CB-185: route PaneLocator, StatusRefiner and FleetApp to the right herdr daemon (#188)

memberHerdrSocket splits lead operations from member operations onto two herdr
daemons. Three seams still assumed one shared daemon and broke silently when the
two clients differ (all three collapse to today's behaviour when they are the
same object):

1. ConnectionIdentity's PaneLocator was pinned to the member daemon only, so a
   lead's own MCP connection (which lives on the LEAD daemon) resolved to
   terminal == null, breaking fleet_reply/fleet_ask/fleet_whoami for a lead.
   PaneLocator now searches the lead client first, then the member client.

2. StatusPoller's StatusRefiner was pinned to the member daemon, so refining an
   UNKNOWN status for a lead target read the wrong daemon's pane content and
   never left UNKNOWN, wedging status-gated delivery to that lead forever.
   StatusRefiner gained a refine(target, raw, control) overload and the poller
   now refines through the same AgentControl the raw status was sampled from.

3. FleetApp was constructed with the raw lead-only herdr client, so /healthz
   stayed green while the member daemon was down (every spawn then fails
   invisibly) and GET /sessions silently dropped every member workspace.
   FleetApp now takes both clients: healthz requires both to answer, sessions
   merges workspaces from both.

Each fix has a test proven to fail without it (verified by reverting the
production change and re-running): FleetdConnectionIdentityConstructionTest /
FleetdFleetAppConstructionTest assert the actual Fleetd.java wiring (the same
technique as FleetdHerdrControlConstructionTest); StatusPollerRoutingTest and
the new PaneLocatorTest/FleetAppTwoDaemonTest cases exercise the real
production classes end to end rather than a hand-built object graph.

.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-bridge",
-  "description": "Tooling for orchestrating a fleet of delegated coding agents through the bridged MCP gateway.",
+  "description": "Tooling for orchestrating a fleet of delegated coding agents through the fleetd MCP gateway.",
   "owner": {
     "name": "LTMS"
   },
@@ -8,7 +8,7 @@
     {
       "name": "claude-bridge",
       "source": "./plugin",
-      "description": "Make a project bridge-ready: mount the bridged MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
+      "description": "Make a project bridge-ready: mount the fleetd MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
       "version": "0.1.0",
       "author": {
         "name": "LTMS"

.claude/agents/architect.md

@@ -3,7 +3,7 @@ name: architect
 description: Refine work into clear, independent units before implementation.
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You are an architect in this fleet. You refine work before anyone builds it: scope,
 acceptance criteria, risks, and a unit split. You read the repo and write analysis.

.claude/agents/dev.md

@@ -3,7 +3,7 @@ name: dev
 description: Implement one assigned unit, test it, and open a pull request.
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You implement the one unit you were given and nothing else. Work in your assigned
 git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm

.claude/agents/reviewer.md

@@ -3,7 +3,7 @@ name: reviewer
 description: Review one assigned scope and report the most important real issue.
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You review the diff you were given. Report bugs, risks, and missing tests. You do
 not change code.

.claude/skills/fleets-status/SKILL.md

@@ -0,0 +1,274 @@
+---
+name: fleets-status
+description: Report the status of every fleet that shares one LavinMQ instance. Use for local daemon health, broker-wide fleet presence, and cross-host lead coordination checks.
+---
+
+# Status of every fleet on the shared LavinMQ instance
+
+**The headline: always report what is missing.** This skill starts with the local fleet, then adds
+broker-wide facts when its read-only credential exists. A missing fleet must appear as `unknown` or
+`not reachable`, with the reason and the fix. Never leave it out.
+
+The known topology has one LavinMQ instance on `10.10.20.13` (`fleet01`). AMQP uses port `5672`,
+and the management API uses port `15672`. The Mac fleet owns vhost `/mac`. The fleet01 fleet owns
+vhost `/fleet01`.
+
+## 1. Protect credentials before any probe
+
+**Hard rule — never print `LAVINMQ_URI`.** It is an AMQP URI with its password inline. It only
+resolves in a login shell because `${SHARED_ENV}/tools/secrets.sh` supplies it. A non-login shell
+can make every broker probe look empty.
+
+- Never run `echo "$LAVINMQ_URI"`.
+- Never put `${LAVINMQ_URI:-something}` in output. That form expands to the secret value when set.
+- Parse the user, host, and password into shell or Python variables. Use them without printing them.
+- Prefer `resolves` or `does not resolve` over any part of the value.
+- Every command that can read `LAVINMQ_URI` must send all output through this redaction before it
+  reaches the report:
+
+```bash
+sed -E 's#://[^@]*@#://<redacted>@#g'
+```
+
+**The `g` flag is not optional.** Without it `sed` replaces only the first match on each line, so a
+line carrying two URIs leaks the second one. `scripts/redeploy-fleetd.sh --check` prints lines like
+that. Checked on 2026-08-27: without `g`, `amqp://u1:p1@h1/mac and http://u2:p2@h2:15672/api`
+redacts the first pair and prints `u2:p2` in the clear.
+
+Keep `pipefail` on when applying that filter. Otherwise the filter can hide a failed probe. Apply
+the same no-print rule to the management password below, even though it is not in an AMQP URI.
+
+## 2. Tier 1 — this fleet (always run)
+
+Start here even when the broker tier is blocked. Work from the local fleetd checkout.
+
+First run the read-only deployment check. It already checks the daemon process, deployed jar versus
+the checkout `HEAD`, launchd state, and whether each configured token resolves in a login shell.
+Do not copy those checks into new shell code. The script reads `LAVINMQ_URI`, so redact all output:
+
+```bash
+set -o pipefail
+scripts/redeploy-fleetd.sh --check 2>&1 \
+  | sed -E 's#://[^@]*@#://<redacted>@#g'
+git rev-parse HEAD
+```
+
+Treat jar drift as a top-level warning. A merge is not a deployment. State the running jar result
+as `matches HEAD`, `drift`, or `unknown`; do not turn an unclear timestamp into a match.
+
+Report the process identifier (PID) and uptime too:
+
+```bash
+PIDS="$(pgrep -f 'target/fleetd.jar' || true)"
+if [ -z "$PIDS" ]; then
+  printf '%s\n' 'fleetd: not running'
+else
+  for PID in $PIDS; do
+    ps -p "$PID" -o pid=,etime=,lstart=,command=
+  done
+fi
+```
+
+Read the full health response. Keep the HTTP status because `503` means fleetd is running but herdr
+is not reachable. Report both `herdr.version` and `herdr.protocol` when present:
+
+```bash
+curl -sS --max-time 5 -w '\nHTTP %{http_code}\n' http://127.0.0.1:8765/healthz
+```
+
+Call `fleet_whoami`, then call `fleet_list`. Preserve its sections in the report:
+
+- `leads`, including which row is this lead;
+- `members`, including state, role, profile, branch, and worktree when present;
+- every per-profile `capacity` row, including `maxLoad`, `live`, `free`, and quarantine facts;
+- the exact `healthCoverage` value.
+
+Do not describe an empty `members` list as an empty fleet. It says only that no members are spawned.
+Also do not hide a profile with `free: 0`; say whether load or credential quarantine caused it.
+
+Show only WARN, ERROR, and SEVERE lines after the last `fleetd listening` line. This anchor stops an
+old incident from looking current:
+
+```bash
+python3 - <<'PY'
+from pathlib import Path
+import re
+
+path = Path("fleetd/fleetd.out")
+if not path.exists():
+    print("cannot check current WARN/ERROR: fleetd/fleetd.out does not exist")
+else:
+    lines = path.read_text(errors="replace").splitlines()
+    starts = [i for i, line in enumerate(lines) if "fleetd listening" in line]
+    if not starts:
+        print("cannot anchor WARN/ERROR: no 'fleetd listening' line exists")
+    else:
+        current = lines[starts[-1]:]
+        alerts = [line for line in current if re.search(r"\b(?:WARN|ERROR|SEVERE)\b", line)]
+        print(f"current WARN/ERROR/SEVERE count: {len(alerts)}")
+        for line in alerts[-50:]:
+            print(line)
+PY
+```
+
+**What this tier cannot see:** it proves facts only about the Mac daemon at `127.0.0.1:8765`.
+It cannot show the fleet01 daemon, broker queue depth, or broker consumers. The fleet01 REST service
+at `10.10.20.13:8765` is not reachable from the Mac. Say this in the report rather than omitting
+fleet01.
+
+**But fleet01 IS reachable over SSH — checked 2026-08-28.** An older version of this line said SSH
+was denied. That is true only for the user `dai.ha`. The host alias `fleet01` maps to user `ltms`,
+and `ssh fleet01` works with key auth:
+
+```bash
+ssh -o BatchMode=yes -o ConnectTimeout=6 fleet01 'echo $(id -un)@$(hostname)'
+```
+
+So fleet01's daemon PID, uptime, jar and `/healthz` **can** be reported — over SSH, not over REST.
+Do that rather than writing `not reachable`. `ltms` also has passwordless sudo there.
+
+## 3. Tier 2 — the shared broker (run when management access exists)
+
+**This tier is blocked today.** The AMQP user in `LAVINMQ_URI` can connect on port `5672`, but gets
+HTTP `401` from the management API on port `15672`. An AMQP connection does not grant monitoring
+access.
+
+The operator must create a separate, read-only LavinMQ management user with the `monitoring` tag.
+It needs access to inspect both `/mac` and `/fleet01`. Store its values as
+`LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD` in
+`${SHARED_ENV}/tools/secrets.sh`. Do not reuse or print the AMQP URI. Full multi-fleet status stays
+blocked until this user exists.
+
+When both variables resolve, run this from a login shell. It calls `GET /api/overview`,
+`GET /api/vhosts`, `GET /api/queues`, and `GET /api/connections`. It prints selected status fields,
+but never the user, password, Authorization header, or AMQP URI:
+
+```bash
+zsh -lc 'python3 - "$@"' -- <<'PY'
+import base64
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+
+base = "http://10.10.20.13:15672"
+user = os.environ.get("LAVINMQ_MANAGEMENT_USER", "")
+password = os.environ.get("LAVINMQ_MANAGEMENT_PASSWORD", "")
+if not user or not password:
+    print("broker tier: BLOCKED — management credential does not resolve in a login shell")
+    sys.exit(0)
+
+token = base64.b64encode(f"{user}:{password}".encode()).decode()
+
+def get(path):
+    request = urllib.request.Request(
+        base + path,
+        headers={"Authorization": "Basic " + token, "Accept": "application/json"},
+    )
+    with urllib.request.urlopen(request, timeout=5) as response:
+        return json.load(response)
+
+try:
+    overview = get("/api/overview")
+    vhosts = get("/api/vhosts")
+    queues = get("/api/queues")
+    connections = get("/api/connections")
+except urllib.error.HTTPError as error:
+    print(f"broker tier: BLOCKED — management API returned HTTP {error.code}")
+    sys.exit(0)
+except Exception as error:
+    print(f"broker tier: BLOCKED — management API is not reachable: {type(error).__name__}")
+    sys.exit(0)
+
+fleet_names = {"/mac": "Mac fleet", "/fleet01": "fleet01 fleet"}
+print(json.dumps({
+    "overview": {
+        "lavinmq_version": overview.get("lavinmq_version"),
+        "rabbitmq_version": overview.get("rabbitmq_version"),
+        "queue_totals": overview.get("queue_totals", {}),
+        "object_totals": overview.get("object_totals", {}),
+    },
+    "fleets": [
+        {
+            "fleet": fleet_names.get(vhost.get("name"), "UNKNOWN FLEET"),
+            "vhost": vhost.get("name"),
+            "queues": [
+                {
+                    "name": queue.get("name"),
+                    "messages": queue.get("messages", 0),
+                    "messages_ready": queue.get("messages_ready", 0),
+                    "messages_unacknowledged": queue.get("messages_unacknowledged", 0),
+                    "consumers": queue.get("consumers", 0),
+                }
+                for queue in queues if queue.get("vhost") == vhost.get("name")
+            ],
+            "connections": [
+                {
+                    "name": connection.get("name"),
+                    "peer_host": connection.get("peer_host"),
+                    "state": connection.get("state"),
+                }
+                for connection in connections if connection.get("vhost") == vhost.get("name")
+            ],
+        }
+        for vhost in vhosts
+    ],
+}, indent=2, sort_keys=True))
+PY
+```
+
+Map `/mac` to the Mac fleet and `/fleet01` to the fleet01 fleet. Keep any other vhost in the
+report as `UNKNOWN FLEET`; do not drop it. For each vhost, total the ready, unacknowledged, and all
+messages. Report every queue's consumer count and each live connection.
+
+**A vhost with queues but zero consumers means that fleet's daemon is down while its durable state
+survives. Call this out as a top-level warning.** This is the main reason to use the management API
+instead of calling each remote daemon.
+
+**What this tier cannot see:** without the new `monitoring` credential it cannot enumerate any
+vhost, queue, depth, consumer, or connection. With the credential it still cannot report fleet01's
+daemon PID, uptime, jar revision, `/healthz`, herdr version, or member capacity. Those need reachable
+fleet01 REST or SSH access, which the Mac does not have today.
+
+## 4. Tier 3 — cross-fleet lead coordination
+
+Use the queue data from Tier 2. Select queues whose names match `lead.<coordId>.inbox`. Report each
+queue's vhost, depth, consumer count, and the `coordId` between the prefix and suffix.
+
+- A lead inbox with a consumer shows that a lead mailbox is live on that vhost.
+- A durable lead inbox with zero consumers shows saved coordination state, but no live receiver.
+- No lead inbox is not proof that coordination is disabled. The daemon may be down before declaring
+  its queue, or this account may not be allowed to see the vhost.
+
+This Mac fleet currently sets both `broker.uriEnv` and `coordinator.uriEnv` to the same variable,
+`LAVINMQ_URI`. Therefore its coordinator connects to `/mac`. Cross-host `fleet_send{coordId}` routes
+only when both leads share the same coordinator vhost. If the fleet01 lead uses `/fleet01` for its
+coordinator, the leads cannot see each other and the send will not route.
+
+**Open question:** the fleet01 coordinator vhost has not been checked. Surface this question in
+every report until a live `lead.<coordId>.inbox` consumer or fleet01's config proves the answer. Do
+not claim that fleet01 uses `/fleet01` just because its member queues do.
+
+Also compare these broker facts with the `leads` rows from local `fleet_list`. A missing remote lead
+is `not visible from this coordinator`, not `down`, unless the broker consumer facts prove it.
+
+**What this tier cannot see:** without Tier 2 management access it cannot list lead inboxes or their
+consumers. Even with that access, a stopped fleet01 daemon leaves only durable queue history. That
+history cannot prove which coordinator URI its current config would use after restart.
+
+## 5. Report all fleets
+
+Use one row per known or discovered fleet. Include blocked rows.
+
+| Fleet | Daemon | Deployment | Herdr | Members/capacity | Queues/consumers | Lead coordination | Cannot check |
+|---|---|---|---|---|---|---|---|
+| Mac (`/mac`) | PID + uptime | jar vs `HEAD` | health + version + protocol | `fleet_list` + `healthCoverage` | facts or blocked reason | inbox facts or open question | exact missing facts |
+| fleet01 (`/fleet01`) | reachable/down/unknown | value or `not reachable` | value or `not reachable` | value or `not reachable` | facts or blocked reason | inbox facts plus coordinator-vhost question | exact missing facts and fix |
+
+Add rows for unknown vhosts. End with three short sections: `Current warnings`, `Checks that were
+blocked`, and `Operator action`. Until the management user exists, `Operator action` must say:
+
+> Create a read-only LavinMQ management user with the `monitoring` tag and access to `/mac` and
+> `/fleet01`. Put its user and password in `${SHARED_ENV}/tools/secrets.sh` as
+> `LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD`.

