset -a _cb633_blank
+                _cb633_blank=()
+                integer _cb633_total=0
+                for _cb633_n in "${_cb633_names[@]}"; do
+                  [[ "$_cb633_n" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+                  (( _cb633_total += 1 ))
+                  [[ -n "${_cb633_allowed[$_cb633_n]-}" ]] && continue
+                  case "$_cb633_n" in %s) continue ;; esac
+                  _cb633_blank+=("$_cb633_n")
+                done
+
+                { for _cb633_n in "${_cb633_blank[@]}"; do export "$_cb633_n="; done; } 2>/dev/null
+
+                integer _cb633_kept=$(( _cb633_total - ${#_cb633_blank} ))
+                {
+                  print -r -- "allowed $_cb633_kept of $_cb633_total"
+                  for _cb633_n in "${_cb633_blank[@]}"; do print -r -- "$_cb633_n"; done
+                } > "$ZDOTDIR/%s" 2>/dev/null
+
+                unset _cb633_allowed _cb633_names _cb633_blank _cb633_n _cb633_total _cb633_kept
+                """.formatted(names, MemberEnvAllowList.zshCasePattern(), REPORT_FILE);
+    }
+
+    private static void write(Path dir, String fileName, String content) throws IOException {
+        Path file = dir.resolve(fileName);
+        Files.writeString(file, content);
+        file.toFile().deleteOnExit();
+    }
+
+    /**
+     * Read and parse {@link #REPORT_FILE} out of a generated ZDOTDIR directory. Returns {@code null}
+     * when absent or unreadable (the pane may have been torn down before its login shell ever got to
+     * the scrub) — callers treat that as "no measurement available", never as success.
+     */
+    static ScrubReport readReport(Path zdotdir) {
+        Path report = zdotdir.resolve(REPORT_FILE);
+        if (!Files.isRegularFile(report)) {
+            return null;
+        }
+        try {
+            List<String> lines = Files.readAllLines(report);
+            if (lines.isEmpty() || !lines.getFirst().startsWith("allowed ")) {
+                return null;
+            }
+            String[] parts = lines.getFirst().substring("allowed ".length()).trim().split("\\s+");
+            if (parts.length != 3 || !"of".equals(parts[1])) {
+                return null;
+            }
+            List<String> blanked = new ArrayList<>();
+            for (int i = 1; i < lines.size(); i++) {
+                if (!lines.get(i).isBlank()) {
+                    blanked.add(lines.get(i));
+                }
+            }
+            return new ScrubReport(Integer.parseInt(parts[0]), Integer.parseInt(parts[2]),
+                    List.copyOf(blanked));
+        } catch (IOException | NumberFormatException e) {
+            return null;
+        }
+    }
+
+    /** Best-effort recursive delete; failures are swallowed — JVM-exit cleanup is the backstop. */
+    /**
+     * Remove generated directories left behind by an earlier daemon process.
+     *
+     * <p>{@link #generate} registers each directory for deletion at JVM exit, which covers a clean
+     * shutdown and covers nothing else. A {@code kill -9}, a crash, or a host reboot leaves the
+     * directory in the temp dir for good, and the daemon is restarted often enough that these
+     * accumulate. They hold no secrets — the generated files contain variable NAMES and a report of
+     * names, never a value — but an unbounded pile of them in {@code /tmp} is still our mess to
+     * clear.
+     *
+     * <p>Called from {@link #generate}, so it runs on the path that creates them and needs no
+     * separate wiring or scheduler. Only directories older than {@link #ORPHAN_AGE} are touched,
+     * which keeps it clear of any pane that is merely still starting, including one belonging to a
+     * different daemon instance running right now. Best-effort: every failure is ignored, because
+     * tidying temp files must never be the reason a spawn fails.
+     */
+    static void reapOrphans(Path parentDir) {
+        Instant cutoff = Instant.now().minus(ORPHAN_AGE);
+        try (Stream<Path> entries = Files.list(parentDir)) {
+            entries.filter(d -> d.getFileName().toString().startsWith(DIR_PREFIX))
+                    .filter(Files::isDirectory)
+                    .filter(d -> olderThan(d, cutoff))
+                    .forEach(EnvAllowListScrub::deleteRecursively);
+        } catch (IOException | RuntimeException e) {
+            log.debug("could not scan {} for orphaned ZDOTDIRs: {}", parentDir, e.toString());
+        }
+    }
+
+    private static boolean olderThan(Path dir, Instant cutoff) {
+        try {
+            return Files.getLastModifiedTime(dir).toInstant().isBefore(cutoff);
+        } catch (IOException e) {
+            return false; // unreadable timestamp ⇒ leave it alone
+        }
+    }
+
+    static void deleteRecursively(Path dir) {
+        if (dir == null || !Files.exists(dir)) {
+            return;
+        }
+        try (Stream<Path> walk = Files.walk(dir)) {
+            walk.sorted(java.util.Comparator.reverseOrder()).forEach(p -> {
+                try {
+                    Files.deleteIfExists(p);
+                } catch (IOException ignored) {
+                    // best effort — deleteOnExit retries at JVM shutdown
+                }
+            });
+        } catch (IOException ignored) {
+            // same
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/member/MemberEnvAllowList.java

@@ -0,0 +1,112 @@
+package dev.ltms.fleet.member;
+
+import dev.ltms.fleet.config.FleetConfig;
+
+import java.util.Collection;
+import java.util.Set;
+import java.util.TreeSet;
+
+/**
+ * CB-633: the set of environment variable NAMES a spawned member is allowed to keep under
+ * {@code memberCredentials.policy: allow-list} — DERIVED from what the launcher itself injects,
+ * never hand-typed.
+ *
+ * <p>A hand-typed allow-list is the defect this class exists to prevent: a name an operator forgets
+ * to type is a credential that passes through to every member, and a profile added to config later
+ * would silently break spawns whose scrub did not know its names. Derivation closes both ends. The
+ * kept-name set is the union of:
+ *
+ * <ul>
+ *   <li>every configured {@link FleetConfig.Profile profile}'s {@code gitTokenEnv},
+ *       {@code gitHostEnv}, and {@code tokenEnv} values — these are variable <em>names</em> held in
+ *       config, and the launcher reads their values out of exactly these variables;</li>
+ *   <li>every key of every profile's {@code env:} map — anything the operator routes into a pane on
+ *       purpose;</li>
+ *   <li>{@link #INFRASTRUCTURE_PASSTHROUGH} — names that are not credentials at all but that a shell
+ *       or the agent binary genuinely needs to function.</li>
+ * </ul>
+ *
+ * <p>Because the union spans EVERY profile (not just the one spawning), adding a new profile can
+ * only ever widen the list — it cannot break another spawn's scrub. And because the launcher also
+ * unions in the exact keys of each spawn's own env map at generation time (see {@code
+ * HerdrPeerLauncher}), anything the daemon deliberately injects for THIS spawn survives its own
+ * control.
+ *
+ * <p>{@code SSH_AUTH_SOCK} is deliberately NOT here. It is a handle to the operator's ssh-agent — a
+ * member holding it can sign with the operator's keys — so keeping it is a config decision
+ * ({@code memberCredentials.sshAuthSock: allow}), not a derivation default.
+ */
+public final class MemberEnvAllowList {
+
+    /**
+     * Names that are not credentials and that a login shell or agent binary genuinely needs.
+     *
+     * <p>Every name here is a location or a shell setting, never a credential. That rule is load
+     * bearing, and CB-633's first cut broke it: it also listed {@code ANTHROPIC_AUTH_TOKEN},
+     * {@code GITEA_TOKEN}, {@code GITEA_HOST}, {@code ANTHROPIC_BASE_URL}, {@code ANTHROPIC_MODEL},
+     * {@code CLAUDE_CONFIG_DIR}, {@code OPENCODE_CONFIG} and {@code BRIDGED_MEMBER} "because the
+     * launcher injects them". The launcher does — but only on the spawns where it actually sets
+     * them, and {@code HerdrPeerLauncher} already unions THIS spawn's env-map keys into the
+     * allow-list. So a static entry adds nothing on a spawn that injects the name, and on a spawn
+     * that does not it lets the operator's own value through under exactly the name a member reads.
+     * {@code ANTHROPIC_BASE_URL} is the sharpest case: an inherited one silently moves a member off
+     * the endpoint the profile chose.
+     *
+     * <p>{@code ZDOTDIR} stays because it is this control's own handle — lose it and every later
+     * sub-shell loses the scrub. {@code JAVA_HOME} and the {@code XDG_*} roots are toolchain
+     * locations. Everything else a member needs must arrive via a profile's {@code env:} or the
+     * launcher's own injection, both of which land on the derived set automatically.
+     */
+    public static final Set<String> INFRASTRUCTURE_PASSTHROUGH = Set.of(
+            "PATH", "HOME", "SHELL", "TERM", "LANG", "TMPDIR",
+            "USER", "LOGNAME", "PWD", "SHLVL", "EDITOR", "PAGER",
+            "_",
+            "ZDOTDIR",
+            "JAVA_HOME",
+            "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "XDG_STATE_HOME");
+
+    /** Locale-category prefix kept as infrastructure ({@code LC_ALL}, {@code LC_CTYPE}, …). */
+    private static final String INFRASTRUCTURE_NAME_PREFIX = "LC_";
+
+    private MemberEnvAllowList() {
+    }
+
+    /**
+     * Derive the allowed NAME set from the given profiles plus {@link #INFRASTRUCTURE_PASSTHROUGH}.
+     * Deterministic (sorted) so generated scrub files are diffable run-to-run.
+     */
+    public static Set<String> derive(Collection<FleetConfig.Profile> profiles) {
+        Set<String> derived = new TreeSet<>(INFRASTRUCTURE_PASSTHROUGH);
+        if (profiles != null) {
+            for (FleetConfig.Profile p : profiles) {
+                addIfPresent(derived, p.gitTokenEnv());
+                addIfPresent(derived, p.gitHostEnv());
+                addIfPresent(derived, p.tokenEnv());
+                if (p.env() != null) {
+                    derived.addAll(p.env().keySet());
+                }
+            }
+        }
+        return Set.copyOf(derived);
+    }
+
+    /**
+     * Whether {@code name} survives the scrub when {@code allowedNames} is the derived set: an exact
+     * match, or an infrastructure-prefixed name ({@code LC_*}). Prefix rules live ONLY here and in
+     * the generated script's {@code case} pattern, which is written from this constant's value.
+     */
+    public static boolean keeps(Set<String> allowedNames, String name) {
+        return allowedNames.contains(name) || name.startsWith(INFRASTRUCTURE_NAME_PREFIX);
+    }
+
+    /** The prefix rule as a zsh {@code case} pattern, so the script and Java cannot drift apart. */
+    public static String zshCasePattern() {
+        return INFRASTRUCTURE_NAME_PREFIX + "*";
+    }
+
+    private static void addIfPresent(Set<String> into, String name) {
+        if (name != null && !name.isBlank()) {
+            into.add(name);
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -0,0 +1,543 @@
+package dev.ltms.fleet.member;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.CharterReceipt;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.SpawnRequest;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * The {@link HerdrPeerLauncher} adapter for <strong>opencode</strong> — an open-source,
+ * provider-agnostic terminal coding agent. Its whole reason for existing is to prove the
+ * {@code PeerLauncher} SPI is genuinely provider-neutral: opencode shares none of Claude Code's
+ * private launch seams, yet reuses every line of shared transport in the base (tab/pane placement,
+ * the CB-306 readiness gate, unique naming + CB-117 reap, teardown, listing, cwd).
+ *
+ * <p>The divergences from {@link ClaudeCodeLauncher}, all confined to {@link #buildLaunch}:
+ * <ul>
+ *   <li><strong>No subscription boundary.</strong> opencode carries no {@code ANTHROPIC_BASE_URL}
+ *       and there is no {@link dev.ltms.fleet.guard.SubscriptionGuard} — the guard is a
+ *       Claude-private concern, not part of the SPI. opencode reads the operator's own provider
+ *       credentials from its global {@code auth.json}; the bridge injects none.</li>
+ *   <li><strong>File-based MCP mount + instructions.</strong> opencode has no inline
+ *       {@code --mcp-config}/{@code --append-system-prompt}. Instead the bridge writes an ephemeral
+ *       {@code opencode.json} that declares the bridge as a {@code remote} MCP server and lists a
+ *       member-charter file under {@code instructions}, then points the worker at it with
+ *       {@code OPENCODE_CONFIG}. This is the one place the launcher touches disk — Claude never did.</li>
+ *   <li><strong>Model as a flag.</strong> the {@code provider/model} selector is passed as
+ *       {@code -m}, not an env var.</li>
+ *   <li><strong>{@code opencode} name prefix</strong> so reap matches {@code opencode-*} panes and
+ *       never another adapter's.</li>
+ * </ul>
+ */
+public final class OpenCodeLauncher extends HerdrPeerLauncher {
+
+    private static final Logger log = LoggerFactory.getLogger(OpenCodeLauncher.class);
+
+    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
+    private static final String NAME_PREFIX = "opencode";
+
+    /** Writer for the generated {@code opencode.json}. */
+    private static final ObjectMapper JSON = new ObjectMapper();
+
+    /** Root under which per-spawn opencode config dirs are created (injectable for tests). */
+    private final Path configRoot;
+
+    /**
+     * Session discovery against opencode's on-disk storage ({@link OpenCodeSessionDiscovery}) —
+     * the one seam that knows opencode's private session-file layout. Its root is injectable for
+     * tests so they never touch the operator's real {@code ~/.local/share/opencode}.
+     */
+    private final OpenCodeSessionDiscovery discovery;
+
+    /**
+     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so it
+     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env) {
+        this(agents, spaces, profiles, defaultProfile, env, 0,
+                System::currentTimeMillis, () -> sleepUninterruptibly(300),
+                defaultConfigRoot(), defaultDiscoveryRoot());
+    }
+
+    /**
+     * Production constructor with the spawn-ready gate enabled. Polls {@code agents.status()} until
+     * the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs, long spawnReadyPollMs) {
+        this(agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, spawnReadyPollMs, null);
+    }
+
+    /**
+     * Production constructor carrying the fleet-wide tab-label template (CB-557). The template comes
+     * from {@code fleet.tabLabel}, which a profile cannot know because it names the member's
+     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                            Supplier<FleetConfig.Fleet> fleet) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
+                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
+                defaultConfigRoot(), defaultDiscoveryRoot(), fleet);
+    }
+
+    /**
+     * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
+                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
+                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials);
+    }
+
+    /**
+     * Full testability constructor. Every injectable collaborator is explicit so unit tests supply a
+     * fake clock ({@code nowMillis}), poll-loop wait ({@code sleeper}), and a temp {@code configRoot}
+     * they can inspect the generated {@code opencode.json}/charter under.
+     *
+     * @param agents              herdr agent control (start, status, close)
+     * @param spaces              workspace / tab control (ensure, create, close)
+     * @param profiles            configured worker profiles
+     * @param defaultProfile      profile a no-argument spawn uses (nullable)
+     * @param env                 host env lookup (injectable for tests)
+     * @param spawnReadyTimeoutMs max ms to wait for injectable state (0 disables the gate)
+     * @param nowMillis           monotonic clock source (e.g. {@code System::currentTimeMillis})
+     * @param sleeper             sleep/wait hook (encodes the poll interval; never called when the
+     *                            gate is disabled)
+     * @param configRoot          existing directory under which per-spawn config dirs are created
+     * @param discoveryRoot       opencode's on-disk storage root to scan for session records
+     *                            (injectable for tests; opencode's layout is matched at
+     *                            {@link OpenCodeSessionDiscovery})
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs,
+                            LongSupplier nowMillis, Runnable sleeper,
+                            Path configRoot, Path discoveryRoot) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
+                nowMillis, sleeper, configRoot, discoveryRoot, null);
+    }
+
+    /**
+     * Full testability constructor, plus the fleet-wide tab-label template (CB-557).
+     *
+     * @param fleet live fleet config, read once for each spawn
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs,
+                            LongSupplier nowMillis, Runnable sleeper,
+                            Path configRoot, Path discoveryRoot,
+                            Supplier<FleetConfig.Fleet> fleet) {
+        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
+        this.configRoot = configRoot;
+        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+    }
+
+    /**
+     * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs,
+                            LongSupplier nowMillis, Runnable sleeper,
+                            Path configRoot, Path discoveryRoot,
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
+        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
+        this.configRoot = configRoot;
+        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+    }
+
+    private static Path defaultConfigRoot() {
+        return Path.of(System.getProperty("java.io.tmpdir"));
+    }
+
+    /** The default opencode storage root: {@code ~/.local/share/opencode} (the XDG data dir). */
+    private static Path defaultDiscoveryRoot() {
+        return Path.of(System.getProperty("user.home"), ".local", "share", "opencode");
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>Builds the opencode launch: no {@code ANTHROPIC_*} and no guard (opencode reads its own
+     * provider credentials); when the profile mounts the bridge MCP or has a member charter,
+     * generate an ephemeral {@code opencode.json} (remote MCP server + member-charter instructions)
+     * and point the worker at it via {@code OPENCODE_CONFIG}; carry the parity-neutral git-forge
+     * grant; and select the model with {@code -m}.
+     */
+    @Override
+    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
+        Map<String, String> workerEnv = baseEnv(cfg);
+        // A config file is needed for the bridge MCP mount, a member charter, the IDE MCP (+ its
+        // guidance overlay, CB-634), or a pinned endpoint (CB-508).
+        if (cfg.hasMcp() || cfg.hasIdeMcp() || spec.charter() != null || hasCustomProvider(cfg)) {
+            workerEnv.put("OPENCODE_CONFIG", writeConfig(cfg, spec.charter(), spec.cwd()).toString());
+        }
+        applyGitToken(workerEnv, cfg);
+        List<String> argv = argvWithResume(argvWithModel(argvWithAuto(cfg), cfg), spec.resumeSessionId());
+        return new Launch(workerEnv, argvWithAgent(argv, spec));
+    }
+
+    /**
+     * The launch argv plus, when the role has an agent-definition file under the worker's cwd,
+     * opencode's {@code --agent <role>} flag (CB-617). A role with no such file gets nothing added —
+     * the member must still spawn.
+     */
+    private List<String> argvWithAgent(List<String> argv, LaunchSpec spec) {
+        Path agentFile = agentDefinitionFile(spec.cwd(), spec.role(), ".opencode", "agent");
+        if (agentFile == null) {
+            return argv;
+        }
+        List<String> withAgent = mutableArgv(argv);
+        withAgent.add("--agent");
+        withAgent.add(spec.role().wireName());
+        return withAgent;
+    }
+
+    /**
+     * True when this profile pins its own OpenAI-compatible endpoint (CB-508) rather than using
+     * whatever provider opencode resolves by default.
+     *
+     * <p>Note this reuses {@code baseUrl}, the same field the Claude adapter injects as
+     * {@code ANTHROPIC_BASE_URL} — but it does <em>not</em> go through {@code SubscriptionGuard}.
+     * That asymmetry is deliberate and safe: the guard exists to stop a worker borrowing the
+     * primary's Anthropic subscription, and an opencode process has no Anthropic credential path
+     * at all. Pointing it at a local vLLM cannot leak the subscription.
+     */
+    private static boolean hasCustomProvider(FleetConfig.Profile cfg) {
+        return cfg.baseUrl() != null && !cfg.baseUrl().isBlank();
+    }
+
+    /**
+     * The launch argv plus the unconditional {@code --auto} flag, which auto-approves the
+     * permissions opencode does not explicitly deny. It is unconditional, not a preference: a
+     * spawned peer has no human at its pane — the bridge spawned it — so one that stops at an
+     * approval prompt is a wedged agent, indistinguishable from a legitimate mid-turn wait and
+     * unable to end its turn with {@code fleet_reply}. opencode's own help calls this
+     * "dangerous!", but the blast radius here is already bounded by design: a worker runs in its
+     * own git worktree on its own branch, is off-subscription, and cannot merge — the lead is the
+     * gate.
+     */
+    private List<String> argvWithAuto(FleetConfig.Profile cfg) {
+        List<String> argv = mutableArgv(cfg.argv());
+        argv.add("--auto");
+        return argv;
+    }
+
+    /**
+     * The launch argv plus, on a resumed spawn, opencode's {@code -s <id>} flag to continue a prior
+     * conversation by its session id. {@code -s, --session <id>} resumes an existing session; on a
+     * fresh spawn (no resume target) no flag is added, letting opencode start a brand-new session.
+     * The id comes from the base launch spec.
+     */
+    private List<String> argvWithResume(List<String> argv, String id) {
+        if (id == null || id.isBlank()) {
+            return argv;
+        }
+        List<String> withResume = mutableArgv(argv);
+        withResume.add("-s");
+        withResume.add(id);
+        return withResume;
+    }
+
+    /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
+    private List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
+        if (cfg.model() != null && !cfg.model().isBlank()) {
+            argv.add("-m");
+            argv.add(cfg.model());
+        }
+        return argv;
+    }
+
+    /**
+     * Write an ephemeral {@code opencode.json} (and the member-charter file it references) into a
+     * fresh per-spawn directory under {@link #configRoot}, and return the config file's path for
+     * {@code OPENCODE_CONFIG}. The dir is unique per spawn so concurrent workers never race on it;
+     * it is best-effort cleaned on JVM exit (worker config is disposable — regenerated every spawn).
+     */
+    private Path writeConfig(FleetConfig.Profile cfg, String charterText, String cwd) {
+        try {
+            Path dir = Files.createTempDirectory(configRoot, "bridged-opencode-");
+            dir.toFile().deleteOnExit();
+
+            ObjectNode root = JSON.createObjectNode();
+            root.put("$schema", "https://opencode.ai/config.json");
+            // CB-523, opencode side: a worker that runs out of context dies mid-turn, and its reply
+            // — the entire point of the turn — is lost with it. Auto-compaction is therefore not an
+            // operator preference for a bridged worker, it is a condition of the turn contract.
+            //
+            // Stated deliberately even though it is redundant today: OPENCODE_CONFIG is MERGED over
+            // ~/.config/opencode/config.json rather than replacing it, so a worker already inherits
+            // an `auto: true` set at home. We do not want that inheritance to be what the guarantee
+            // rests on — the home file is outside this repo, differs per machine, and is not ours.
+            //
+            // Know the cost before removing it: this key WINS over the home config (verified — an
+            // OPENCODE_CONFIG value overrides the home value, it does not defer to it), so an
+            // operator who sets `compaction.auto: false` at home cannot turn it off for bridged
+            // workers. That is the intended trade for peers we spawn and whose turns we must land;
+            // if per-profile control is ever wanted, add a profile knob rather than dropping this.
+            root.putObject("compaction").put("auto", true);
+
+            if (charterText != null) {
+                Path charter = dir.resolve("member-charter.md");
+                Files.writeString(charter, charterText);
+                charter.toFile().deleteOnExit();
+
+                root.putArray("instructions").add(charter.toAbsolutePath().toString());
+            }
+
+            if (cfg.hasMcp() || cfg.hasIdeMcp()) {
+                // One shared mcp node for both servers — putObject would replace the node (and thus
+                // the other server) on the second call, so build into a single get-or-create node.
+                ObjectNode mcp = root.withObject("mcp");
+                if (cfg.hasMcp()) {
+                    ObjectNode mount = mcp.putObject(PeerLauncher.MCP_MOUNT_NAME);
+                    mount.put("type", "remote");
+                    mount.put("url", cfg.mcpUrl());
+                    mount.put("enabled", true);
+                }
+                // CB-634: mount the IDE Index MCP in the same shape as the bridge remote server, and
+                // deliver its guidance via the instructions array (opencode does not read
+                // CLAUDE.local.md) rather than any system-prompt string.
+                if (cfg.hasIdeMcp()) {
+                    ObjectNode ide = mcp.putObject("intellij");
+                    ide.put("type", "remote");
+                    ide.put("url", cfg.ideMcpUrl());
+                    ide.put("enabled", true);
+
+                    // CB-634: pin the overlay and open the IDE at the module dir (this repo's pom is
+                    // in `bridged/`, not at the worktree root) — see PeerLauncher.ideProjectPath.
+                    String projectPath = PeerLauncher.ideProjectPath(cwd, cfg.ideProjectDir());
+                    Path rules = dir.resolve("ide-rules.md");
+                    Files.writeString(rules, PeerLauncher.ideOverlayText(projectPath));
+                    rules.toFile().deleteOnExit();
+                    // The array may already hold the member-charter path; withArray gets-or-creates.
+                    root.withArray("instructions").add(rules.toAbsolutePath().toString());
+                    PeerLauncher.openInIde(projectPath, cfg.ideOpenCommand(), log);
+                }
+            }
+            if (hasCustomProvider(cfg)) {
+                addCustomProvider(root, cfg);
+            }
+
+            Path cfgFile = dir.resolve("opencode.json");
+            // Built with Jackson rather than string concatenation: the provider block is nested and
+            // carries operator-supplied values (URL, model id, api key), so escaping must be real.
+            Files.writeString(cfgFile, JSON.writerWithDefaultPrettyPrinter().writeValueAsString(root));
+            cfgFile.toFile().deleteOnExit();
+            return cfgFile;
+        } catch (IOException e) {
+            throw new UncheckedIOException(
+                    "cannot write opencode config for profile " + cfg.profile(), e);
+        }
+    }
+
+    /**
+     * Declare a custom OpenAI-compatible provider so the worker talks to a pinned endpoint (a local
+     * vLLM, say) instead of opencode's default gateway (CB-508).
+     *
+     * <p>The provider id comes from the {@code provider/model} selector in {@code model:}, so one
+     * field drives both the declaration and the {@code -m} flag and they cannot drift apart.
+     */
+    private void addCustomProvider(ObjectNode root, FleetConfig.Profile cfg) {
+        String[] parts = splitModelSelector(cfg);
+        String providerId = parts[0];
+        String modelId = parts[1];
+
+        ObjectNode provider = root.putObject("provider").putObject(providerId);
+        provider.put("npm", "@ai-sdk/openai-compatible");
+        provider.put("name", providerId + " (bridged)");
+
+        ObjectNode options = provider.putObject("options");
+        options.put("baseURL", openAiBaseUrl(cfg.baseUrl()));
+        // vLLM and friends usually ignore the key, but the AI SDK still requires a non-empty one.
+        String token = resolveEnv(cfg.tokenEnv());
+        options.put("apiKey", (token == null || token.isBlank()) ? "fleetd-local-noauth" : token);
+
+        provider.putObject("models").putObject(modelId).put("name", modelId);
+    }
+
+    /**
+     * Split {@code model:} into its {@code provider} and {@code model} halves. A pinned endpoint
+     * needs both, so a bare model name is rejected loudly rather than silently falling back to the
+     * default gateway — a worker quietly talking to the wrong endpoint is the failure this avoids.
+     */
+    private static String[] splitModelSelector(FleetConfig.Profile cfg) {
+        String model = cfg.model();
+        int slash = model == null ? -1 : model.indexOf('/');
+        if (model == null || model.isBlank() || slash <= 0 || slash == model.length() - 1) {
+            throw new IllegalArgumentException(
+                    "profile " + cfg.profile() + " sets baseUrl (a pinned opencode endpoint) so"
+                            + " model: must be \"<provider>/<model>\", e.g."
+                            + " \"local-vllm/deepseek-v4-flash\"; got "
+                            + (model == null ? "null" : '"' + model + '"'));
+        }
+        return new String[]{model.substring(0, slash), model.substring(slash + 1)};
+    }
+
+    /**
+     * The OpenAI-compatible base URL for {@code baseUrl}. A bare {@code host:port} gets {@code /v1}
+     * appended (where these servers put the API); a URL that already carries a path is taken as-is,
+     * so an endpoint mounted somewhere unusual is still reachable.
+     */
+    private static String openAiBaseUrl(String baseUrl) {
+        String trimmed = baseUrl.trim();
+        while (trimmed.endsWith("/")) {
+            trimmed = trimmed.substring(0, trimmed.length() - 1);
+        }
+        int schemeEnd = trimmed.indexOf("://");
+        String afterScheme = schemeEnd < 0 ? trimmed : trimmed.substring(schemeEnd + 3);
+        return afterScheme.contains("/") ? trimmed : trimmed + "/v1";
+    }
+
+    /** Add lazy on-disk session discovery to the base handle. */
+    @Override
+    public PeerHandle spawn(SpawnRequest req) {
+        PeerHandle inner = super.spawn(req);
+        return new SessionAwareHandle(inner, discovery, effectiveCwd(req));
+    }
+
+    /**
+     * A {@link PeerHandle} that delegates everything to the base's worker handle but resolves
+     * {@link #agentSessionId()} lazily through opencode session discovery. Delegate-only, so the
+     * base's id/terminalId/profile semantics (CB-519's host-unique routing key, herdr coordinates)
+     * are untouched — only the opencode-specific identity answer is added. {@code sessionName()}
+     * stays null: opencode has no display-name seam, so the logical name lives only in the bridge's
+     * roster (see the SESSION_NAME capability).
+     */
+    private static final class SessionAwareHandle implements PeerHandle {
+        private final PeerHandle delegate;
+        private final OpenCodeSessionDiscovery discovery;
+        private final String cwd;
+
+        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd) {
+            this.delegate = delegate;
+            this.discovery = discovery;
+            this.cwd = cwd;
+        }
+
+        @Override
+        public String id() {
+            return delegate.id();
+        }
+
+        @Override
+        public String terminalId() {
+            return delegate.terminalId();
+        }
+
+        @Override
+        public String profile() {
+            return delegate.profile();
+        }
+
+        @Override
+        public String sessionName() {
+            return delegate.sessionName();
+        }
+
+        @Override
+        public String agentSessionId() {
+            // Lazy + retried, never a spawn-time blocker: opencode writes the session record only
+            // when the session is first persisted, so null here is the correct interim answer and
+            // the caller re-calls later (each call re-scans, picking up a record that has since
+            // appeared).
+            return discovery.sessionIdForDirectory(cwd);
+        }
+
+        @Override
+        public CharterReceipt charterReceipt() {
+            return delegate.charterReceipt();
+        }
+    }
+
+    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
+
+    /** Spawn a worker for the default profile in the resolved default cwd. */
+    public Agent spawn() {
+        return spawnInternal(null, null, null);
+    }
+
+    /** Spawn a worker for a named profile (null → default) in the resolved default cwd. */
+    public Agent spawn(String profileName) {
+        return spawnInternal(profileName, null, null);
+    }
+
+    /** Spawn a worker for a named profile with an explicit requested/caller cwd (CB-112). */
+    public Agent spawn(String profileName, String requestedCwd, String callerCwd) {
+        return spawnInternal(profileName, requestedCwd, callerCwd);
+    }
+
+    // --- capabilities --------------------------------------------------------------------------
+
+    @Override
+    public Set<Capability> capabilities() {
+        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
+                Capability.ORPHAN_REAP, Capability.SESSION_RESUME);
+        if (hasGitTokenProfile()) {
+            caps.add(Capability.SELF_PR);
+        }
+        // Deliberately NOT SESSION_NAME: opencode has no display-name flag, so the bridge's logical
+        // name can't surface in the peer's own UI — declaring the capability would hide that
+        // asymmetry rather than make it honest. For opencode the name lives only in the bridge's
+        // roster (see PeerHandle.sessionName() returning null).
+        return Set.copyOf(caps);
+    }
+
+    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
+    private boolean hasGitTokenProfile() {
+        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
+    }
+
+    // --- CB-117 reap predicate (opencode prefix), kept for direct unit testing -----------------
+
+    /**
+     * Whether {@code name} is an opencode bridge worker started by a <em>different</em> process than
+     * {@code currentNonce}. A thin {@code opencode}-prefix binding of
+     * {@link HerdrPeerLauncher#isForeignWorker(String, String, String)}.
+     */
+    static boolean isForeignWorker(String name, String currentNonce) {
+        return HerdrPeerLauncher.isForeignWorker(NAME_PREFIX, name, currentNonce);
+    }
+}