.claude/skills/implementer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: implementer
-description: Implementer-role procedure for a bridged worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over bridged.
+description: Implementer-role procedure for a fleetd worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over fleetd.
 ---
 
 # Implementer worker — procedure
@@ -49,7 +49,7 @@ test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-t
 your worktree*:
 
 ```bash
-cd "$(git rev-parse --show-toplevel)/bridged" && mvn clean install
+cd "$(git rev-parse --show-toplevel)/fleetd" && mvn clean install
 echo "exit=$?"
 ```
 

.claude/skills/reviewer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reviewer
-description: Reviewer-role procedure for a bridged worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over bridged.
+description: Reviewer-role procedure for a fleetd worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over fleetd.
 ---
 
 # Reviewer worker — procedure

.gitea/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
       # does not depend on the wiki repo being reachable.
       - uses: actions/checkout@v4
 
-      # The runner image ships an older default-jdk; bridged sets maven.compiler.release=25, so
+      # The runner image ships an older default-jdk; fleetd sets maven.compiler.release=25, so
       # provision the JDK explicitly rather than apt-installing whatever "default" means today.
       - name: Set up JDK 25
         uses: actions/setup-java@v4
@@ -32,7 +32,7 @@ jobs:
           mvn -version
 
       - name: Build and test
-        working-directory: bridged
+        working-directory: fleetd
         # This IS the mock-socket surface CB-503 asks for: the pom's `default-excludes` profile
         # already sets excludedGroups=contract, so the @Tag("contract") tests — which need a live
         # herdr socket and a RabbitMQ container — are excluded without any flag here. Everything
@@ -46,7 +46,7 @@ jobs:
       # the log instead, where they are actually readable.
       - name: Failing test output
         if: failure()
-        working-directory: bridged
+        working-directory: fleetd
         run: |
           for f in target/surefire-reports/*.txt; do
             [ -f "$f" ] || continue
@@ -59,7 +59,7 @@ jobs:
   # AmqpReplyInboxContractTest reads AMQP_URI (set below to the service's network alias) and binds
   # straight to it — no Docker, no skipped tests. This separation (build job hermetic and
   # Docker-free; contract job broker-provided) is deliberate — see the default-excludes/contract
-  # profiles in bridged/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
+  # profiles in fleetd/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
   # exactly as in the build job above.
   contract:
     runs-on: ubuntu-latest
@@ -91,12 +91,12 @@ jobs:
       # runs against the RabbitMQ service container (AMQP_URI). Pinned to the one contract test to
       # avoid re-running the unit suite already covered by the `build` job.
       - name: Contract tests
-        working-directory: bridged
+        working-directory: fleetd
         run: mvn -B -Pcontract test -Dtest=AmqpReplyInboxContractTest
 
       - name: Failing test output
         if: failure()
-        working-directory: bridged
+        working-directory: fleetd
         run: |
           for f in target/surefire-reports/*.txt; do
             [ -f "$f" ] || continue

.gitignore

@@ -14,8 +14,8 @@
 .env
 .envrc
 
-# Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
-# repo root and bridged/ collect one; neither belongs in git.
-bridged.out
-bridged/bridged.out
+# Daemon runtime artefacts. fleetd appends its log wherever it is launched from, so both the
+# repo root and fleetd/ collect one; neither belongs in git.
+fleetd.out
+fleetd/fleetd.out
 logs/

.opencode/agent/architect.md

@@ -3,7 +3,7 @@ description: Refine work into clear, independent units before implementation.
 mode: primary
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You are an architect in this fleet. You refine work before anyone builds it: scope,
 acceptance criteria, risks, and a unit split. You read the repo and write analysis.

.opencode/agent/dev.md

@@ -3,7 +3,7 @@ description: Implement one assigned unit, test it, and open a pull request.
 mode: primary
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You implement the one unit you were given and nothing else. Work in your assigned
 git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm

.opencode/agent/reviewer.md

@@ -3,7 +3,7 @@ description: Review one assigned scope and report the most important real issue.
 mode: primary
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You review the diff you were given. Report bugs, risks, and missing tests. You do
 not change code.

CLAUDE.md

@@ -10,7 +10,7 @@
 
 If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.
 
-`bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
+`fleetd` is the **sole communication gateway** between agents here. The orchestrating session (the
 **primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
 through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.
 
@@ -185,13 +185,14 @@ must obey belongs in the charter, not here.
 
 ## Project addendum — claude-bridge (not part of the canonical block)
 
-- **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
+- **This repo is the bridge.** The daemon is `fleetd`, its MCP mount is `http://127.0.0.1:8765/mcp`,
   and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
   `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
 - **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
   `reviewer` (scoped review → one structured finding). Name one in every delegation.
 - **Primary-side skills** (not delegation playbooks — a worker cannot use them):
-  `port-to-opencode` (make an OpenCode session a participant in this workspace).
+  `port-to-opencode` (make an OpenCode session a participant in this workspace) and
+  `fleets-status` (report every fleet that shares one LavinMQ instance).
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
   (a submodule with its own remote).
 - **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, turn-done fallback —
@@ -202,7 +203,7 @@ must obey belongs in the charter, not here.
 
 ### Redeploying the daemon — the lead may do this (primary only)
 
-**A merge is not a deployment.** The running `bridged` holds the jar it was started with, so a
+**A merge is not a deployment.** The running `fleetd` holds the jar it was started with, so a
 feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
 about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
 rather than hand the job back to the operator.
@@ -213,9 +214,9 @@ and stopping it kills the worker's own channel mid-turn.
 **Use the script — do not hand-roll the steps.**
 
 ```bash
-scripts/redeploy-bridged.sh --check   # report state, change nothing
-scripts/redeploy-bridged.sh           # build, confirm drain, restart, verify
-scripts/redeploy-bridged.sh --yes     # skip the drain prompt (fleet already checked)
+scripts/redeploy-fleetd.sh --check   # report state, change nothing
+scripts/redeploy-fleetd.sh           # build, confirm drain, restart, verify
+scripts/redeploy-fleetd.sh --yes     # skip the drain prompt (fleet already checked)
 ```
 
 It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
@@ -241,8 +242,8 @@ if the script is unavailable or a step fails, this is what it was protecting you
 4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
    lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
    demoted to worker, which refuses every orchestration call.
-5. **Prove the new jar is the one running.** Confirm a *fresh* `bridged listening` line at the end of
-   `bridged/bridged.out`, dated after the restart. An old daemon that never died looks identical from
+5. **Prove the new jar is the one running.** Confirm a *fresh* `fleetd listening` line at the end of
+   `fleetd/fleetd.out`, dated after the restart. An old daemon that never died looks identical from
    the outside.
 
 **Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
@@ -251,7 +252,7 @@ it is one auditable command, so the operator allow-lists it once instead of appr
 start every time. The rule lives in the operator's Claude Code settings:
 
 ```json
-{ "permissions": { "allow": ["Bash(scripts/redeploy-bridged.sh:*)"] } }
+{ "permissions": { "allow": ["Bash(scripts/redeploy-fleetd.sh:*)"] } }
 ```
 
 Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
@@ -277,7 +278,7 @@ Before you call any work done, check the row that matches what you touched:
 | worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
 | `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
 | a new peer kind (non-Claude adapter) | what that peer can read — anything it must obey belongs in its charter, not in the block |
-| **anything an operator can use, configure, or observe** — an MCP tool, a `bridged.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
+| **anything an operator can use, configure, or observe** — an MCP tool, a `fleetd.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
 
 That last row is not bookkeeping. Chapters 1–10 answer *how is this built* and *why this way*;
 none of them has a home for *what can it do and how do I turn it on*, so for twenty tickets a
@@ -311,10 +312,10 @@ PY
 
 Two IDE MCP servers are connected: **intellij-index** (semantic code intelligence) and
 **jetbrains** (file problems, reformat, debugger). IntelliJ has multiple projects open; our
-module is **`bridged`**. Always pass these to IDE MCP tools:
+module is **`fleetd`**. Always pass these to IDE MCP tools:
 
-- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/bridged`
-- IDE paths are relative to `bridged/` (e.g. `src/main/java/dev/ltms/bridged/...`)
+- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/fleetd`
+- IDE paths are relative to `fleetd/` (e.g. `src/main/java/dev/ltms/fleet/...`)
 
 ### After editing any file — mandatory
 
@@ -328,7 +329,7 @@ module is **`bridged`**. Always pass these to IDE MCP tools:
    whole-project gate before declaring work done or committing.
 
 **Whenever dependencies change (or a `pom.xml` edit), validate CVEs with
-`jetbrains get_file_problems{filePath: "bridged/pom.xml"}`** — its Mend.io check reflects the
+`jetbrains get_file_problems{filePath: "fleetd/pom.xml"}`** — its Mend.io check reflects the
 dependencies on disk. (Note: `ide_diagnostics` / intellij-index does NOT re-resolve dependencies
 after a pom edit without a full Maven reimport, so it reports stale CVE results — don't trust it
 for this.) Treat a CVE warning like any other: bump to a patched version and confirm

README.md

@@ -56,9 +56,8 @@ flowchart LR
    ever addresses a broker, a peer, or the network
    directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
    mounting the bridge is subscription-safe by construction.
-   **Tool naming:** the tools were renamed from `bridge_*` to `fleet_*` (CB-622). The daemon
-   still answers the old `bridge_*` names for one release, but they are deprecated — use the
-   `fleet_*` names.
+   **Tool naming:** the tools are `fleet_*` (renamed from `bridge_*` in CB-622). The old
+   `bridge_*` names were removed in CB-634 — only `fleet_*` answers now.
 - **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
   `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
   `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so

bridged/src/main/java/dev/ltms/fleet/herdr/PaneLocator.java

@@ -1,59 +0,0 @@
-package dev.ltms.fleet.herdr;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-import java.util.Map;
-
-/**
- * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
- * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
- * the agent pane whose process tree contains it, so {@code bridged} can tell <em>which worker</em>
- * is calling without the worker sending anything spoofable.
- *
- * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
- * and foreground process PIDs. This scans agent panes; a spawn-time {@code pid→terminal} cache is
- * the obvious optimization once wired into {@code ClaudeCodeLauncher}.
- */
-public final class PaneLocator {
-
-    private final HerdrClient herdr;
-
-    public PaneLocator(HerdrClient herdr) {
-        this.herdr = herdr;
-    }
-
-    /**
-     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
-     * {@code null} if no agent pane owns it (e.g. the caller is the primary, or off-host).
-     */
-    public String terminalForPid(long pid) {
-        if (pid <= 0) {
-            return null;
-        }
-        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
-            String paneId = pane.path("pane_id").asText(null);
-            if (paneId != null && paneOwnsPid(paneId, pid)) {
-                return pane.path("terminal_id").asText(null);
-            }
-        }
-        return null;
-    }
-
-    private boolean paneOwnsPid(String paneId, long pid) {
-        JsonNode info;
-        try {
-            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
-        } catch (HerdrException e) {
-            return false; // pane vanished mid-scan — just skip it
-        }
-        if (info.path("shell_pid").asLong(-1) == pid) {
-            return true;
-        }
-        for (JsonNode p : info.path("foreground_processes")) {
-            if (p.path("pid").asLong(-1) == pid) {
-                return true;
-            }
-        }
-        return false;
-    }
-}

bridged/src/test/java/dev/ltms/fleet/health/FleetHealthMonitorTest.java

@@ -1,170 +0,0 @@
-package dev.ltms.fleet.health;
-
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.inject.Injector;
-import dev.ltms.fleet.msg.InMemoryReplyInbox;
-import dev.ltms.fleet.msg.MessageService;
-import dev.ltms.fleet.msg.Rendezvous;
-import dev.ltms.fleet.session.SessionManager;
-import dev.ltms.fleet.member.ClaudeCodeLauncher;
-import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.guard.SubscriptionGuard;
-import dev.ltms.fleet.config.FleetConfig;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.Executors;
-import java.util.function.BiConsumer;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class FleetHealthMonitorTest {
-    @Test void oneTickUsesOneFleetListForAnyRosterSize() {
-        FakeHerdr herdr = new FakeHerdr();
-        AgentControl agents = new AgentControl(herdr);
-        FleetConfig.Profile profile = new FleetConfig.Profile("test", "http://test:1", null,
-                null, null, null, null, null, null, null, null, null);
-        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(agents, new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("test")), Map.of("test", profile), "test", _ -> "token");
-        SessionManager sessions = new SessionManager(launcher);
-        sessions.acquire("test", null, null, null);
-        sessions.acquire("test", null, null, null);
-        herdr.calls.clear();
-        MessageService messages = new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox());
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents, sessions::roster, messages, scheduler, () -> 1, 60,
-                (_, _) -> { });
-        monitor.tick();
-        monitor.stop();
-        assertEquals(1, herdr.calls.stream().filter(call -> call.method().equals("agent.list")).count());
-    }
-
-    @Test void failedTickDoesNotStopTheNextTick() {
-        FakeHerdr herdr = new FakeHerdr().healthy(false);
-        AgentControl agents = new AgentControl(herdr);
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents, java.util.List::of,
-                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                scheduler, () -> 1, 60, (_, _) -> { });
-        monitor.tick();
-        herdr.healthy(true);
-        monitor.tick();
-        monitor.stop();
-        assertEquals(2, herdr.calls.stream().filter(call -> call.method().equals("agent.list")).count());
-    }
-
-    @Test void faultTransitionLogsOnlyOnceUntilItChanges() {
-        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        try {
-            FakeHerdr herdr = new FakeHerdr();
-            AgentControl agents = new AgentControl(herdr);
-            var scheduler = Executors.newSingleThreadScheduledExecutor();
-            FleetHealthMonitor monitor = new FleetHealthMonitor(agents, java.util.List::of,
-                    new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                    scheduler, () -> 1, 60, (_, _) -> { });
-            monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-            monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-            monitor.stop();
-            assertEquals(1, appender.list.stream().filter(event -> event.getFormattedMessage()
-                    .contains("member=term_a state=TURN_BOUNDARY_LOST")).count());
-        } finally {
-            logger.detachAppender(appender);
-        }
-    }
-
-    // --- CB-580: a member that reaches GONE/NEVER_READY must fail its waiting tickets
-
-    private static FleetHealthMonitor monitorWith(BiConsumer<String, String> failTarget) {
-        FakeHerdr herdr = new FakeHerdr();
-        AgentControl agents = new AgentControl(herdr);
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        return new FleetHealthMonitor(agents, java.util.List::of,
-                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                scheduler, () -> 1, 60, failTarget);
-    }
-
-    @Test void terminalTransitionFailsTheTargetOnce() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-        assertEquals("term_a", failTarget.calls.get(0).target());
-        assertTrue(failTarget.calls.get(0).reason().contains("GONE"));
-    }
-
-    @Test void neverReadyNamesItselfAsTheReason() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.NEVER_READY);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-        assertTrue(failTarget.calls.get(0).reason().contains("NEVER_READY"));
-    }
-
-    @Test void stayingInATerminalStateProducesOneFailureNotN() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-    }
-
-    @Test void aNonTerminalFaultStateDoesNotFailTheTarget() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-        monitor.stop();
-        assertEquals(0, failTarget.calls.size());
-    }
-
-    @Test void failTargetRetryIsBounded() {
-        AlwaysThrowingFailTarget failTarget = new AlwaysThrowingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(FleetHealthMonitor.MAX_FAIL_TARGET_ATTEMPTS, failTarget.calls);
-    }
-
-    @Test void exhaustedRetryStillDoesNotRefireOnAnUnchangedTick() {
-        AlwaysThrowingFailTarget failTarget = new AlwaysThrowingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        int afterFirstTransition = failTarget.calls;
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(afterFirstTransition, failTarget.calls);
-    }
-
-    private record RecordedCall(String target, String reason) { }
-
-    private static final class RecordingFailTarget implements BiConsumer<String, String> {
-        final java.util.List<RecordedCall> calls = new java.util.ArrayList<>();
-
-        @Override public void accept(String target, String reason) {
-            calls.add(new RecordedCall(target, reason));
-        }
-    }
-
-    private static final class AlwaysThrowingFailTarget implements BiConsumer<String, String> {
-        int calls = 0;
-
-        @Override public void accept(String target, String reason) {
-            calls++;
-            throw new RuntimeException("boom");
-        }
-    }
-}

bridged/src/test/java/dev/ltms/fleet/herdr/PaneLocatorTest.java

@@ -1,27 +0,0 @@
-package dev.ltms.fleet.herdr;
-
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/** Unit tests for PID → pane resolution (the herdr half of connection-based MCP identity). */
-class PaneLocatorTest {
-
-    private final PaneLocator loc = new PaneLocator(new FakeHerdr());
-
-    @Test
-    void resolvesTerminalForAForegroundPid() {
-        assertEquals("term_a", loc.terminalForPid(FakeHerdr.WORKER_PID));
-    }
-
-    @Test
-    void nullForAPidInNoPane() {
-        assertNull(loc.terminalForPid(999_999));
-    }
-
-    @Test
-    void nullForNonPositivePid() {
-        assertNull(loc.terminalForPid(0));
-        assertNull(loc.terminalForPid(-1));
-    }
-}

deploy/dev.ltms.fleetd.plist

@@ -1,36 +1,36 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <!--
-  CB-504 / CB-594 — launchd agent for bridged (macOS).
+  CB-504 / CB-594 — launchd agent for fleetd (macOS).
 
   This is the real supervision target today: the dogfooded daemon runs on macOS, where there is
-  no systemd. A systemd unit ships alongside (deploy/bridged.service) for the Linux gateways
+  no systemd. A systemd unit ships alongside (deploy/fleetd.service) for the Linux gateways
   CB-308 introduces.
 
   Install:
-    cp deploy/dev.ltms.bridged.plist ~/Library/LaunchAgents/
-    launchctl load -w ~/Library/LaunchAgents/dev.ltms.bridged.plist
-    launchctl list | grep bridged
+    cp deploy/dev.ltms.fleetd.plist ~/Library/LaunchAgents/
+    launchctl load -w ~/Library/LaunchAgents/dev.ltms.fleetd.plist
+    launchctl list | grep fleetd
 
   The paths below are already filled in for this host (resolved 2026-08-16 from
   `/usr/libexec/java_home`... except that reported the system Applet-plugin JVM, not the jenv-
-  managed JDK 25 actually used to build/run bridged, so JAVA_HOME here is the real one:
+  managed JDK 25 actually used to build/run fleetd, so JAVA_HOME here is the real one:
   `JENV_VERSION=25.0.3 java -XshowSettings:properties -version 2>&1 | grep java.home`; `which mvn`;
   `echo $HOME`). If this file is copied to a different host, re-resolve all three paths and check
-  no placeholder path is left behind; scripts/redeploy-bridged.sh's check mode does not (and
+  no placeholder path is left behind; scripts/redeploy-fleetd.sh's check mode does not (and
   cannot) check this file for you.
 
   CB-594 — launchd cannot run a login shell (see the PATH comment on EnvironmentVariables below,
-  and scripts/bridged-launchd-wrapper.sh for the fix): ProgramArguments below execs THAT wrapper,
+  and scripts/fleetd-launchd-wrapper.sh for the fix): ProgramArguments below execs THAT wrapper,
   not java directly, so WORKER_GITEA_TOKEN and AI_GATEWAY_TOKEN still get sourced from
   ${SHARED_ENV}/tools/secrets.sh even though launchd itself never sources anything.
 
   Note on ordering: launchd has no "start after herdr" primitive for user agents, and neither
-  does systemd in a way that survives a socket appearing late. bridged retries the herdr socket
+  does systemd in a way that survives a socket appearing late. fleetd retries the herdr socket
   on startup instead, so an agent that comes up before herdr converges rather than dying — that
   retry is the actual fix; KeepAlive below is the backstop.
 
-  CB-594 — KeepAlive vs. scripts/redeploy-bridged.sh: a bare SIGTERM makes this JVM exit 143 even
+  CB-594 — KeepAlive vs. scripts/redeploy-fleetd.sh: a bare SIGTERM makes this JVM exit 143 even
   with its shutdown hook running to completion (measured, see the CB-594 report), which
   SuccessfulExit:false below reads as a crash and races to restart the OLD jar. The redeploy
   script now detects a loaded agent and uses `launchctl unload`/`load` instead of a raw kill, so
@@ -40,20 +40,20 @@
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>dev.ltms.bridged</string>
+    <string>dev.ltms.fleetd</string>
 
     <key>ProgramArguments</key>
     <array>
-        <string>/Users/dai.ha/LTMS/claude-bridge/scripts/bridged-launchd-wrapper.sh</string>
+        <string>/Users/dai.ha/LTMS/claude-bridge/scripts/fleetd-launchd-wrapper.sh</string>
         <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin/java</string>
         <string>-jar</string>
-        <string>/Users/dai.ha/LTMS/claude-bridge/bridged/target/bridged.jar</string>
-        <string>bridged.yaml</string>
+        <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/target/fleetd.jar</string>
+        <string>fleetd.yaml</string>
     </array>
 
     <!-- Config path in ProgramArguments is relative, so the working directory must be the module. -->
     <key>WorkingDirectory</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd</string>
 
     <key>EnvironmentVariables</key>
     <dict>
@@ -62,7 +62,7 @@
         <key>HERDR_SOCKET_PATH</key>
         <string>/Users/dai.ha/.config/herdr/herdr.sock</string>
         <!--
-          PATH matters more than it looks (CB-511): bridged propagates its own PATH to every worker
+          PATH matters more than it looks (CB-511): fleetd propagates its own PATH to every worker
           it spawns, so this line decides whether the fleet can run a build at all. launchd does NOT
           source .zprofile/.zshrc, so without this the daemon (and therefore every worker) gets a
           bare /usr/bin:/bin and no JDK or Maven. Keep the toolchain entries first.
@@ -71,10 +71,10 @@
         <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin:/Users/dai.ha/Softwares/apache-maven/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
         <!--
           Worker/API tokens are NOT set here: this file is committed. CB-594 —
-          scripts/bridged-launchd-wrapper.sh (named in ProgramArguments above) is what supplies
+          scripts/fleetd-launchd-wrapper.sh (named in ProgramArguments above) is what supplies
           them, by execing a login shell that sources ${SHARED_ENV}/tools/secrets.sh before the
-          daemon itself starts. bridged also reads the API token from the env var named by
-          auth.tokenEnv (default BRIDGED_API_TOKEN) and only in auth.mode: token — the wrapper
+          daemon itself starts. fleetd also reads the API token from the env var named by
+          auth.tokenEnv (default FLEETD_API_TOKEN) and only in auth.mode: token — the wrapper
           covers that one too, since it is the same login shell.
         -->
     </dict>
@@ -84,21 +84,21 @@
 
     <!--
       CB-600 — read this before assuming ThrottleInterval bounds anything. It paces restarts to at
-      most one per 10s; it does NOT cap how many times launchd retries. If bridged fails fast on
-      every start — a bad bridged.yaml, for example auth.mode: token with the token env var unset,
+      most one per 10s; it does NOT cap how many times launchd retries. If fleetd fails fast on
+      every start — a bad fleetd.yaml, for example auth.mode: token with the token env var unset,
       which throws in main() before the daemon ever binds a port — launchd restarts it forever,
       once every 10s, until a human intervenes. LaunchAgents have no "give up after N attempts"
       primitive, so this is not something a config change here can fix.
 
-      That loop stops only two ways: (1) `launchctl unload -w ~/Library/LaunchAgents/dev.ltms.bridged.plist`,
+      That loop stops only two ways: (1) `launchctl unload -w ~/Library/LaunchAgents/dev.ltms.fleetd.plist`,
       or (2) the underlying cause gets fixed, so the process starts successfully and stays up (no
-      more exits to restart). scripts/redeploy-bridged.sh does not add a third way — it does not
-      make bridged self-disable on a config error, on purpose: a fail-fast exit path that
+      more exits to restart). scripts/redeploy-fleetd.sh does not add a third way — it does not
+      make fleetd self-disable on a config error, on purpose: a fail-fast exit path that
       sometimes decides "this is unrecoverable, stop trying" is one more thing that can misfire,
       and a wrongly self-disabled daemon needs the exact same manual `launchctl load -w` recovery
       this comment already names — so it buys nothing an operator watching for the crash loop
       doesn't already have, at the cost of a new way to be silently down. Watch for it with
-      `launchctl list dev.ltms.bridged` (a high restart count) or by tailing bridged.out for the
+      `launchctl list dev.ltms.fleetd` (a high restart count) or by tailing fleetd.out for the
       same startup error repeating every ~10s.
     -->
     <key>KeepAlive</key>
@@ -110,16 +110,16 @@
     <integer>10</integer>
 
     <!--
-      CB-594 — same file scripts/redeploy-bridged.sh already tails ($BRIDGED/bridged.out), and both
+      CB-594 — same file scripts/redeploy-fleetd.sh already tails ($BRIDGED/fleetd.out), and both
       streams point at it, not two separate log files: the script's fresh-line / ERROR-count checks
       after a restart read this one path regardless of whether launchd or the script started the
       process, and a stdout/stderr split would make half of what happens during a launchd-driven
       restart invisible to it.
     -->
     <key>StandardOutPath</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged/bridged.out</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/fleetd.out</string>
     <key>StandardErrorPath</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged/bridged.out</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/fleetd.out</string>
 
     <key>ProcessType</key>
     <string>Background</string>

deploy/fleetd.service

@@ -1,45 +1,45 @@
-# CB-504 — systemd unit for bridged (Linux).
+# CB-504 — systemd unit for fleetd (Linux).
 #
-# The macOS launchd agent (deploy/dev.ltms.bridged.plist) is the supervision target for the
+# The macOS launchd agent (deploy/dev.ltms.fleetd.plist) is the supervision target for the
 # current single-host deployment. This unit exists for the per-host gateways CB-308 introduces,
 # which will run on Linux.
 #
-# Install (user service — bridged drives the user's herdr, not a system daemon):
+# Install (user service — fleetd drives the user's herdr, not a system daemon):
 #   mkdir -p ~/.config/systemd/user
-#   cp deploy/bridged.service ~/.config/systemd/user/
+#   cp deploy/fleetd.service ~/.config/systemd/user/
 #   # edit ExecStart / WorkingDirectory / Environment below, then:
 #   systemctl --user daemon-reload
-#   systemctl --user enable --now bridged
-#   journalctl --user -u bridged -f
+#   systemctl --user enable --now fleetd
+#   journalctl --user -u fleetd -f
 
 [Unit]
-Description=bridged — claude-bridge message server
+Description=fleetd — claude-bridge message server
 Documentation=https://git.ltms.dev/fleet/fleetd/wiki
 # Ordering only: herdr is a user process and its socket may appear after us. This is advisory —
-# bridged retries the herdr socket rather than exiting, which is what actually makes a late
-# socket survivable. Do NOT add Requires=: a herdr restart must not take bridged down with it.
+# fleetd retries the herdr socket rather than exiting, which is what actually makes a late
+# socket survivable. Do NOT add Requires=: a herdr restart must not take fleetd down with it.
 After=herdr.service
 Wants=herdr.service
 
 [Service]
 Type=simple
-WorkingDirectory=%h/src/claude-bridge/bridged
-ExecStart=/usr/lib/jvm/temurin-25-jdk/bin/java -jar target/bridged.jar bridged.yaml
+WorkingDirectory=%h/src/claude-bridge/fleetd
+ExecStart=/usr/lib/jvm/temurin-25-jdk/bin/java -jar target/fleetd.jar fleetd.yaml
 
 Environment=HERDR_SOCKET_PATH=%h/.config/herdr/herdr.sock
-# PATH matters more than it looks (CB-511): bridged propagates its own PATH to every worker it
+# PATH matters more than it looks (CB-511): fleetd propagates its own PATH to every worker it
 # spawns, so this line decides whether the fleet can run a build at all. systemd does not source a
 # login shell, so without it the daemon — and every worker — gets a bare default with no JDK/Maven.
 Environment=PATH=/usr/lib/jvm/temurin-25-jdk/bin:/usr/share/maven/bin:/usr/local/bin:/usr/bin:/bin
 # Secrets are NOT set here — this file is committed. Put the API/worker tokens in a private
 # drop-in that systemd reads with restrictive permissions:
-#   systemctl --user edit bridged     →  [Service] / Environment=BRIDGED_API_TOKEN=...
+#   systemctl --user edit fleetd     →  [Service] / Environment=FLEETD_API_TOKEN=...
 # or point EnvironmentFile at a 0600 file:
-# EnvironmentFile=%h/.config/bridged/env
+# EnvironmentFile=%h/.config/fleetd/env
 
 Restart=on-failure
 RestartSec=10s
-# A bad config (e.g. a non-loopback bind without token auth) makes bridged fail fast by design.
+# A bad config (e.g. a non-loopback bind without token auth) makes fleetd fail fast by design.
 # Give up rather than restart-loop on a permanent error.
 StartLimitBurst=5
 StartLimitIntervalSec=120
@@ -55,7 +55,7 @@ RestrictSUIDSGID=true
 
 StandardOutput=journal
 StandardError=journal
-SyslogIdentifier=bridged
+SyslogIdentifier=fleetd
 
 [Install]
 WantedBy=default.target

deploy/lavinmq/compose.yaml

@@ -1,8 +1,8 @@
-# LavinMQ — the AMQP broker behind bridged's durable ReplyInbox (CB-307 Stage 2).
+# LavinMQ — the AMQP broker behind fleetd's durable ReplyInbox (CB-307 Stage 2).
 #
 # Why this file exists: the broker was previously run ad hoc and simply vanished from the host,
-# which takes bridged down with it — AmqpReplyInbox.open throws on an unreachable broker and
-# Bridged.java:187 does not guard it, so a missing broker is a hard startup failure, not a
+# which takes fleetd down with it — AmqpReplyInbox.open throws on an unreachable broker and
+# Fleetd.java:187 does not guard it, so a missing broker is a hard startup failure, not a
 # degraded mode. This pins the version, keeps the data, and brings itself back after a reboot.
 #
 # Usage:
@@ -14,27 +14,27 @@
 #
 # Management UI: http://127.0.0.1:15672  (guest / guest)
 #
-# This is bridged's OWN broker. Do not point bridged at any other AMQP server on this host —
+# This is fleetd's OWN broker. Do not point fleetd at any other AMQP server on this host —
 # notably not the `local-rabbitmq` container, which belongs to a different project and would end
 # up carrying this project's queues.
 
-name: bridged-broker
+name: fleetd-broker
 
 services:
   lavinmq:
     # Pinned deliberately: :latest silently moves the broker under a running daemon.
     image: cloudamqp/lavinmq:2.9.1
-    container_name: bridged-lavinmq
+    container_name: fleetd-lavinmq
 
     # The failure this deployment exists to prevent — survive reboots and Docker restarts, but
     # stay down if it was stopped on purpose.
     restart: unless-stopped
 
     # Loopback-bound on purpose. LavinMQ ships a default guest/guest account, which is only
-    # acceptable because nothing off-host can reach it. bridged connects over 127.0.0.1, and
+    # acceptable because nothing off-host can reach it. fleetd connects over 127.0.0.1, and
     # binding 0.0.0.0 here would expose a broker with default credentials to the network.
     ports:
-      - "127.0.0.1:5672:5672"      # AMQP — bridged.yaml broker.uri points here
+      - "127.0.0.1:5672:5672"      # AMQP — fleetd.yaml broker.uri points here
       - "127.0.0.1:15672:15672"    # HTTP management API + UI
 
     # The whole point of Stage 2. Held-but-unacked replies live here; without a named volume a
@@ -57,4 +57,4 @@ services:
 
 volumes:
   lavinmq-data:
-    name: bridged-lavinmq-data
+    name: fleetd-lavinmq-data

docs/CB-306-Spawn-Readiness-Gate.md

@@ -79,7 +79,7 @@ Unit tests (add to the existing `ClaudeCodeLauncher` test):
 
 ## 5. Config
 
-Add to the launcher-level config (a bridged-level knob, not per-profile) in `bridged.yaml` +
+Add to the launcher-level config (a fleetd-level knob, not per-profile) in `fleetd.yaml` +
 `FleetConfig`:
 
 ```yaml

docs/CB-307-Reliable-Delivery.md

@@ -140,7 +140,7 @@ Stage-2 AMQP adapter: absent → in-memory, present → AMQP).
 
 ## 5. Build & verification (worker side)
 
-- Build with Maven from the worktree's `bridged/` dir. **Capture the exit code without a masking pipe**
+- Build with Maven from the worktree's `fleetd/` dir. **Capture the exit code without a masking pipe**
   (`mvn clean install; echo "MVN_EXIT=$?"` — never `mvn … | tail`, which hides failures).
 - Read the real test totals from `target/surefire-reports/TEST-*.xml`, not from stdout scroll.
 - You do **not** have IDE MCP access — do not claim `ide_diagnostics` results. The **primary** runs the

docs/CB-308-Multi-Host-Federation.md

@@ -208,7 +208,7 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
    never an argument* — across the broker: cross-host, identity comes from the key. Complements
    (not replaces) per-gateway broker logins over TLS.
 2. **Profiles are owned by the worker's host.** `fleet_spawn(profile, host)` resolves the name in
-   the *target* gateway's `bridged.yaml`. Gateways advertise their profile names in presence
+   the *target* gateway's `fleetd.yaml`. Gateways advertise their profile names in presence
    heartbeats, so a leader sees what each host offers before spawning; an unknown name is a clear
    error from the target. Secrets (base URLs, tokens) never leave the host that uses them.
 3. **Repo provisioning — clone from the forge, pinned.** A cross-host spawn names the repo URL and
@@ -275,11 +275,11 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
 - **Gateway discovery:** how gateways find the broker and each other (static config vs. discovery).
 - **Control authorization — THE GATE ON U4.** Signing (§7.1) settles *who sent it*; authorization
   is *who may do what*. **Cross-host spawn must not land before the minimal version exists**: a
-  per-host allowlist in `bridged.yaml` — beside the peer public keys — of gateway ids permitted to
+  per-host allowlist in `fleetd.yaml` — beside the peer public keys — of gateway ids permitted to
   publish control to this host, checked against the verified signature. A few lines of config and
   check; without them, any principal holding broker credentials can start processes on every host
   in the fleet.
-- **Key distribution & rotation:** static config (host → public key in each `bridged.yaml`) is
+- **Key distribution & rotation:** static config (host → public key in each `fleetd.yaml`) is
   fine at the current 2–3 host scale; rotation is manual. A refinement, not a blocker.
 - **Gateway death mid-turn:** the roster reaps it by missed heartbeat, and in-flight primary-bound
   messages survive by broker durability; still open is reconciling *worker* state when the dead

docs/CB-402-OpenCode-Adapter.md

@@ -11,7 +11,7 @@ All five increments of §4 are done, including increment 5 (the §5 live checkli
 
 ## 1. Goal
 
-Prove the [`PeerLauncher`](../bridged/src/main/java/dev/ltms/fleet/peer/PeerLauncher.java) SPI
+Prove the [`PeerLauncher`](../fleetd/src/main/java/dev/ltms/fleet/peer/PeerLauncher.java) SPI
 actually holds for a **non-Claude** coding agent by shipping a second, first-class in-tree
 adapter: **opencode** (`opencode` 1.1.31, a provider-agnostic terminal coding agent).
 

docs/CB-591-Gateway-Migration.md

@@ -9,7 +9,7 @@ with no terminator, and our third-party members cannot detect it (§7.2).
 · **Upstream issue:** [systems/vms#31](https://git.ltms.dev/systems/vms/issues/31)
 
 The gateway went live on 2026-08-15 and replaced Bifrost. This plan says what that means for a
-**member definition** in `bridged.yaml`, because that is the part of this repo the change actually
+**member definition** in `fleetd.yaml`, because that is the part of this repo the change actually
 touches.
 
 ---
@@ -134,16 +134,16 @@ own provider credentials. So 3b needs **no allowlist change**; only 3a does.
 `HerdrPeerLauncher.resolveEnv` → `env.apply(name)`, which reads the **daemon's own process
 environment**. The running `fleetd` inherited its environment when it started, so a variable added to
 `secrets.sh` afterwards is simply not there — the launcher would inject an empty token and the
-gateway would answer 401. This is the same failure as trap 1 in `scripts/redeploy-bridged.sh`
+gateway would answer 401. This is the same failure as trap 1 in `scripts/redeploy-fleetd.sh`
 (`WORKER_GITEA_TOKEN`), and it has the same fix: **restart from a login shell**, and use
-`scripts/redeploy-bridged.sh --check` to confirm the name resolves before restarting anything.
+`scripts/redeploy-fleetd.sh --check` to confirm the name resolves before restarting anything.
 
 ### 3c. What this does to `ccs`
 
 Once a profile carries `baseUrl`, `tokenEnv` and `model` itself, the ccs instance stops being what
 routes a member. Be precise about what is left, though: `configDir` still supplies **folder trust**
 and `settings.json`, and dropping it is what produced the trust dialog and the wrong-model error
-recorded in `bridged.yaml`. So ccs goes from *deciding where the tokens go* to *holding client-side
+recorded in `fleetd.yaml`. So ccs goes from *deciding where the tokens go* to *holding client-side
 state*. Less load-bearing, not removable.
 
 ### Why `/anthropic` and never `/v1/chat/completions`
@@ -217,7 +217,7 @@ defensible; picking one is not mine to do.
 ### D3 — token scope
 
 One consumer, `claude-bridge`, its token in `${SHARED_ENV}/tools/secrets.sh` as `AI_GATEWAY_TOKEN`,
-referenced by name only. Never the literal value in `bridged.yaml` — `tokenEnv` exists for this.
+referenced by name only. Never the literal value in `fleetd.yaml` — `tokenEnv` exists for this.
 
 ---
 
@@ -226,7 +226,7 @@ referenced by name only. Never the literal value in `bridged.yaml` — `tokenEnv
 ```mermaid
 flowchart TB
     U1["U1 · consumer token<br/>issue via cockpit, add to secrets.sh"]
-    U2["U2 · profile + guard<br/>bridged.yaml, restart"]
+    U2["U2 · profile + guard<br/>fleetd.yaml, restart"]
     U3["U3 · verify live<br/>spawn, prove thinking survives"]
     U4["U4 · context7 via gateway<br/>.mcp.json + opencode.json"]
     U5["U5 · docs<br/>CLAUDE.md, wiki 11-Features"]
@@ -238,7 +238,7 @@ flowchart TB
 | # | Scope | Who | Why |
 |---|---|---|---|
 | U1 | Issue the `claude-bridge` consumer at `auth.ltms.dev`; store as `AI_GATEWAY_TOKEN` | **operator** | touches secrets and a host we do not own |
-| U2a | New `gx` opencode profile on `/v1` — pure config, no guard change | **lead** | `bridged.yaml` is gitignored, so a worker cannot see or edit it |
+| U2a | New `gx` opencode profile on `/v1` — pure config, no guard change | **lead** | `fleetd.yaml` is gitignored, so a worker cannot see or edit it |
 | U2b | `local` → `/anthropic`; add `local-direct` weight 0; add `llm.ltms.dev` to the guard allowlist | **lead** | same |
 | U2c | One restart from a **login shell**, after U2a and U2b | **lead** | picks up `AI_GATEWAY_TOKEN` into the daemon env *and* the guard allowlist, in one stop |
 | U3 | Live spawn on both new profiles; confirm reasoning survives on each surface | **lead** | needs real spawns and the running daemon |
@@ -372,7 +372,7 @@ one turn; this one costs the whole task and is indistinguishable from a slow wor
 