bridged/src/main/java/dev/ltms/fleet/member/OpenCodeSessionDiscovery.java

@@ -0,0 +1,122 @@
+package dev.ltms.fleet.member;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.stream.Stream;
+
+/**
+ * Resolves the opencode session id for a bridged worker from opencode's on-disk storage — the
+ * only place this adapter touches opencode's private layout, and deliberately the <em>only</em>
+ * class that does.
+ *
+ * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not a
+ * stable contract: opencode writes one JSON file per session under
+ * {@code <storageRoot>/session/<projectID>/<ses_*.json>}, and each record carries a
+ * {@code "version"} field (e.g. {@code "1.1.31"}), so the exact directory shape, file naming, and
+ * field names can move between opencode releases. opencode also ships a headless HTTP server that
+ * may supersede file scanning entirely. Everything this adapter knows about that private storage —
+ * its shape, naming, and field names — lives here, so a layout change, or a switch to the HTTP
+ * server, changes exactly one class and nothing in {@link OpenCodeLauncher}.
+ *
+ * <p>The determinism that makes this useful is structural, not a guess: every bridged worker runs
+ * in its own unique git worktree, so the record's {@code directory} (its project root) equals the
+ * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
+ * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
+ * the CLI listing does not even show the directory.
+ *
+ * <p>All reads are best-effort and never throw: a missing or unreadable storage root, a record that
+ * fails to parse, or a directory with no record yet all yield {@code null}, and the caller (the
+ * session handle) treats that as "identity not resolved yet" and retries later.
+ */
+final class OpenCodeSessionDiscovery {
+
+    private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
+    private final ObjectMapper json;
+
+    OpenCodeSessionDiscovery(Path storageRoot) {
+        this.storageRoot = storageRoot;
+        this.json = new ObjectMapper();
+    }
+
+    /**
+     * The opencode session id whose record references {@code directory} (the worker's cwd), or
+     * {@code null} when no record matches yet. When several records share the directory — e.g.
+     * repeated spawns into the same worktree — the <em>most recently modified</em> one wins: it is
+     * the session the pane most likely corresponds to.
+     *
+     * <p>Never throws: a missing {@code storageRoot}, an unreadable/malformed record, or a
+     * directory that has not been persisted yet all resolve to {@code null} rather than failing a
+     * spawn. A bridged worker's session record is written lazily (when the session is first
+     * persisted), so {@code null} here is the normal answer right after the pane is ready, and the
+     * caller retries later.
+     *
+     * @param directory the worker's cwd, as resolved for this spawn
+     * @return the matching session id, or {@code null} if none is known yet
+     */
+    String sessionIdForDirectory(String directory) {
+        if (directory == null || directory.isBlank()) {
+            return null;
+        }
+        Path sessionRoot = storageRoot.resolve("session");
+        if (!Files.isDirectory(sessionRoot)) {
+            return null;
+        }
+        String best = null;
+        long bestMtime = Long.MIN_VALUE;
+        try (Stream<Path> projectDirs = Files.list(sessionRoot)) {
+            for (Path projectDir : projectDirs.filter(Files::isDirectory).toList()) {
+                try (Stream<Path> records = Files.list(projectDir)) {
+                    for (Path record : records.toList()) {
+                        String id = matchId(record, directory);
+                        if (id == null) {
+                            continue;
+                        }
+                        long mtime = lastModifiedEpochMillis(record);
+                        if (mtime > bestMtime) {
+                            bestMtime = mtime;
+                            best = id;
+                        }
+                    }
+                } catch (IOException ignored) {
+                    // one project dir unreadable — skip it; another may still match
+                }
+            }
+        } catch (IOException ignored) {
+            // storage root vanished or became unreadable — "no session known yet"
+            return null;
+        }
+        return best;
+    }
+
+    /**
+     * The record's session id when it references {@code directory}, else {@code null}. A record
+     * that is not JSON, lacks {@code id}/{@code directory}, or points at a different directory is
+     * simply not our session; a malformed one is skipped, never fatal.
+     */
+    private String matchId(Path record, String directory) {
+        try {
+            JsonNode node = json.readTree(record.toFile());
+            JsonNode id = node == null ? null : node.get("id");
+            JsonNode dir = node == null ? null : node.get("directory");
+            if (id == null || dir == null || !directory.equals(dir.asText())) {
+                return null;
+            }
+            return id.asText();
+        } catch (IOException e) {
+            return null;
+        }
+    }
+
+    /** The record's last-modified epoch ms, or {@code Long.MIN_VALUE} if unreadable (never wins). */
+    private static long lastModifiedEpochMillis(Path record) {
+        try {
+            return Files.getLastModifiedTime(record).toMillis();
+        } catch (IOException e) {
+            return Long.MIN_VALUE;
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/metrics/FleetMetrics.java

@@ -0,0 +1,101 @@
+package dev.ltms.fleet.metrics;
+
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.MemberSession;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * The daemon's metric definitions (CB-502) — one place where every series is named, described, and
+ * (for gauges) bound to live state.
+ *
+ * <p>The set is deliberately small: each series maps to a failure mode this project has actually
+ * hit, not to whatever was easy to count. The two worth watching in practice are
+ * {@code fleet_sends_total{outcome="completion_fallback"}} — a rising share means turn detection
+ * is degrading, the CB-115/116/118 failure family — and
+ * {@code fleet_push_nudges_total{outcome="exhausted"}}, which means the primary stopped draining
+ * its inbox and CB-307's active push gave up.
+ */
+public final class FleetMetrics {
+
+    /** Counter: delegated sends by terminal outcome. */
+    public static final String SENDS = "fleet_sends_total";
+    /** Counter: worker replies by the path that carried them (rendezvous vs stranded-to-inbox). */
+    public static final String REPLIES = "fleet_replies_total";
+    /** Counter: push-loop nudges to the primary, by outcome. */
+    public static final String PUSH_NUDGES = "fleet_push_nudges_total";
+    /** Counter: idle-lead heartbeat nudges to the lead, by outcome (CB-551). */
+    public static final String HEARTBEAT_NUDGES = "fleet_lead_heartbeat_nudges_total";
+    /** Counter: spawn attempts by peer kind and outcome. */
+    public static final String SPAWNS = "fleet_spawns_total";
+    /** Counter: herdr socket calls by method and outcome. */
+    public static final String HERDR_CALLS = "fleet_herdr_calls_total";
+    /** Counter: rejected requests by reason (CB-501). */
+    public static final String AUTH_FAILURES = "fleet_auth_failures_total";
+    /** Gauge: session census by lifecycle state. */
+    public static final String SESSIONS = "fleet_sessions";
+    /** Gauge: undrained replies held per target. */
+    public static final String INBOX_DEPTH = "fleet_inbox_depth";
+
+    private FleetMetrics() {
+    }
+
+    /**
+     * Build the registry with its help text and live gauges bound.
+     *
+     * @param sessions the authoritative session registry (census gauge)
+     * @param inbox    the reply inbox; only used for a depth gauge when it can be inspected
+     */
+    public static Metrics create(SessionManager sessions, ReplyInbox inbox) {
+        Metrics m = new Metrics();
+
+        m.describe(SENDS, "counter",
+                "Delegated sends by terminal outcome (replied|completion_fallback|timeout|failed).");
+        m.describe(REPLIES, "counter",
+                "Worker replies by delivery path (rendezvous=resolved an open send, inbox=stranded and held).");
+        m.describe(PUSH_NUDGES, "counter",
+                "CB-307 push-loop nudges to the primary (delivered|exhausted).");
+        m.describe(HEARTBEAT_NUDGES, "counter",
+                "CB-551 idle-lead heartbeat nudges (delivered|failed|exhausted). Quiet-cap exhaustion "
+                        + "means the lead idled with nothing pending and was told to stand down.");
+        m.describe(SPAWNS, "counter",
+                "Worker spawn attempts by peer kind and outcome (ready|timeout|guard_rejected).");
+        m.describe(HERDR_CALLS, "counter",
+                "herdr socket calls by method and outcome — the dependency everything else rests on.");
+        m.describe(AUTH_FAILURES, "counter",
+                "Requests refused by CB-501/505 (unauthenticated|forbidden).");
+        m.describe(SESSIONS, "gauge",
+                "Registered worker sessions by lifecycle state.");
+        m.describe(INBOX_DEPTH, "gauge",
+                "Replies held for a target that the primary has not drained. Steady state is 0; "
+                        + "a target stuck above 0 means CB-307 delivery is not completing.");
+
+        // One gauge per state so a scrape shows the whole census even when a state is empty —
+        // an absent series and a zero series read very differently on a dashboard.
+        for (MemberSession.State state : MemberSession.State.values()) {
+            String label = state.name().toLowerCase();
+            m.gauge(SESSIONS, () -> countIn(sessions, state), "state", label);
+        }
+
+        // Depth is per live session, so the label set is only known at scrape time. peek() is the
+        // port's non-destructive read — scraping metrics must never ack a reply out of the inbox.
+        m.collector(INBOX_DEPTH, "target", () -> {
+            Map<String, Number> depths = new LinkedHashMap<>();
+            for (MemberSession s : sessions.roster()) {
+                String target = s.terminalId();
+                if (target == null) {
+                    continue;
+                }
+                depths.put(target, inbox.peek(target).size());
+            }
+            return depths;
+        });
+        return m;
+    }
+
+    private static long countIn(SessionManager sessions, MemberSession.State state) {
+        return sessions.roster().stream().filter(s -> s.state() == state).count();
+    }
+}

bridged/src/main/java/dev/ltms/fleet/metrics/Metrics.java

@@ -0,0 +1,181 @@
+package dev.ltms.fleet.metrics;
+
+import java.util.Map;
+import java.util.NavigableMap;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentSkipListMap;
+import java.util.concurrent.atomic.LongAdder;
+import java.util.function.Supplier;
+
+/**
+ * The daemon's metric registry and Prometheus text renderer (CB-502).
+ *
+ * <p>Deliberately dependency-free. The roadmap's tech-stack table specified Micrometer, but this
+ * pom already carries an unusual reconciliation burden (a hand-pinned {@code jackson-annotations}
+ * to make the MCP SDK's Jackson 3 coexist with our Jackson 2, a Jetty BOM import to stop version
+ * skew, and four documented accepted-CVE advisories), and the dependency CVE gate this project
+ * mandates could not be run when this landed. The metric set is small and fully known, and
+ * Prometheus text exposition is a stable, well-specified format — so the registry is ~100 lines
+ * here instead of a new transitive tree. {@code GET /metrics} is the swap seam if Micrometer's
+ * ecosystem is ever wanted.
+ *
+ * <p>Thread-safe: counters are {@link LongAdder} (built for contended increment), gauges are
+ * supplier-backed so they read live state at scrape time rather than needing to be pushed.
+ */
+public final class Metrics {
+
+    /** Counter series, keyed by the fully-rendered {@code name{labels}} sample id. */
+    private final NavigableMap<String, LongAdder> counters = new ConcurrentSkipListMap<>();
+    /** Gauge series, evaluated at scrape time. */
+    private final NavigableMap<String, Supplier<Number>> gauges = new ConcurrentSkipListMap<>();
+    /** Gauge families whose label set is only known at scrape time, keyed by metric name. */
+    private final NavigableMap<String, Collector> collectors = new ConcurrentSkipListMap<>();
+    /** HELP/TYPE metadata, keyed by bare metric name. */
+    private final Map<String, String[]> meta = new ConcurrentHashMap<>();
+
+    /** A gauge family whose series are discovered per scrape (one label, many values). */
+    private record Collector(String labelName, Supplier<Map<String, Number>> samples) {
+    }
+
+    /** Declare a metric's help text and type once, so the exposition carries HELP/TYPE lines. */
+    public Metrics describe(String name, String type, String help) {
+        meta.put(name, new String[]{type, help});
+        return this;
+    }
+
+    /** Increment a counter by one. */
+    public void inc(String name, String... labelPairs) {
+        add(name, 1, labelPairs);
+    }
+
+    /** Increment a counter by {@code delta}. */
+    public void add(String name, long delta, String... labelPairs) {
+        counters.computeIfAbsent(sample(name, labelPairs), _ -> new LongAdder()).add(delta);
+    }
+
+    /**
+     * Register a live gauge. The supplier is called at scrape time, so it reflects current state
+     * (session census, inbox depth) without anything having to remember to update it.
+     */
+    public void gauge(String name, Supplier<Number> value, String... labelPairs) {
+        gauges.put(sample(name, labelPairs), value);
+    }
+
+    /**
+     * Register a gauge family whose label values are not known up front — inbox depth per target,
+     * for instance, where the set of targets changes as workers come and go. The supplier returns
+     * {@code labelValue → value} and is evaluated once per scrape.
+     */
+    public void collector(String name, String labelName, Supplier<Map<String, Number>> samples) {
+        collectors.put(name, new Collector(labelName, samples));
+    }
+
+    /** Current value of a counter series — for assertions in tests. */
+    public long count(String name, String... labelPairs) {
+        LongAdder a = counters.get(sample(name, labelPairs));
+        return a == null ? 0 : a.sum();
+    }
+
+    /**
+     * Render the Prometheus text exposition format (version 0.0.4): optional {@code # HELP} and
+     * {@code # TYPE} lines per metric family, then one line per sample.
+     */
+    public String render() {
+        StringBuilder out = new StringBuilder(1024);
+        String lastFamily = null;
+        for (Map.Entry<String, LongAdder> e : counters.entrySet()) {
+            lastFamily = emitHeader(out, e.getKey(), lastFamily);
+            out.append(e.getKey()).append(' ').append(e.getValue().sum()).append('\n');
+        }
+        for (Map.Entry<String, Supplier<Number>> e : gauges.entrySet()) {
+            lastFamily = emitHeader(out, e.getKey(), lastFamily);
+            Number v;
+            try {
+                v = e.getValue().get();
+            } catch (RuntimeException ex) {
+                continue; // a broken gauge must never break the whole scrape
+            }
+            if (v == null) {
+                continue;
+            }
+            out.append(e.getKey()).append(' ').append(format(v)).append('\n');
+        }
+        for (Map.Entry<String, Collector> e : collectors.entrySet()) {
+            Map<String, Number> samples;
+            try {
+                samples = e.getValue().samples().get();
+            } catch (RuntimeException ex) {
+                continue; // a broken collector must never break the whole scrape
+            }
+            if (samples == null || samples.isEmpty()) {
+                continue;
+            }
+            lastFamily = emitHeader(out, e.getKey(), lastFamily);
+            // Sort so repeated scrapes are byte-stable and diffable.
+            new java.util.TreeMap<>(samples).forEach((label, v) -> {
+                if (v != null) {
+                    out.append(sample(e.getKey(), e.getValue().labelName(), label))
+                            .append(' ').append(format(v)).append('\n');
+                }
+            });
+        }
+        return out.toString();
+    }
+
+    /** Emit HELP/TYPE when the sample starts a new metric family; returns the current family. */
+    private String emitHeader(StringBuilder out, String sampleId, String lastFamily) {
+        String family = familyOf(sampleId);
+        if (family.equals(lastFamily)) {
+            return lastFamily;
+        }
+        String[] m = meta.get(family);
+        if (m != null) {
+            out.append("# HELP ").append(family).append(' ').append(m[1]).append('\n');
+            out.append("# TYPE ").append(family).append(' ').append(m[0]).append('\n');
+        }
+        return family;
+    }
+
+    private static String familyOf(String sampleId) {
+        int brace = sampleId.indexOf('{');
+        return brace < 0 ? sampleId : sampleId.substring(0, brace);
+    }
+
+    /** Whole numbers render without a decimal point; everything else as-is. */
+    private static String format(Number v) {
+        double d = v.doubleValue();
+        return (d == Math.rint(d) && !Double.isInfinite(d))
+                ? Long.toString((long) d)
+                : Double.toString(d);
+    }
+
+    /** Build the {@code name{k="v",k2="v2"}} sample id; labels are sorted for stable output. */
+    private static String sample(String name, String... labelPairs) {
+        if (labelPairs == null || labelPairs.length == 0) {
+            return name;
+        }
+        if (labelPairs.length % 2 != 0) {
+            throw new IllegalArgumentException("labels must be key/value pairs, got " + labelPairs.length);
+        }
+        NavigableMap<String, String> sorted = new java.util.TreeMap<>();
+        for (int i = 0; i < labelPairs.length; i += 2) {
+            sorted.put(labelPairs[i], labelPairs[i + 1] == null ? "" : labelPairs[i + 1]);
+        }
+        StringBuilder sb = new StringBuilder(name.length() + 16 * sorted.size());
+        sb.append(name).append('{');
+        boolean first = true;
+        for (Map.Entry<String, String> e : sorted.entrySet()) {
+            if (!first) {
+                sb.append(',');
+            }
+            first = false;
+            sb.append(e.getKey()).append("=\"").append(escapeLabel(e.getValue())).append('"');
+        }
+        return sb.append('}').toString();
+    }
+
+    /** Label values are escaped per the exposition format: backslash, quote, newline. */
+    private static String escapeLabel(String v) {
+        return v.replace("\\", "\\\\").replace("\"", "\\\"").replace("\n", "\\n");
+    }
+}

bridged/src/main/java/dev/ltms/fleet/msg/AmqpReplyInbox.java

@@ -0,0 +1,451 @@
+package dev.ltms.fleet.msg;
+
+import com.rabbitmq.client.AMQP;
+import com.rabbitmq.client.Channel;
+import com.rabbitmq.client.Connection;
+import com.rabbitmq.client.ConnectionFactory;
+import com.rabbitmq.client.DeliverCallback;
+import com.rabbitmq.client.Recoverable;
+import com.rabbitmq.client.RecoveryListener;
+import com.rabbitmq.client.Return;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.NavigableMap;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentSkipListMap;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+
+/**
+ * AMQP-backed {@link ReplyInbox} (CB-307 Stage 2): genuine cross-restart durability behind the same
+ * port {@link InMemoryReplyInbox} implements as soft state.
+ *
+ * <p><strong>Mapping — consume-and-hold with deferred manual ack.</strong> Each target has a durable
+ * queue {@code agent.<target>.inbox}. The gateway that owns the target starts a manual-ack consumer
+ * ({@link #own}) that pulls persistent messages off that queue into an in-memory <em>held</em> map
+ * (keyed by {@code msgId}) but does <em>not</em> ack them. {@link #peek} returns that snapshot;
+ * {@link #ack} acks the broker delivery-tag and drops the entry. Because messages stay unacked until
+ * the owning gateway actually drains them, a crash (or a {@code java -jar} bounce) before caller-ack
+ * leaves them on the broker — it redelivers on reconnect. That is the durability the in-memory
+ * adapter cannot give, with the port contract preserved.
+ *
+ * <p><strong>Prefetch bounds the held backlog (CB-527).</strong> The consumer channel calls
+ * {@code basicQos} with a configurable prefetch count ({@link #DEFAULT_PREFETCH} unless the caller
+ * passes another value to {@link #open(String, int)}) before starting any consumer. Without a bound,
+ * the broker pushes its entire queue into {@link #held} the instant a target is {@link #own owned},
+ * so an undrained primary grows the JVM heap without limit and any queue-level control
+ * ({@code x-max-length}, per-message TTL) never fires because the queue never actually holds a
+ * backlog. Prefetch keeps the backlog where it is visible — on the broker — until the owner drains it.
+ *
+ * <p><strong>Publishes require a confirmed, routable delivery (CB-528).</strong> {@link #publish}
+ * runs on a channel separate from the consume/ack channel ({@link #channel}), so a slow or blocked
+ * publish confirm can never hold {@link #channelLock} and stall an ack — the ack path never waits on
+ * a publish confirm. That publish channel is in publisher-confirm mode and every publish sets the
+ * {@code mandatory} flag, so an unroutable publish (queue not declared, e.g. the owner never called
+ * {@link #own}) is returned by the broker instead of silently dropped. The broker sends the
+ * <em>return</em> for an unroutable message before the <em>confirm</em> that covers it — the ack/nack
+ * callback checks the returned-set at confirm time rather than assuming an ack means routed — so
+ * "confirmed" here means "durably queued", not merely "accepted by the broker". A returned or nacked
+ * (or un-confirmed within the timeout) publish surfaces as an {@link IllegalStateException} on the
+ * caller's thread; the caller — {@link MessageService#reply} — must not report success for a
+ * black-holed reply.
+ *
+ * <p><strong>Ownership is explicit.</strong> {@link #own} declares the queue and starts the consumer;
+ * {@link #release} cancels it. {@link #publish} sends to the queue but does <em>not</em> imply ownership
+ * and does not attach a consumer. This split is required by CB-308 federation, where one gateway may
+ * publish to an agent owned by another gateway; in that case the publisher must not compete for
+ * deliveries.
+ *
+ * <p><strong>Dedup.</strong> The consumer keys the held map by {@code msgId}; a redelivered duplicate
+ * (at-least-once, or a producer double-publish) is acked-and-dropped on arrival, so it never
+ * double-queues.
+ *
+ * <p><strong>Visibility.</strong> Unlike the in-memory adapter, publish → broker → consumer is
+ * asynchronous, so a {@link #peek} immediately after {@link #publish} may not yet see the message
+ * (broker delivery latency). Callers that need the reply drained poll (as the primary already does);
+ * the contract test waits for visibility. This is inherent to broker-backed delivery, not a defect.
+ *
+ * <p>The default deploy targets LavinMQ; a stock RabbitMQ speaks the same AMQP 0-9-1 (URI-only swap),
+ * so the {@code @Tag("contract")} integration test runs against a RabbitMQ container.
+ */
+public final class AmqpReplyInbox implements ReplyInbox, AutoCloseable {
+
+    private static final Logger log = LoggerFactory.getLogger(AmqpReplyInbox.class);
+
+    private static final String QUEUE_PREFIX = "agent.";
+    private static final String QUEUE_SUFFIX = ".inbox";
+
+    /** CB-527: the prefetch used when a caller does not pass an explicit value to {@link #open(String, int)}. */
+    public static final int DEFAULT_PREFETCH = 32;
+
+    /** How long {@link #publish} waits for its publisher confirm before failing the call (CB-528). */
+    private static final long CONFIRM_TIMEOUT_MS = 10_000L;
+
+    private final Connection connection;
+    private final Channel channel;
+    /** All channel operations (publish/declare/ack/cancel) serialize on this — a Channel is not thread-safe. */
+    private final Object channelLock = new Object();
+    /** target → (msgId → held delivery). Per-target map is guarded by synchronizing on itself. */
+    private final ConcurrentHashMap<String, LinkedHashMap<String, Held>> held = new ConcurrentHashMap<>();
+    /** Targets whose queue is declared and consumer is running, mapped to their broker consumer tag. */
+    private final ConcurrentHashMap<String, String> consumerTags = new ConcurrentHashMap<>();
+
+    /**
+     * CB-528: a dedicated channel for {@link #publish}, kept separate from {@link #channel} (consume
+     * + ack) so a publish confirm round trip never blocks under {@link #channelLock} and stalls an ack.
+     */
+    private final Channel publishChannel;
+    private final Object publishChannelLock = new Object();
+    /** In-flight publishes awaiting their confirm, keyed by the publish channel's sequence number. */
+    private final ConcurrentSkipListMap<Long, Pending> pendingBySeq = new ConcurrentSkipListMap<>();
+    /**
+     * The same in-flight publishes, keyed by {@code msgId} — a broker {@code Return} carries no delivery
+     * tag. Assumes {@code msgId} is unique per in-flight publish: a second {@link #publish} for a
+     * {@code msgId} still awaiting its confirm would overwrite this entry and misdirect
+     * {@link #onReturn}'s lookup. Not reachable today — {@code MessageService.reply} generates a fresh
+     * {@code UUID} per call — so no guard is added for it.
+     */
+    private final ConcurrentHashMap<String, Pending> pendingByMsgId = new ConcurrentHashMap<>();
+
+    /** A message pulled off the broker but not yet acked: its delivery-tag plus the port payload. */
+    private record Held(long deliveryTag, InboxMessage message) {}
+
+    /** A publish awaiting its confirm; {@link #returned} records whether the broker already returned it. */
+    private static final class Pending {
+        final String msgId;
+        final CompletableFuture<Void> confirmed = new CompletableFuture<>();
+        volatile boolean returned;
+
+        Pending(String msgId) {
+            this.msgId = msgId;
+        }
+    }
+
+    /** Connect to {@code uri} (e.g. {@code amqp://guest:guest@127.0.0.1:5672/}) with {@link #DEFAULT_PREFETCH}. */
+    public static AmqpReplyInbox open(String uri) {
+        return open(uri, DEFAULT_PREFETCH);
+    }
+
+    /** As {@link #open(String)}, with an explicit consumer prefetch (CB-527: caps the held backlog per target). */
+    public static AmqpReplyInbox open(String uri, int prefetch) {
+        try {
+            ConnectionFactory factory = new ConnectionFactory();
+            factory.setUri(uri);
+            // Self-heal transient blips; topology recovery re-declares queues and re-attaches consumers.
+            factory.setAutomaticRecoveryEnabled(true);
+            factory.setTopologyRecoveryEnabled(true);
+            return new AmqpReplyInbox(factory.newConnection("bridged-reply-inbox"), prefetch);
+        } catch (Exception e) {
+            throw new IllegalStateException("cannot connect to AMQP broker at " + uri, e);
+        }
+    }
+
+    /** Wrap an already-open connection with {@link #DEFAULT_PREFETCH} (injection seam for the contract test). */
+    AmqpReplyInbox(Connection connection) {
+        this(connection, DEFAULT_PREFETCH);
+    }
+
+    /** As above, with an explicit prefetch (injection seam for the contract test). */
+    AmqpReplyInbox(Connection connection, int prefetch) {
+        this.connection = connection;
+        try {
+            this.channel = connection.createChannel();
+            // CB-527: bound the held backlog per owned target — must be set before any own()/basicConsume.
+            this.channel.basicQos(prefetch);
+            this.publishChannel = connection.createChannel();
+            this.publishChannel.confirmSelect();
+            this.publishChannel.addReturnListener(this::onReturn);
+            this.publishChannel.addConfirmListener(this::onAck, this::onNack);
+        } catch (IOException e) {
+            throw new IllegalStateException("cannot open AMQP channel", e);
+        }
+        // On automatic recovery the broker redelivers unacked messages with FRESH delivery-tags; the
+        // tags we were holding are now stale. Drop the held snapshot so the re-attached consumer
+        // repopulates it with valid tags (dedup by msgId still prevents any double-queue). Any publish
+        // confirm still in flight when the connection dropped is equally stale — its sequence number
+        // meant nothing on the old channel and means nothing on the recovered one, so fail it now
+        // rather than let it silently ride out CONFIRM_TIMEOUT_MS.
+        if (connection instanceof Recoverable recoverable) {
+            recoverable.addRecoveryListener(new RecoveryListener() {
+                @Override
+                public void handleRecovery(Recoverable recoverable) {
+                    held.clear();
+                    failPendingPublishesOnRecovery();
+                    log.info("AMQP connection recovered; cleared held replies for fresh redelivery");
+                }
+
+                @Override
+                public void handleRecoveryStarted(Recoverable recoverable) {
+                    // no-op: we act once recovery completes
+                }
+            });
+        }
+    }
+
+    @Override
+    public void own(String target) {
+        synchronized (channelLock) {
+            if (consumerTags.containsKey(target)) {
+                return;                            // already owning this target
+            }
+            String queue = queueName(target);
+            try {
+                channel.queueDeclare(queue, true, false, false, null); // durable, non-exclusive, keep on idle
+                String tag = channel.basicConsume(queue, false, deliverCallback(target), _ -> { });
+                consumerTags.put(target, tag);
+                log.debug("AMQP inbox owns queue {} for target {}", queue, target);
+            } catch (IOException e) {
+                throw new IllegalStateException("cannot own queue " + queue, e);
+            }
+        }
+    }
+
+    @Override
+    public void release(String target) {
+        synchronized (channelLock) {
+            String tag = consumerTags.remove(target);
+            held.remove(target);                   // stale delivery tags must not survive release
+            if (tag == null) {
+                return;
+            }
+            try {
+                channel.basicCancel(tag);
+            } catch (IOException e) {
+                throw new IllegalStateException("cannot cancel consumer for " + target, e);
+            }
+        }
+    }
+
+    /**
+     * Publish {@code content} and block until the broker's publisher confirm for it lands (CB-528).
+     * Throws {@link IllegalStateException} if the message is returned as unroutable, nacked, or not
+     * confirmed within {@link #CONFIRM_TIMEOUT_MS} — the caller must treat that as a failed publish,
+     * not a lost-and-forgotten one.
+     */
+    @Override
+    public void publish(String target, String msgId, String content) {
+        AMQP.BasicProperties props = new AMQP.BasicProperties.Builder()
+                .messageId(msgId)
+                .deliveryMode(2)                   // persistent — survives a broker restart
+                .contentType("text/plain")
+                .build();
+        Pending pending = new Pending(msgId);
+        long seq;
+        synchronized (publishChannelLock) {
+            seq = publishChannel.getNextPublishSeqNo();
+            pendingBySeq.put(seq, pending);
+            pendingByMsgId.put(msgId, pending);
+            try {
+                publishChannel.basicPublish("", queueName(target), true, props,
+                        content.getBytes(StandardCharsets.UTF_8));
+            } catch (IOException e) {
+                pendingBySeq.remove(seq, pending);
+                pendingByMsgId.remove(msgId, pending);
+                throw new IllegalStateException("cannot publish reply to " + queueName(target), e);
+            }
+        }
+        try {
+            pending.confirmed.get(CONFIRM_TIMEOUT_MS, TimeUnit.MILLISECONDS);
+        } catch (ExecutionException e) {
+            Throwable cause = e.getCause();
+            throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+        } catch (TimeoutException e) {
+            throw new IllegalStateException("publish confirm for reply " + msgId + " to " + queueName(target)
+                    + " timed out after " + CONFIRM_TIMEOUT_MS + "ms — broker may be unreachable or overloaded", e);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IllegalStateException("interrupted awaiting publish confirm for " + msgId, e);
+        } finally {
+            pendingBySeq.remove(seq, pending);
+            pendingByMsgId.remove(msgId, pending);
+        }
+    }
+
+    @Override
+    public List<InboxMessage> peek(String target) {
+        var perTarget = held.get(target);
+        if (perTarget == null) {
+            return List.of();
+        }
+        synchronized (perTarget) {
+            return perTarget.values().stream().map(Held::message).toList();
+        }
+    }
+
+    @Override
+    public void ack(String target, String msgId) {
+        var perTarget = held.get(target);
+        if (perTarget == null) {
+            return;
+        }
+        Held h;
+        synchronized (perTarget) {
+            h = perTarget.remove(msgId);
+        }
+        if (h == null) {
+            return;                                // never held (or already acked) — no-op
+        }
+        try {
+            synchronized (channelLock) {
+                channel.basicAck(h.deliveryTag(), false);
+            }
+        } catch (IOException e) {
+            // Ack didn't reach the broker: restore the entry so a later ack (or a redelivery after
+            // reconnect) can retry. Keeps the at-least-once contract — a reply is never silently lost.
+            synchronized (perTarget) {
+                perTarget.putIfAbsent(msgId, h);
+            }
+            throw new IllegalStateException("cannot ack reply " + msgId + " on " + queueName(target), e);
+        }
+    }
+
+    private DeliverCallback deliverCallback(String target) {
+        return (_, delivery) -> {
+            String msgId = delivery.getProperties().getMessageId();
+            long tag = delivery.getEnvelope().getDeliveryTag();
+            if (msgId == null || msgId.isBlank()) {
+                msgId = Long.toHexString(tag);     // synthesize an id so dedup still has a key
+            }
+            String content = new String(delivery.getBody(), StandardCharsets.UTF_8);
+            var perTarget = held.computeIfAbsent(target, _ -> new LinkedHashMap<>());
+            boolean duplicate;
+            synchronized (perTarget) {
+                if (perTarget.containsKey(msgId)) {
+                    duplicate = true;
+                } else {
+                    perTarget.put(msgId, new Held(tag, new InboxMessage(msgId, target, content)));
+                    duplicate = false;
+                }
+            }
+            if (duplicate) {
+                // Redelivered duplicate: ack the new tag and drop it so the broker stops resending.
+                synchronized (channelLock) {
+                    channel.basicAck(tag, false);
+                }
+            }
+        };
+    }
+
+    /** Broker return for an unroutable {@code mandatory} publish — arrives BEFORE its confirm (CB-528). */
+    private void onReturn(Return r) {
+        String msgId = r.getProperties() == null ? null : r.getProperties().getMessageId();
+        Pending pending = msgId == null ? null : pendingByMsgId.get(msgId);
+        if (pending != null) {
+            pending.returned = true;
+        } else {
+            log.warn("AMQP return for reply {} (routingKey={}, {} {}) with no matching in-flight publish"
+                    + " — already resolved by a prior confirm", msgId, r.getRoutingKey(), r.getReplyCode(),
+                    r.getReplyText());
+        }
+    }
+
+    private void onAck(long seq, boolean multiple) {
+        resolveConfirm(seq, multiple, true);
+    }
+
+    private void onNack(long seq, boolean multiple) {
+        resolveConfirm(seq, multiple, false);
+    }
+
+    /**
+     * Resolve every pending publish covered by this confirm (a single seq, or — {@code multiple} —
+     * every seq up to and including it). Checks {@link Pending#returned} at confirm time: since the
+     * broker's return for an unroutable message always precedes its confirm, an ack that arrives after
+     * a return means "confirmed but never routed", not "durably queued".
+     */
+    private void resolveConfirm(long seq, boolean multiple, boolean ack) {
+        NavigableMap<Long, Pending> covered = multiple
+                ? pendingBySeq.headMap(seq, true)
+                : pendingBySeq.subMap(seq, true, seq, true);
+        for (var it = covered.entrySet().iterator(); it.hasNext(); ) {
+            Pending pending = it.next().getValue();
+            it.remove();
+            pendingByMsgId.remove(pending.msgId, pending);
+            if (ack && !pending.returned) {
+                pending.confirmed.complete(null);
+            } else if (ack) {
+                pending.confirmed.completeExceptionally(new IllegalStateException(
+                        "reply " + pending.msgId + " was returned as unroutable (queue not declared/owned)"));
+            } else {
+                pending.confirmed.completeExceptionally(new IllegalStateException(
+                        "broker nacked publish of reply " + pending.msgId));
+            }
+        }
+    }
+
+    /**
+     * Fail every publish still awaiting its confirm — their sequence numbers are stale after recovery.
+     * Guarded by {@link #publishChannelLock}, the same lock {@link #publish} holds while it takes its
+     * sequence number and registers its {@link Pending}: without it, a {@link #publish} that starts
+     * after the connection has already recovered (so it publishes — and will be confirmed — on the
+     * <em>new</em> channel) can register between this sweep's iteration and its clear, and this sweep
+     * then fails a publish that actually succeeded. {@link #publish} only holds the lock for the
+     * seq/map-put/{@code basicPublish} — it awaits the confirm outside it — so this sweep can only ever
+     * wait for an in-flight {@code basicPublish} call to return, never for a broker round trip. No
+     * deadlock.
+     *
+     * <p>Package-private (rather than {@code private}) only so the unit test can drive it directly
+     * against a concurrent {@link #publish} without a live broker reconnect.
+     */
+    void failPendingPublishesOnRecovery() {
+        synchronized (publishChannelLock) {
+            for (var it = pendingBySeq.entrySet().iterator(); it.hasNext(); ) {
+                Pending pending = it.next().getValue();
+                it.remove();
+                pendingByMsgId.remove(pending.msgId, pending);
+                pending.confirmed.completeExceptionally(new IllegalStateException(
+                        "AMQP connection recovered mid-publish; confirm status of reply " + pending.msgId
+                                + " is unknown"));
+            }
+        }
+    }
+
+    /**
+     * Fail every publish still awaiting its confirm with a clear, immediate error instead of leaving it
+     * to time out after {@link #CONFIRM_TIMEOUT_MS} once the channels are closed underneath it. Guarded
+     * by {@link #publishChannelLock} for the same reason as {@link #failPendingPublishesOnRecovery}.
+     */
+    private void failPendingPublishesOnClose() {
+        synchronized (publishChannelLock) {
+            for (var it = pendingBySeq.entrySet().iterator(); it.hasNext(); ) {
+                Pending pending = it.next().getValue();
+                it.remove();
+                pendingByMsgId.remove(pending.msgId, pending);
+                pending.confirmed.completeExceptionally(new IllegalStateException(
+                        "AMQP reply inbox closed while publish of reply " + pending.msgId
+                                + " was still awaiting its confirm"));
+            }
+        }
+    }
+
+    private static String queueName(String target) {
+        return QUEUE_PREFIX + target + QUEUE_SUFFIX;
+    }
+
+    @Override
+    public void close() {
+        failPendingPublishesOnClose();
+        try {
+            channel.close();
+        } catch (Exception e) {
+            log.debug("AMQP channel close: {}", e.toString());
+        }
+        try {
+            publishChannel.close();
+        } catch (Exception e) {
+            log.debug("AMQP publish channel close: {}", e.toString());
+        }
+        try {
+            connection.close();
+        } catch (Exception e) {
+            log.debug("AMQP connection close: {}", e.toString());
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/msg/InMemoryReplyInbox.java

@@ -0,0 +1,74 @@
+package dev.ltms.fleet.msg;
+
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Soft-state {@link ReplyInbox} backed by a {@link ConcurrentHashMap} keyed by target session.
+ * Per-target FIFO ordering (insertion order via {@link LinkedHashMap}). Dedup by {@code msgId}
+ * within a target. Thread-safe for concurrent publish vs. drain.
+ *
+ * <p><strong>Ownership is explicit.</strong> {@link #own} marks a target as locally owned so that
+ * {@link #peek} and {@link #ack} operate on it; {@link #publish} works whether or not the target is
+ * owned. {@link #release} clears the local snapshot. This mirrors the AMQP adapter's contract so the
+ * non-broker path stays interchangeable.
+ *
+ * <p><strong>This is soft-state, NOT persistence.</strong> Lost on a {@code java -jar} bounce — that
+ * is correct and consistent with "bridged stays soft-state." The Stage-2 AMQP adapter replaces this.
+ */
+public final class InMemoryReplyInbox implements ReplyInbox {
+
+    private final ConcurrentHashMap<String, LinkedHashMap<String, InboxMessage>> store = new ConcurrentHashMap<>();
+    private final Set<String> owned = ConcurrentHashMap.newKeySet();
+
+    @Override
+    public void own(String target) {
+        owned.add(target);
+    }
+
+    @Override
+    public void release(String target) {
+        owned.remove(target);
+        store.remove(target);
+    }
+
+    @Override
+    public void publish(String target, String msgId, String content) {
+        var perTarget = store.computeIfAbsent(target, _ -> new LinkedHashMap<>());
+        //noinspection SynchronizationOnLocalVariableOrMethodParameter
+        synchronized (perTarget) {
+            perTarget.putIfAbsent(msgId, new InboxMessage(msgId, target, content));
+        }
+    }
+
+    @Override
+    public List<InboxMessage> peek(String target) {
+        if (!owned.contains(target)) {
+            return List.of();
+        }
+        var perTarget = store.get(target);
+        if (perTarget == null) {
+            return List.of();
+        }
+        //noinspection SynchronizationOnLocalVariableOrMethodParameter
+        synchronized (perTarget) {
+            return List.copyOf(perTarget.values());
+        }
+    }
+
+    @Override
+    public void ack(String target, String msgId) {
+        if (!owned.contains(target)) {
+            return;
+        }
+        var perTarget = store.get(target);
+        if (perTarget != null) {
+            //noinspection SynchronizationOnLocalVariableOrMethodParameter
+            synchronized (perTarget) {
+                perTarget.remove(msgId);
+            }
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/msg/LeadHeartbeatLoop.java