 > **Diagnosing a stuck opencode member.** Do not read its pane. The launcher writes its config to a
 > temp dir and passes it as `OPENCODE_CONFIG` — find it with
-> `ls -dt /var/folders/*/*/T/bridged-opencode-* | head -1`, check the provider block and the key's
+> `ls -dt /var/folders/*/*/T/fleetd-opencode-* | head -1`, check the provider block and the key's
 > length and prefix (never its value), then reproduce with `opencode run --auto -m <provider>/<model>`
 > using the same `OPENCODE_CONFIG`. That is what turned "it hangs" into a one-line error.
 

docs/CB-5xx-Hardening.md

@@ -67,7 +67,7 @@ it will be disabled and the stage is wasted. So:
 auth:
   mode: loopback-trust   # default — behaves exactly like today: loopback ⇒ PRIMARY, no token needed
   # mode: token          # every non-worker caller must present a valid bearer token
-  # tokenEnv: BRIDGED_API_TOKEN   # host env var holding the token; never the literal value
+  # tokenEnv: FLEETD_API_TOKEN   # host env var holding the token; never the literal value
 ```
 
 `mode: loopback-trust` is the current behaviour, named honestly and now *chosen* rather than
@@ -114,7 +114,7 @@ not found), and the daemon that has been dogfooded for weeks runs as a bare fore
 
 - `deploy/dev.ltms.fleet.plist` — launchd agent, the *actual* runtime here, with `KeepAlive` and
   ordered start after herdr.
-- `deploy/bridged.service` — systemd unit for the Linux gateways CB-308 introduces.
+- `deploy/fleetd.service` — systemd unit for the Linux gateways CB-308 introduces.
 
 Ordering after herdr is advisory in both: the herdr socket may not exist at boot, so the daemon
 must **retry the socket rather than exit** — supervision ordering is a nicety, socket-retry is the

docs/M4-Fleet-Health.md

@@ -807,7 +807,7 @@ Checked against `main` at `e09cac6` on 2026-08-15. Unit 2 was written as one blo
 have since been built by separate CB tickets. Read this before planning the rest, or that work gets
 done twice.
 
-The check was a symbol survey of `bridged/src/main/java` plus the merge history. It tells you whether
+The check was a symbol survey of `fleetd/src/main/java` plus the merge history. It tells you whether
 the machinery exists at all. It is **not** a line-by-line audit of whether each criterion is fully
 met, and I did not run one.
 

docs/MCP-Contract.md

@@ -4,11 +4,11 @@
 > any MCP code existed. The system shipped and this page never caught up, so **its tool names,
 > parameter names and REST paths are wrong today**. Audited 2026-08-17; the specific drift:
 >
-> - **Tools it names that do not exist:** `bridge_read`, `bridge_cancel`.
-> - **Shipped tools it omits:** `bridge_poll`, `bridge_ack`, `bridge_profiles`, `bridge_whoami`.
+> - **Tools it names that do not exist:** `fleet_read`, `fleet_cancel`.
+> - **Shipped tools it omits:** `fleet_poll`, `fleet_ack`, `fleet_profiles`, `fleet_whoami`.
 > - **Parameter names are wrong nearly everywhere** — it says `message`/`target`/`timeout_seconds`/
 >   `block` where the code takes `content`/`sessionId`/`timeoutMs`/`wait`; `text` where
->   `bridge_reply` takes `content`; `target` where `bridge_stop` takes `paneId`.
+>   `fleet_reply` takes `content`; `target` where `fleet_stop` takes `paneId`.
 > - **REST paths are wrong:** it says `POST /workers` and `DELETE /workers/{paneId}`; the daemon
 >   serves `POST /members` and `DELETE /members/{paneId}`.
 >
@@ -60,7 +60,7 @@ face** is the herdr Unix socket. REST/SSE remains only for non-Claude clients an
 flowchart LR
     OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
     subgraph BD["fleetd — standalone daemon"]
-        MCP["MCP server (north face)<br/>bridge_send · bridge_reply<br/>bridge_ask · bridge_status · lifecycle"]
+        MCP["MCP server (north face)<br/>fleet_send · fleet_reply<br/>fleet_ask · fleet_status · lifecycle"]
         RDV["rendezvous registry<br/>(blocking-call waiters)"]
         INJ["Injector + StatusPoller<br/>(status-gated writer)"]
         SOCK["herdr socket client (south face)"]
@@ -72,8 +72,8 @@ flowchart LR
     HERDR["herdr<br/>panes · agent-status"]
     W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
 
-    OPUS -->|"bridge_send (blocks)"| MCP
-    W -.->|"bridge_reply / bridge_ask"| MCP
+    OPUS -->|"fleet_send (blocks)"| MCP
+    W -.->|"fleet_reply / fleet_ask"| MCP
     SOCK -->|"agent.start · agent.send<br/>agent.get · pane.close"| HERDR
     HERDR -->|"drives PTY"| W
 
@@ -97,8 +97,8 @@ request — this is the linchpin of the whole contract and has no code yet.
 - **The primary is "not a worker".** Any connection that does not map to a known worker is
   treated as a primary. It addresses workers **explicitly** by `target` — a session UUID,
   a `terminal_id`, or a friendly `profile` name.
-- **Turn correlation.** A blocking `bridge_send` registers a *waiter* keyed by worker
-  identity. A worker's later `bridge_reply` / `bridge_ask` on the same identity resolves that
+- **Turn correlation.** A blocking `fleet_send` registers a *waiter* keyed by worker
+  identity. A worker's later `fleet_reply` / `fleet_ask` on the same identity resolves that
   waiter. A `turn_id` is minted per exchange so a clarification round-trip
   (§6.2) rejoins the right turn.
 
@@ -123,36 +123,36 @@ This adds an MCP-server dependency the pom does not yet carry. See [Open decisio
 
 | Tool | Caller | Blocks? | Backing (exists today?) |
 |---|---|---|---|
-| [`bridge_send`](#bridge_send) | primary | yes (default) | `Injector.enqueue` ✅ · rendezvous registry ❌ (CB-104) |
-| [`bridge_reply`](#bridge_reply) | worker | no | rendezvous ❌ · pane injection via `Injector` ✅ |
-| [`bridge_ask`](#bridge_ask) | worker | yes | reverse rendezvous ❌ |
-| [`bridge_status`](#bridge_status) | either | no | `AgentControl.status` ✅ · `Injector.activeTargets` ✅ |
-| [`bridge_spawn`](#lifecycle) | primary | no | `WorkerService.spawn` ✅ (`POST /workers`) |
-| [`bridge_list`](#lifecycle) | either | no | `WorkerService.list` ✅ (`/agents`) |
-| [`bridge_stop`](#lifecycle) | primary | no | `WorkerService.stop` ✅ (`DELETE /workers/{paneId}`) |
-| [`bridge_read`](#bridge_read) | primary | no | `AgentControl.read` ✅ |
-| [`bridge_cancel`](#bridge_cancel) | primary | no | — ❌ (future) |
+| [`fleet_send`](#fleet_send) | primary | yes (default) | `Injector.enqueue` ✅ · rendezvous registry ❌ (CB-104) |
+| [`fleet_reply`](#fleet_reply) | worker | no | rendezvous ❌ · pane injection via `Injector` ✅ |
+| [`fleet_ask`](#fleet_ask) | worker | yes | reverse rendezvous ❌ |
+| [`fleet_status`](#fleet_status) | either | no | `AgentControl.status` ✅ · `Injector.activeTargets` ✅ |
+| [`fleet_spawn`](#lifecycle) | primary | no | `WorkerService.spawn` ✅ (`POST /workers`) |
+| [`fleet_list`](#lifecycle) | either | no | `WorkerService.list` ✅ (`/agents`) |
+| [`fleet_stop`](#lifecycle) | primary | no | `WorkerService.stop` ✅ (`DELETE /workers/{paneId}`) |
+| [`fleet_read`](#fleet_read) | primary | no | `AgentControl.read` ✅ |
+| [`fleet_cancel`](#fleet_cancel) | primary | no | — ❌ (future) |
 
 ### Core: delegation & rendezvous
 
-#### `bridge_send`
+#### `fleet_send`
 *(primary → worker — the headline tool, CB-104)*
 
 - **Params:** `message` (required); `target` (optional — defaults to the sole worker / default
   profile); `timeout_seconds` (default 600); `block` (default `true`); `auto_spawn`
-  (default `true`); `turn_id` (optional — supplied when answering a worker's `bridge_ask`).
+  (default `true`); `turn_id` (optional — supplied when answering a worker's `fleet_ask`).
 - **Blocking (`block:true`):** enqueue `message` via the `Injector`, then hold the call open
   until exactly one of:
-  - worker calls `bridge_reply` → `{ outcome:"reply", text }`
-  - worker calls `bridge_ask` → `{ outcome:"question", text, turn_id }`
+  - worker calls `fleet_reply` → `{ outcome:"reply", text }`
+  - worker calls `fleet_ask` → `{ outcome:"question", text, turn_id }`
   - worker's `agent_status` reaches done/idle with no reply → `{ outcome:"turn_done", text:<terminal tail> }`
   - deadline elapses → `{ outcome:"timeout" }`
   - worker gone → error `worker_gone`
 - **Detached (`block:false`):** enqueue and return `{ outcome:"dispatched", dispatch_id }`
   immediately. The eventual reply is injected into the primary's idle pane (§6.3), or drained
-  via `bridge_status` on a split-host primary.
+  via `fleet_status` on a split-host primary.
 
-#### `bridge_reply`
+#### `fleet_reply`
 *(worker → primary)*
 
 - **Params:** `text` (required); `final` (default `true`).
@@ -160,28 +160,28 @@ This adds an MCP-server dependency the pom does not yet carry. See [Open decisio
   waiter exists (detached delegation), `fleetd` **injects the primary's idle pane** instead.
   Returns `{ delivered:true, mode:"resolved"|"injected" }`. No `target` — identity is implicit.
 
-#### `bridge_ask`
+#### `fleet_ask`
 *(worker → primary — the reverse rendezvous)*
 
 - **Params:** `question` (required); `timeout_seconds`.
 - **Behavior:** blocks the *worker's* call. Surfaces the question to the primary (resolving its
-  open `bridge_send` with `outcome:"question"`, or injecting its pane). When the primary
-  answers — a `bridge_send` carrying the matching `turn_id` — that unblocks this call and
+  open `fleet_send` with `outcome:"question"`, or injecting its pane). When the primary
+  answers — a `fleet_send` carrying the matching `turn_id` — that unblocks this call and
   returns `{ answer }` to the worker, which continues **in the same turn**.
 
 ### Worker lifecycle
 <a id="lifecycle"></a>
 Thin adapters over [`WorkerService`](1-Architecture) — parity with the existing REST routes.
 
-- **`bridge_spawn`** — `{ profile? }` → worker view (`sessionId`, `terminalId`, `paneId`,
+- **`fleet_spawn`** — `{ profile? }` → worker view (`sessionId`, `terminalId`, `paneId`,
   `status`). Guard-checked; a boundary breach returns error `subscription_boundary` (the
   REST `403`).
-- **`bridge_list`** — no params → all workers + `agent_status`. Read-only, either role.
-- **`bridge_stop`** — `{ target }` → tears down the pane and its dedicated tab. Idempotent.
+- **`fleet_list`** — no params → all workers + `agent_status`. Read-only, either role.
+- **`fleet_stop`** — `{ target }` → tears down the pane and its dedicated tab. Idempotent.
 
 ### Observability
 
-#### `bridge_status`
+#### `fleet_status`
 *(either role — the README's 4th named tool)*
 
 - **Params:** `target?`.
@@ -190,7 +190,7 @@ Thin adapters over [`WorkerService`](1-Architecture) — parity with the existin
   messages addressed to me** — the path a split-host primary's `Stop`-hook uses to wake and
   collect replies without being injectable. Read-only, non-blocking.
 
-#### `bridge_read`
+#### `fleet_read`
 *(primary)*
 
 - **Params:** `target`; `source` ∈ `visible | recent | recent_unwrapped | detection`.
@@ -199,7 +199,7 @@ Thin adapters over [`WorkerService`](1-Architecture) — parity with the existin
 
 ### Control (future)
 
-#### `bridge_cancel`
+#### `fleet_cancel`
 *(primary)*
 
 - **Params:** `target`. Interrupt the worker's current turn / abandon the rendezvous. No
@@ -294,7 +294,7 @@ sequenceDiagram
 ## 7. Status gating
 
 Delivery only happens in a safe window. This is the state machine the `Injector` already
-enforces via `AgentStatus.injectable()`; MCP `bridge_send` is simply its producer.
+enforces via `AgentStatus.injectable()`; MCP `fleet_send` is simply its producer.
 
 ```mermaid
 stateDiagram-v2
@@ -330,17 +330,17 @@ touching this state machine.
 
 ## 8. Error model
 
-| Condition | `bridge_send` result | Notes |
+| Condition | `fleet_send` result | Notes |
 |---|---|---|
 | Worker replies | `{ outcome:"reply" }` | normal |
-| Worker asks | `{ outcome:"question", turn_id }` | answer with `bridge_send(turn_id)` |
+| Worker asks | `{ outcome:"question", turn_id }` | answer with `fleet_send(turn_id)` |
 | Turn ends, no reply | `{ outcome:"turn_done" }` | terminal tail as text |
 | Deadline elapsed | `{ outcome:"timeout" }` | message may still be queued/delivered |
 | Worker vanished | error `worker_gone` | `Injector.drop` fails the queued future |
 | Guard breach on spawn | error `subscription_boundary` | REST `403` parity |
 | Delivery failed at herdr | error, message dropped | poisoned message not left blocking the FIFO |
 
-`bridge_reply` from a worker with no open waiter is **not** an error — it falls through to
+`fleet_reply` from a worker with no open waiter is **not** an error — it falls through to
 detached pane injection (§6.3).
 