@@ -0,0 +1,351 @@
+package dev.ltms.fleet.msg;
+
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.session.MemberSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/**
+ * CB-551: an opt-in heartbeat that nudges the single idle lead back to work once it has been
+ * continuously idle past a quiet period with no open {@code fleet_send} driving it.
+ *
+ * <p>Why this exists: the fleet is ONE lead + architects + workers, so an idle, stalled lead is a
+ * single point of failure for the fleet's progress. {@link ReplyPushLoop} nudges the lead only when
+ * a worker reply lands; this loop is the timer that catches the gap where nothing lands and the
+ * lead simply sits idle with nobody to prompt it onward.
+ *
+ * <p>Mechanism mirrors {@link ReplyPushLoop}: a pure, unit-testable decision function
+ * ({@link #decide(long, Long, int, AgentStatus, boolean, boolean, FleetState)}) plus a thin
+ * scheduler around it. The loop is <em>entirely opt-in</em> ({@code leadHeartbeat:} in config); with
+ * no such block it is never constructed, so upgrading the daemon cannot silently acquire a behaviour
+ * that spends the operator's model subscription on its own initiative (constraint 1).
+ *
+ * <p>Four invariants keep it from becoming a runaway subscription burner:
+ * <ol>
+ *   <li><b>Status-gated</b> — a {@code WORKING} lead is making progress and is never touched; only an
+ *       injectable (idle/done/blocked) lead is even considered (constraint 2).</li>
+ *   <li><b>Debounced</b> — a nudge only fires once the lead has been <em>continuously</em> idle past
+ *       {@code idleAfterSeconds}, so a lead that just finished a turn is not re-prompted into every
+ *       natural pause (constraint 3).</li>
+ *   <li><b>Bounded when quiet</b> — consecutive nudges that find no pending fleet state are capped at
+ *       {@code quietNudgeCap}, then the loop stops nudging until real state returns (constraint 4).</li>
+ *   <li><b>Never races {@link ReplyPushLoop}</b> — while that loop is actively nudging any target this
+ *       loop stands down, so two competing injections never start two turns in the same pane
+ *       (constraint 6).</li>
+ * </ol>
+ */
+public final class LeadHeartbeatLoop {
+
+    private static final Logger log = LoggerFactory.getLogger(LeadHeartbeatLoop.class);
+
+    /** Sentinel for {@link #idleSinceNanos}: the lead is not currently in an idle stretch. */
+    private static final long NOT_IDLE = Long.MIN_VALUE;
+
+    private final PrimaryRegistry primaryRegistry;
+    private final AgentControl agents;
+    private final ReplyInbox inbox;
+    private final Supplier<List<MemberSession>> roster;
+    private final ReplyPushLoop pushLoop;
+    private final ScheduledExecutorService scheduler;
+    private final LongSupplier clock;
+    private final long idleAfterNanos;
+    private final long backoffMs;
+    private final int quietNudgeCap;
+    private final Metrics metrics; // CB-512 pattern: nullable — no registry in unit tests
+
+    /** When the current idle stretch began (nanos), or {@link #NOT_IDLE}. Single scheduler thread only. */
+    private long idleSinceNanos = NOT_IDLE;
+    /** Consecutive nudges that found no pending fleet state. Single scheduler thread only. */
+    private int quietCount = 0;
+
+    /** Constructor with an injectable clock and no metric registry (unit tests, or wiring that opts out). */
+    public LeadHeartbeatLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
+                             Supplier<List<MemberSession>> roster, ReplyPushLoop pushLoop,
+                             ScheduledExecutorService scheduler, LongSupplier clock,
+                             long idleAfterNanos, long backoffMs, int quietNudgeCap) {
+        this(primaryRegistry, agents, inbox, roster, pushLoop, scheduler, clock,
+                idleAfterNanos, backoffMs, quietNudgeCap, null);
+    }
+
+    /** As above, with a metric registry (the CB-512 pattern) so nudge outcomes are counted. */
+    public LeadHeartbeatLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
+                             Supplier<List<MemberSession>> roster, ReplyPushLoop pushLoop,
+                             ScheduledExecutorService scheduler, LongSupplier clock,
+                             long idleAfterNanos, long backoffMs, int quietNudgeCap, Metrics metrics) {
+        this.primaryRegistry = primaryRegistry;
+        this.agents = agents;
+        this.inbox = inbox;
+        this.roster = roster;
+        this.pushLoop = pushLoop;
+        this.scheduler = scheduler;
+        this.clock = clock;
+        this.idleAfterNanos = idleAfterNanos;
+        this.backoffMs = backoffMs;
+        this.quietNudgeCap = quietNudgeCap;
+        this.metrics = metrics;
+    }
+
+    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
+    private void countNudge(String outcome) {
+        if (metrics != null) {
+            metrics.inc(FleetMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
+        }
+    }
+
+    // --- decision logic (package-private for unit-testing) --------------------------------------
+
+    /** The action the loop should take on one tick. */
+    enum Action {
+        /** Send a heartbeat nudge to the lead now. */
+        INJECT,
+        /** Lead is idle but not yet past the quiet period — keep waiting, do nothing. */
+        WAIT_IDLE,
+        /** Lead is making progress (or its status cannot be read) — reset the idle window and re-arm. */
+        LEAD_BUSY,
+        /** Idle past the quiet period with nothing pending and the cap exhausted — stop until new state appears. */
+        QUIET_DONE,
+        /** {@link ReplyPushLoop} is actively nudging — stand aside rather than start a competing turn. */
+        STAND_DOWN
+    }
+
+    /** The outcome of one decision: the action plus the state to persist for the next tick. */
+    record Decision(Action action, Long idleSinceNanos, int quietCount) {}
+
+    /**
+     * Pure decision function: given the current loop state and fleet/lead facts, return what to do
+     * next and the exact state to carry forward. Pure means no I/O and no mutation — the caller
+     * ({@link #tick}) applies {@link Decision} to its fields. This is what makes the loop unit-testable
+     * with a fake clock and no sleeping.
+     *
+     * @param nowNanos        the current time (an injected clock in tests, {@link System#nanoTime()} live)
+     * @param idleSinceNanos  when the current idle stretch began, or {@code null} if the lead is not idle
+     * @param quietCount      consecutive nudges so far that found no pending fleet state
+     * @param status          the lead's herdr status
+     * @param pushLoopActive  whether {@link ReplyPushLoop} is currently nudging some target (constraint 6)
+     * @param leadKnown       whether a lead terminal is known to nudge at all
+     * @param fleet           a snapshot of the pending fleet state (constraint 5)
+     * @return the action to take and the state to persist
+     */
+    Decision decide(long nowNanos, Long idleSinceNanos, int quietCount, AgentStatus status,
+                    boolean pushLoopActive, boolean leadKnown, FleetState fleet) {
+        // Constraint 6: while ReplyPushLoop is actively nudging the lead, injecting a second,
+        // competing prompt into the same pane would start a second turn — racing loops multiply
+        // turns and context burn. Stand aside, and treat the active push as real state (re-arm the
+        // quiet counter), because the reply that drove it is exactly the kind of new state that
+        // should reset the cap.
+        if (pushLoopActive) {
+            return new Decision(Action.STAND_DOWN, idleSinceNanos, 0);
+        }
+        // Constraint 2: a WORKING lead is making progress and must NOT be touched; an unreadable
+        // status (read failure, or the agent is gone) is safest treated the same way — never inject
+        // into a state we cannot read. Either way, reset the idle window and the quiet counter: the
+        // lead was / may be active, so the next idle stretch must count its own quiet period fresh.
+        if (status == null || !status.injectable()) {
+            return new Decision(Action.LEAD_BUSY, null, 0);
+        }
+        if (idleSinceNanos == null) {
+            // The lead just became injectable — record the start of an idle stretch and wait out the
+            // debounce quiet period before ever nudging (constraint 3).
+            return new Decision(Action.WAIT_IDLE, nowNanos, quietCount);
+        }
+        if (nowNanos - idleSinceNanos < idleAfterNanos) {
+            // Still within the quiet period: the lead that just finished a turn sits momentarily idle
+            // and must not be re-prompted into every natural pause.
+            return new Decision(Action.WAIT_IDLE, idleSinceNanos, quietCount);
+        }
+        // Past the quiet period with an injectable lead: it is a genuine candidate for a nudge. Two
+        // gating facts decide whether and how:
+        if (!leadKnown) {
+            // No lead terminal is known yet (e.g. the registry has not learned one) — there is nobody
+            // to nudge. Keep waiting; the window stays open so discovery re-arms it without a fresh
+            // quiet period.
+            return new Decision(Action.WAIT_IDLE, idleSinceNanos, quietCount);
+        }
+        if (fleet.hasPending()) {
+            // Real fleet state is waiting — a worker reply or a DONE session. This is new state, so
+            // it resets the quiet counter (constraint 4) and the lead is nudged to go collect it.
+            return new Decision(Action.INJECT, idleSinceNanos, 0);
+        }
+        if (quietCount < quietNudgeCap) {
+            // Nothing is pending, but the cap is not exhausted: nudge anyway, telling the lead
+            // exactly that nothing is waiting so it can choose to stand down rather than hunt
+            // (constraint 5). Count it toward the consecutive-quiet cap.
+            return new Decision(Action.INJECT, idleSinceNanos, quietCount + 1);
+        }
+        // Nothing pending and the cap is exhausted: stop nudging until real state appears again
+        // (constraint 4). The loop still ticks on backoff so a genuinely new reply or session change
+        // re-arms it — QUIET_DONE stops injection, not observation.
+        return new Decision(Action.QUIET_DONE, idleSinceNanos, quietCount);
+    }
+
+    // --- loop ----------------------------------------------------------------------------------
+
+    /**
+     * Start the heartbeat. Schedules the first tick after one backoff so a freshly-booting daemon
+     * does not evaluate the lead's idle state before the fleet has settled.
+     */
+    public void start() {
+        log.info("idle-lead heartbeat: on — nudge lead after {}s idle (recheck {}ms, quiet cap {})",
+                TimeUnit.NANOSECONDS.toSeconds(idleAfterNanos), backoffMs, quietNudgeCap);
+        scheduler.schedule(this::tick, backoffMs, TimeUnit.MILLISECONDS);
+    }
+
+    /** One loop tick, every {@link #backoffMs} — the thin scheduler around {@link #decide}. */
+    private void tick() {
+        boolean leadKnown = primaryRegistry.primaryTerminal().isPresent();
+        FleetState fleet = snapshot(inbox, roster);
+        AgentStatus status = AgentStatus.UNKNOWN;
+        if (leadKnown) {
+            try {
+                status = agents.status(primaryRegistry.primaryTerminal().orElseThrow());
+            } catch (RuntimeException e) {
+                // A failed status read degrades to "unknown" — decide() treats that like a busy lead
+                // and never injects into a state it cannot read. Retry on the next backoff.
+                log.debug("idle-heartbeat: status check failed for lead, will retry: {}", e.toString());
+            }
+        }
+
+        Decision d = decide(clock.getAsLong(),
+                idleSinceNanos == NOT_IDLE ? null : idleSinceNanos,
+                quietCount, status, pushLoop.isActive(), leadKnown, fleet);
+        applyDecision(d);
+        switch (d.action()) {
+            case INJECT -> injectNudge(fleet);
+            case QUIET_DONE -> countNudge("exhausted");
+            case WAIT_IDLE, LEAD_BUSY, STAND_DOWN -> { /* nothing to inject, nothing to count */ }
+        }
+        scheduleNext();
+    }
+
+    /** Persist the state a decision returned, so the next tick starts from it. */
+    private void applyDecision(Decision d) {
+        idleSinceNanos = d.idleSinceNanos() == null ? NOT_IDLE : d.idleSinceNanos();
+        quietCount = d.quietCount();
+    }
+
+    /** Send the nudge to the known lead. */
+    private void injectNudge(FleetState fleet) {
+        var lead = primaryRegistry.primaryTerminal();
+        if (lead.isEmpty()) {
+            return; // the lead disappeared between the decision and the injection
+        }
+        String leadTerminal = lead.get();
+        try {
+            agents.send(leadTerminal, fleet.nudgeText());
+            log.debug("idle-heartbeat: nudge sent to lead {} (quiet nudges so far in this stretch: {})",
+                    leadTerminal, quietCount);
+            countNudge("delivered");
+        } catch (RuntimeException e) {
+            log.warn("idle-heartbeat: failed to nudge lead {}: {}", leadTerminal, e.toString());
+            countNudge("failed");
+        }
+    }
+
+    /** Schedule the next tick on the scheduler thread pool. */
+    private void scheduleNext() {
+        scheduler.schedule(this::tick, backoffMs, TimeUnit.MILLISECONDS);
+    }
+
+    // --- lifecycle -----------------------------------------------------------------------------
+
+    /** Shut down the scheduler; outstanding ticks are cancelled. */
+    public void stop() {
+        scheduler.shutdownNow();
+    }
+
+    /** @see #stop() */
+    public void close() {
+        stop();
+    }
+
+    /**
+     * A read-only snapshot of the fleet facts the heartbeat reports to an idle lead. Carries exact
+     * counts and names the targets that hold replies, so the nudge is actionable rather than a
+     * content-free "keep working" that would cost the lead a turn just to discover what there is to
+     * do (constraint 5).
+     *
+     * @param pendingReplies total undrained worker replies across owned targets
+     * @param doneSessions   session count in the DONE state — finished turns awaiting teardown
+     * @param liveWorkers    sessions still registered (acquired minus released)
+     * @param replyTargets   the terminals whose inboxes currently hold at least one reply
+     */
+    record FleetState(int pendingReplies, int doneSessions, int liveWorkers, List<String> replyTargets) {
+
+        /** True when the lead has something real to collect — a reply or a session awaiting teardown. */
+        boolean hasPending() {
+            return pendingReplies > 0 || doneSessions > 0;
+        }
+
+        /** The nudge body, phrased for the two cases the heartbeat distinguishes. */
+        String nudgeText() {
+            StringBuilder sb = new StringBuilder(
+                    "Heartbeat: you are idle and no fleet_send is waiting on you.");
+            if (hasPending()) {
+                sb.append(" The fleet has state to collect: ").append(pendingDetail());
+            } else {
+                sb.append(" Fleet is quiet — nothing pending to collect (")
+                        .append(pendingReplies).append(" worker replies, ")
+                        .append(doneSessions).append(" DONE sessions); ")
+                        .append(liveWorkers).append(" workers live. You may stand down until new state re-arms me.");
+            }
+            return sb.toString();
+        }
+
+        private String pendingDetail() {
+            StringBuilder sb = new StringBuilder();
+            sb.append(pendingReplies).append(" worker ")
+                    .append(pendingReplies == 1 ? "reply" : "replies")
+                    .append(" pending collection");
+            if (!replyTargets.isEmpty()) {
+                // Render each as the exact command so the lead can act without parsing: the nearest
+                // analogue to ReplyPushLoop's fleet_poll(target=...) nudge.
+                sb.append(" (")
+                        .append(String.join(", ",
+                                replyTargets.stream().map(t -> "fleet_poll(target=" + t + ")").toList()))
+                        .append(")");
+            }
+            sb.append(", ").append(doneSessions).append(" DONE session").append(doneSessions == 1 ? "" : "s")
+                    .append(" awaiting teardown")
+                    .append(", ").append(liveWorkers).append(" worker").append(liveWorkers == 1 ? "" : "s")
+                    .append(" live");
+            return sb.toString();
+        }
+    }
+
+    /**
+     * Build a {@link FleetState} snapshot over the live roster and the reply inbox — the same
+     * sources the metrics collector uses, so the heartbeat reports facts the operator can cross-check
+     * against {@code /metrics}. Package-private and pure (reads only) so it is unit-testable.
+     */
+    static FleetState snapshot(ReplyInbox inbox, Supplier<List<MemberSession>> roster) {
+        List<MemberSession> sessions = roster.get();
+        int replies = 0;
+        int done = 0;
+        List<String> replyTargets = new ArrayList<>();
+        for (MemberSession s : sessions) {
+            if (s.terminalId() == null) {
+                continue;
+            }
+            int depth = inbox.peek(s.terminalId()).size();
+            if (depth > 0) {
+                replies += depth;
+                replyTargets.add(s.terminalId());
+            }
+            if (s.state() == MemberSession.State.DONE) {
+                done++;
+            }
+        }
+        return new FleetState(replies, done, sessions.size(), List.copyOf(replyTargets));
+    }
+}

bridged/src/main/java/dev/ltms/fleet/msg/LeadMailbox.java

@@ -0,0 +1,422 @@
+package dev.ltms.fleet.msg;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.rabbitmq.client.AMQP;
+import com.rabbitmq.client.Channel;
+import com.rabbitmq.client.Connection;
+import com.rabbitmq.client.ConnectionFactory;
+import com.rabbitmq.client.DeliverCallback;
+import com.rabbitmq.client.Recoverable;
+import com.rabbitmq.client.RecoveryListener;
+import com.rabbitmq.client.Return;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.NavigableMap;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentSkipListMap;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+
+/**
+ * Durable, AMQP-backed mailbox for lead-to-lead messages across daemons — including daemons on
+ * different hosts, where a herdr pane injection (how {@code fleet_send} reaches a lead today)
+ * cannot reach at all. The broker is the only medium two independently-owned daemons share, which
+ * is exactly why {@link AmqpReplyInbox}'s javadoc already calls out "one gateway may publish to an
+ * agent owned by another gateway" (CB-308 federation) as the reason {@code publish} and
+ * {@code own}/consume are separate operations there — this class leans on the same split.
+ *
+ * <p><strong>Single-target, unlike {@link AmqpReplyInbox}.</strong> {@code AmqpReplyInbox}
+ * multiplexes many workers' reply queues under one gateway connection. A {@code LeadMailbox}
+ * instance is simpler: it owns exactly <em>one</em> queue — this daemon's own
+ * {@code lead.<selfCoordId>.inbox} — declared and consumed the moment it is constructed. There is
+ * no {@code own}/{@code release} pair to call separately; a daemon either runs a {@code LeadMailbox}
+ * for its own coord-id, or it does not run one at all.
+ *
+ * <p><strong>Consume-and-hold with deferred manual ack</strong> — same mapping as
+ * {@code AmqpReplyInbox}. The constructor declares the durable queue and starts a manual-ack
+ * consumer that pulls persistent messages into an in-memory {@code held} map (keyed by
+ * {@link LeadMessage#msgId()}) but does not ack them. {@link #peek} returns a non-destructive
+ * snapshot; {@link #ack} acks the broker delivery-tag and drops the entry. A message that is never
+ * acked (a crash, a bounce) survives — the broker redelivers it to the next connection that owns
+ * the queue.
+ *
+ * <p><strong>Publishing does not imply owning.</strong> {@link #publish} sends to
+ * {@code lead.<toCoordId>.inbox} over a dedicated confirm-mode channel; it never declares that
+ * queue as owned and never attaches a consumer to it. A sender that has never opened its own
+ * {@code LeadMailbox} for {@code toCoordId} can still publish to it, exactly as CB-308 federation
+ * requires. Publish blocks for the broker's publisher confirm (persistent delivery, {@code
+ * mandatory=true}) and throws {@link IllegalStateException} on an unroutable return, a nack, or a
+ * timeout — the caller must not report success for a black-holed message.
+ *
+ * <p><strong>Recovery.</strong> The connection is opened with automatic + topology recovery
+ * enabled, mirroring {@code AmqpReplyInbox}: on reconnect the broker hands out fresh delivery tags,
+ * so the held snapshot is cleared (dedup by {@code msgId} still prevents any double-queue on
+ * redelivery) and any publish still awaiting its confirm is failed rather than left to idle out
+ * the confirm timeout against a sequence number that means nothing on the new channel.
+ */
+public final class LeadMailbox implements AutoCloseable {
+
+    private static final Logger log = LoggerFactory.getLogger(LeadMailbox.class);
+
+    private static final String QUEUE_PREFIX = "lead.";
+    private static final String QUEUE_SUFFIX = ".inbox";
+
+    /** The prefetch used when a caller does not pass an explicit value to {@link #open(String, String, int)}. */
+    public static final int DEFAULT_PREFETCH = 32;
+
+    /** How long {@link #publish} waits for its publisher confirm before failing the call. */
+    private static final long CONFIRM_TIMEOUT_MS = 10_000L;
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    private final Connection connection;
+    private final String selfCoordId;
+
+    private final Channel channel;
+    /** All consume-channel operations (declare/consume/ack) serialize on this — a Channel is not thread-safe. */
+    private final Object channelLock = new Object();
+    /** msgId → held delivery, for this mailbox's own queue only (there is exactly one). */
+    private final LinkedHashMap<String, Held> held = new LinkedHashMap<>();
+
+    /**
+     * A dedicated channel for {@link #publish}, kept separate from {@link #channel} (consume + ack)
+     * so a publish confirm round trip never blocks under {@link #channelLock} and stalls an ack.
+     */
+    private final Channel publishChannel;
+    private final Object publishChannelLock = new Object();
+    /** In-flight publishes awaiting their confirm, keyed by the publish channel's sequence number. */
+    private final ConcurrentSkipListMap<Long, Pending> pendingBySeq = new ConcurrentSkipListMap<>();
+    /** The same in-flight publishes, keyed by {@code msgId} — a broker {@code Return} carries no delivery tag. */
+    private final ConcurrentHashMap<String, Pending> pendingByMsgId = new ConcurrentHashMap<>();
+
+    /** A message pulled off the broker but not yet acked: its delivery-tag plus the deserialized envelope. */
+    private record Held(long deliveryTag, LeadMessage message) {}
+
+    /** A publish awaiting its confirm; {@link #returned} records whether the broker already returned it. */
+    private static final class Pending {
+        final String msgId;
+        final CompletableFuture<Void> confirmed = new CompletableFuture<>();
+        volatile boolean returned;
+
+        Pending(String msgId) {
+            this.msgId = msgId;
+        }
+    }
+
+    /**
+     * Connect to {@code uri} (the shared cross-host coordination vhost, e.g.
+     * {@code amqp://guest:guest@127.0.0.1:5672/coord}) and own {@code selfCoordId}'s mailbox, with
+     * {@link #DEFAULT_PREFETCH}.
+     */
+    public static LeadMailbox open(String uri, String selfCoordId) {
+        return open(uri, selfCoordId, DEFAULT_PREFETCH);
+    }
+
+    /** As {@link #open(String, String)}, with an explicit consumer prefetch. */
+    public static LeadMailbox open(String uri, String selfCoordId, int prefetch) {
+        try {
+            ConnectionFactory factory = new ConnectionFactory();
+            factory.setUri(uri);
+            // Self-heal transient blips; topology recovery re-declares the queue and re-attaches the consumer.
+            factory.setAutomaticRecoveryEnabled(true);
+            factory.setTopologyRecoveryEnabled(true);
+            return new LeadMailbox(factory.newConnection("bridged-lead-mailbox"), selfCoordId, prefetch);
+        } catch (Exception e) {
+            throw new IllegalStateException("cannot connect to AMQP coordination broker at " + uri, e);
+        }
+    }
+
+    /** Wrap an already-open connection with {@link #DEFAULT_PREFETCH} (injection seam for tests). */
+    LeadMailbox(Connection connection, String selfCoordId) {
+        this(connection, selfCoordId, DEFAULT_PREFETCH);
+    }
+
+    /** As above, with an explicit prefetch (injection seam for tests). */
+    LeadMailbox(Connection connection, String selfCoordId, int prefetch) {
+        this.connection = connection;
+        this.selfCoordId = selfCoordId;
+        try {
+            this.channel = connection.createChannel();
+            // Bound the held backlog — must be set before basicConsume.
+            this.channel.basicQos(prefetch);
+            this.publishChannel = connection.createChannel();
+            this.publishChannel.confirmSelect();
+            this.publishChannel.addReturnListener(this::onReturn);
+            this.publishChannel.addConfirmListener(this::onAck, this::onNack);
+            own();
+        } catch (IOException e) {
+            throw new IllegalStateException("cannot open AMQP channel", e);
+        }
+        // On automatic recovery the broker redelivers unacked messages with FRESH delivery-tags; the
+        // tags we were holding are now stale. Drop the held snapshot so the re-attached consumer
+        // repopulates it with valid tags (dedup by msgId still prevents any double-queue). Any publish
+        // confirm still in flight when the connection dropped is equally stale — fail it now rather
+        // than let it silently ride out CONFIRM_TIMEOUT_MS.
+        if (connection instanceof Recoverable recoverable) {
+            recoverable.addRecoveryListener(new RecoveryListener() {
+                @Override
+                public void handleRecovery(Recoverable recoverable) {
+                    synchronized (held) {
+                        held.clear();
+                    }
+                    failPendingPublishesOnRecovery();
+                    log.info("AMQP lead mailbox connection recovered; cleared held messages for fresh redelivery");
+                }
+
+                @Override
+                public void handleRecoveryStarted(Recoverable recoverable) {
+                    // no-op: we act once recovery completes
+                }
+            });
+        }
+    }
+
+    /** Declare + consume this daemon's own {@code lead.<selfCoordId>.inbox}. Called once, at construction. */
+    private void own() throws IOException {
+        String queue = queueName(selfCoordId);
+        synchronized (channelLock) {
+            channel.queueDeclare(queue, true, false, false, null); // durable, non-exclusive, keep on idle
+            channel.basicConsume(queue, false, deliverCallback(), _ -> { }); // autoAck=false: manual ack
+        }
+        log.debug("lead mailbox owns queue {} for coord-id {}", queue, selfCoordId);
+    }
+
+    /**
+     * Publish {@code msg} to {@code toCoordId}'s mailbox and block until the broker's publisher
+     * confirm for it lands. Does <em>not</em> imply owning or consuming {@code toCoordId}'s queue.
+     * Throws {@link IllegalStateException} if the message is returned as unroutable, nacked, or not
+     * confirmed within {@link #CONFIRM_TIMEOUT_MS} — the caller must treat that as a failed publish,
+     * not a lost-and-forgotten one.
+     */
+    public void publish(String toCoordId, LeadMessage msg) {
+        byte[] body;
+        try {
+            body = MAPPER.writeValueAsBytes(msg);
+        } catch (JsonProcessingException e) {
+            throw new IllegalStateException("cannot serialize lead message " + msg.msgId(), e);
+        }
+        AMQP.BasicProperties props = new AMQP.BasicProperties.Builder()
+                .messageId(msg.msgId())
+                .deliveryMode(2)                   // persistent — survives a broker restart
+                .contentType("application/json")
+                .build();
+        Pending pending = new Pending(msg.msgId());
+        long seq;
+        synchronized (publishChannelLock) {
+            seq = publishChannel.getNextPublishSeqNo();
+            pendingBySeq.put(seq, pending);
+            pendingByMsgId.put(msg.msgId(), pending);
+            try {
+                publishChannel.basicPublish("", queueName(toCoordId), true, props, body);
+            } catch (IOException e) {
+                pendingBySeq.remove(seq, pending);
+                pendingByMsgId.remove(msg.msgId(), pending);
+                throw new IllegalStateException("cannot publish lead message to " + queueName(toCoordId), e);
+            }
+        }
+        try {
+            pending.confirmed.get(CONFIRM_TIMEOUT_MS, TimeUnit.MILLISECONDS);
+        } catch (ExecutionException e) {
+            Throwable cause = e.getCause();
+            throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+        } catch (TimeoutException e) {
+            throw new IllegalStateException("publish confirm for lead message " + msg.msgId() + " to "
+                    + queueName(toCoordId) + " timed out after " + CONFIRM_TIMEOUT_MS
+                    + "ms — broker may be unreachable or overloaded", e);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IllegalStateException("interrupted awaiting publish confirm for " + msg.msgId(), e);
+        } finally {
+            pendingBySeq.remove(seq, pending);
+            pendingByMsgId.remove(msg.msgId(), pending);
+        }
+    }
+
+    /** Non-destructive FIFO snapshot of this mailbox's currently-held messages. */
+    public List<LeadMessage> peek() {
+        synchronized (held) {
+            return held.values().stream().map(Held::message).toList();
+        }
+    }
+
+    /** Convenience: {@link #peek} the current snapshot, then {@link #ack} every message in it. */
+    public List<LeadMessage> drain() {
+        List<LeadMessage> snapshot = peek();
+        snapshot.forEach(m -> ack(m.msgId()));
+        return snapshot;
+    }
+
+    /** Remove the held message {@code msgId} and ack it on the broker. No-op if not held. */
+    public void ack(String msgId) {
+        Held h;
+        synchronized (held) {
+            h = held.remove(msgId);
+        }
+        if (h == null) {
+            return;                                // never held (or already acked) — no-op
+        }
+        try {
+            synchronized (channelLock) {
+                channel.basicAck(h.deliveryTag(), false);
+            }
+        } catch (IOException e) {
+            // Ack didn't reach the broker: restore the entry so a later ack (or a redelivery after
+            // reconnect) can retry. Keeps the at-least-once contract — a message is never silently lost.
+            synchronized (held) {
+                held.putIfAbsent(msgId, h);
+            }
+            throw new IllegalStateException("cannot ack lead message " + msgId, e);
+        }
+    }
+
+    private DeliverCallback deliverCallback() {
+        return (_, delivery) -> {
+            long tag = delivery.getEnvelope().getDeliveryTag();
+            LeadMessage msg;
+            try {
+                msg = MAPPER.readValue(delivery.getBody(), LeadMessage.class);
+            } catch (IOException e) {
+                // A malformed body can never be dedup-keyed or handed to a caller; ack it so the
+                // broker does not redeliver it forever, and log loudly since this should never happen
+                // for a producer that only ever calls publish(String, LeadMessage).
+                log.warn("dropping malformed lead-mailbox delivery (tag {}): {}", tag, e.toString());
+                synchronized (channelLock) {
+                    channel.basicAck(tag, false);
+                }
+                return;
+            }
+            boolean duplicate;
+            synchronized (held) {
+                if (held.containsKey(msg.msgId())) {
+                    duplicate = true;
+                } else {
+                    held.put(msg.msgId(), new Held(tag, msg));
+                    duplicate = false;
+                }
+            }
+            if (duplicate) {
+                // Redelivered duplicate: ack the new tag and drop it so the broker stops resending.
+                synchronized (channelLock) {
+                    channel.basicAck(tag, false);
+                }
+            }
+        };
+    }
+
+    /** Broker return for an unroutable {@code mandatory} publish — arrives BEFORE its confirm. */
+    private void onReturn(Return r) {
+        String msgId = r.getProperties() == null ? null : r.getProperties().getMessageId();
+        Pending pending = msgId == null ? null : pendingByMsgId.get(msgId);
+        if (pending != null) {
+            pending.returned = true;
+        } else {
+            log.warn("AMQP return for lead message {} (routingKey={}, {} {}) with no matching in-flight publish"
+                    + " — already resolved by a prior confirm", msgId, r.getRoutingKey(), r.getReplyCode(),
+                    r.getReplyText());
+        }
+    }
+
+    private void onAck(long seq, boolean multiple) {
+        resolveConfirm(seq, multiple, true);
+    }
+
+    private void onNack(long seq, boolean multiple) {
+        resolveConfirm(seq, multiple, false);
+    }
+
+    /**
+     * Resolve every pending publish covered by this confirm (a single seq, or — {@code multiple} —
+     * every seq up to and including it). Checks {@link Pending#returned} at confirm time: since the
+     * broker's return for an unroutable message always precedes its confirm, an ack that arrives after
+     * a return means "confirmed but never routed", not "durably queued".
+     */
+    private void resolveConfirm(long seq, boolean multiple, boolean ack) {
+        NavigableMap<Long, Pending> covered = multiple
+                ? pendingBySeq.headMap(seq, true)
+                : pendingBySeq.subMap(seq, true, seq, true);
+        for (var it = covered.entrySet().iterator(); it.hasNext(); ) {
+            Pending pending = it.next().getValue();
+            it.remove();
+            pendingByMsgId.remove(pending.msgId, pending);
+            if (ack && !pending.returned) {
+                pending.confirmed.complete(null);
+            } else if (ack) {
+                pending.confirmed.completeExceptionally(new IllegalStateException(
+                        "lead message " + pending.msgId + " was returned as unroutable (mailbox not owned)"));
+            } else {
+                pending.confirmed.completeExceptionally(new IllegalStateException(
+                        "broker nacked publish of lead message " + pending.msgId));
+            }
+        }
+    }
+
+    /**
+     * Fail every publish still awaiting its confirm — their sequence numbers are stale after
+     * recovery. Guarded by {@link #publishChannelLock}, the same lock {@link #publish} holds while
+     * it takes its sequence number and registers its {@link Pending} — see
+     * {@code AmqpReplyInbox.failPendingPublishesOnRecovery}'s javadoc for the full race analysis this
+     * mirrors. Package-private only so a unit test can drive it directly without a live broker
+     * reconnect.
+     */
+    void failPendingPublishesOnRecovery() {
+        synchronized (publishChannelLock) {
+            for (var it = pendingBySeq.entrySet().iterator(); it.hasNext(); ) {
+                Pending pending = it.next().getValue();
+                it.remove();
+                pendingByMsgId.remove(pending.msgId, pending);
+                pending.confirmed.completeExceptionally(new IllegalStateException(
+                        "AMQP connection recovered mid-publish; confirm status of lead message "
+                                + pending.msgId + " is unknown"));
+            }
+        }
+    }
+
+    /**
+     * Fail every publish still awaiting its confirm with a clear, immediate error instead of leaving
+     * it to time out after {@link #CONFIRM_TIMEOUT_MS} once the channels are closed underneath it.
+     */
+    private void failPendingPublishesOnClose() {
+        synchronized (publishChannelLock) {
+            for (var it = pendingBySeq.entrySet().iterator(); it.hasNext(); ) {
+                Pending pending = it.next().getValue();
+                it.remove();
+                pendingByMsgId.remove(pending.msgId, pending);
+                pending.confirmed.completeExceptionally(new IllegalStateException(
+                        "lead mailbox closed while publish of lead message " + pending.msgId
+                                + " was still awaiting its confirm"));
+            }
+        }
+    }
+
+    /** The durable queue name a coord-id's mailbox lives on: {@code lead.<coordId>.inbox}. */
+    public static String queueName(String coordId) {
+        return QUEUE_PREFIX + coordId + QUEUE_SUFFIX;
+    }
+
+    @Override
+    public void close() {
+        failPendingPublishesOnClose();
+        try {
+            channel.close();
+        } catch (Exception e) {
+            log.debug("AMQP lead mailbox channel close: {}", e.toString());
+        }
+        try {
+            publishChannel.close();
+        } catch (Exception e) {
+            log.debug("AMQP lead mailbox publish channel close: {}", e.toString());
+        }
+        try {
+            connection.close();
+        } catch (Exception e) {
+            log.debug("AMQP lead mailbox connection close: {}", e.toString());
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/msg/LeadMessage.java

@@ -0,0 +1,22 @@
+package dev.ltms.fleet.msg;
+
+/**
+ * Wire envelope for a lead-to-lead message carried over {@link LeadMailbox}.
+ *
+ * <p>Unlike {@link ReplyInbox.InboxMessage} (a worker→primary reply, addressed only by the single
+ * gateway that owns the worker), a lead message crosses independently-owned daemons — possibly on
+ * different hosts — so it carries an explicit sender ({@code from}) as well as the recipient
+ * ({@code to}): the recipient needs the sender's coord-id to reply back.
+ *
+ * <p>{@code from} and {@code to} are globally-unique lead coordination ids (e.g. {@code "mac-opus"},
+ * {@code "fleet01-lead"}) — NOT herdr terminal ids. A herdr terminal id is meaningful only on the
+ * host that owns it, so it cannot address a lead running on another daemon; a coord-id is chosen
+ * by configuration ({@code coordinator.selfId}) precisely so it means the same thing everywhere.
+ *
+ * @param msgId   idempotency id; a redelivered duplicate (at-least-once delivery) is deduped on this
+ * @param from    the sending lead's coord-id
+ * @param to      the receiving lead's coord-id — identifies the mailbox this message is held on
+ * @param content the message text
+ */
+public record LeadMessage(String msgId, String from, String to, String content) {
+}

bridged/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -0,0 +1,831 @@
+package dev.ltms.fleet.msg;
+
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.List;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.locks.ReentrantLock;
+import java.util.function.LongSupplier;
+
+/**
+ * The blocking delegation feature (CB-104): deliver {@code content} into a worker and block until
+ * the worker returns a <em>structured reply</em> via {@code fleet_reply} (the {@link Rendezvous}),
+ * then hand that reply back. Delivery is the {@link Injector}'s job (the background poller sends it
+ * when the worker is injectable); this service never drives the injector or scrapes the terminal —
+ * completion is the worker's explicit reply, not a guess about {@code agent_status}.
+ *
+ * <p>Sends are serialized per session so exactly one reply can be outstanding per worker, which is
+ * what lets a reply map unambiguously to its send (no cross-talk between concurrent callers).
+ *
+ * <p>If the worker never replies within the timeout, the caller gets a typed "still working" /
+ * "queued" outcome — the message may still be mid-flight. A finished-but-unreplied turn is caught
+ * by the CB-106 completion fallback (see {@link Rendezvous#resolveCompletion}).
+ *
+ * <p><strong>Async fire-and-poll (CB-107).</strong> A caller's MCP client caps a blocking call at
+ * ~60s, but a real delegated task runs for minutes. {@link #sendAsync} therefore runs the same
+ * blocking {@link #send} on a background virtual thread and hands back a <em>ticket</em> the caller
+ * polls with {@link #poll}. The blocking and async paths share one code path (and the same per-target
+ * serialization), so async inherits the reply + completion resolution behaviour for free.
+ */
+public final class MessageService {
+
+    private static final Logger log = LoggerFactory.getLogger(MessageService.class);
+
+    /**
+     * The window a fire-and-poll send waits for resolution — generous, since no caller is blocked on
+     * it; a real delegated task resolves (reply or completion) well within this, and only a genuinely
+     * hung worker rides it out.
+     */
+    private static final long ASYNC_TIMEOUT_MS = 30 * 60 * 1_000L;
+
+    /**
+     * How long a finished (terminal) ticket is retained for polling before it is pruned. Package-
+     * private (not {@code private}) so a test can advance an injected clock past it deterministically
+     * instead of duplicating the magic number or sleeping for real.
+     */
+    static final long TICKET_TTL_NANOS = 10 * 60 * 1_000_000_000L;
+
+    /** Outcome of a blocking send. */
+    public enum Outcome {
+        /** The worker called {@code fleet_reply}; {@code text} holds the structured answer. */
+        REPLIED,
+        /**
+         * The worker's delegated turn finished without a {@code fleet_reply} (CB-106 fallback);
+         * {@code text} is the scraped transcript tail rather than a structured answer.
+         */
+        COMPLETED_UNREPLIED,
+        /**
+         * The worker ran the turn then wedged in an unrecoverable state (CB-109); {@code text} is the
+         * failure context (e.g. the error screen). Terminal, but not a successful completion.
+         */
+        WORKER_FAILED,
+        /**
+         * The turn finished without a {@code fleet_reply} and the scrape matched the backend's
+         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
+         * carrying the matched line. The worker's pane is healthy — only its account is refusing —
+         * so this is never reported as a completed reply, and is kept distinct from
+         * {@link #WORKER_FAILED} (a wedged worker) and a session simply going {@code GONE}.
+         */
+        BACKEND_EXHAUSTED,
+        /**
+         * The worker paused mid-turn to ask the primary a question (CB-205); {@code text} is the
+         * question and {@code turnId} correlates the answer. Not terminal — the primary answers with
+         * {@link #answer(String, String, long)} and the turn resumes.
+         */
+        QUESTION,
+        /** Timed out after the message was delivered — the worker is still working. */
+        TIMED_OUT_WORKING,
+        /** Timed out before delivery — the message is still queued for the worker. */
+        TIMED_OUT_QUEUED,
+        /** Another send to this session was in flight for the whole window. */
+        BUSY,
+        /**
+         * An answer ({@link #answer(String, String, long)}) referenced a {@code turnId} that is no
+         * longer open — the worker's {@code fleet_ask} already timed out or was answered.
+         */
+        STALE_TURN
+    }
+
+    /**
+     * @param outcome how the send ended (or paused)
+     * @param text    the worker's answer when {@link #completed()} (a structured {@code fleet_reply}
+     *                for {@link Outcome#REPLIED}, a scraped transcript tail for
+     *                {@link Outcome#COMPLETED_UNREPLIED}), or the question for {@link Outcome#QUESTION},
+     *                else {@code null}
+     * @param turnId  correlation id for a {@link Outcome#QUESTION} (answered via
+     *                {@link #answer(String, String, long)}), else {@code null}
+     */
+    public record Reply(Outcome outcome, String text, String turnId) {
+        /** A reply with no correlation id (the common terminal outcomes). */
+        public Reply(Outcome outcome, String text) {
+            this(outcome, text, null);
+        }
+
+        /** Whether the worker's turn actually finished with an answer (replied or scraped). */
+        public boolean completed() {
+            return outcome == Outcome.REPLIED || outcome == Outcome.COMPLETED_UNREPLIED;
+        }
+    }
+
+    /** How a worker's {@code fleet_ask} (CB-205) resolved. */
+    public enum AskOutcome {
+        /** The primary answered; {@link AskResult#answer} carries it. */
+        ANSWERED,
+        /** No delegation was open to surface the question to — the worker has no one to ask. */
+        NO_WAITER,
+        /** The primary did not answer within the window. */
+        TIMED_OUT
+    }
+
+    /** The outcome of a worker's {@code fleet_ask}: how it resolved and (if answered) the answer. */
+    public record AskResult(AskOutcome outcome, String answer) {
+    }
+
+    /** Lifecycle phase of an async delegation ticket. */
+    public enum Phase {
+        /** Delegated and in flight — queued for the worker or being worked. */
+        PENDING,
+        /** The worker is paused in {@code fleet_ask}; {@link TaskView#reply} and {@link TaskView#turnId} identify it. */
+        ASKING,
+        /** The worker's turn finished; {@link TaskView#reply} holds the answer. */
+        DONE,
+        /** The delegation could not complete (timed out, worker gone, or busy). */
+        FAILED
+    }
+
+    /**
+     * A poll snapshot of an async delegation.
+     *
+     * @param reply       the answer when {@link #phase} is {@link Phase#DONE}, or the question when
+     *                    {@link #phase} is {@link Phase#ASKING}; otherwise {@code null}
+     * @param replySource {@code "reply"} (structured {@code fleet_reply}) or {@code "transcript"}
+     *                    (completion scrape) when {@link Phase#DONE}, else {@code null}
+     * @param detail      a human note (live worker status while pending, ask state, or failure reason)
+     * @param turnId      correlation id for an {@link Phase#ASKING} ticket, else {@code null}
+     */
+    public record TaskView(String ticket, Phase phase, String reply, String replySource, String detail,
+                           String turnId) {
+    }
+
+    /** An in-flight or finished async delegation, keyed by its ticket. */
+    private static final class Task {
+        private final String ticket;
+        private final String target;
+        private final CompletableFuture<Reply> future = new CompletableFuture<>();
+        private final long createdNanos;
+        private volatile Reply question;
+        private volatile String turnId;
+
+        private Task(String ticket, String target, long createdNanos) {
+            this.ticket = ticket;
+            this.target = target;
+            this.createdNanos = createdNanos;
+        }
+    }
+
+    /**
+     * A worker session's currently-open {@code fleet_ask} question, surfaced so {@code fleet_status}
+     * can show it without the caller needing the ticket first (CB-582). Only covers async
+     * (fire-and-poll) delegations, which track the question on their {@link Task}; a blocking
+     * ({@code wait:true}) send already hands the question straight back to its own caller, so there is
+     * nothing hidden left for {@code fleet_status} to surface in that case.
+     */
+    public record PendingAsk(String ticket, String question, String turnId) {
+    }
+
+    private final AgentControl agents;
+    private final Injector injector;
+    private final Rendezvous rendezvous;
+    private final ReplyInbox inbox;
+    private final ReplyPushLoop pushLoop;
+    private final Metrics metrics; // CB-502: nullable — no registry in unit tests
+    // CB-588: injectable so pruneTerminalTickets' 10-minute TICKET_TTL_NANOS can be exercised in a
+    // test without a real wait — same seam SessionManager already uses for its idle reaper (nowNanos).
+    private final LongSupplier nowNanos;
+    private final ConcurrentHashMap<String, ReentrantLock> sessionLocks = new ConcurrentHashMap<>();
+    private final ConcurrentHashMap<String, Task> tasks = new ConcurrentHashMap<>();
+    /** Async task that owns each exact forward rendezvous waiter. */
+    private final ConcurrentHashMap<CompletableFuture<Rendezvous.Resolution>, Task> asyncTasksByWaiter =
+            new ConcurrentHashMap<>();
+    /** Async tickets paused on a specific {@code fleet_ask} turn. */
+    private final ConcurrentHashMap<String, Task> asyncTasksByTurn = new ConcurrentHashMap<>();
+    private final AtomicLong ticketSeq = new AtomicLong();
+    private final ExecutorService asyncExecutor = Executors.newThreadPerTaskExecutor(
+            Thread.ofVirtual().name("bridge-async-", 0).factory());
+
+    /**
+     * Create with an explicit {@link ReplyInbox} and optional {@link ReplyPushLoop}.
+     *
+     * @param pushLoop nullable — when non-null, the push loop is notified on the no-waiter reply
+     *                 branch ({@link #reply}) so it can nudge the primary to drain the inbox,
+     *                 (CB-588) whenever an async ticket started by {@link #sendAsync} reaches a
+     *                 terminal phase, whenever {@link #poll} hands a terminal ticket to its caller,
+     *                 and (CB-582) whenever an async ticket's worker pauses mid-turn in
+     *                 {@code fleet_ask} or that pause ends (answered or lapsed)
+     */
+    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
+                          ReplyInbox inbox, ReplyPushLoop pushLoop) {
+        this(agents, injector, rendezvous, inbox, pushLoop, null);
+    }
+
+    /**
+     * As above, with a metric registry (CB-502). Instrumenting here rather than at the REST and MCP
+     * edges means both surfaces are counted by one piece of code and cannot drift.
+     *
+     * @param metrics nullable — when null, nothing is recorded
+     */
+    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
+                          ReplyInbox inbox, ReplyPushLoop pushLoop, Metrics metrics) {
+        this(agents, injector, rendezvous, inbox, pushLoop, metrics, System::nanoTime);
+    }
+
+    /** Test constructor with an injectable clock (CB-588: exercise the ticket-prune TTL without a real wait). */
+    MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous, ReplyInbox inbox,
+                   ReplyPushLoop pushLoop, Metrics metrics, LongSupplier nowNanos) {
+        this.agents = agents;
+        this.injector = injector;
+        this.rendezvous = rendezvous;
+        this.inbox = inbox;
+        this.pushLoop = pushLoop;
+        this.metrics = metrics;
+        this.nowNanos = nowNanos;
+    }
+
+    /** Create with an explicit {@link ReplyInbox} and no push loop. */
+    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous, ReplyInbox inbox) {
+        this(agents, injector, rendezvous, inbox, null);
+    }
+
+    /** Backward-compatible constructor that uses a default {@link InMemoryReplyInbox}. */
+    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous) {
+        this(agents, injector, rendezvous, new InMemoryReplyInbox());
+    }
+
+    /** Current lifecycle status of a worker (the {@code GET /sessions/{id}/status} surface). */
+    public AgentStatus status(String target) {
+        return agents.status(target);
+    }
+
+    /** Read-only delegation fact for fleet views. */
+    public boolean hasAcceptedDelivery(String target) {
+        return rendezvous.isWaiting(target);
+    }
+
+    /** Read-only inbox fact for fleet views. */
+    public boolean hasInboxMessage(String target) {
+        return !inbox.peek(target).isEmpty();
+    }
+
+    /**
+     * Route a worker's explicit {@code fleet_reply}: resolve an open send, or queue it in the
+     * inbox if no send is currently open. Unlike the bare {@link Rendezvous#resolve}, a no-waiter
+     * result is <em>not</em> a failure — the reply is held for later drain.
+     *
+     * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code fleet_ask} /
+     * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
+     * are interactive and must never be queued.
+     *
+     * @return always {@code true} — the reply either resolved a live send or was queued
+     */
+    public boolean reply(String session, String content) {
+        if (rendezvous.resolve(session, content)) {
+            count(FleetMetrics.REPLIES, "path", "rendezvous");
+            return true;                       // a live send took it — unchanged fast path
+        }
+        inbox.publish(session, UUID.randomUUID().toString(), content);
+        // A rising inbox share is the signal CB-307 exists to make visible: the worker finished but
+        // nobody was waiting, so delivery now depends on the push loop and a drain.
+        count(FleetMetrics.REPLIES, "path", "inbox");
+        if (pushLoop != null) {
+            pushLoop.onReplyQueued(session);
+        }
+        return true;                           // held, not lost
+    }
+
+    /** Record a counter sample when a registry is wired; a no-op in unit tests. */
+    private void count(String name, String... labels) {
+        if (metrics != null) {
+            metrics.inc(name, labels);
+        }
+    }
+
+    /** Count a send's terminal outcome and pass the reply through unchanged. */
+    private Reply recorded(Reply r) {
+        String label = sendOutcomeLabel(r.outcome());
+        if (label != null) {
+            count(FleetMetrics.SENDS, "outcome", label);
+        }
+        return r;
+    }
+
+    /** Map a terminal send outcome to its metric label, or {@code null} for non-terminal ones. */
+    private static String sendOutcomeLabel(Outcome o) {
+        return switch (o) {
+            case REPLIED -> "replied";
+            case COMPLETED_UNREPLIED -> "completion_fallback";
+            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> "timeout";
+            case WORKER_FAILED -> "failed";
+            case BACKEND_EXHAUSTED -> "backend_exhausted";
+            case STALE_TURN, QUESTION -> null; // not a completed delegation
+        };
+    }
+
+    /**
+     * Abandon any send still waiting on {@code target} because its session has gone away (CB-516).
+     *
+     * <p>Without this, tearing a worker down left its rendezvous waiter open: a blocking
+     * {@code fleet_send} kept blocking, and an async one kept reporting {@code PENDING} until
+     * {@link #ASYNC_TIMEOUT_MS} — thirty minutes — even though the worker provably no longer
+     * existed and the delegation could never complete. Worse, {@code poll} already had the evidence
+     * (it calls {@code liveStatus} to build its detail string and gets back {@code "unknown"}) and
+     * reported {@code PENDING} anyway.
+     *
+     * <p>Resolving the waiter as a failure — rather than letting it time out — also means the
+     * outcome is counted, so a torn-down delegation stops being invisible to {@code /metrics}.
+     *
+     * @return true if a live waiter was failed
+     */
+    public boolean abandon(String target, String reason) {
+        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
+        boolean failed = waiter != null && !waiter.isDone() && rendezvous.resolveFailure(waiter, reason);
+        boolean asyncFailed = false;
+        for (Task task : tasks.values()) {
+            if (target.equals(task.target) && task.question == null
+                    && task.future.complete(new Reply(Outcome.WORKER_FAILED, reason))) {
+                asyncFailed = true;
+            }
+        }
+        if (failed) {
+            log.warn("abandoning the blocked send to {}: {}", target, reason);
+        }
+        return failed || asyncFailed;
+    }
+
+    /**
+     * Acknowledge a specific reply by {@code msgId} for {@code target}. Removes it from the inbox
+     * so that a subsequent drain or peek no longer returns it.
+     */
+    public void ackReply(String target, String msgId) {
+        inbox.ack(target, msgId);
+    }
+
+    /**
+     * Drain (peek + ack) all pending inbox replies for {@code target}.
+     *
+     * <p><strong>The ack happens here, before the caller has the messages</strong> — before the MCP
+     * or REST response carrying them has been written, and long before the client has processed
+     * them. That ordering is what the two adapters disagree about, so do not read this method as
+     * "at-least-once" without qualifying which inbox is behind it (CB-529):
+     *
+     * <ul>
+     *   <li>{@code InMemoryReplyInbox} — the ack only drops an entry from a local map. The messages
+     *       are already in the returned list, so nothing can be lost after this point.
+     *   <li>{@code AmqpReplyInbox} — the ack is a broker-side {@code basicAck}. Once it lands the
+     *       broker has forgotten the message. If the daemon dies while writing the response, the
+     *       reply is gone from the broker <em>and</em> the client never received it. Re-polling
+     *       cannot recover it, because there is nothing left to re-deliver.
+     * </ul>
+     *
+     * <p>So the loss window is the response write, and it is a genuine loss rather than a
+     * redelivery. This is accepted, not overlooked: the alternative — ack on the next poll — turns
+     * every normal drain into a double delivery, which costs more than the window it closes. A
+     * caller that needs certainty re-polls; that is idempotent for every case except this one.
+     *
+     * <p>Any change here must be checked against <em>both</em> adapters. The previous version of
+     * this javadoc claimed "the ack is local", which was true when only the in-memory inbox existed
+     * and silently became false when the AMQP adapter landed.
+     *
+     * @return the drained messages, newest last (FIFO); empty list if none
+     */
+    public List<ReplyInbox.InboxMessage> drainReplies(String target) {
+        var messages = inbox.peek(target);
+        for (var msg : messages) {
+            inbox.ack(target, msg.msgId());
+        }
+        return messages;
+    }
+
+    /**
+     * Deliver {@code content} to {@code target} (a herdr {@code terminal_id}) and block until the
+     * worker replies via {@link Rendezvous} or {@code timeoutMillis} elapses.
+     */
+    public Reply send(String target, String content, long timeoutMillis) {
+        return send(target, content, timeoutMillis, null);
+    }
+
+    /**
+     * As {@link #send(String, String, long)}, but with an accepted-delivery hook.
+     *
+     * <p>{@code onAccepted} is invoked exactly once, once this send has won {@code target}'s send
+     * lock and so become the <em>accepted target turn</em> — it runs <em>before</em> delivery is
+     * queued, so a throwing hook fails the send cleanly (the waiter it already opened is closed and
+     * nothing is left queued). It is <em>not</em> invoked when the send is {@link Outcome#BUSY}
+     * (lock never taken). A caller uses this to record that <em>it</em> now owns the delegation's
+     * reply routing (CB-548: {@code PrimaryRegistry} delegator ownership) — recording only on
+     * acceptance means a concurrent sender that times out {@code BUSY} can never steal ownership it
+     * never earned. {@code null} disables the hook.
+     */
+    public Reply send(String target, String content, long timeoutMillis, Runnable onAccepted) {
+        return send(target, content, timeoutMillis, onAccepted, null);
+    }
+
+    /** Run a send, optionally stopping an async task that teardown already failed before acceptance. */
+    private Reply send(String target, String content, long timeoutMillis, Runnable onAccepted, Task task) {
+        long deadlineNanos = System.nanoTime() + timeoutMillis * 1_000_000L;
+        ReentrantLock lock = sessionLocks.computeIfAbsent(target, _ -> new ReentrantLock());
+
+        if (!tryLock(lock, remainingMillis(deadlineNanos))) {
+            return new Reply(Outcome.BUSY, null); // another send held the session the whole window
+        }
+        try {
+            if (task != null && task.future.isDone()) {
+                return task.future.getNow(null);
+            }
+            if (hasAsyncQuestion(target)) {
+                return new Reply(Outcome.BUSY, null); // the worker's current turn is paused for its lead
+            }
+            // Open the waiter BEFORE queueing delivery (CB-548). A fast reply — the worker already
+            // injectable the instant we enqueue — otherwise arrives before the waiter is registered
+            // and orphans into the inbox while this send blocks to the timeout (the enqueue-before-
+            // open race). Opening first also means a throwing onAccepted (fired before enqueue) or an
+            // enqueue failure is safely closed by the finally below: nothing is left queued, and the
+            // failed send leaves no stale waiter behind.
+            CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(target);
+            try {
+                if (task != null) {
+                    asyncTasksByWaiter.put(reply, task);
+                }
+                TurnToken token = new TurnToken(target, reply);
+                // The send has won the lock; the accepted-delivery hook records delegator ownership
+                // here (CB-548). It runs BEFORE enqueue so a throwing hook — onAccepted is now a
+                // public callback — fails the send without queuing a message that would orphan.
+                if (onAccepted != null) {
+                    onAccepted.run();
+                }
+                CompletableFuture<Void> delivered = injector.enqueue(target, content, token);
+                try {
+                    Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
+                    return recorded(new Reply(outcomeOf(r.kind()), r.text(), r.turnId()));
+                } catch (TimeoutException e) {
+                    boolean wasDelivered = delivered.isDone() && !delivered.isCompletedExceptionally();
+                    log.debug("send to {} timed out (delivered={})", target, wasDelivered);
+                    return recorded(new Reply(
+                            wasDelivered ? Outcome.TIMED_OUT_WORKING : Outcome.TIMED_OUT_QUEUED, null));
+                } catch (ExecutionException e) {
+                    Throwable cause = e.getCause();
+                    throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    throw new IllegalStateException("interrupted awaiting reply from " + target, e);
+                }
+            } finally {
+                asyncTasksByWaiter.remove(reply);
+                rendezvous.close(target, reply);
+            }
+        } finally {
+            lock.unlock();
+        }
+    }
+
+    /**
+     * A worker's mid-turn question (CB-205 reverse rendezvous): surface {@code question} to the
+     * primary by resolving its open blocking {@code fleet_send}, then block this (worker) call until
+     * the primary answers via {@link #answer} or {@code timeoutMillis} elapses. Identity is the
+     * worker's own session — it does not address the primary.
+     *
+     * <p>Returns {@link AskOutcome#NO_WAITER} when no delegation is open to surface the question to
+     * (nothing to answer it), {@link AskOutcome#ANSWERED} with the primary's answer, or
+     * {@link AskOutcome#TIMED_OUT} if the primary stayed silent. The worker resumes its turn either
+     * way — an answered ask hands back the answer; an unanswered one leaves it to proceed alone.
+     */
+    public AskResult ask(String workerSession, String question, long timeoutMillis) {
+        Rendezvous.AskTicket ticket = rendezvous.openAsk(workerSession);
+        // Only the freshly-opening caller surfaces the question; a coalesced duplicate simply blocks on
+        // the shared answer future that the fresh owner is already responsible for.
+        if (ticket.fresh()) {
+            // Register the reverse waiter first, then surface the question — so the answer, which can
+            // arrive the instant the primary reacts, always finds an open waiter to resolve.
+            CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(workerSession);
+            Task task = markAsyncQuestion(waiter, question, ticket.turnId());
+            if (!rendezvous.resolveQuestion(workerSession, question, ticket.turnId())) {
+                if (task != null) {
+                    clearAsyncQuestion(ticket.turnId(), true);
+                }
+                rendezvous.closeAsk(ticket.turnId());
+                return new AskResult(AskOutcome.NO_WAITER, null); // no primary is blocked on this worker
+            }
+            // CB-582: the question just became visible via fleet_poll (Phase.ASKING) for an async
+            // (wait:false) delegation — nudge the lead's own pane the same way a terminal ticket does
+            // (CB-588), since the lead's normal poll cadence is minutes away and the reverse-rendezvous
+            // window (~55s, see FleetMcp/FleetApp) is far shorter. A blocking (wait:true) send has
+            // no Task and gets the question directly in its own reply, so task == null there — nothing
+            // to nudge.
+            if (task != null && pushLoop != null) {
+                pushLoop.onQuestionOpened(task.ticket, workerSession, ticket.turnId(), question);
+            }
+        }
+        try {
+            String answer = ticket.answer().get(timeoutMillis, TimeUnit.MILLISECONDS);
+            return new AskResult(AskOutcome.ANSWERED, answer);
+        } catch (TimeoutException e) {
+            log.debug("fleet_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
+            clearAsyncQuestion(ticket.turnId(), true);
+            return new AskResult(AskOutcome.TIMED_OUT, null);
+        } catch (ExecutionException e) {
+            Throwable cause = e.getCause();
+            throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IllegalStateException("interrupted awaiting the primary's answer for " + workerSession, e);
+        } finally {
+            // Only the fresh owner tears down the shared turn; a duplicate must leave it open.
+            if (ticket.fresh()) {
+                rendezvous.closeAsk(ticket.turnId());
+                // CB-582: tear the push loop's copy down at the same point, not only on the three
+                // paths that call clearAsyncQuestion. The answer future can complete exceptionally
+                // (ExecutionException) or the thread be interrupted, and both leave this method by
+                // throwing — the question would stay pending forever, keep being named in nudges
+                // until its own cap, and never be removed from the map. Already-closed is a no-op.
+                if (pushLoop != null) {
+                    pushLoop.questionClosed(ticket.turnId());
+                }
+            }
+        }
+    }
+
+    /**
+     * The primary's answer to a worker's {@code fleet_ask} (CB-205): resolve the worker's blocked
+     * question identified by {@code turnId}, then — like a fresh {@link #send} — block for the worker's
+     * eventual {@code fleet_reply} as it finishes the resumed turn. The worker session is derived from
+     * {@code turnId}, never a caller argument.
+     *
+     * <p>Unlike {@link #send} this does not re-inject through the {@link Injector}: the worker is
+     * mid-turn (already picked up), so the answer flows back through its own open {@code fleet_ask}
+     * call, not a new status-gated delivery. The forward waiter is opened <em>before</em> the worker
+     * is unblocked so a reply that lands the instant it resumes is not lost.
+     */
+    public Reply answer(String turnId, String content, long timeoutMillis) {
+        String workerSession = rendezvous.askSession(turnId);
+        if (workerSession == null) {
+            return new Reply(Outcome.STALE_TURN, null); // the ask lapsed (timed out or already answered)
+        }
+        long deadlineNanos = System.nanoTime() + timeoutMillis * 1_000_000L;
+        ReentrantLock lock = sessionLocks.computeIfAbsent(workerSession, _ -> new ReentrantLock());
+        if (!tryLock(lock, remainingMillis(deadlineNanos))) {
+            return new Reply(Outcome.BUSY, null);
+        }
+        try {
+            CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(workerSession);
+            if (!rendezvous.answerAsk(turnId, content)) {
+                rendezvous.close(workerSession, reply);
+                return new Reply(Outcome.STALE_TURN, null); // lapsed between the lookup and the unblock
+            }
+            clearAsyncQuestion(turnId, false);
+            try {
+                Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
+                Reply result = new Reply(outcomeOf(r.kind()), r.text(), r.turnId());
+                finishAsyncTask(turnId, result);
+                return result;
+            } catch (TimeoutException e) {
+                // The worker resumed but hasn't replied yet — no completion fallback arms an answered
+                // turn (it never re-entered the injector), so a silent worker rides out the window.
+                return new Reply(Outcome.TIMED_OUT_WORKING, null);
+            } catch (ExecutionException e) {
+                Throwable cause = e.getCause();
+                throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                throw new IllegalStateException("interrupted awaiting reply from " + workerSession, e);
+            } finally {
+                rendezvous.close(workerSession, reply);
+            }
+        } finally {
+            lock.unlock();
+        }
+    }
+
+    /**
+     * Fire-and-poll variant of {@link #send}: deliver {@code content} to {@code target} on a
+     * background virtual thread and return immediately with a ticket to {@link #poll}. This is how a
+     * long task is delegated without tripping the caller's MCP client call timeout.
+     *
+     * @return the ticket to poll for the eventual result
+     */
+    public String sendAsync(String target, String content) {
+        return sendAsync(target, content, null);
+    }
+
+    /**
+     * As {@link #sendAsync(String, String)}, with the accepted-delivery hook of
+     * {@link #send(String, String, long, Runnable)} — the running {@code send} invokes {@code onAccepted}
+     * the moment it becomes the accepted target turn, so async flooding records delegator ownership
+     * exactly as the blocking path does (CB-548).
+     *
+     * @return the ticket to poll for the eventual result
+     */
+    public String sendAsync(String target, String content, Runnable onAccepted) {
+        String ticket = "task-" + ticketSeq.incrementAndGet();
+        Task task = new Task(ticket, target, nowNanos.getAsLong());
+        tasks.put(ticket, task);
+        if (pushLoop != null) {
+            // CB-588: task.future only ever completes on a terminal phase (DONE or a failure) — a
+            // worker paused in fleet_ask leaves it running, per finishAsyncTask's own contract — so
+            // this fires exactly once, from whichever path completes it: finishAsyncTask(task, result)
+            // below on any non-QUESTION outcome of send() — a worker's fleet_reply, the CB-106
+            // completion fallback, a CB-109 wedge, TIMED_OUT, BUSY, or BACKEND_EXHAUSTED — the same
+            // finishAsyncTask reached via answer()'s finishAsyncTask(turnId, result) once a QUESTION
+            // is resolved, completeExceptionally(t) just below when send() itself throws, or a CB-516
+            // abandon() on teardown. Without this, MessageService.reply's rendezvous fast path (the
+            // one an async ticket always takes) never told the push loop anything happened — see the
+            // class javadoc on sendAsync/CB-107.
+            task.future.whenComplete((reply, ex) -> {
+                boolean failed = ex != null || reply == null || !reply.completed();
+                pushLoop.onTicketTerminal(ticket, target, failed);
+            });
+        }
+        asyncExecutor.submit(() -> {
+            try {
+                Reply result = send(target, content, ASYNC_TIMEOUT_MS, onAccepted, task);
+                if (result.outcome() == Outcome.QUESTION) {
+                    // Keep the accepted owner until answer() finishes it. markAsyncQuestion may run
+                    // just after resolveQuestion wakes this thread.
+                } else {
+                    finishAsyncTask(task, result);
+                }
+            } catch (Throwable t) {
+                task.future.completeExceptionally(t);
+            }
+        });
+        pruneTerminalTickets();
+        log.debug("async send {} -> {}", ticket, target);
+        return ticket;
+    }
+
+    /**
+     * Snapshot the state of an async delegation. Returns {@code null} for an unknown/expired ticket;
+     * otherwise a {@link Phase#PENDING} view (with the live worker status as detail), a
+     * {@link Phase#DONE} view carrying the reply, or a {@link Phase#FAILED} view with the reason.
+     */
+    public TaskView poll(String ticket) {
+        Task task = tasks.get(ticket);
+        if (task == null) {
+            return null;
+        }
+        CompletableFuture<Reply> f = task.future;
+        if (!f.isDone()) {
+            Reply question = task.question;
+            if (question != null) {
+                return new TaskView(ticket, Phase.ASKING, question.text(), null,
+                        "worker is waiting for your answer", question.turnId());
+            }
+            return new TaskView(ticket, Phase.PENDING, null, null, "worker " + liveStatus(task.target), null);
+        }
+        // CB-588: the ticket is terminal and being handed to the caller right here — tell the push
+        // loop it is collected so a later tick's nudge never names a ticket the lead already has.
+        if (pushLoop != null) {
+            pushLoop.ticketCollected(ticket);
+        }
+        Reply r;
+        try {
+            r = f.getNow(null);
+        } catch (CompletionException | java.util.concurrent.CancellationException e) {
+            Throwable cause = (e instanceof CompletionException ce && ce.getCause() != null) ? ce.getCause() : e;
+            return new TaskView(ticket, Phase.FAILED, null, null, cause.getMessage(), null);
+        }
+        if (r.completed()) {
+            String source = r.outcome() == Outcome.REPLIED ? "reply" : "transcript";
+            return new TaskView(ticket, Phase.DONE, r.text(), source, null, null);
+        }
+        // A wedged worker (CB-109) or a backend-exhausted classification (CB-578 stage A) carries
+        // the real cause as its reason; the timeout/busy outcomes carry none, so fall back to the
+        // outcome name.
+        boolean carriesReason = r.outcome() == Outcome.WORKER_FAILED || r.outcome() == Outcome.BACKEND_EXHAUSTED;
+        String detail = carriesReason && r.text() != null
+                ? r.text()
+                : "no reply — " + r.outcome().name().toLowerCase();
+        return new TaskView(ticket, Phase.FAILED, null, null, detail, null);
+    }
+
+    /** Best-effort live worker status for a pending poll; never throws (a lookup error is just noise). */
+    private String liveStatus(String target) {
+        try {
+            return agents.status(target).name().toLowerCase();
+        } catch (RuntimeException e) {
+            return "unknown";
+        }
+    }
+
+    /**
+     * Drop finished tickets older than the TTL so {@link #tasks} cannot grow without bound.
+     *
+     * <p>{@code tasks} is the sole authority on whether a ticket still exists — {@link #poll} returns
+     * {@code null} the instant a ticket is gone from here, before it ever reaches the terminal branch
+     * that calls {@link ReplyPushLoop#ticketCollected}. Without telling the push loop about a prune
+     * too, its own {@code pendingTickets} entry would outlive the ticket it names: an unpolled ticket
+     * (or one the reminder cap already gave up on) is pruned here but never collected there, so it
+     * lingers in {@code pendingTickets} forever and rides along on every later nudge to the same lead
+     * — naming a ticket {@code fleet_poll} can no longer find (CB-588 follow-up).
+     */
+    private void pruneTerminalTickets() {
+        long cutoff = nowNanos.getAsLong() - TICKET_TTL_NANOS;
+        tasks.entrySet().removeIf(e -> {
+            Task t = e.getValue();
+            boolean expired = t.future.isDone() && t.createdNanos < cutoff;
+            if (expired && pushLoop != null) {
+                pushLoop.ticketCollected(e.getKey());
+            }
+            return expired;
+        });
+    }
+
+    /** Record the active question for an async ticket; blocking sends have no entry and stay unchanged. */
+    private Task markAsyncQuestion(CompletableFuture<Rendezvous.Resolution> waiter, String text, String turnId) {
+        Task task = waiter == null ? null : asyncTasksByWaiter.get(waiter);
+        if (task != null) {
+            task.question = new Reply(Outcome.QUESTION, text, turnId);
+            task.turnId = turnId;
+            asyncTasksByTurn.put(turnId, task);
+        }
+        return task;
+    }
+
+    /** Clear an answered or lapsed question, but only when it matches the ticket's current turn. */
+    private void clearAsyncQuestion(String turnId, boolean forgetTurn) {
+        // CB-582: tell the push loop first — like ticketCollected, a removal for a turnId it never
+        // nudged about (or already dropped) is a harmless no-op, so this is safe to call unconditionally
+        // rather than threading the guard below through it.
+        if (pushLoop != null) {
+            pushLoop.questionClosed(turnId);
+        }
+        Task task = asyncTasksByTurn.get(turnId);
+        if (task != null && turnId.equals(task.turnId)) {
+            task.question = null;
+            if (forgetTurn) {
+                asyncTasksByTurn.remove(turnId, task);
+                task.turnId = null;
+            }
+        }
+    }
+
+    /** Complete and detach an async ticket after its worker's actual terminal reply. */
+    private void finishAsyncTask(Task task, Reply result) {
+        task.future.complete(result);
+        if (task.turnId != null) {
+            asyncTasksByTurn.remove(task.turnId, task);
+        }
+    }
+
+    /** Complete the async ticket correlated to a specific answered turn. */
+    private void finishAsyncTask(String turnId, Reply result) {
+        Task task = asyncTasksByTurn.get(turnId);
+        if (task != null) {
+            finishAsyncTask(task, result);
+        }
+    }
+
+    /** A new send must not open a waiter while an async ticket owns this worker's paused turn. */
+    private boolean hasAsyncQuestion(String target) {
+        return asyncTasksByTurn.values().stream().anyMatch(task -> target.equals(task.target));
+    }
+
+    /**
+     * The question {@code workerSession} is currently paused on via {@code fleet_ask}, if any
+     * (CB-582) — {@code fleet_status} uses this to show a pending question without the caller
+     * needing the ticket. {@code null} when the session has no open async question (including a
+     * session mid a <em>blocking</em> {@code fleet_ask}, which has no {@link Task} to look up — see
+     * {@link PendingAsk}).
+     */
+    public PendingAsk pendingAsk(String workerSession) {
+        for (Task task : tasks.values()) {
+            Reply q = task.question;
+            if (q != null && workerSession.equals(task.target)) {
+                return new PendingAsk(task.ticket, q.text(), q.turnId());
+            }
+        }
+        return null;
+    }
+
+    /** Release the async executor. */
+    public void close() {
+        asyncExecutor.shutdown();
+    }
+
+    /** Map a rendezvous {@link Rendezvous.Kind} onto its send {@link Outcome} (shared by send/answer). */
+    private static Outcome outcomeOf(Rendezvous.Kind kind) {
+        return switch (kind) {
+            case REPLY -> Outcome.REPLIED;
+            case COMPLETION -> Outcome.COMPLETED_UNREPLIED;
+            case FAILED -> Outcome.WORKER_FAILED;
+            case BACKEND_EXHAUSTED -> Outcome.BACKEND_EXHAUSTED;
+            case QUESTION -> Outcome.QUESTION;
+        };
+    }
+
+    private static boolean tryLock(ReentrantLock lock, long millis) {
+        try {
+            return lock.tryLock(Math.max(0, millis), TimeUnit.MILLISECONDS);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IllegalStateException("interrupted awaiting the session send lock", e);
+        }
+    }
+
+    private static long remainingMillis(long deadlineNanos) {
+        return (deadlineNanos - System.nanoTime()) / 1_000_000L;
+    }
+}