 ---
@@ -352,11 +352,11 @@ seam. Only the **rendezvous registry** and the **caller-identity resolver** are
 
 | MCP tool | Existing collaborator | New work |
 |---|---|---|
-| `bridge_send` | `Injector.enqueue`, `AgentControl.send` | waiter registry, timeout, outcome mux (CB-104) |
-| `bridge_reply` / `bridge_ask` | `Injector` (pane injection) | reverse rendezvous, identity resolver |
-| `bridge_status` | `AgentControl.status`, `Injector.activeTargets` | pending-drain projection |
-| `bridge_spawn` / `list` / `stop` | `WorkerService.{spawn,list,stop}` | MCP adapter only |
-| `bridge_read` | `AgentControl.read` | MCP adapter only |
+| `fleet_send` | `Injector.enqueue`, `AgentControl.send` | waiter registry, timeout, outcome mux (CB-104) |
+| `fleet_reply` / `fleet_ask` | `Injector` (pane injection) | reverse rendezvous, identity resolver |
+| `fleet_status` | `AgentControl.status`, `Injector.activeTargets` | pending-drain projection |
+| `fleet_spawn` / `list` / `stop` | `WorkerService.{spawn,list,stop}` | MCP adapter only |
+| `fleet_read` | `AgentControl.read` | MCP adapter only |
 
 Because the REST routes in `FleetApp` already exercise the collaborators, MCP tools are
 validated by **parity** against those routes, not by re-testing behavior.
@@ -365,14 +365,14 @@ validated by **parity** against those routes, not by re-testing behavior.
 
 ## 10. Open decisions
 
-1. **`bridge_ask` direction.** This page defines it as *worker-asks-primary* (a genuine reverse
+1. **`fleet_ask` direction.** This page defines it as *worker-asks-primary* (a genuine reverse
    channel, matching the "inject the primary's pane" language). The alternative — a synonym for
    a blocking primary→worker send — is weaker and produces different plumbing. **Recommend
    worker-asks-primary.**
-2. **Detached delivery shape.** A `block:false` param on `bridge_send` (keeps the catalog
-   small) vs. a separate `bridge_dispatch` tool. **Recommend the param.**
-3. **Auto-spawn on send.** `bridge_send` provisions a worker per profile when none exists
-   (simplest primary UX) vs. requiring an explicit `bridge_spawn` first. **Recommend
+2. **Detached delivery shape.** A `block:false` param on `fleet_send` (keeps the catalog
+   small) vs. a separate `fleet_dispatch` tool. **Recommend the param.**
+3. **Auto-spawn on send.** `fleet_send` provisions a worker per profile when none exists
+   (simplest primary UX) vs. requiring an explicit `fleet_spawn` first. **Recommend
    auto-spawn, defaulting on.**
 4. **Transport & SDK.** Streamable-HTTP/SSE co-located with the REST bind (recommended) vs.
    stdio. Requires choosing a Java MCP server SDK and adding it to the pom.
@@ -381,9 +381,9 @@ validated by **parity** against those routes, not by re-testing behavior.
 
 ## 11. Implementation staging
 
-- **CB-104** — blocking `bridge_send` + rendezvous registry + caller-identity resolver
+- **CB-104** — blocking `fleet_send` + rendezvous registry + caller-identity resolver
   (the producer that finally drives the inert `StatusPoller`).
-- **CB-1xx** — `bridge_reply` / `bridge_ask` reverse rendezvous + detached pane injection.
-- **CB-1xx** — lifecycle + observability adapters (`bridge_spawn/list/stop/status/read`).
+- **CB-1xx** — `fleet_reply` / `fleet_ask` reverse rendezvous + detached pane injection.
+- **CB-1xx** — lifecycle + observability adapters (`fleet_spawn/list/stop/status/read`).
 - **CB-1xx** — transport wiring + `claude mcp add` docs; parity tests vs. REST.
-- **Later** — `bridge_cancel`; swap `StatusPoller` for herdr `events.subscribe`.
+- **Later** — `fleet_cancel`; swap `StatusPoller` for herdr `events.subscribe`.

e2e/README.md

@@ -2,7 +2,7 @@
 
 A standard, repeatable **live** end-to-end test of the two-way channel: it drives a real
 multi-turn conversation between a primary and an off-subscription worker **through the
-running `bridged` daemon**, captures the full transcript, and grades the channel.
+running `fleetd` daemon**, captures the full transcript, and grades the channel.
 