bridged/src/main/java/dev/ltms/fleet/msg/Rendezvous.java

@@ -0,0 +1,251 @@
+package dev.ltms.fleet.msg;
+
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicLong;
+
+/**
+ * The reply rendezvous: where a blocking {@code fleet_send} awaits how the worker's delegated turn
+ * ends. The sending (primary) request thread {@link #open}s a waiter; it is resolved either by the
+ * worker's explicit {@code fleet_reply} ({@link #resolve}, arriving on a different thread via
+ * {@code POST /sessions/{id}/reply}) or — the CB-106 fallback — by the injector observing the
+ * worker's delegated turn return to idle without a reply ({@link #resolveCompletion}).
+ *
+ * <p>At most one waiter per session — {@link MessageService} serializes sends per session, so a
+ * resolution maps unambiguously to the one outstanding send and cannot be captured by another.
+ *
+ * <p><strong>Waiter identity (CB-116).</strong> The completion/failure fallbacks run asynchronously
+ * and can fire <em>after</em> the turn they belong to has already been resolved by an explicit reply
+ * and a <em>next</em> send has opened its own waiter on the same session. Resolving "whatever waiter
+ * is registered now" would then land turn N's stale scrape on turn N+1's send. So those fallbacks
+ * resolve a <em>specific</em> {@link CompletableFuture} captured when their turn was delivered
+ * ({@link #resolveCompletion(CompletableFuture, String)} /
+ * {@link #resolveFailure(CompletableFuture, String)}): a no-op if that waiter was already resolved,
+ * and it can never touch a later send's waiter.
+ */
+public final class Rendezvous {
+
+    /** How a delegated turn ended (or paused). */
+    public enum Kind {
+        /** The worker called {@code fleet_reply} with a structured answer. */
+        REPLY,
+        /** The worker's turn finished without a {@code fleet_reply}; {@code text} is a scrape. */
+        COMPLETION,
+        /** The worker ran the turn then wedged (CB-109); {@code text} is the failure context. */
+        FAILED,
+        /**
+         * The turn finished without a {@code fleet_reply}, and the scrape matched the backend's
+         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
+         * carrying the matched line. The pane is healthy — only the account is refusing — so this
+         * is kept separate from a session simply going {@code GONE}.
+         */
+        BACKEND_EXHAUSTED,
+        /**
+         * The worker paused mid-turn to ask the primary a question (CB-205 reverse rendezvous);
+         * {@code text} is the question and {@code turnId} correlates the primary's answer back to
+         * the worker's blocked {@code fleet_ask}. Not terminal — the turn resumes after the answer.
+         */
+        QUESTION
+    }
+
+    /**
+     * The resolved outcome of a send: its {@link Kind}, the associated text, and — only for
+     * {@link Kind#QUESTION} — the {@code turnId} the primary answers with (else {@code null}).
+     */
+    public record Resolution(Kind kind, String text, String turnId) {
+        /** A terminal resolution (reply / completion / failure) with no correlation id. */
+        public Resolution(Kind kind, String text) {
+            this(kind, text, null);
+        }
+    }
+
+    /** A worker's open mid-turn question: the worker session it belongs to and the answer future. */
+    private record AskWaiter(String session, CompletableFuture<String> answer) {
+    }
+
+    /**
+     * Handle to a reverse-rendezvous turn: the {@code turnId}, its answer future, and whether this
+     * call freshly opened it (versus coalescing onto an already-open ask).
+     */
+    public record AskTicket(String turnId, CompletableFuture<String> answer, boolean fresh) {
+    }
+
+    private final ConcurrentHashMap<String, CompletableFuture<Resolution>> waiters = new ConcurrentHashMap<>();
+
+    /** Reverse rendezvous (CB-205): worker questions awaiting the primary's answer, keyed by {@code turnId}. */
+    private final ConcurrentHashMap<String, AskWaiter> asks = new ConcurrentHashMap<>();
+    private final AtomicLong askSeq = new AtomicLong();
+    /** Per-session index of the currently-open ask, so duplicate fleet_ask calls coalesce onto one turn. */
+    private final ConcurrentHashMap<String, String> openAsksBySession = new ConcurrentHashMap<>();
+
+    /**
+     * Register a waiter for {@code session} — the await side of the public {@code resolve*} methods.
+     * The caller must hold that session's send lock.
+     *
+     * <p>Atomic fail-if-present (CB-548): if a waiter is already registered for {@code session}, an
+     * {@link IllegalStateException} is thrown rather than replacing the first — so any future
+     * invariant violation fails loudly instead of silently swapping the waiter another send is
+     * blocked on. {@code MessageService} serializes sends per session (the send lock), so in correct
+     * code a double open is impossible; this is a tripwire for the day that no longer holds.
+     */
+    public CompletableFuture<Resolution> open(String session) {
+        CompletableFuture<Resolution> waiter = new CompletableFuture<>();
+        CompletableFuture<Resolution> existing = waiters.putIfAbsent(session, waiter);
+        if (existing != null) {
+            throw new IllegalStateException(
+                    "rendezvous double-open for session " + session + " — a waiter is already registered");
+        }
+        return waiter;
+    }
+
+    /**
+     * Remove {@code waiter} for {@code session}, only if it is still the registered one. The
+     * symmetric complement of {@link #open}: a terminal send deregisters its waiter so the next
+     * send on the session may {@link #open} a fresh one (CB-548 makes double-open an error, so a
+     * successful {@code open} after a finished turn requires this close to have happened first).
+     */
+    public void close(String session, CompletableFuture<Resolution> waiter) {
+        waiters.remove(session, waiter);
+    }
+
+    /** Whether a send is currently awaiting a resolution for {@code session}. */
+    public boolean isWaiting(String session) {
+        return waiters.containsKey(session);
+    }
+
+    /**
+     * The waiter currently registered for {@code session}, or {@code null} if none is waiting. The
+     * completion/failure fallbacks capture this at delivery time so they can later resolve that exact
+     * send (see the CB-116 note above) rather than whichever send happens to be waiting when they fire.
+     */
+    public CompletableFuture<Resolution> currentWaiter(String session) {
+        return waiters.get(session);
+    }
+
+    /**
+     * Resolve the send awaiting on {@code session} with the worker's explicit reply {@code content}.
+     *
+     * @return {@code true} if a waiter was resolved; {@code false} if none was waiting (a late or
+     *         spurious reply — e.g. the send already timed out)
+     */
+    public boolean resolve(String session, String content) {
+        return complete(session, new Resolution(Kind.REPLY, content));
+    }
+
+    // --- reverse rendezvous (CB-205 fleet_ask) ------------------------------------------------
+
+    /**
+     * Open a reverse-rendezvous waiter for a worker's mid-turn question. If {@code session} already has
+     * an open ask, coalesce onto it (same {@code turnId}, same answer future). Otherwise atomically mint
+     * a fresh {@code turnId}, register it in both the per-turn and per-session indexes, and hand it back
+     * marked fresh. The caller then {@link #resolveQuestion surfaces the question} to the primary and
+     * blocks on the returned future until the primary {@link #answerAsk answers}.
+     */
+    public AskTicket openAsk(String session) {
+        while (true) {
+            AskWaiter[] minted = { null };
+            String turnId = openAsksBySession.computeIfAbsent(session, _ -> {
+                String newTurnId = session + "#" + askSeq.incrementAndGet();
+                CompletableFuture<String> answer = new CompletableFuture<>();
+                AskWaiter waiter = new AskWaiter(session, answer);
+                asks.put(newTurnId, waiter);
+                minted[0] = waiter;
+                return newTurnId;
+            });
+            if (minted[0] != null) {
+                return new AskTicket(turnId, minted[0].answer(), true);
+            }
+            AskWaiter existing = asks.get(turnId);
+            if (existing != null) {
+                return new AskTicket(turnId, existing.answer(), false);
+            }
+            // A close raced and removed the waiter after we read the turnId; clear the stale index entry
+            // and retry so a fresh ask is always backed by a registered waiter.
+            openAsksBySession.remove(session, turnId);
+        }
+    }
+
+    /**
+     * Surface a worker's mid-turn {@code question} by resolving the primary's open {@code fleet_send}
+     * with a {@link Kind#QUESTION} carrying {@code turnId}. Same session-keyed semantics as
+     * {@link #resolve}: the one outstanding send for {@code session} unblocks with the question.
+     *
+     * @return {@code true} if a send was awaiting (the question reached the primary); {@code false}
+     *         if none was (no delegation is open to answer it)
+     */
+    public boolean resolveQuestion(String session, String question, String turnId) {
+        return complete(session, new Resolution(Kind.QUESTION, question, turnId));
+    }
+
+    /** The worker session an outstanding ask {@code turnId} belongs to, or {@code null} if unknown/lapsed. */
+    public String askSession(String turnId) {
+        AskWaiter w = asks.get(turnId);
+        return w == null ? null : w.session();
+    }
+
+    /**
+     * Resolve a worker's blocked {@code fleet_ask} with the primary's {@code answer}, unblocking it
+     * to resume its turn.
+     *
+     * @return {@code true} if the ask was still open and got the answer; {@code false} if the
+     *         {@code turnId} is unknown or the ask already lapsed (timed out / was answered)
+     */
+    public boolean answerAsk(String turnId, String answer) {
+        AskWaiter w = asks.get(turnId);
+        return w != null && w.answer().complete(answer);
+    }
+
+    /** Drop a reverse-rendezvous turn once its {@code fleet_ask} has resolved (answered or lapsed). */
+    public void closeAsk(String turnId) {
+        AskWaiter w = asks.get(turnId);
+        if (w == null) {
+            return;
+        }
+        // Remove the session index first and only if it still points to this turn, so a concurrent
+        // fresh ask cannot inherit a waiter we are about to drop.
+        openAsksBySession.remove(w.session(), turnId);
+        asks.remove(turnId);
+    }
+
+    /**
+     * Resolve a specific captured {@code waiter} as a completion (the delegated turn finished with no
+     * {@code fleet_reply}); {@code text} is the scraped transcript tail. The waiter is the one
+     * captured when this turn was delivered, so a late completion for turn N cannot land on turn N+1's
+     * send (CB-116). A no-op if that waiter was already resolved — a raced {@code fleet_reply} wins.
+     *
+     * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
+     */
+    public boolean resolveCompletion(CompletableFuture<Resolution> waiter, String text) {
+        return waiter != null && waiter.complete(new Resolution(Kind.COMPLETION, text));
+    }
+
+    /**
+     * Resolve a specific captured {@code waiter} as a failure — the worker ran the turn but wedged in
+     * an unrecoverable state (CB-109); {@code reason} is the failure context (e.g. the error screen).
+     * Like {@link #resolveCompletion(CompletableFuture, String)} it targets the exact captured send
+     * (CB-116). A no-op if that waiter was already resolved — first resolution wins.
+     *
+     * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
+     */
+    public boolean resolveFailure(CompletableFuture<Resolution> waiter, String reason) {
+        return waiter != null && waiter.complete(new Resolution(Kind.FAILED, reason));
+    }
+
+    /**
+     * Resolve a specific captured {@code waiter} as {@link Kind#BACKEND_EXHAUSTED} (CB-578 stage A):
+     * the turn finished with no {@code fleet_reply} and the scrape matched the backend's configured
+     * usage-limit pattern; {@code reason} carries the matched line. Like
+     * {@link #resolveCompletion(CompletableFuture, String)} it targets the exact captured send
+     * (CB-116). A no-op if that waiter was already resolved — first resolution wins.
+     *
+     * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
+     */
+    public boolean resolveExhausted(CompletableFuture<Resolution> waiter, String reason) {
+        return waiter != null && waiter.complete(new Resolution(Kind.BACKEND_EXHAUSTED, reason));
+    }
+
+    private boolean complete(String session, Resolution resolution) {
+        CompletableFuture<Resolution> waiter = waiters.get(session);
+        return waiter != null && waiter.complete(resolution);
+    }
+}