 This is the committed form of the ad-hoc channel test that discovered the CB-115 gaps
 (herdr `unknown` misclassification wedging delivery, dirty completion scrapes, and workers
@@ -20,7 +20,7 @@ construction** — it only calls the bridge's loopback REST face.
 ```mermaid
 sequenceDiagram
     participant T as conversation_test.py
-    participant B as bridged (REST)
+    participant B as fleetd (REST)
     participant W as worker (off-sub)
     T->>B: POST /workers  (spawn)
     T->>B: GET /sessions/{id}/status  (await ready)
@@ -37,7 +37,7 @@ sequenceDiagram
 
 ## Prerequisites
 
-- `bridged` is running (default REST on `http://127.0.0.1:8765`) with at least one worker
+- `fleetd` is running (default REST on `http://127.0.0.1:8765`) with at least one worker
   profile configured and its backend reachable.
 - herdr is up (the daemon needs it).
 - Python 3 (standard library only — no pip installs).

e2e/conversation_sustained_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Sustained back-and-forth bridge test — ONE primary, ONE worker, many dependent turns
-over a fixed wall-clock window (default 5 minutes), through the running `bridged` daemon.
+over a fixed wall-clock window (default 5 minutes), through the running `fleetd` daemon.
 
 Where conversation_test.py proves a handful of turns work and issue_hunt_test.py proves
 fan-out isolation, this proves the channel stays healthy under a *sustained, stateful*

e2e/conversation_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Standard bridge conversation test — a multi-turn primary↔worker exchange through
-the running `bridged` daemon, fully captured, with automatic gap analysis.
+the running `fleetd` daemon, fully captured, with automatic gap analysis.
 
 This is the repeatable form of the ad-hoc channel test that surfaced the CB-115 gaps
 (herdr `unknown` misclassification, dirty completion scrape, workers not calling

e2e/fleet_ask_test.py

@@ -24,7 +24,7 @@ Like the rest of the suite it talks ONLY to the bridge's REST face on loopback
 ANTHROPIC_BASE_URL and never touches herdr, so it is subscription-safe by construction.
 
 Usage:
-    python3 bridge_ask_test.py [--base URL] [--profile NAME] [--repo DIR] [--out DIR]
+    python3 fleet_ask_test.py [--base URL] [--profile NAME] [--repo DIR] [--out DIR]
                                [--send-timeout SECS] [--answer-timeout SECS] [--keep-worker]
 
     --base            bridge REST base URL              (default http://127.0.0.1:8765)

e2e/fleet_ask_transcript.md

@@ -1,12 +1,12 @@
-# Live bridge_ask — reverse rendezvous — 2026-07-16 16:30
+# Live fleet_ask — reverse rendezvous — 2026-07-16 16:30
 
 One worker paused its delegated turn to ask the primary, then resumed with the answer (profile `default`). Result: **`OK`**.
 
 ## Round-trip
 
 1. **primary → worker** (delegation): the ask-forcing task.
-2. **worker → primary** (`bridge_ask`, 6.6s): 'PICK A COLOR: red or blue?' — surfaced on the primary's blocked send as a `question` with `turnId=term_656bb47d2c42a9e#1`.
+2. **worker → primary** (`fleet_ask`, 6.6s): 'PICK A COLOR: red or blue?' — surfaced on the primary's blocked send as a `question` with `turnId=term_656bb47d2c42a9e#1`.
 3. **primary → worker** (answer on that turn): `blue`.
-4. **worker → primary** (`bridge_reply`, 7.9s, source=reply): 'CHOSEN=BLUE'
+4. **worker → primary** (`fleet_reply`, 7.9s, source=reply): 'CHOSEN=BLUE'
 
 > **OK:** asked, resumed the same turn, and the reply reflected the primary's answer

e2e/issue_hunt_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Standard bridge fan-out test — ONE primary vs MANY workers, concurrently, for
-issue hunting through the running `bridged` daemon, fully captured, with gap analysis.
+issue hunting through the running `fleetd` daemon, fully captured, with gap analysis.
 
 Where conversation_test.py exercises a single worker over multiple turns, this drives
 the path that only appears under fan-out: the primary spawns N workers, sends each a
@@ -53,11 +53,11 @@ REPO_ROOT = HERE.parent
 # hot files this project has been iterating on, so a real issue is plausible to find.
 DEFAULT_ASSIGNMENTS = [
     {"id": "completion", "probe": "CompletionResolver",
-     "target": "bridged/src/main/java/dev/ltms/bridged/inject/CompletionResolver.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java"},
     {"id": "worker", "probe": "WorkerService",
-     "target": "bridged/src/main/java/dev/ltms/bridged/worker/WorkerService.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/worker/WorkerService.java"},
     {"id": "rendezvous", "probe": "Rendezvous",
-     "target": "bridged/src/main/java/dev/ltms/bridged/msg/Rendezvous.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/msg/Rendezvous.java"},
 ]
 
 PROMPT_TMPL = (

fleetd/.gitignore

@@ -2,8 +2,8 @@
 target/
 dependency-reduced-pom.xml
 
-# Local runtime config (copy from fleetd.example.yaml). Both names: the live file is still
-# bridged.yaml until the cutover, and Fleetd reads either one.
+# Local runtime config (copy from fleetd.example.yaml). Both names are ignored: fleetd.yaml is
+# the current name, and bridged.yaml is the legacy name Fleetd still falls back to.
 fleetd.yaml
 bridged.yaml
 

fleetd/fleetd.example.yaml

@@ -1,10 +1,10 @@
-# bridged configuration (example). Copy to bridged.yaml and adjust.
+# fleetd configuration (example). Copy to fleetd.yaml and adjust.
 #
-# bridged is the sole gateway between primary/worker Claude sessions and herdr.
+# fleetd is the sole gateway between primary/worker Claude sessions and herdr.
 # It is NOT a Claude process and must never carry ANTHROPIC_BASE_URL.
 
 # REST + MCP listen address. Keep it on loopback unless you also switch auth.mode to `token`
-# below — bridged REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
+# below — fleetd REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
 bind:
   host: 127.0.0.1
   port: 8765
@@ -21,7 +21,7 @@ bind:
 #                           bind — the daemon fails fast otherwise, because "unauthenticated ⇒
 #                           primary" on a reachable port would hand spawn/stop/send to anyone.
 #   tokenEnv              → host env var holding the token (never the literal value). Default
-#                           BRIDGED_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
+#                           FLEETD_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
 #
 # TLS is deliberately NOT terminated in the daemon (CB-501 D3): run a reverse proxy in front and
 # let it own certificate lifecycle, e.g.
@@ -29,7 +29,7 @@ bind:
 # The broker link gets TLS from its own URI (amqps://…) — see `broker` below.
 # auth:
 #   mode: token
-#   tokenEnv: BRIDGED_API_TOKEN
+#   tokenEnv: FLEETD_API_TOKEN
 
 # Optional pinned primary terminal (CB-307). Names the herdr pane the PRIMARY itself runs in:
 # a caller whose connection maps to this pane resolves as the primary (no credential needed —
@@ -48,10 +48,10 @@ bind:
 # every orchestration call. List each lead's pane here and all of them resolve as leads.
 #
 #   tab → the ONLY field identity depends on (CB-579); the exact label of the tab hosting the lead.
-#         Label the tab yourself, or let bridged label one it launches — see `fleet.leaders:` below.
+#         Label the tab yourself, or let fleetd label one it launches — see `fleet.leaders:` below.
 #   kind/model → descriptive; they document what runs in the pane and are echoed by fleet_whoami
 #
-# A lead's tab must already carry its label (or be launched by bridged, which labels it) — there is
+# A lead's tab must already carry its label (or be launched by fleetd, which labels it) — there is
 # no terminal id to paste in and nothing to re-pin when the session restarts: the tab survives, so
 # the same label resolves the same lead again on the next scan.
 # `fleet_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
@@ -63,7 +63,7 @@ bind:
 # Leads are configured under `fleet.leaders:` — see THE FLEET further down.
 #
 # Two things stop the tab-name convention from becoming a way to claim leadership: the configured
-# member spaces are excluded from the scan, so nothing bridged places can land in a matching tab;
+# member spaces are excluded from the scan, so nothing fleetd places can land in a matching tab;
 # and startup REFUSES a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel`
 # override, also matches — so the two namespaces cannot overlap by accident. The label is a NAME,
 # never a capability: what a pane may do is decided by the role the daemon resolves for it.
@@ -93,21 +93,20 @@ bind:
 #   intervalSeconds → how often a tick runs (default 30). ENFORCED floor of 15: the code computes
 #                      Math.max(15, intervalSeconds), so a lower value is silently raised, not
 #                      rejected.
-#   workingSuspectAfterSeconds, paneProbeIntervalSeconds → accepted and parsed, but NOT YET READ by
-#                      anything — the dormant monitor only consumes intervalSeconds today (CB-573
-#                      shipped ahead of the evidence publishers these two knobs are for). Setting
-#                      them changes nothing right now, and no minimum is enforced on either, because
-#                      nothing reads them to enforce one. They exist so a later build can start
-#                      honouring them without another config-shape change.
+#   workingSuspectAfterSeconds → age before a BUSY member is suspected of a stall (default 600).
+#                      ENFORCED floor of 300: a lower value is silently raised.
+#   paneProbeIntervalSeconds → accepted and parsed, but NOT YET READ by anything. Setting it changes
+#                      nothing right now. It exists so a later build can start honouring it without
+#                      another config-shape change.
 #   notifications.mode → "webhook" flips what fleet_list REPORTS (healthCoverage: "full" instead
-#                      of "detection-only") — it does NOT make bridged send any webhook call; no
+#                      of "detection-only") — it does NOT make fleetd send any webhook call; no
 #                      delivery mechanism is implemented yet. Any other value, or omitting the
 #                      block, reports "detection-only".
 # health:
 #   enabled: true
-#   intervalSeconds: 30
-#   workingSuspectAfterSeconds: 600
-#   paneProbeIntervalSeconds: 60
+#   intervalSeconds: 30               # floor 15
+#   workingSuspectAfterSeconds: 600   # floor 300 — how long BUSY with no activity means STALL_SUSPECTED
+#   paneProbeIntervalSeconds: 60      # parsed, but nothing reads it yet — changing it changes nothing
 #   notifications:
 #     mode: disabled
 
@@ -115,6 +114,9 @@ bind:
 # (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
 herdrSocket: ~/.config/herdr/herdr.sock
 
+# Optional socket for member panes. Omit this to use herdrSocket for both leads and members.
+# memberHerdrSocket: /Users/member/.config/herdr/herdr.sock
+
 # How member sessions are spawned. Define one or more named profiles (backends) under
 # `profiles`; each key is the profile name (also the ccs profile). A profile says only WHICH
 # BACKEND — model, CLI adapter, credentials, cost. It says nothing about what a member spawned on
@@ -124,16 +126,16 @@ herdrSocket: ~/.config/herdr/herdr.sock
 # Shared knobs (placement/workspace) can be repeated per profile; they usually match.
 #   placement: tab   → each worker lands in its OWN tab in a dedicated worker space (default).
 #                      Use `pane` for the legacy behaviour (split the focused tab).
-#   mcpUrl           → bridged mounts the bridge MCP (--mcp-config, inline) + reply charter
+#   mcpUrl           → fleetd mounts the bridge MCP (--mcp-config, inline) + reply charter
 #                      (--append-system-prompt) as launch flags; nothing is written to the profile.
-#   ideMcpUrl        → opt-in (CB-634), default off. When set, bridged mounts the IDE Index MCP as a
+#   ideMcpUrl        → opt-in (CB-634), default off. When set, fleetd mounts the IDE Index MCP as a
 #                      second inline server named `intellij`, and adds an IDE charter that pins every
 #                      ide_* call to the member's own worktree. A URL, not a boolean — host and port
 #                      are host-specific. Set it only on a host where the IDE actually runs.
 #   ideProjectDir    → repo-relative module dir the IDE opens and the overlay pins (CB-634). Only read
-#                      when ideMcpUrl is set. This repo's Maven pom lives in `bridged/`, not at the
+#                      when ideMcpUrl is set. This repo's Maven pom lives in `fleetd/`, not at the
 #                      worktree root, so opening the root imports no module and ide_* resolves nothing;
-#                      set this to `bridged`. Omit for a repo whose project is the worktree root.
+#                      set this to `fleetd`. Omit for a repo whose project is the worktree root.
 #   ideOpenCommand   → host command that opens ideProjectDir in the IDE at spawn (CB-634 auto-open).
 #                      Only read when ideMcpUrl is set. `{dir}` is replaced with the absolute module
 #                      dir and the command runs through `/bin/sh -c`, so set env inline if needed —
@@ -151,7 +153,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      already), so this is instead applied as the model's `limit.context` in the
 #                      generated opencode.json — the member compacts WITHIN this window, not exactly
 #                      at it — and only when this profile's `model:` is in `provider/model` form; if it
-#                      isn't, bridged logs a WARN naming the profile rather than silently doing nothing.
+#                      isn't, fleetd logs a WARN naming the profile rather than silently doing nothing.
 #   tokenEnv         → host env var holding the worker's auth token (value never stored in config);
 #                      omit for a backend that needs no token (e.g. a local ollama).
 #   cwd              → pin this profile's working directory (CB-112). Omit to inherit the primary's
@@ -170,7 +172,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      checkout, so its navigation returned paths OUTSIDE its own worktree: one
 #                      worker made all 59 of its edits in the primary tree while compiling its
 #                      worktree, and every build it ran was of code that did not contain them.
-#                      bridged neutralizes a provisioned worktree's .mcp.json for this reason;
+#                      fleetd neutralizes a provisioned worktree's .mcp.json for this reason;
 #                      listing it here would copy the primary's back over that.
 #   gitTokenEnv      → host env var holding the git-forge API token. When set, its value is injected
 #                      as GITEA_TOKEN so the worker can open its OWN PR at checkpoint (CB-302).
@@ -183,7 +185,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      refused on a subscription usage limit, rather than a real answer. Opt-in —
 #                      omit and this profile's completion fallback behaves exactly as before.
 #                      Every backend words its refusal differently, so this is config, never a
-#                      vendor string baked into bridged itself.
+#                      vendor string baked into fleetd itself.
 #                      DEFERRED: compiled once into a startup pattern map — editing it needs a
 #                      daemon restart, same as this profile's model/baseUrl/argv.
 #   credentialId     → CB-578 stage B: the credential this profile quarantines WITH when a
@@ -198,15 +200,15 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #   env              → extra environment for this profile's workers, as a literal key/value map
 #                      (CB-511). Use it to give workers a toolchain.
 #
-#                      A worker's environment does NOT come from your shell. bridged hands herdr an
+#                      A worker's environment does NOT come from your shell. fleetd hands herdr an
 #                      explicit env map and herdr merges it into ITS OWN process env — so before
 #                      CB-511 a worker inherited whatever PATH the herdr server happened to be
 #                      started with, which on a long-lived herdr can predate your toolchain entirely
 #                      and leave workers unable to run `mvn` or `java` at all.
-#                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
+#                      fleetd now propagates ITS OWN PATH to every worker by default; set `env:`
 #                      only to override that or add more (JAVA_HOME, …). Since the default is the
 #                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
-#                      lines in deploy/dev.ltms.fleet.plist and deploy/bridged.service.
+#                      lines in deploy/dev.ltms.fleet.plist and deploy/fleetd.service.
 #
 #                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
 #                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
@@ -219,10 +221,10 @@ profiles:
     baseUrl: http://gx01.gw:8000     # the vLLM host this profile targets (gx00.gw / gx01.gw)
     model: coder
     placement: tab
-    workspace: bridged-workers
+    workspace: fleetd-workers
     # tabLabel: an optional per-profile override; the fleet template usually covers it
     mcpUrl: http://127.0.0.1:8765/mcp
-    tokenEnv: BRIDGED_WORKER_TOKEN
+    tokenEnv: FLEETD_WORKER_TOKEN
     argv: ["ccs", "gx10"]
     # weight: relative selection weight for automatic placement (weighted, round-robin, and
     # fixed's fallback walk). Absent defaults to 1.0. An explicit 0 or negative value means
@@ -266,13 +268,13 @@ profiles:
     # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
     # parityOverlay: [".env", ".envrc"]   # the default; never add .mcp.json or .claude/settings.local.json — see above
     # ideMcpUrl: http://127.0.0.1:29170/index-mcp/streamable-http   # opt-in (CB-634): IDE code intelligence, pinned to the worktree
-    # ideProjectDir: bridged          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in bridged/)
+    # ideProjectDir: fleetd          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in fleetd/)
     # ideOpenCommand: env DISPLAY=:10.0 idea {dir}   # CB-634 auto-open: opens {dir} in the IDE at spawn; omit to open by hand
     # autoCompactWindow: 250000   # opt-in: bound member context; claude-code compacts AT this, opencode within it (model limit.context)
   gx11:                              # a second backend, so `placement: weighted` has a choice
     baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
     placement: tab
-    workspace: bridged-workers
+    workspace: fleetd-workers
     # tabLabel: an optional per-profile override; the fleet template usually covers it
     mcpUrl: http://127.0.0.1:8765/mcp
     argv: ["ccs", "gx11"]
@@ -298,7 +300,7 @@ profiles:
   #     kind: opencode
   #     model: opencode/north-mini-code-free  # `provider/model` selector, injected as `-m`
   #     placement: tab
-  #     workspace: bridged-workers
+  #     workspace: fleetd-workers
   #     tabLabel: "opencode: {profile} #{n}"
   #     mcpUrl: http://127.0.0.1:8765/mcp
   #     argv: ["opencode"]
@@ -323,7 +325,7 @@ profiles:
   #     baseUrl: http://127.0.0.1:8000
   #     model: local-vllm/deepseek-v4-flash
   #     placement: tab
-  #     workspace: bridged-workers
+  #     workspace: fleetd-workers
   #     tabLabel: "opencode: {profile} #{n}"
   #     mcpUrl: http://127.0.0.1:8765/mcp
   #     argv: ["opencode"]
@@ -361,8 +363,8 @@ placement: weighted
 # quarantineCooldownSeconds: 1800
 
 # Re-read this file without restarting the daemon (CB-559). Off unless you add this block, so an
-# upgraded bridged keeps the old behaviour: the file is read once at boot and never again.
-#   enabled          → turn the watch on. bridged checks the file's modified time on a timer and
+# upgraded fleetd keeps the old behaviour: the file is read once at boot and never again.
+#   enabled          → turn the watch on. fleetd checks the file's modified time on a timer and
 #                      reloads when it moves.
 #   intervalSeconds  → how often to check (default 10). One `stat` per tick, so this is cheap.
 #
@@ -477,7 +479,7 @@ fleet:
   #     workspace: leads             # where a launched lead's tab is created (default "leads").
   #                                  # MUST NOT be a member workspace — those are excluded from the
   #                                  # scan, so a lead placed in one is never found again.
-  #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
+  #     cwd: /path/to/repo           # the launched lead's working directory (default: fleetd's own)
   #     kind: claude                 # descriptive; reported by fleet_whoami
   #   gpt-sol-5.6:
   #     tab: "lead: gpt-sol-5.6"
@@ -506,7 +508,7 @@ guard:
 
 # Member credential policy (CB-596, gitea issue #82). A herdr pane runs a LOGIN shell, and that
 # shell re-sources the operator's own secret store — so a spawned member inherits every credential
-# the operator's shell holds, not just the ones bridged means to give it. Measured on this host:
+# the operator's shell holds, not just the ones fleetd means to give it. Measured on this host:
 # 31 credential names, all set, with only ONE (GITEA_ACCESS_TOKEN) blocked before this — and that
 # block was a single name hardcoded in HerdrPeerLauncher.java, not driven by this file. This block
 # replaces that hardcoded shadow with a config-driven list of names.
@@ -695,7 +697,7 @@ guard:
 #
 #                    REQUIRED (CB-522) if the primary itself runs inside a herdr pane. Caller
 #                    identity resolves a loopback PID to its herdr pane, and PaneLocator scans
-#                    EVERY pane — not just bridged-spawned ones — so such a primary is otherwise
+#                    EVERY pane — not just fleetd-spawned ones — so such a primary is otherwise
 #                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
 #                    self-locking: the learned terminal is populated by the very orchestration
 #                    calls being refused, so only this pinned value can break the cycle. Read the

fleetd/pom.xml

@@ -106,7 +106,7 @@
         </dependency>
 
         <!-- MCP server: the SERVER face. Streamable-HTTP servlet mounted on Javalin's Jetty at
-             /mcp, exposing bridge_send/bridge_reply/bridge_status as thin adapters over REST. -->
+             /mcp, exposing fleet_send/fleet_reply/fleet_status as thin adapters over REST. -->
         <dependency>
             <groupId>io.modelcontextprotocol.sdk</groupId>
             <artifactId>mcp</artifactId>
@@ -161,10 +161,10 @@
     </dependencies>
 
     <build>
-        <!-- CB-632: stays 'bridged' until the cutover renames the module dir and the launchd
-         plist together. The installed plist names bridged/target/bridged.jar and
-         KeepAlive is armed, so renaming the jar alone strands a restart. -->
-        <finalName>bridged</finalName>
+        <!-- CB-634: the cutover renamed the module dir (bridged/ -> fleetd/), the jar, and the
+         launchd plist together. The installed plist names fleetd/target/fleetd.jar and
+         KeepAlive is armed, so this name, the plist, and the wrapper must move as one. -->
+        <finalName>fleetd</finalName>
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -206,7 +206,7 @@
                 </configuration>
             </plugin>
 
-            <!-- Runnable fat jar: java -jar target/bridged.jar -->
+            <!-- Runnable fat jar: java -jar target/fleetd.jar -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -7,6 +7,7 @@ import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.HerdrRouter;
 import dev.ltms.fleet.herdr.LeadTabScanner;
 import dev.ltms.fleet.lead.LeadLauncher;
 import dev.ltms.fleet.herdr.PaneLocator;
@@ -60,7 +61,6 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
@@ -70,12 +70,11 @@ import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;
 
 /**
- * {@code bridged} entry point. Wires the real herdr socket client to the REST app and