bridged/src/main/java/dev/ltms/fleet/msg/ReplyInbox.java

@@ -0,0 +1,51 @@
+package dev.ltms.fleet.msg;
+
+import java.util.List;
+
+/**
+ * Holds terminal worker→primary replies that arrive with no live send to resolve, keyed by worker
+ * session (target), until the primary drains them. Soft-state in Stage 1 (in-memory, lost on restart);
+ * the Stage 2 AMQP adapter implements the same contract with cross-restart durability.
+ *
+ * <p><strong>This interface is the port.</strong> {@link InMemoryReplyInbox} is the Stage-1 adapter;
+ * an AMQP-backed adapter (Stage 2) must implement the same contract (idempotent publish, FIFO peek,
+ * at-least-once ack).
+ *
+ * <p><strong>Ownership is explicit.</strong> A gateway {@link #own owns} the inbox for each agent it
+ * spawned; only the owner consumes and drains it. {@link #publish} sends a reply to the target's
+ * inbox but does <em>not</em> imply ownership or start a consumer. This separation is required by
+ * CB-308 federation, where one gateway may publish to an agent owned by another gateway.
+ */
+public interface ReplyInbox {
+
+    /** A queued reply: an idempotency id, the worker session it came from, and the reply text. */
+    record InboxMessage(String msgId, String target, String content) {}
+
+    /**
+     * Start owning (consuming) the inbox for {@code target}. Idempotent: multiple calls for the same
+     * target are no-ops. The owner is the only gateway that may {@link #peek} and {@link #ack} replies
+     * for this target.
+     */
+    void own(String target);
+
+    /**
+     * Stop owning (consuming) the inbox for {@code target}. Idempotent. Any replies held locally but
+     * not yet acked are dropped from the local snapshot; the underlying durable queue keeps
+     * unacked messages for redelivery when the target is re-owned.
+     */
+    void release(String target);
+
+    /**
+     * Queue {@code content} from worker {@code target} under {@code msgId}. Idempotent: publishing an
+     * already-present {@code msgId} for {@code target} is a no-op (dedup), so an at-least-once Stage-2
+     * redelivery cannot double-queue. Publishing does <em>not</em> imply ownership and must not start a
+     * consumer.
+     */
+    void publish(String target, String msgId, String content);
+
+    /** Non-destructive snapshot of pending replies for {@code target} (FIFO), empty list if none. */
+    List<InboxMessage> peek(String target);
+
+    /** Remove the reply {@code msgId} for {@code target} once the primary has taken it. No-op if absent. */
+    void ack(String target, String msgId);
+}

bridged/src/main/java/dev/ltms/fleet/msg/ReplyPushLoop.java

@@ -0,0 +1,636 @@
+package dev.ltms.fleet.msg;
+
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+/**
+ * A status-gated push loop that nudges a lead's own herdr pane when it has uncollected work
+ * waiting: a worker reply queued with no live {@code fleet_send} to resolve it (CB-307), an
+ * async delegation ticket ({@code fleet_send(wait:false)}) that reached a terminal phase
+ * (CB-588), or an async ticket's worker pausing mid-turn in {@code fleet_ask} to await an answer
+ * (CB-582).
+ *
+ * <p><strong>CB-590: one schedule per lead.</strong> All three kinds of work are triggered
+ * through their own entry point — {@link #onReplyQueued(String)},
+ * {@link #onTicketTerminal(String, String, boolean)}, and
+ * {@link #onQuestionOpened(String, String, String, String)} — but each resolves the lead that
+ * should be nudged and coalesces onto a single per-lead reminder schedule, tracked in
+ * {@link #activeLeads}. Earlier this was two independent schedules (one keyed by worker target
+ * for replies, one keyed by lead for tickets) that could both decide to inject into the same pane
+ * in the same window — a race, not routine behaviour, but the expensive kind: it interrupts the
+ * lead's live turn twice. Collapsing to one schedule per lead makes that structurally impossible:
+ * at most one scheduled tick chain is ever live for a given lead (guarded by {@link #activeLeads}'
+ * compare-and-set), so at most one {@code agents.send} to that lead's pane is ever in flight.
+ *
+ * <p>Each tick examines <em>everything</em> pending for that lead — reply targets whose inbox
+ * still holds an unacked message ({@link #pendingReplies}), tickets not yet collected
+ * ({@link #pendingTickets}), and open questions not yet answered or lapsed
+ * ({@link #pendingQuestions}) — and sends at most one combined nudge per tick
+ * ({@link #injectNudge(String, int, int, int)}). Work that arrives while the lead is busy is
+ * never lost: it is re-read fresh on every tick until the lead is injectable or its own reminder
+ * cap ({@link #maxReminders}) is reached — each source spends from its own budget, so one source
+ * exhausting its cap does not stop nudges about the others (post-CB-590 regression fix; see
+ * {@link #decide}) — whichever the durable inbox / pending set doesn't already answer via
+ * {@code STOP}.
+ */
+public final class ReplyPushLoop {
+
+    private static final Logger log = LoggerFactory.getLogger(ReplyPushLoop.class);
+    static final String NUDGE_FORMAT = "Worker %s returned a reply — run fleet_poll(target=%s) to collect it";
+    /** Coalesced form, several uncollected replies for the same lead. */
+    static final String REPLIES_NUDGE_FORMAT =
+            "%d workers returned replies — run fleet_poll(target=...) for each to collect them: %s";
+    /** Singular form, one uncollected ticket. */
+    static final String TICKET_NUDGE_FORMAT =
+            "Ticket %s finished%s — run fleet_poll(ticket=%s) to collect it";
+    /** Coalesced form, several uncollected tickets for the same lead. */
+    static final String TICKETS_NUDGE_FORMAT =
+            "%d tickets finished%s — run fleet_poll(ticket=...) for each to collect them: %s";
+    /** Singular form, one worker paused mid-turn in fleet_ask (CB-582) — names the answer call directly. */
+    static final String QUESTION_NUDGE_FORMAT =
+            "Worker %s asked a question (ticket %s) — answer it with fleet_send(turnId=\"%s\", "
+                    + "content=...) to resume its turn:\n%s";
+    /** Coalesced form, several open questions for the same lead. */
+    static final String QUESTIONS_NUDGE_FORMAT =
+            "%d workers are paused on a question — run fleet_poll(ticket=...) for each, then answer "
+                    + "with fleet_send(turnId=..., content=...): %s";
+
+    private final PrimaryRegistry primaryRegistry;
+    private final AgentControl agents;
+    private final ReplyInbox inbox;
+    private final ScheduledExecutorService scheduler;
+    private final int maxReminders;
+    private final long backoffMs;
+    private final Metrics metrics; // CB-512: nullable — no registry in unit tests
+
+    /**
+     * Worker targets with a reply queued, keyed by target. Each entry carries its own nudge
+     * count (CB-598) rather than sharing one counter per lead per source: a target's count only
+     * ever reflects nudges that actually named that target, so a target that joins while the
+     * schedule is already deep into another target's reminders still reads as fresh.
+     */
+    private final ConcurrentHashMap<String, ReplyEntry> pendingReplies = new ConcurrentHashMap<>();
+    /** Tickets that have gone terminal but not yet been polled, keyed by ticket. */
+    private final ConcurrentHashMap<String, PendingTicket> pendingTickets = new ConcurrentHashMap<>();
+    /**
+     * Open {@code fleet_ask} questions not yet answered or lapsed, keyed by {@code turnId}
+     * (CB-582). A question's own nudge count is tracked the same per-item way as
+     * {@link #pendingTickets} (CB-598): a fresh question keeps its source eligible regardless of
+     * how depleted an older, still-open question's count is.
+     */
+    private final ConcurrentHashMap<String, PendingQuestion> pendingQuestions = new ConcurrentHashMap<>();
+    /** CB-590: leads with an active combined reminder schedule (replies and/or tickets and/or questions). */
+    private final ConcurrentHashMap<String, Boolean> activeLeads = new ConcurrentHashMap<>();
+
+    public ReplyPushLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
+                         ScheduledExecutorService scheduler,
+                         int maxReminders, long backoffMs) {
+        this(primaryRegistry, agents, inbox, scheduler, maxReminders, backoffMs, null);
+    }
+
+    /** As above, with a metric registry (CB-512) so push outcomes are counted. */
+    public ReplyPushLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
+                         ScheduledExecutorService scheduler,
+                         int maxReminders, long backoffMs, Metrics metrics) {
+        this.primaryRegistry = primaryRegistry;
+        this.agents = agents;
+        this.inbox = inbox;
+        this.scheduler = scheduler;
+        this.maxReminders = maxReminders;
+        this.backoffMs = backoffMs;
+        this.metrics = metrics;
+    }
+
+    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
+    private void countNudge(String outcome) {
+        if (metrics != null) {
+            metrics.inc(FleetMetrics.PUSH_NUDGES, "outcome", outcome);
+        }
+    }
+
+    // --- pending-work lookups (package-private for unit-testing) -------------------------------
+
+    /** The action the loop should take for a lead at the given reminder count. */
+    enum Action { INJECT, WAIT_BUSY, STOP }
+
+    /**
+     * Reply targets still pending for {@code lead} — registered via {@link #onReplyQueued} and
+     * whose inbox still holds an unacked message. A target whose inbox has since drained (acked,
+     * or collected via a live {@code fleet_send} rendezvous instead) is dropped from
+     * {@link #pendingReplies} here rather than lingering forever; there is no explicit "reply
+     * collected" callback the way {@link #ticketCollected} exists for tickets, so the inbox itself
+     * is the only signal.
+     */
+    private Set<String> pendingReplyTargetsFor(String lead) {
+        Set<String> result = new HashSet<>();
+        for (var entry : pendingReplies.entrySet()) {
+            String target = entry.getKey();
+            ReplyEntry owning = entry.getValue();
+            if (!lead.equals(owning.lead())) continue;
+            if (inbox.peek(target).isEmpty()) {
+                pendingReplies.remove(target, owning);
+                continue;
+            }
+            result.add(target);
+        }
+        return result;
+    }
+
+    /** A pending reply target: which lead to nudge, and how many nudges have named it so far. */
+    private record ReplyEntry(String lead, int nudgeCount) {
+    }
+
+    /**
+     * A ticket awaiting collection: which lead to nudge, whether it ended in failure, and how
+     * many nudges have named it so far (CB-598 — tracked per ticket, not per lead per source).
+     */
+    private record PendingTicket(String ticket, String lead, boolean failed, int nudgeCount) {
+    }
+
+    /** Tickets still pending for {@code lead}, snapshotted fresh for one tick. */
+    private List<PendingTicket> pendingTicketsFor(String lead) {
+        return pendingTickets.values().stream().filter(t -> lead.equals(t.lead())).toList();
+    }
+
+    /** Ticket ids still pending for {@code lead} — a plain snapshot for race comparison. */
+    private Set<String> pendingTicketIdsFor(String lead) {
+        return pendingTicketsFor(lead).stream().map(PendingTicket::ticket)
+                .collect(Collectors.toUnmodifiableSet());
+    }
+
+    /**
+     * An open question awaiting the lead's answer: which ticket it belongs to, which worker asked,
+     * which lead to nudge, the question text, and how many nudges have named it so far (CB-598 —
+     * tracked per question, not per lead per source).
+     */
+    private record PendingQuestion(String turnId, String ticket, String target, String lead,
+                                   String question, int nudgeCount) {
+    }
+
+    /** Questions still open for {@code lead}, snapshotted fresh for one tick. */
+    private List<PendingQuestion> pendingQuestionsFor(String lead) {
+        return pendingQuestions.values().stream().filter(q -> lead.equals(q.lead())).toList();
+    }
+
+    /** Question turnIds still open for {@code lead} — a plain snapshot for race comparison. */
+    private Set<String> pendingQuestionTurnIdsFor(String lead) {
+        return pendingQuestionsFor(lead).stream().map(PendingQuestion::turnId)
+                .collect(Collectors.toUnmodifiableSet());
+    }
+
+    /**
+     * The reply-source reminder count {@link #decide} should see for {@code lead} on this tick:
+     * the <em>minimum</em> nudge count among the reply targets currently pending for it (CB-598).
+     *
+     * <p>Before this, the count passed to {@code decide} was a single counter carried forward
+     * across scheduled ticks ({@code scheduleNext(lead, count + 1, ...)}), incremented whenever
+     * the source had <em>any</em> pending work — not tied to which target that work was. A target
+     * that joined while an older target's count was already near the cap inherited that count on
+     * its very next tick, even though no nudge had ever named it. Taking the minimum over what is
+     * actually pending now means a fresh target (count 0) keeps the source eligible regardless of
+     * how many times an older, still-undrained target has already been nudged; that older target
+     * keeps riding along in the combined nudge text without spending any more of its own budget
+     * (see {@link #bumpNudgeCounts}). Returns 0 when nothing is pending — {@link #decide} never
+     * consults the count in that case, since {@code hasReplyWork} is false.
+     */
+    private int minReplyNudgeCountFor(String lead) {
+        int min = Integer.MAX_VALUE;
+        for (String target : pendingReplyTargetsFor(lead)) {
+            ReplyEntry entry = pendingReplies.get(target);
+            if (entry != null) {
+                min = Math.min(min, entry.nudgeCount());
+            }
+        }
+        return min == Integer.MAX_VALUE ? 0 : min;
+    }
+
+    /** As {@link #minReplyNudgeCountFor}, for the ticket source. */
+    private int minTicketNudgeCountFor(String lead) {
+        int min = Integer.MAX_VALUE;
+        for (PendingTicket ticket : pendingTicketsFor(lead)) {
+            min = Math.min(min, ticket.nudgeCount());
+        }
+        return min == Integer.MAX_VALUE ? 0 : min;
+    }
+
+    /** As {@link #minReplyNudgeCountFor}, for the question source (CB-582). */
+    private int minQuestionNudgeCountFor(String lead) {
+        int min = Integer.MAX_VALUE;
+        for (PendingQuestion q : pendingQuestionsFor(lead)) {
+            min = Math.min(min, q.nudgeCount());
+        }
+        return min == Integer.MAX_VALUE ? 0 : min;
+    }
+
+    /**
+     * Pure decision function: examine everything pending for {@code lead} — reply targets and
+     * tickets alike — and return what the loop should do.
+     *
+     * <p><strong>CB-590-fix: one schedule, two budgets.</strong> The single per-lead schedule
+     * (CB-590) still ticks once for both sources, but each source is capped independently —
+     * {@code replyReminderCount} against a reply target still pending, {@code ticketReminderCount}
+     * against a ticket still pending. A busy reply stream that exhausts its own cap must not stop
+     * the loop from nudging about a ticket that still has budget left, and vice versa: either
+     * source being eligible (has pending work AND is under its own cap) is enough for
+     * {@link Action#INJECT}. Only when neither source has eligible work does the loop
+     * {@link Action#STOP}.
+     *
+     * <p><strong>CB-598: the counts are per-item, not per-tick.</strong> {@link #tick} no longer
+     * carries these counts forward across scheduled calls — it recomputes them fresh every tick via
+     * {@link #minReplyNudgeCountFor} / {@link #minTicketNudgeCountFor}, so this function itself did
+     * not need to change; only what its caller feeds it did.
+     *
+     * @param lead                the lead terminal to nudge
+     * @param replyReminderCount  the lowest nudge count among reply targets pending for this lead
+     * @param ticketReminderCount the lowest nudge count among tickets pending for this lead
+     * @return the action the caller should take
+     */
+    Action decide(String lead, int replyReminderCount, int ticketReminderCount) {
+        return decide(lead, replyReminderCount, ticketReminderCount, minQuestionNudgeCountFor(lead));
+    }
+
+    /**
+     * As {@link #decide(String, int, int)}, with the question source (CB-582) folded in on the
+     * same footing as replies and tickets: its own eligibility (has open questions AND under its
+     * own {@link #maxReminders} budget) is enough on its own to {@link Action#INJECT}, exactly like
+     * the other two.
+     *
+     * @param questionReminderCount the lowest nudge count among questions open for this lead
+     */
+    Action decide(String lead, int replyReminderCount, int ticketReminderCount, int questionReminderCount) {
+        boolean hasReplyWork = !pendingReplyTargetsFor(lead).isEmpty();
+        boolean hasTicketWork = !pendingTicketIdsFor(lead).isEmpty();
+        boolean hasQuestionWork = !pendingQuestionTurnIdsFor(lead).isEmpty();
+        if (!hasReplyWork && !hasTicketWork && !hasQuestionWork) {
+            log.debug("push: nothing pending for lead {}, stopping reminder", lead);
+            return Action.STOP;
+        }
+        boolean replyEligible = hasReplyWork && replyReminderCount < maxReminders;
+        boolean ticketEligible = hasTicketWork && ticketReminderCount < maxReminders;
+        boolean questionEligible = hasQuestionWork && questionReminderCount < maxReminders;
+        if (!replyEligible && !ticketEligible && !questionEligible) {
+            log.debug("push: reminder cap ({}) reached for lead {} on every source with pending work, stopping",
+                    maxReminders, lead);
+            countNudge("exhausted");
+            return Action.STOP;
+        }
+        AgentStatus status;
+        try {
+            status = agents.status(lead);
+        } catch (RuntimeException e) {
+            log.debug("push: status check failed for lead {}, will retry", lead, e);
+            return Action.WAIT_BUSY;
+        }
+        if (status.injectable()) {
+            return Action.INJECT;
+        }
+        log.debug("push: lead {} is {} (not injectable), waiting", lead, status);
+        return Action.WAIT_BUSY;
+    }
+
+    // --- public entrypoints ----------------------------------------------------------------------
+
+    /**
+     * Called when a reply is queued for {@code target}. Resolves the lead delegating to
+     * {@code target} (CB-532) and coalesces onto that lead's single reminder schedule — starting
+     * one if none is active, joining an already-active one otherwise. A no-op if no lead is known
+     * to be waiting on {@code target}: there is nobody to nudge yet, and the durable inbox is the
+     * backstop until a lead is recorded.
+     */
+    public void onReplyQueued(String target) {
+        var lead = primaryRegistry.nudgeTargetFor(target);
+        if (lead.isEmpty()) {
+            log.debug("push: no lead is known to be waiting on {}, skipping reminder", target);
+            return;
+        }
+        pendingReplies.compute(target, (t, existing) ->
+                new ReplyEntry(lead.get(), existing == null ? 0 : existing.nudgeCount()));
+        startOrCoalesce(lead.get());
+    }
+
+    /**
+     * Called when an async delegation ticket ({@code fleet_send(wait:false)}, CB-107) reaches a
+     * terminal phase — DONE or a failure. Unlike {@link #onReplyQueued}, which nudges about the
+     * durable-inbox no-waiter path, this covers the path {@code MessageService.reply} takes when a
+     * fire-and-poll send's own rendezvous waiter resolves the reply directly: that path returns
+     * before {@link #onReplyQueued} is ever called, so without this entry point a ticket finishing
+     * that way never nudged anyone (CB-588 / gitea #72).
+     *
+     * <p>Resolves the delegating lead the same way {@link #onReplyQueued} does and coalesces onto
+     * the same per-lead schedule (CB-590) — several tickets, or a ticket and a reply, finishing
+     * for the same lead while its schedule is already active all ride the existing schedule's next
+     * tick rather than firing a nudge each.
+     *
+     * @param ticket the ticket to nudge about
+     * @param target the worker session the ticket was sent to — resolves which lead delegated it
+     * @param failed whether the ticket ended in a failure phase rather than {@code DONE}
+     */
+    public void onTicketTerminal(String ticket, String target, boolean failed) {
+        var lead = primaryRegistry.nudgeTargetFor(target);
+        if (lead.isEmpty()) {
+            log.debug("push: no lead is known to be waiting on ticket {} (target {}), skipping nudge",
+                    ticket, target);
+            return;
+        }
+        pendingTickets.compute(ticket, (id, existing) ->
+                new PendingTicket(ticket, lead.get(), failed, existing == null ? 0 : existing.nudgeCount()));
+        startOrCoalesce(lead.get());
+    }
+
+    /**
+     * Called when a ticket's terminal state has been collected via {@code fleet_poll}. Removes it
+     * from the pending set so a scheduled tick — and any nudge it sends — never names a ticket the
+     * lead already has. A ticket that was never pending (unknown ticket, or one nudged with no push
+     * loop configured) is a no-op.
+     */
+    public void ticketCollected(String ticket) {
+        pendingTickets.remove(ticket);
+    }
+
+    /**
+     * Called when an async ticket's worker pauses mid-turn in {@code fleet_ask} (CB-582): the
+     * question is now visible via {@code fleet_poll} (Phase.ASKING), but the reverse-rendezvous
+     * window it opened with (~55s default, see {@code FleetMcp}/{@code FleetApp}) is far shorter
+     * than a lead's normal minutes-long poll cadence — exactly the gap this closes. Resolves the
+     * delegating lead the same way {@link #onTicketTerminal} does and coalesces onto the same
+     * per-lead schedule (CB-590).
+     *
+     * @param ticket   the async ticket the question belongs to (for {@code fleet_poll})
+     * @param target   the worker session that asked
+     * @param turnId   correlation id the lead answers with ({@code fleet_send turnId=...})
+     * @param question the question text
+     */
+    public void onQuestionOpened(String ticket, String target, String turnId, String question) {
+        var lead = primaryRegistry.nudgeTargetFor(target);
+        if (lead.isEmpty()) {
+            log.debug("push: no lead is known to be waiting on {}'s question (turnId {}), skipping nudge",
+                    target, turnId);
+            return;
+        }
+        pendingQuestions.put(turnId, new PendingQuestion(turnId, ticket, target, lead.get(), question, 0));
+        startOrCoalesce(lead.get());
+    }
+
+    /**
+     * Called when a worker's {@code fleet_ask} resolves — answered or lapsed unanswered — so a
+     * scheduled tick never nudges about a question the lead already handled. A {@code turnId} that
+     * was never pending (never nudged, or already closed) is a no-op.
+     */
+    public void questionClosed(String turnId) {
+        pendingQuestions.remove(turnId);
+    }
+
+    // --- the schedule ----------------------------------------------------------------------------
+
+    /** Start a reminder schedule for {@code lead}, or join the one already running. */
+    private void startOrCoalesce(String lead) {
+        if (activeLeads.putIfAbsent(lead, Boolean.TRUE) != null) {
+            log.debug("push: reminder loop already active for lead {}, work coalesced in", lead);
+            return;
+        }
+        log.debug("push: starting reminder loop for lead {}", lead);
+        scheduleNext(lead);
+    }
+
+    /**
+     * Execute one loop tick — called on the scheduler thread (or directly by a test; package-private
+     * for the same reason as {@link #stopOrRestart}).
+     *
+     * <p><strong>CB-598.</strong> The reminder counts fed into {@link #decide} are recomputed fresh
+     * every tick from what is actually pending right now ({@link #minReplyNudgeCountFor} /
+     * {@link #minTicketNudgeCountFor}), rather than carried forward as running counters across
+     * scheduled calls. A counter carried forward has no memory of which item it was counting for:
+     * a target or ticket that joined mid-backoff — after the previous tick fired but before this one
+     * did — is already sitting in {@code repliesBefore} / {@code ticketsBefore} below by the time this
+     * tick takes its snapshot, indistinguishable at that point from backlog the cap is meant to
+     * silence. Recomputing from the per-item counts fixes that: a newly-joined item's own count is
+     * still 0, so it keeps its source eligible regardless of how depleted an older, still-undrained
+     * item's count is.
+     */
+    void tick(String lead) {
+        Set<String> repliesBefore = pendingReplyTargetsFor(lead);
+        Set<String> ticketsBefore = pendingTicketIdsFor(lead);
+        Set<String> questionsBefore = pendingQuestionTurnIdsFor(lead);
+        int replyReminderCount = minReplyNudgeCountFor(lead);
+        int ticketReminderCount = minTicketNudgeCountFor(lead);
+        int questionReminderCount = minQuestionNudgeCountFor(lead);
+        var action = decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount);
+        switch (action) {
+            case INJECT -> {
+                injectNudge(lead, replyReminderCount, ticketReminderCount, questionReminderCount);
+                scheduleNext(lead);
+            }
+            // Re-check after the configured backoff; the lead may become injectable soon.
+            case WAIT_BUSY -> scheduleNext(lead);
+            case STOP -> stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore);
+        }
+    }
+
+    /**
+     * Release {@code lead}'s active-schedule slot, then restart it only if work landed that
+     * {@code repliesBefore} / {@code ticketsBefore} — the snapshots taken just before this tick's
+     * decision — did not already account for. {@link #onReplyQueued} / {@link #onTicketTerminal}
+     * read {@link #activeLeads} to decide whether to coalesce onto an existing schedule or start
+     * one, so work that lands between {@link #decide} returning {@link Action#STOP} and this
+     * removal running sees the (soon-to-be-stale) slot as occupied, coalesces onto a schedule that
+     * is about to die, and gets no nudge scheduled at all — a lost nudge, exactly what CB-588 (and
+     * now CB-590) exist to remove (originally found in review, gitea PR #73, for the ticket-only
+     * loop; carried forward here for the unified one).
+     *
+     * <p>Restarting on ANY non-empty pending set would be wrong: when STOP is reached because the
+     * reminder cap was hit rather than the backlog draining, the same never-collected work is
+     * expected to still be sitting there — that is the cap doing its job — and restarting would
+     * nudge about it forever, defeating the bound. Diffing the current pending sets against the
+     * "before" snapshots tells the two cases apart: an item present before this tick's decision is
+     * stale backlog, not a race; only an item absent from the "before" snapshot can only have
+     * arrived during the decision-to-release window, which is exactly the race this method closes.
+     *
+     * <p>Package-private so a test can drive the interleaving directly rather than trying to force a
+     * genuine thread race.
+     *
+     * <p>Terminates rather than spinning: this method restarts the schedule at most once per call,
+     * and a fresh {@link #onReplyQueued} / {@link #onTicketTerminal} racing the recheck below still
+     * terminates in one of two ways — either it observes the slot already vacated (by the
+     * {@code activeLeads.remove} above, which happens-before this recheck in program order) and
+     * claims it itself, or it lands first and this recheck then observes its work in
+     * {@link #pendingReplies} / {@link #pendingTickets} and reclaims the slot instead. Exactly one
+     * side always wins; neither can miss the other, so this never loops on its own account.
+     */
+    void stopOrRestart(String lead, Set<String> repliesBefore, Set<String> ticketsBefore) {
+        stopOrRestart(lead, repliesBefore, ticketsBefore, pendingQuestionTurnIdsFor(lead));
+    }
+
+    /**
+     * As {@link #stopOrRestart(String, Set, Set)}, with the question source's (CB-582) own "before"
+     * snapshot folded into the same race check: a question that raced in during the
+     * decision-to-release window reclaims the schedule slot exactly like a raced-in reply or ticket.
+     */
+    void stopOrRestart(String lead, Set<String> repliesBefore, Set<String> ticketsBefore,
+                       Set<String> questionsBefore) {
+        activeLeads.remove(lead);
+        boolean racedIn = pendingReplyTargetsFor(lead).stream().anyMatch(t -> !repliesBefore.contains(t))
+                || pendingTicketIdsFor(lead).stream().anyMatch(t -> !ticketsBefore.contains(t))
+                || pendingQuestionTurnIdsFor(lead).stream().anyMatch(t -> !questionsBefore.contains(t));
+        if (racedIn && activeLeads.putIfAbsent(lead, Boolean.TRUE) == null) {
+            log.debug("push: new work for lead {} raced the reminder loop's stop — restarting", lead);
+            scheduleNext(lead);
+            return;
+        }
+        log.debug("push: reminder loop ended for lead {}", lead);
+    }
+
+    /** Send one combined nudge covering everything currently pending for {@code lead}. */
+    private void injectNudge(String lead, int replyReminderCount, int ticketReminderCount,
+                             int questionReminderCount) {
+        // Re-read rather than threading it down from decide(): a reply can drain, a ticket be
+        // collected, or a question be answered (or another arrive), between the decision and the
+        // injection.
+        Set<String> replyTargets = pendingReplyTargetsFor(lead);
+        List<PendingTicket> tickets = pendingTicketsFor(lead);
+        List<PendingQuestion> questions = pendingQuestionsFor(lead);
+        if (replyTargets.isEmpty() && tickets.isEmpty() && questions.isEmpty()) {
+            log.debug("push: pending work for lead {} drained before the nudge could be sent", lead);
+            return;
+        }
+        String nudge = formatNudge(replyTargets, tickets, questions);
+        try {
+            agents.send(lead, nudge);
+            log.debug("push: nudge sent to lead {} (reply {}/{}, ticket {}/{}, question {}/{}; "
+                            + "{} reply target(s), {} ticket(s), {} question(s))",
+                    lead, replyReminderCount + 1, maxReminders, ticketReminderCount + 1, maxReminders,
+                    questionReminderCount + 1, maxReminders,
+                    replyTargets.size(), tickets.size(), questions.size());
+            countNudge("delivered");
+        } catch (RuntimeException e) {
+            log.warn("push: failed to nudge lead {} (reply {}/{}, ticket {}/{}, question {}/{}): {}",
+                    lead, replyReminderCount + 1, maxReminders, ticketReminderCount + 1, maxReminders,
+                    questionReminderCount + 1, maxReminders, e.toString());
+        }
+        // Bump every item actually named in this nudge, not just whatever the shared source-level
+        // eligibility used to gate (CB-598) — each item's own count is what the next tick's
+        // minReplyNudgeCountFor / minTicketNudgeCountFor / minQuestionNudgeCountFor will read. An
+        // item already at or over the cap keeps riding along in the text (still pending, still
+        // named) but its extra bumps here are inert: decide() already treats it as ineligible once
+        // its count reaches maxReminders.
+        bumpNudgeCounts(replyTargets, tickets, questions);
+    }
+
+    /** Record that every one of these items was just named in a sent (or attempted) nudge. */
+    private void bumpNudgeCounts(Set<String> replyTargets, List<PendingTicket> tickets,
+                                 List<PendingQuestion> questions) {
+        for (String target : replyTargets) {
+            pendingReplies.computeIfPresent(target, (t, e) -> new ReplyEntry(e.lead(), e.nudgeCount() + 1));
+        }
+        for (PendingTicket ticket : tickets) {
+            pendingTickets.computeIfPresent(ticket.ticket(),
+                    (id, e) -> new PendingTicket(e.ticket(), e.lead(), e.failed(), e.nudgeCount() + 1));
+        }
+        for (PendingQuestion question : questions) {
+            pendingQuestions.computeIfPresent(question.turnId(), (id, e) ->
+                    new PendingQuestion(e.turnId(), e.ticket(), e.target(), e.lead(), e.question(),
+                            e.nudgeCount() + 1));
+        }
+    }
+
+    /** Schedule the next tick on the scheduler thread pool. */
+    private void scheduleNext(String lead) {
+        scheduler.schedule(() -> tick(lead),
+                backoffMs, TimeUnit.MILLISECONDS);
+    }
+
+    // --- nudge formatting ------------------------------------------------------------------------
+
+    /** Render everything pending for one lead as a single nudge line. */
+    private static String formatNudge(Set<String> replyTargets, List<PendingTicket> tickets,
+                                      List<PendingQuestion> questions) {
+        List<String> parts = new ArrayList<>();
+        if (!replyTargets.isEmpty()) {
+            parts.add(formatRepliesNudge(replyTargets));
+        }
+        if (!tickets.isEmpty()) {
+            parts.add(formatTicketsNudge(tickets));
+        }
+        if (!questions.isEmpty()) {
+            parts.add(formatQuestionsNudge(questions));
+        }
+        return String.join(" | ", parts);
+    }
+
+    /** Render one or several pending reply targets. */
+    private static String formatRepliesNudge(Set<String> targets) {
+        if (targets.size() == 1) {
+            String target = targets.iterator().next();
+            return NUDGE_FORMAT.formatted(target, target);
+        }
+        String ids = String.join(", ", targets);
+        return REPLIES_NUDGE_FORMAT.formatted(targets.size(), ids);
+    }
+
+    /** Render one or several pending tickets. */
+    private static String formatTicketsNudge(List<PendingTicket> pending) {
+        if (pending.size() == 1) {
+            PendingTicket t = pending.get(0);
+            return TICKET_NUDGE_FORMAT.formatted(t.ticket(), t.failed() ? " (FAILED)" : "", t.ticket());
+        }
+        long failedCount = pending.stream().filter(PendingTicket::failed).count();
+        String ids = pending.stream()
+                .map(t -> t.failed() ? t.ticket() + " (FAILED)" : t.ticket())
+                .collect(Collectors.joining(", "));
+        String failedNote = failedCount > 0 ? " (%d failed)".formatted(failedCount) : "";
+        return TICKETS_NUDGE_FORMAT.formatted(pending.size(), failedNote, ids);
+    }
+
+    /** Render one or several open questions (CB-582). */
+    private static String formatQuestionsNudge(List<PendingQuestion> pending) {
+        if (pending.size() == 1) {
+            PendingQuestion q = pending.get(0);
+            return QUESTION_NUDGE_FORMAT.formatted(q.target(), q.ticket(), q.turnId(), q.question());
+        }
+        String ids = pending.stream()
+                .map(q -> q.ticket() + " (turnId=" + q.turnId() + ")")
+                .collect(Collectors.joining(", "));
+        return QUESTIONS_NUDGE_FORMAT.formatted(pending.size(), ids);
+    }
+
+    // --- lifecycle -----------------------------------------------------------------------------
+
+    /**
+     * Whether any reminder loop is currently active for some lead (CB-551). The idle-lead heartbeat
+     * uses this to stand aside: while the push loop is actively nudging a lead, a concurrent
+     * heartbeat injection would start a second competing turn in the same pane — racing loops
+     * multiply turns and context burn. "Active" means a schedule exists in {@link #activeLeads},
+     * which now covers reply-queued (CB-307), ticket-terminal (CB-588), and question-open (CB-582)
+     * work (CB-590) — bounded by what has been triggered, not by any persistent state.
+     */
+    public boolean isActive() {
+        return !activeLeads.isEmpty();
+    }
+
+    /** Shut down the scheduler. Outstanding reminders are cancelled. */
+    public void stop() {
+        scheduler.shutdownNow();
+        activeLeads.clear();
+        pendingReplies.clear();
+        pendingTickets.clear();
+        pendingQuestions.clear();
+    }
+
+    /** @see #stop() */
+    public void close() {
+        stop();
+    }
+}

bridged/src/main/java/dev/ltms/fleet/msg/TurnToken.java

@@ -0,0 +1,20 @@
+package dev.ltms.fleet.msg;
+
+import java.util.concurrent.CompletableFuture;
+
+/**
+ * Identity for one accepted send. The session turn is deliberately absent: CompletionResolver's
+ * delivery callback runs before SessionManager.onDelivered, so binding it needs a later ordering design.
+ */
+public final class TurnToken {
+    private final String target;
+    private final CompletableFuture<Rendezvous.Resolution> waiter;
+
+    public TurnToken(String target, CompletableFuture<Rendezvous.Resolution> waiter) {
+        this.target = target;
+        this.waiter = waiter;
+    }
+
+    public String target() { return target; }
+    public CompletableFuture<Rendezvous.Resolution> waiter() { return waiter; }
+}

bridged/src/main/java/dev/ltms/fleet/peer/Capability.java

@@ -0,0 +1,58 @@
+package dev.ltms.fleet.peer;
+
+/**
+ * Declared capabilities of a {@link PeerLauncher}. The protocol is the union across all
+ * configured launchers; a verb invoked against a peer that lacks the capability returns a clean
+ * "unsupported for this peer" rather than a crash. Capabilities keep the protocol honest as peers
+ * diversify and prevent the core from assuming "every peer is a Claude in a worktree."
+ */
+public enum Capability {
+
+    /**
+     * The peer supports {@code fleet_ask} rendezvous — pausing its delegated turn to ask
+     * the primary a question, then resuming once answered. All Claude Code peers support this.
+     */
+    MID_TURN_ASK,
+
+    /**
+     * The peer can open its own PR at the end of an implementation turn (CB-302). Opt-in per
+     * profile: granted only when the profile carries a git-forge token ({@code gitTokenEnv}).
+     */
+    SELF_PR,
+
+    /**
+     * The peer can run inside a provisioned isolated git worktree. All CLI-based peers support
+     * this since their cwd is set at spawn time.
+     */
+    WORKTREE,
+
+    /**
+     * The peer can discard its current conversation context without starting a delegated bridge
+     * turn. The command or API used to do that is adapter-specific.
+     */
+    CONTEXT_RESET,
+
+    /**
+     * The spawner can reconcile orphaned peers on boot — workers that outlived a prior daemon
+     * process and whose pane ids died with it (CB-117). Claude Code over herdr supports this
+     * via name-based matching against the herdr agent list.
+     */
+    ORPHAN_REAP,
+
+    /**
+     * The peer surfaces the bridge's logical name ({@link SpawnRequest#sessionName()}) in its own
+     * UI at spawn — e.g. Claude Code's {@code -n} display name, which shows in the prompt box, the
+     * {@code /resume} picker, and the terminal title. This is what lets an operator tell the
+     * bridge's worker apart from a user's own session in the same terminal after a restart.
+     */
+    SESSION_NAME,
+
+    /**
+     * The peer can be relaunched onto a prior conversation via that conversation's own session id
+     * ({@link SpawnRequest#resumeSessionId()}) — e.g. Claude Code's {@code -r}, which adopts the id
+     * as the agent's own identity rather than starting a new conversation. A launcher that declares
+     * this mints/resolves that id at spawn and exposes it on the returned
+     * {@link PeerHandle#agentSessionId()}, so a later resume addresses the same conversation.
+     */
+    SESSION_RESUME
+}

bridged/src/main/java/dev/ltms/fleet/peer/CharterReceipt.java

@@ -0,0 +1,84 @@
+package dev.ltms.fleet.peer;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.HexFormat;
+
+/**
+ * CB-571: a fingerprint of the exact charter bytes handed to a spawned member.
+ *
+ * <p>Lets an operator prove <em>which</em> charter a member actually got, without ever logging the
+ * charter text. The digest covers the exact composed UTF-8 string {@code HerdrPeerLauncher} passes
+ * to its adapter as {@code LaunchSpec.charter()}, so every adapter that receives the same string —
+ * Claude inlining it, OpenCode writing it to a file — produces the same digest for the same config.
+ * Two spawns of the same role from the same config agree; editing the charter changes the digest.
+ *
+ * <p>Deliberately places no charter prose. A charter is operator-authored text that may name
+ * internal projects or unreleased plans, and logs get tailed, shipped, and pasted into tickets.
+ * The {@code charterSource} key is what the operator wants to confirm, and it carries no content.
+ */
+public record CharterReceipt(
+        MemberRole role,
+        String profile,
+        String charterSource,
+        String charterSha256,
+        int charterBytes) {
+
+    /** Source reported when the role has no configured charter, so the field is never omitted. */
+    public static final String NO_SOURCE = "none";
+
+    /**
+     * The config key that supplied the role's charter text, e.g. {@code fleet.charters.architect}.
+     */
+    public static String sourceKey(MemberRole role) {
+        return "fleet.charters." + (role == null ? "?" : role.wireName());
+    }
+
+    /**
+     * Fingerprint the composed charter for {@code role} on {@code profile}. {@code configured} is
+     * the role's charter text as read from config ({@code null} when none is configured);
+     * {@code composed} is the exact string the launcher will pass to the adapter — the reply
+     * charter may be appended to {@code configured}, or stand alone when no role charter exists.
+     *
+     * <p>No composed charter at all is reported as an explicit absence — a {@code null} digest and
+     * a zero byte count — never a digest of the empty string, which would hide the fact that no
+     * text was supplied. {@code configured} being {@code null} while {@code composed} is the reply
+     * charter alone is a normal case, and the source says so.
+     */
+    public static CharterReceipt compose(MemberRole role, String profile,
+                                         String configured, String composed) {
+        String source = (configured == null || configured.isBlank())
+                ? NO_SOURCE : sourceKey(role);
+        if (composed == null) {
+            return new CharterReceipt(role, profile, source, null, 0);
+        }
+        byte[] bytes = composed.getBytes(StandardCharsets.UTF_8);
+        return new CharterReceipt(role, profile, source, digestOf(composed), bytes.length);
+    }
+
+    /** Whether the composed charter was absent (no text was given to the member). */
+    public boolean absent() {
+        return charterSha256 == null;
+    }
+
+    /**
+     * The stable SHA-256 hex digest of {@code text}, or {@code null} for null/blank text. Used both
+     * for the receipt's fingerprint and to redact a charter argument in a spawn log.
+     */
+    public static String digestOf(String text) {
+        if (text == null || text.isBlank()) {
+            return null;
+        }
+        return sha256Hex(text.getBytes(StandardCharsets.UTF_8));
+    }
+
+    private static String sha256Hex(byte[] bytes) {
+        try {
+            MessageDigest md = MessageDigest.getInstance("SHA-256");
+            return HexFormat.of().formatHex(md.digest(bytes));
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException("SHA-256 is unavailable", e);
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/peer/MemberRole.java

@@ -0,0 +1,122 @@
+package dev.ltms.fleet.peer;
+
+import java.util.Locale;
+
+/**
+ * What a member is <em>for</em> — the contract it runs under.
+ *
+ * <p>A member is anything a lead spawns. Every member carries two independent attributes:
+ *
+ * <ul>
+ *   <li><b>role</b> (this enum) — <em>which contract</em>: the launch charter it is given, the role
+ *       file it reads, the playbook skill it loads, and its authorization row.</li>
+ *   <li><b>profile</b> (a {@code profiles:} key) — <em>which backend</em>: model, CLI adapter,
+ *       credentials, cost.</li>
+ * </ul>
+ *
+ * <p>These are separate axes on purpose. A {@code REVIEWER} may run on the same profile as the
+ * {@code DEV} whose diff it reviews — same backend, different contract. That case is what proves
+ * role and profile cannot be collapsed into one field.
+ *
+ * <p>A lead is deliberately <em>not</em> a role here. A lead is not spawned: it is a pre-existing,
+ * human-facing session that config recognises. Only spawned peers have a member role.
+ */
+public enum MemberRole {
+
+    /**
+     * Refines a ticket before anyone implements it: scope, acceptance criteria, risks, unit split.
+     *
+     * <p>Reads the repo and writes analysis. Never commits code and never opens a pull request —
+     * an architect that starts implementing has stopped doing the job that makes it useful.
+     *
+     * <p>Architects are the one member kind declared in config, because a lead addresses the same
+     * slots across many tickets and needs a stable name for them.
+     */
+    ARCHITECT,
+
+    /**
+     * Implements one unit of work: provisions a worktree, writes the code, commits, pushes, and
+     * opens its own pull request.
+     *
+     * <p>Never merges. The lead is the gate, and a member that merged its own work would remove the
+     * only independent check in the flow.
+     */
+    DEV,
+
+    /**
+     * Reviews a diff it did not write and reports one structured finding.
+     *
+     * <p>Never commits, never merges, and is never the member that wrote the scope under review.
+     * Briefed from the diff rather than from the implementer's rationale, because that rationale
+     * carries the same blind spot that produced the bug.
+     */
+    REVIEWER;
+
+    /** The lowercase spelling used in config and on the wire ({@code architect}, {@code dev}, …). */
+    public String wireName() {
+        return name().toLowerCase(Locale.ROOT);
+    }
+
+    /**
+     * The {@code fleet:} block that holds this role's pool — {@code architects},
+     * {@code developers}, {@code reviewers}.
+     *
+     * <p>Plural, and not always the wire name: the pool of things a {@code dev} may run on reads
+     * naturally as {@code developers:}. The wire name stays the singular {@code dev}, because that
+     * is what a tab label and a roster row say.
+     */
+    public String configKey() {
+        return switch (this) {
+            case ARCHITECT -> "architects";
+            case DEV -> "developers";
+            case REVIEWER -> "reviewers";
+        };
+    }
+
+    /**
+     * The role owning the {@code fleet:} pool named {@code key}, or {@code null} when the key is not
+     * a role pool ({@code leaders}, {@code tabLabel}, …). Null rather than a throw: callers use this
+     * to sort a fleet block's children, where a non-pool key is normal rather than an error.
+     */
+    public static MemberRole fromConfigKey(String key) {
+        if (key == null) {
+            return null;
+        }
+        String k = key.trim().toLowerCase(Locale.ROOT);
+        for (MemberRole r : values()) {
+            if (r.configKey().equals(k)) {
+                return r;
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Parse a config/wire spelling, case-insensitively.
+     *
+     * @param s the spelling to parse
+     * @return the matching role
+     * @throws IllegalArgumentException when {@code s} is null, blank, or not a known role — the
+     *                                  message lists the valid spellings, because a typo'd role in
+     *                                  config should fail at startup with the fix in the error
+     */
+    public static MemberRole parse(String s) {
+        if (s != null && !s.isBlank()) {
+            String t = s.trim().toLowerCase(Locale.ROOT);
+            for (MemberRole r : values()) {
+                if (r.wireName().equals(t)) {
+                    return r;
+                }
+            }
+        }
+        StringBuilder valid = new StringBuilder();
+        for (MemberRole r : values()) {
+            if (!valid.isEmpty()) {
+                valid.append(", ");
+            }
+            valid.append(r.wireName());
+        }
+        throw new IllegalArgumentException(
+                "unknown member role '" + s + "'; valid roles are: " + valid);
+    }
+}

bridged/src/main/java/dev/ltms/fleet/peer/PeerHandle.java

@@ -0,0 +1,88 @@
+package dev.ltms.fleet.peer;
+
+/**
+ * An opaque handle returned by {@link PeerLauncher#spawn(SpawnRequest)}. The core routes on
+ * {@link #id()} (the registry/routing key) and uses {@link #terminalId()} for session tracking;
+ * launcher-private coordinates beyond these are reachable through the concrete implementation.
+ *
+ * <p>A {@link PeerHandle} is returned <em>after</em> the peer process is live — the launcher
+ * has already completed subscription-guarded env/vfs setup, process start, and placement. The
+ * handle is a ticket the core exchanges for the running peer, not a lazy/delayed reference.
+ */
+public interface PeerHandle {
+
+    /**
+     * The registry/routing key — an opaque, launcher-assigned identifier (CB-519). Multiple
+     * daemon processes may run on one host, so the contract is <em>host-unique</em>, not merely
+     * process-unique: the herdr-backed launcher mints a fresh UUID per spawn, and a non-herdr
+     * launcher is likewise expected to return an identifier that cannot collide across processes
+     * on the same host. This id is the routing key and is deliberately decoupled from any launcher
+     * transport coordinate (e.g. a herdr pane id), which stays launcher-private. Guaranteed to be
+     * non-null and unique among live peers on the host.
+     */
+    String id();
+
+    /**
+     * The transport-level session identifier used for message routing and presence tracking.
+     * For the herdr launcher this is the herdr terminal UUID. A non-herdr launcher may return
+     * its own analogous identifier, or {@code null} if the concept does not apply.
+     */
+    default String terminalId() {
+        return null;
+    }
+
+    /**
+     * The worker profile that spawned this peer, if the launcher resolved one. A launcher that
+     * performs dynamic profile selection (e.g. CB-518 weighted placement) sets this so the
+     * session registry records the actual profile rather than the requested/default one.
+     *
+     * @return the profile name, or {@code null} when the launcher leaves it unspecified
+     */
+    default String profile() {
+        return null;
+    }
+
+    /**
+     * The bridge's logical name for this session, as assigned at spawn
+     * ({@link SpawnRequest#sessionName()}). Stable across restarts and meaningful to an operator,
+     * unlike the transport identifiers above; a launch with no name leaves the peer's display
+     * identity to the launcher to derive.
+     *
+     * @return the bridge-assigned logical session name, or {@code null} if none was assigned
+     */
+    default String sessionName() {
+        return null;
+    }
+
+    /**
+     * The peer's OWN session id — the handle that resumes this conversation later (the id a
+     * later {@link Capability#SESSION_RESUME resume} spawn would pass back). Null when the adapter
+     * cannot determine it — the contract for an adapter that declines
+     * {@link Capability#SESSION_RESUME}; an adapter that declares that capability returns this
+     * non-null for a spawn that requested session identity, because it knows the id before the
+     * peer has written anything.
+     *
+     * <p>Deliberately not a {@code default} (CB-584, the same fix CB-571 made for
+     * {@link #charterReceipt()} one method below): a decorator that forgets to override this
+     * silently answers {@code null} for a question it has no basis to answer, and the gap surfaces
+     * only as a resume that quietly starts a cold session, not a compile error. Every
+     * implementation must answer explicitly.
+     *
+     * @return the peer's own session id, or {@code null} when not determinable
+     */
+    String agentSessionId();
+
+    /**
+     * The charter receipt (CB-571) for this peer's launch — the fingerprint of the exact charter
+     * bytes it was started with. {@code null} when the launcher records none (a non-instrumented
+     * adapter, or a launcher before this field); the session registry stores it so the spawn result
+     * and the roster row can show an operator which charter a member actually got.
+     *
+     * <p>Deliberately not a {@code default}: a decorator that forgets to override this silently
+     * answers {@code null} for a question it has no basis to answer, and the gap surfaces only as
+     * a missing roster field, not a compile error. Every implementation must answer explicitly.
+     *
+     * @return the fingerprint, or {@code null} when the launcher carries none
+     */
+    CharterReceipt charterReceipt();
+}