+ * {@code fleetd} entry point. Wires the real herdr socket client to the REST app and
  * starts listening. Before anything else it asserts its own environment is clean —
- * {@code bridged} is not a Claude process and must never carry a base_url.
+ * {@code fleetd} is not a Claude process and must never carry a base_url.
  */
 public final class Fleetd {
 
@@ -94,9 +93,10 @@ public final class Fleetd {
     private static final long HERDR_WAIT_POLL_MILLIS = 500;
 
     /**
-     * CB-632: prefer {@code fleetd.yaml} in {@code dir}; fall back to {@code bridged.yaml} when
-     * the new name is not there. The operator's live file is still named {@code bridged.yaml},
-     * so the old name keeps working until that file moves.
+     * CB-632/CB-634: prefer {@code fleetd.yaml} in {@code dir}; fall back to the legacy
+     * {@code bridged.yaml} when the new name is not there. The product renamed to {@code fleetd},
+     * but a deployment whose local config file is still {@code bridged.yaml} keeps working until
+     * that file is renamed.
      */
     static Path chooseDefaultConfigFile(Path dir) {
         Path fleetd = dir.resolve("fleetd.yaml");
@@ -108,8 +108,8 @@ public final class Fleetd {
 
     static void main(String[] args) {
         Path configPath = args.length > 0 ? Path.of(args[0]) : chooseDefaultConfigFile(Path.of(""));
-        // CB-632: the config file is being renamed bridged.yaml -> fleetd.yaml. Name the file we
-        // actually loaded, whichever of the two names it carries.
+        // The config file was renamed bridged.yaml -> fleetd.yaml. Name the file we actually
+        // loaded, whichever of the two names it carries.
         log.info("Using configuration file {}", configPath);
         FleetConfig cfg = FleetConfig.load(configPath);
         // CB-594: report which secret env vars the config actually needs, by name, before anything
@@ -127,7 +127,7 @@ public final class Fleetd {
         // contract; adding a reader here does not make a key reloadable by itself.
         ConfigRef config = new ConfigRef(configPath, cfg);
 
-        // The primary/host env that launched bridged must not be tainted.
+        // The primary/host env that launched fleetd must not be tainted.
         SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
         guard.assertPrimaryClean(System.getenv());
 
@@ -150,9 +150,12 @@ public final class Fleetd {
                 : UnixSocketHerdrClient.defaultSocketPath();
 
         UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect(socket, new com.fasterxml.jackson.databind.ObjectMapper());
-
-        AgentControl agents = new AgentControl(herdr);
-        WorkspaceControl spaces = new WorkspaceControl(herdr);
+        UnixSocketHerdrClient memberHerdr = cfg.memberHerdrSocket() != null && !cfg.memberHerdrSocket().isBlank()
+                ? UnixSocketHerdrClient.connect(Path.of(cfg.memberHerdrSocket()), new com.fasterxml.jackson.databind.ObjectMapper())
+                : herdr;
+        AtomicReference<Supplier<Map<String, String>>> leadsRef = new AtomicReference<>(Map::of);
+        HerdrRouter router = new HerdrRouter(herdr, memberHerdr,
+                target -> leadsRef.get().get().containsKey(target));
         // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
         // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
         // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
@@ -170,14 +173,14 @@ public final class Fleetd {
         // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
         // unless opencode is the only kind configured.
         if (!claudeProfiles.isEmpty() || opencodeProfiles.isEmpty()) {
-            adapters.add(new ClaudeCodeLauncher(agents, spaces, guard,
+            adapters.add(new ClaudeCodeLauncher(router.memberAgents(), router.memberSpaces(), guard,
                     claudeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                     () -> config.get().fleet(),
                     () -> config.get().memberCredentials()));
         }
         if (!opencodeProfiles.isEmpty()) {
-            adapters.add(new OpenCodeLauncher(agents, spaces,
+            adapters.add(new OpenCodeLauncher(router.memberAgents(), router.memberSpaces(),
                     opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                     () -> config.get().fleet(),
@@ -196,7 +199,7 @@ public final class Fleetd {
                 config,
                 profileName -> liveCountRef.get().apply(profileName),
                 quarantine);
-        // CB-504: under supervision (launchd/systemd) bridged can start before herdr's socket
+        // CB-504: under supervision (launchd/systemd) fleetd can start before herdr's socket
         // exists. The client itself is lazy — it connects per call — but the orphan reap below is
         // the first thing that actually talks to herdr, so without this wait a boot-order race
         // would crash the daemon into a restart loop. Wait, then degrade rather than die: serving
@@ -255,34 +258,39 @@ public final class Fleetd {
         final Supplier<Map<String, String>> leads;
         var leaders = cfg.fleet().leaders();
         if (!leaders.isEmpty()) {
-            Set<String> memberSpaces = cfg.profiles().values().stream()
-                    .map(FleetConfig.Profile::workspace)
-                    .filter(Objects::nonNull)
-                    .collect(Collectors.toSet());
             Map<String, String> tabToName = new LinkedHashMap<>();
             leaders.forEach((name, leader) -> {
                 if (leader != null && leader.tab() != null && !leader.tab().isBlank()) {
                     tabToName.put(leader.tab(), name);
                 }
             });
+            // The lead and the members now share ONE workspace (the operator asked for a single
+            // "session" with many tabs), so no workspace can be excluded — the lead lives in the
+            // members' space by design. A lead is told from a member by its exact tab label alone:
+            // a lead carries its configured `tab`, a member its `worker: {profile} #{n}` template,
+            // and the two never collide. (The scanner still supports an exclusion set for a split
+            // layout; the fleet's policy here is simply not to use one.)
+            //
             // One shared rescan cadence: still taken from the first entry, as before — it is an
             // operational cadence, not identity, so there is no correctness reason to give every
             // lead its own scanner.
             int scanIntervalSeconds = leaders.values().iterator().next().scanIntervalSeconds();
-            leads = new LeadTabScanner(herdr, tabToName, memberSpaces,
+            // This must use the lead daemon: scanning member tabs would demote the lead to a worker.
+            leads = new LeadTabScanner(herdr, tabToName, Set.of(),
                     TimeUnit.SECONDS.toNanos(scanIntervalSeconds), System::nanoTime);
-            log.info("lead scan: tabs {} host a lead (rescan every {}s, member spaces {} excluded)",
-                    tabToName.keySet(), scanIntervalSeconds, memberSpaces);
+            log.info("lead scan: tabs {} host a lead (rescan every {}s, shared fleet space)",
+                    tabToName.keySet(), scanIntervalSeconds);
         } else {
             leads = () -> leadTerminals;
         }
+        leadsRef.set(leads);
 
         // CB-558: start any declared lead that is not already running. After the scanner is built,
         // because both read the same tab labels and the ordering makes that dependency visible; and
         // only when herdr answered, because the launcher's whole safety property is that it can
         // count live leads first — it must never guess and risk a second orchestrator.
         if (herdrUp && !leaders.isEmpty()) {
-            int launched = new LeadLauncher(agents, spaces, cfg).ensureLeads();
+            int launched = new LeadLauncher(router.leadAgents(), router.leadSpaces(), cfg).ensureLeads();
             if (launched > 0) {
                 log.info("lead auto-launch: {} lead(s) started", launched);
             }
@@ -338,6 +346,7 @@ public final class Fleetd {
                                     + "BACKEND_EXHAUSTED): {}", credentialId,
                             cfg.quarantineCooldownSeconds(), profile.profile(), reason);
                 });
+        AgentControl agents = router.memberAgents();
         CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns, exhaustionSink);
         // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
         // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
@@ -378,13 +387,14 @@ public final class Fleetd {
                 sessions.onTurnFailed(target);
             }
         };
-        Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
+        Predicate<String> deliverable = deliverableTo(presence, leads);
+        Injector injector = new Injector(router, turnListener, deliverable,
                 presence::forget);
-        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
+        StatusPoller poller = new StatusPoller(router, injector, Injector.POLL_INTERVAL_MILLIS);
         poller.start();
 
         // CB-307: reply inbox. A broker: block selects the AMQP-backed durable adapter; absent (or
-        // unusable), bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
+        // unusable), fleetd stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
         // connection, so keep the reference to close it in the ordered shutdown hook.
         final ReplyInbox replyInbox = selectReplyInbox(cfg.broker(), System.getenv(), AmqpReplyInbox::open);
         // CB-637: this daemon's lead-to-lead mailbox on the SHARED coordination vhost — a separate
@@ -417,7 +427,7 @@ public final class Fleetd {
         // are counted at their single funnel rather than at each of the two caller-facing surfaces.
         // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
         Metrics metrics = FleetMetrics.create(sessions, replyInbox);
-        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
+        var pushLoop = new ReplyPushLoop(primaryRegistry, router.leadAgents(), replyInbox,
                 pushScheduler, maxReminders, backoffMs, metrics);
         // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
         // an upgraded daemon cannot silently start spending subscription on nudging an idle lead.
@@ -427,7 +437,7 @@ public final class Fleetd {
                 Thread.ofVirtual().name("bridge-heartbeat-").unstarted(r));
         if (cfg.leadHeartbeat() != null) {
             var hb = cfg.leadHeartbeat();
-            heartbeat = new LeadHeartbeatLoop(primaryRegistry, agents, replyInbox, sessions::roster,
+            heartbeat = new LeadHeartbeatLoop(primaryRegistry, router.leadAgents(), replyInbox, sessions::roster,
                     pushLoop, heartbeatScheduler, System::nanoTime,
                     TimeUnit.SECONDS.toNanos(hb.idleAfterSeconds()), hb.backoffMs(), hb.quietNudgeCap(),
                     metrics);
@@ -436,7 +446,7 @@ public final class Fleetd {
             heartbeat = null;
             heartbeatScheduler.shutdownNow();
         }
-        MessageService messages = new MessageService(agents, injector, rendezvous, replyInbox,
+        MessageService messages = new MessageService(router, injector, rendezvous, replyInbox,
                 pushLoop, metrics);
 
         // Health is a slow whole-fleet observer. Keep it separate from the 250ms delivery poller.
@@ -447,7 +457,8 @@ public final class Fleetd {
             // CB-580: a member found GONE/NEVER_READY must fail whatever ticket is waiting on it,
             // through the same idempotent target-wide operation CB-516 already uses on release.
             healthMonitor = new FleetHealthMonitor(agents, sessions::roster, messages, healthScheduler,
-                    System::nanoTime, cfg.health().intervalOrDefault(), messages::abandon);
+                    System::nanoTime, cfg.health().intervalOrDefault(),
+                    cfg.health().workingSuspectAfterOrDefault(), messages::abandon);
             String coverage = FleetHealthMonitor.coverage(true,
                     cfg.health().notifications() != null && cfg.health().notifications().configured());
             if ("detection-only".equals(coverage)) {
@@ -487,8 +498,11 @@ public final class Fleetd {
 
         // MCP server face (CB-105): fleet_send/fleet_reply/fleet_status, mounted at /mcp.
         // Caller identity is resolved from the connection (peer PID → herdr pane), not arguments.
+        // CB-185: a caller's pane can live on either daemon (a lead's on the lead daemon, a
+        // member's on the member daemon) — search both, lead first. Collapses to one scan when
+        // memberHerdrSocket is unset (herdr == memberHerdr).
         ConnectionIdentity identity = new ConnectionIdentity(
-                new PaneLocator(herdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
+                new PaneLocator(herdr, memberHerdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
 
         // CB-501: one resolver behind both entry paths. Worker identity still comes from the
         // connection and is never token-gated, so enabling token mode cannot lock the fleet out.
@@ -497,7 +511,7 @@ public final class Fleetd {
             String token = System.getenv(cfg.auth().tokenEnv());
             if (token == null || token.isBlank()) {
                 throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
-                        + " is unset or empty — export it before starting bridged");
+                        + " is unset or empty — export it before starting fleetd");
             }
             callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
             log.info("auth: token mode (bearer required for non-worker callers, env {})",
@@ -534,7 +548,7 @@ public final class Fleetd {
         if (leadMailbox != null) {
             var leadCoordScheduler = Executors.newSingleThreadScheduledExecutor(r ->
                     Thread.ofVirtual().name("bridge-leadcoord-").unstarted(r));
-            leadCoordLoop = new LeadCoordLoop(leadMailbox, agents, leads, leadCoordScheduler,
+            leadCoordLoop = new LeadCoordLoop(leadMailbox, router.leadAgents(), leads, leadCoordScheduler,
                     LEAD_COORD_INTERVAL_MS);
             leadCoordLoop.start();
             leadCoordSchedulerRef = leadCoordScheduler;
@@ -585,13 +599,15 @@ public final class Fleetd {
                     log.debug("lead mailbox close: {}", e.toString());
                 }
             }
-            herdr.close();
+            router.close();
         }));
 
-        Javalin app = new FleetApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
-                callers, metrics).build();
+        // CB-185: give FleetApp both daemons — /healthz must require both to answer and
+        // GET /sessions must merge across both, or a down/unpolled member daemon is invisible.
+        Javalin app = new FleetApp(herdr, memberHerdr, workers, sessions, messages, presence, mcp.servlet(),
+                callers, metrics, deliverable).build();
         app.start(cfg.bind().host(), cfg.bind().port());
-        log.info("bridged listening on {}:{}, herdr socket {}",
+        log.info("fleetd listening on {}:{}, herdr socket {}",
                 cfg.bind().host(), cfg.bind().port(), socket);
     }
 
@@ -665,7 +681,7 @@ public final class Fleetd {
             log.warn("coordinator.selfId is unset — lead coordination is OFF. A lead mailbox is the "
                     + "queue named after the coord-id that owns it, so with no id there is nothing to "
                     + "own and no sender identity to publish as. Set coordinator.selfId to a name that "
-                    + "is unique across every daemon sharing {} and restart bridged.",
+                    + "is unique across every daemon sharing {} and restart fleetd.",
                     stripCredentials(uri));
             return null;
         }
@@ -708,7 +724,7 @@ public final class Fleetd {
             if (effectiveUri == null) {
                 log.warn("broker.uriEnv={} is unset or blank — durable AMQP reply inbox DISABLED. "
                                 + "Replies are soft-state and will not survive a restart. Set {} in the "
-                                + "daemon's environment (see scripts/redeploy-bridged.sh) and restart to "
+                                + "daemon's environment (see scripts/redeploy-fleetd.sh) and restart to "
                                 + "use the durable broker inbox.",
                         broker.uriEnv(), broker.uriEnv());
                 log.info("reply inbox: in-memory (soft-state)");
@@ -823,8 +839,8 @@ public final class Fleetd {
             } else {
                 log.warn("startup secret {}: MISSING ({}) — the daemon will start anyway, and this "
                                 + "failure stays invisible until a worker actually needs it. Fix "
-                                + "${SHARED_ENV}/tools/secrets.sh and restart bridged from a LOGIN "
-                                + "shell (see scripts/redeploy-bridged.sh).",
+                                + "${SHARED_ENV}/tools/secrets.sh and restart fleetd from a LOGIN "
+                                + "shell (see scripts/redeploy-fleetd.sh).",
                         varName, String.join(", ", sources));
             }
         });
@@ -856,7 +872,7 @@ public final class Fleetd {
         log.warn("memberCredentials: absent or empty — the daemon will start anyway, and every "
                 + "member pane inherits the operator's WHOLE secret store, unblocked (CB-592's "
                 + "protection is lost). Add a memberCredentials: block (policy/allow/known) to "
-                + "bridged.yaml — see fleetd.example.yaml — and restart.");
+                + "fleetd.yaml — see fleetd.example.yaml — and restart.");
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -71,7 +71,7 @@ public final class ConfigRef implements Supplier<FleetConfig> {
 
     /** Keys that cannot change under a running daemon — see the class doc. */
     private static final Set<String> COLD_KEYS =
-            Set.of("bind", "herdrSocket", "broker", "auth");
+             Set.of("bind", "herdrSocket", "memberHerdrSocket", "broker", "auth");
 
     private final Path path;
     private final AtomicReference<FleetConfig> current;
@@ -128,7 +128,7 @@ public final class ConfigRef implements Supplier<FleetConfig> {
             }
             if (!applied) {
                 return "config reload refused — these keys cannot change under a running daemon: "
-                        + String.join(", ", coldKeys) + ". Restart bridged to apply them.";
+                        + String.join(", ", coldKeys) + ". Restart fleetd to apply them.";
             }
             if (!deferred.isEmpty()) {
                 return "config reloaded; these changes need a restart to take effect: "
@@ -190,6 +190,9 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         if (!Objects.equals(old.herdrSocket(), fresh.herdrSocket())) {
             changed.add("herdrSocket");
         }
+        if (!Objects.equals(old.memberHerdrSocket(), fresh.memberHerdrSocket())) {
+            changed.add("memberHerdrSocket");
+        }
         if (!Objects.equals(old.broker(), fresh.broker())) {
             changed.add("broker");
         }

fleetd/src/main/java/dev/ltms/fleet/config/ConfigWatcher.java

@@ -11,7 +11,7 @@ import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
 /**
- * Polls {@code bridged.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
+ * Polls {@code fleetd.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
  * (CB-559). Opt-in through {@code configReload.enabled}.
  *
  * <p><strong>Why polling and not a filesystem watch.</strong> {@code WatchService} on macOS has no

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -26,13 +26,14 @@ import java.util.Map;
 import java.util.Set;
 
 /**
- * {@code bridged} configuration, loaded from a YAML file (see
+ * {@code fleetd} configuration, loaded from a YAML file (see
  * {@code fleetd.example.yaml}). Unknown keys are ignored so config can grow ahead
  * of the code — but an unknown <em>top-level</em> key is logged as a WARN at load (CB-530), because
  * silently dropping a whole block is indistinguishable from honouring it.
  *
  * @param bind          REST/MCP listen host:port
- * @param herdrSocket   path to herdr's Unix socket ({@code null} → client default)
+ * @param herdrSocket   path to the lead herdr Unix socket ({@code null} → client default)
+ * @param memberHerdrSocket optional member herdr Unix socket ({@code null}/blank → lead socket)
  * @param profiles      named backend profiles, keyed by profile name (multi-backend fleet). A
  *                      profile answers <em>which backend</em> — model, CLI adapter, credentials,
  *                      cost. It says nothing about what the member spawned on it is for; that is
@@ -80,6 +81,7 @@ import java.util.Set;
 public record FleetConfig(
         Bind bind,
         String herdrSocket,
+        String memberHerdrSocket,
         Map<String, Profile> profiles,
         Guard guard,
         String worktreeRoot,
@@ -105,7 +107,7 @@ public record FleetConfig(
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
                          ConfigReload configReload, Integer quarantineCooldownSeconds,
                          MemberCredentials memberCredentials) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
                 configReload, quarantineCooldownSeconds, memberCredentials, null);
     }
@@ -116,9 +118,9 @@ public record FleetConfig(
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
                          ConfigReload configReload, Integer quarantineCooldownSeconds) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, null);
+                configReload, quarantineCooldownSeconds, null, null);
     }
 
     /** Default cooldown (CB-578 stage B) when {@code quarantineCooldownSeconds} is absent/non-positive. */
@@ -129,8 +131,8 @@ public record FleetConfig(
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, String placement, Auth auth) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
-                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, null, null);
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, null, null, null, null);
     }
 
     /** Back-compat form before the optional {@code health:} block was added. */
@@ -138,8 +140,8 @@ public record FleetConfig(
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, String placement, Auth auth, ConfigReload configReload) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
-                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, configReload, null);
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, configReload, null, null, null);
     }
 
     /** Back-compat form before the CB-578 stage B {@code quarantineCooldownSeconds} field was added. */
@@ -148,9 +150,9 @@ public record FleetConfig(
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
                          ConfigReload configReload) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, null);
+                configReload, null, null, null);
     }
 
     /**
@@ -196,9 +198,9 @@ public record FleetConfig(
      * @param argv      launch command; defaults to {@code ["claude"]}
      * @param placement where a worker lands: {@code "tab"} (default — its own tab in the
      *                  worker space) or {@code "pane"} (legacy — split the focused tab)
-     * @param workspace label of the dedicated worker space; found-or-created on first
-     *                  spawn (default {@code "bridged-workers"}). A future per-session
-     *                  layout is just a distinct label here — the shared space is default.
+     * @param workspace label of the shared fleet space; found-or-created on first spawn
+     *                  (default {@code "fleet"}). The lead and every member share this one
+     *                  space so the operator sees a single "session" with many tabs.
      * @param tabLabel  template for a worker tab's label; {@code {profile}}/{@code {model}}
      *                  and {@code {n}} (per-worker number, to keep sibling tabs distinct)
      *                  are substituted (default {@code "worker: {profile} #{n}"})
@@ -218,7 +220,7 @@ public record FleetConfig(
      *                       worktrees then accumulate with no error anywhere.
      *                       <p>Checked on 2026-08-15 (CB-581): inert as configured. Tracked overlay
      *                       files carry {@code --skip-worktree} so {@code --porcelain} cannot see them,
-     *                       {@code bridged.yaml} is gitignored, and the default pair {@code .env} /
+     *                       {@code fleetd.yaml} is gitignored, and the default pair {@code .env} /
      *                       {@code .envrc} does not exist in this repo. Note the default applies to
      *                       <em>every</em> profile, so creating either file at the repo root is enough
      *                       to make it live. Add a new overlay path to {@code .gitignore} in the same
@@ -341,9 +343,9 @@ public record FleetConfig(
                     ? (KIND_CLAUDE_CODE.equals(k) ? List.of("claude") : List.of(k))
                     : List.copyOf(argv);
             kind = k;
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_WORKER_TOKEN" : tokenEnv;
+            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "FLEETD_WORKER_TOKEN" : tokenEnv;
             placement = (placement == null || placement.isBlank()) ? "tab" : placement.toLowerCase();
-            workspace = (workspace == null || workspace.isBlank()) ? "bridged-workers" : workspace;
+            workspace = (workspace == null || workspace.isBlank()) ? "fleet" : workspace;
             // CB-557: no per-profile default any more. A label is generated from the member's ROLE
             // ("dev: sonnet #2"), which a profile cannot know, so the template lives on `fleet:` and
             // this field is only an override for a profile that wants its own. Blank ⇒ defer.
@@ -389,7 +391,7 @@ public record FleetConfig(
             // (pinned to its own worktree via the charter). Blank ⇒ off.
             ideMcpUrl = (ideMcpUrl == null || ideMcpUrl.isBlank()) ? null : ideMcpUrl;
             // CB-634 auto-open: both are only read when hasIdeMcp(). ideProjectDir is the repo-relative
-            // module dir IntelliJ must open (this repo's pom lives in `bridged/`, not at the root), and
+            // module dir IntelliJ must open (this repo's pom lives in `fleetd/`, not at the root), and
             // it is also the project_path the overlay pins. Blank ⇒ the worktree root (unchanged before
             // auto-open). ideOpenCommand is the host command that opens that dir in the IDE, with {dir}
             // substituted; blank ⇒ no auto-open (the operator opens the module by hand).
@@ -642,6 +644,9 @@ public record FleetConfig(
                          Integer paneProbeIntervalSeconds, Notifications notifications) {
         public boolean isEnabled() { return Boolean.TRUE.equals(enabled); }
         public int intervalOrDefault() { return Math.max(15, intervalSeconds == null ? 30 : intervalSeconds); }
+        public int workingSuspectAfterOrDefault() {
+            return Math.max(300, workingSuspectAfterSeconds == null ? 600 : workingSuspectAfterSeconds);
+        }
         public record Notifications(String mode) {
             public boolean configured() { return "webhook".equalsIgnoreCase(mode); }
         }
@@ -649,7 +654,7 @@ public record FleetConfig(
 
     /**
      * External AMQP broker for durable, cross-restart reply delivery (CB-307 Stage 2). Its mere
-     * presence swaps the in-memory {@code ReplyInbox} for the AMQP-backed adapter; absent, bridged
+     * presence swaps the in-memory {@code ReplyInbox} for the AMQP-backed adapter; absent, fleetd
      * stays soft-state. Production default is LavinMQ; a stock RabbitMQ speaks the same AMQP 0-9-1
      * and is a URI-only swap.
      *
@@ -857,11 +862,12 @@ public record FleetConfig(
                          String workspace, String cwd) {
 
         /**
-         * Where an auto-launched lead's tab is created (CB-558). It must NOT be a member workspace:
-         * {@code LeadTabScanner} excludes those wholesale, so a lead placed in one would never be
-         * discovered and the daemon would relaunch it on every boot.
+         * Where an auto-launched lead's tab is created (CB-558). It defaults to the SAME shared
+         * {@code "fleet"} space the members use, so the operator sees one "session" with many tabs.
+         * The scanner no longer excludes member spaces — it tells a lead from a member by the exact
+         * tab label, so a lead sharing the members' space is still discovered (see LeadLauncher).
          */
-        public static final String DEFAULT_WORKSPACE = "leads";
+        public static final String DEFAULT_WORKSPACE = "fleet";
 
         public Leader {
             instances = (instances == null || instances < 0) ? 1 : instances;
@@ -1060,7 +1066,7 @@ public record FleetConfig(
     }
 
     /**
-     * Watch {@code bridged.yaml} and re-read it when it changes (CB-559).
+     * Watch {@code fleetd.yaml} and re-read it when it changes (CB-559).
      *
      * <p>Opt-in, like every other block that acts on its own initiative. A daemon that reloads
      * whenever a file is saved would apply a half-finished edit the moment an editor writes it, and
@@ -1118,7 +1124,7 @@ public record FleetConfig(
      *                 a caller must present {@code Authorization: Bearer <token>} or it is
      *                 {@code ANONYMOUS} and authorized for nothing.
      * @param tokenEnv name of the host env var holding the bearer token; the literal value is
-     *                 never stored in config. Defaults to {@code BRIDGED_API_TOKEN}. Only read
+     *                 never stored in config. Defaults to {@code FLEETD_API_TOKEN}. Only read
      *                 when {@code mode} is {@code token}.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
@@ -1131,7 +1137,7 @@ public record FleetConfig(
 
         public Auth {
             mode = (mode == null || mode.isBlank()) ? MODE_LOOPBACK_TRUST : mode.toLowerCase();
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_API_TOKEN" : tokenEnv;
+            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "FLEETD_API_TOKEN" : tokenEnv;
         }
 
         /** True when a bearer token is required of every non-worker caller. */
@@ -1313,10 +1319,10 @@ public record FleetConfig(
      *
      * <p>Package-private (not {@code private}) so a test can assert every key here is documented in
      * {@code fleetd.example.yaml} — the only committed description of the config schema, since
-     * {@code bridged.yaml} itself is gitignored.
+     * {@code fleetd.yaml} itself is gitignored.
      */
     static final Set<String> KNOWN_TOP_LEVEL_KEYS = Set.of(
-            "bind", "herdrSocket", "profiles", "guard", "worktreeRoot",
+            "bind", "herdrSocket", "memberHerdrSocket", "profiles", "guard", "worktreeRoot",
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
             "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
             "memberCredentials", "coordinator");
@@ -1342,7 +1348,7 @@ public record FleetConfig(
             rejectUnknownPlacementPolicy(cfg.placement());
             return cfg.withDefaults();
         } catch (IOException e) {
-            throw new UncheckedIOException("cannot read bridged config at " + path, e);
+            throw new UncheckedIOException("cannot read fleetd config at " + path, e);
         }
     }
 
@@ -1929,7 +1935,7 @@ public record FleetConfig(
         // guard/lifecycle, an absent block is not a safe "feature off" default here, it is a gap. It
         // is deliberately not pre-populated with a Java-side name list (that would just reintroduce
         // the hardcoded-list defect this record replaces); the block must be configured in
-        // bridged.yaml to protect anything. See fleetd.example.yaml's memberCredentials: comment.
+        // fleetd.yaml to protect anything. See fleetd.example.yaml's memberCredentials: comment.
         // CB-633: policy stays deny-by-default here — the allow-list scrub is opt-in, because it is
         // stricter than today's behaviour (it blanks every non-derived name, not just known ones)
         // and an upgrade must not change what a running deployment's members inherit.
@@ -1937,7 +1943,7 @@ public record FleetConfig(
                 : new MemberCredentials(null, List.of(), List.of());
         // coordinator is left as-is, like broker/primary above: null keeps no LeadMailbox opened,
         // and this ticket's Coordinator is config-only anyway (nothing yet reads it at startup).
-        return new FleetConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
+        return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
                 quarantineCooldown, mc, coordinator);
     }
@@ -1969,7 +1975,7 @@ public record FleetConfig(
     /**
      * Reject a lead-scan convention that a worker tab would also satisfy (CB-531).
      *
-     * <p>The scan reads a tab label and concludes "a lead lives here". bridged also <em>writes</em>
+     * <p>The scan reads a tab label and concludes "a lead lives here". fleetd also <em>writes</em>
      * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
      * a member template matches and the daemon starts labelling its own members as leads, promoting
      * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.

fleetd/src/main/java/dev/ltms/fleet/guard/SubscriptionGuard.java

@@ -16,7 +16,7 @@ import java.util.Set;
  *       means its traffic would leave the subscription. That is a hard stop.</li>
  * </ul>
  *
- * Both checks throw {@link GuardException} on violation. {@code bridged} calls
+ * Both checks throw {@link GuardException} on violation. {@code fleetd} calls
  * {@link #assertWorker} before spawning a worker and {@link #assertPrimaryClean}
  * against its own environment at startup.
  */

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -3,6 +3,7 @@ package dev.ltms.fleet.health;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.msg.MessageService;
 import dev.ltms.fleet.session.MemberSession;
 import org.slf4j.Logger;
@@ -25,6 +26,8 @@ public final class FleetHealthMonitor {
 
     /** Bounded attempts to run {@link #failTarget} for one transition. Never retried tick-to-tick (CB-580). */
     static final int MAX_FAIL_TARGET_ATTEMPTS = 3;
+    // CB-641: Match the injector's 60s readiness gate so health allows a full first boot.
+    static final long READINESS_GRACE_NANOS = TimeUnit.SECONDS.toNanos(60);
 
     private final AgentControl agents;
     private final Supplier<List<MemberSession>> roster;
@@ -32,12 +35,30 @@ public final class FleetHealthMonitor {
     private final ScheduledExecutorService scheduler;
     private final LongSupplier clock;
     private final long intervalSeconds;
+    private final long workingSuspectAfterNanos;
     private final BiConsumer<String, String> failTarget;
     private final Map<String, HealthPrior> priors = new HashMap<>();
     private final Map<String, HealthState> states = new HashMap<>();
+    /**
+     * CB-643: consecutive ticks on which a target looked like an orphaned delegation. The fact
+     * {@link MessageService#hasOrphanedDelegation} reports is a true snapshot, but it can read true
+     * for one tick during an ordinary race — an async ticket exists before its virtual thread has
+     * reached {@code rendezvous.open()}, so for that instant nothing is accepted or queued behind
+     * it. {@code decide} maps the field straight to {@code DELEGATION_ORPHANED} with no cross-tick
+     * smoothing of its own, so a single racy read would log a fault that clears on the next tick.
+     * Requiring two consecutive observations costs one interval of latency on a real orphan and
+     * removes that false positive entirely.
+     */
+    private final Map<String, Integer> orphanStreaks = new HashMap<>();
 
-    // These facts need the evidence publishers introduced by later M4 units. They are not negatives.
-    private static final boolean NOT_YET_OBSERVED = false;
+    /** How many consecutive ticks a target must look orphaned before health reports it (CB-643). */
+    static final int ORPHAN_CONFIRM_TICKS = 2;
+
+    // CB-643: every HealthSnapshot field now carries real evidence. The NOT_YET_OBSERVED placeholder
+    // that stood in for 7 of the 12 is gone, and with it the reason 8 of the 9 fault states were
+    // unreachable — GONE and NEVER_READY included, which is what kept CB-580's failTarget from ever
+    // firing. Do not reintroduce a constant here: a field with no publisher is a dead state, and the
+    // tests pass either way, so nothing else will tell you.
 
     /**
      * @param failTarget CB-568's idempotent target-wide failure operation (e.g. {@code messages::abandon}),
@@ -48,13 +69,14 @@ public final class FleetHealthMonitor {
      */
     public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
                               ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
-                              BiConsumer<String, String> failTarget) {
+                              long workingSuspectAfterSeconds, BiConsumer<String, String> failTarget) {
         this.agents = agents;
         this.roster = roster;
         this.messages = messages;
         this.scheduler = scheduler;
         this.clock = clock;
         this.intervalSeconds = intervalSeconds;
+        this.workingSuspectAfterNanos = TimeUnit.SECONDS.toNanos(workingSuspectAfterSeconds);
         this.failTarget = Objects.requireNonNull(failTarget, "failTarget");
     }
 
@@ -69,28 +91,50 @@ public final class FleetHealthMonitor {
     // Package-private so tests can run one tick without waiting.
     void tick() {
         try {
-            List<Agent> agentsNow = agents.list(); // Exactly one list call for this complete observation.
             List<MemberSession> rosterNow = roster.get(); // One in-memory roster snapshot for this tick.
+            List<Agent> agentsNow;
+            boolean controlLinkDown = false;
+            try {
+                agentsNow = agents.list(); // Exactly one list call for this complete observation.
+            } catch (HerdrException error) {
+                agentsNow = List.of();
+                controlLinkDown = true;
+                log.warn("fleet health control link unavailable; classifying roster", error);
+            }
             Map<String, Agent> live = new HashMap<>();
             for (Agent agent : agentsNow) live.put(agent.terminalId(), agent);
             HashSet<String> current = new HashSet<>();
+            long nowNanos = clock.getAsLong();
             for (MemberSession session : rosterNow) {
                 current.add(session.terminalId());
                 Agent agent = live.get(session.terminalId());
                 AgentStatus status = agent == null ? AgentStatus.UNKNOWN : agent.status();
                 boolean accepted = messages.hasAcceptedDelivery(session.terminalId());
-                HealthSnapshot snapshot = new HealthSnapshot(session.state(), status, accepted, NOT_YET_OBSERVED,
-                        messages.hasInboxMessage(session.terminalId()), agent != null, NOT_YET_OBSERVED,
-                        NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED);
+                boolean present = agent != null;
+                boolean targetNotFound = !controlLinkDown && !present
+                        && session.state() != MemberSession.State.SPAWNING;
+                boolean readinessGraceElapsed = nowNanos - session.spawnedAtNanos() >= READINESS_GRACE_NANOS;
+                boolean stalled = session.state() == MemberSession.State.BUSY
+                        && nowNanos - session.lastActivityAtNanos() >= workingSuspectAfterNanos;
+                // CB-643: the three message-layer facts CB-640 published. Read them here rather than
+                // leaving them false — that constant is what made 8 of the 9 fault states dead.
+                boolean queuedDelivery = messages.hasQueuedDelivery(session.terminalId());
+                boolean replyStranded = messages.hasStrandedReply(session.terminalId());
+                boolean orphanedDelegation = confirmOrphan(session.terminalId(),
+                        messages.hasOrphanedDelegation(session.terminalId()));
+                HealthSnapshot snapshot = new HealthSnapshot(session.state(), status, accepted, queuedDelivery,
+                        messages.hasInboxMessage(session.terminalId()), present, targetNotFound, controlLinkDown,
+                        readinessGraceElapsed, orphanedDelegation, replyStranded, stalled);
                 HealthDecision decision = decide(snapshot, priors.getOrDefault(session.terminalId(), HealthPrior.NONE),
-                        clock.getAsLong());
+                        nowNanos);
                 priors.put(session.terminalId(), decision.prior());
                 reportTransition(session.terminalId(), decision.state());
             }
             priors.keySet().retainAll(current);
             states.keySet().retainAll(current);
+            orphanStreaks.keySet().retainAll(current);
         } catch (Throwable error) {
-            // A list failure is health evidence, and must never kill the monitor's only scheduler task.
+            // Any unclassified collection failure must never kill the monitor's only scheduler task.
             log.warn("fleet health collection failed; will retry next tick", error);
         } finally {
             if (!scheduler.isShutdown()) {
@@ -99,6 +143,20 @@ public final class FleetHealthMonitor {
         }
     }
 
+    /**
+     * Debounce {@link MessageService#hasOrphanedDelegation} across ticks (CB-643). Returns true only
+     * once {@code observed} has held for {@link #ORPHAN_CONFIRM_TICKS} consecutive ticks; a single
+     * false reading resets the streak, so a transient race never reaches the classifier.
+     */
+    private boolean confirmOrphan(String target, boolean observed) {
+        if (!observed) {
+            orphanStreaks.remove(target);
+            return false;
+        }
+        int streak = orphanStreaks.merge(target, 1, Integer::sum);
+        return streak >= ORPHAN_CONFIRM_TICKS;
+    }
+
     void reportTransition(String target, HealthState next) {
         HealthState previous = states.put(target, next);
         if (previous == next) return;

fleetd/src/main/java/dev/ltms/fleet/herdr/AgentStatus.java

@@ -32,7 +32,7 @@ public enum AgentStatus {
         };
     }
 
-    /** Whether {@code bridged} may inject a message now without stepping on a live turn. */
+    /** Whether {@code fleetd} may inject a message now without stepping on a live turn. */
     public boolean injectable() {
         return this == IDLE || this == BLOCKED || this == DONE;
     }

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrClient.java

@@ -5,13 +5,13 @@ import com.fasterxml.jackson.databind.JsonNode;
 /**
  * Client face onto the herdr daemon (protocol 14, herdr 0.7.0).
  *
- * <p>This is the ONLY thing in {@code bridged} that speaks to herdr. Every method
+ * <p>This is the ONLY thing in {@code fleetd} that speaks to herdr. Every method
  * maps to a herdr JSON-RPC call over its Unix domain socket. Requests are
  * newline-delimited JSON with a <em>string</em> id; responses carry either a
  * {@code result} object (whose {@code type} field discriminates the payload) or an
  * {@code error} object.
  *
- * <p>Higher layers ({@code bridged}'s policy brain, REST endpoints, MCP adapters)
+ * <p>Higher layers ({@code fleetd}'s policy brain, REST endpoints, MCP adapters)
  * depend on this interface, not on the socket. Tests substitute a fake; the
  * {@code contract}-tagged suite exercises the real implementation against a running
  * herdr to catch protocol drift.

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrRouter.java

@@ -0,0 +1,40 @@
+package dev.ltms.fleet.herdr;
+
+import java.util.Objects;
+import java.util.function.Predicate;
+
+/** Routes lead operations and member operations to their owning herdr daemon. */
+public final class HerdrRouter implements AutoCloseable {
+    private final HerdrClient lead;
+    private final HerdrClient member;
+    private final AgentControl leadAgents;
+    private final AgentControl memberAgents;
+    private final WorkspaceControl leadSpaces;
+    private final WorkspaceControl memberSpaces;
+    private final Predicate<String> isLead;
+
+    public HerdrRouter(HerdrClient lead, HerdrClient member, Predicate<String> isLead) {
+        this.lead = Objects.requireNonNull(lead, "lead");
+        this.member = member != null ? member : lead;
+        this.isLead = Objects.requireNonNull(isLead, "isLead");
+        leadAgents = new AgentControl(this.lead);
+        memberAgents = this.member == this.lead ? leadAgents : new AgentControl(this.member);
+        leadSpaces = new WorkspaceControl(this.lead);
+        memberSpaces = this.member == this.lead ? leadSpaces : new WorkspaceControl(this.member);
+    }
+
+    public AgentControl leadAgents() { return leadAgents; }
+    public WorkspaceControl leadSpaces() { return leadSpaces; }
+    public AgentControl memberAgents() { return memberAgents; }
+    public WorkspaceControl memberSpaces() { return memberSpaces; }
+    public AgentControl agentsFor(String targetId) { return isLead.test(targetId) ? leadAgents : memberAgents; }
+
+    HerdrClient leadClient() { return lead; }
+    HerdrClient memberClient() { return member; }
+
+    @Override
+    public void close() {
+        lead.close();
+        if (member != lead) member.close();
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -39,18 +39,18 @@ import java.util.function.Supplier;
  *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
  *       become a lead by being placed — as a split, say — inside a matching tab.</li>
  *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
- *       {@link WorkspaceControl}, which no {@code bridge_*} tool exposes. The label is writable by
+ *       {@link WorkspaceControl}, which no {@code fleet_*} tool exposes. The label is writable by
  *       the human at the terminal and by nobody the bridge is defending against.</li>
  *   <li>The label is a <em>name</em>, not a capability. What a pane may do is decided by
  *       {@code Authz} against the role {@code CallerResolver} returns; a tab that calls itself a
  *       lead still cannot act as one unless the daemon's own registry agrees.</li>
  * </ol>
  *
- * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
- * that bridged never renames a lead tab, so the label was always the human's own writing and there
+ * <p><strong>CB-558 — fleetd now writes lead labels too.</strong> This class used to be able to say
+ * that fleetd never renames a lead tab, so the label was always the human's own writing and there
  * was no round-trip from the daemon's rename back into its next decision.
  * {@code dev.ltms.fleet.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
- * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
+ * daemon and found again by this scan. The trust direction above is unaffected — fleetd writing a
  * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
  * real: a label left behind by a session that has since died would read as a live lead forever.
  * This scanner does not solve that (its job is naming, and a stale name costs nothing here); the

fleetd/src/main/java/dev/ltms/fleet/herdr/PaneLocator.java

@@ -0,0 +1,88 @@
+package dev.ltms.fleet.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
+ * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
+ * the agent pane whose process tree contains it, so {@code fleetd} can tell <em>which worker</em>
+ * is calling without the worker sending anything spoofable.
+ *
+ * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
+ * and foreground process PIDs. This scans agent panes; a spawn-time {@code pid→terminal} cache is
+ * the obvious optimization once wired into {@code ClaudeCodeLauncher}.
+ *
+ * <p>CB-185 split the fleet across two herdr daemons — lead operations on one, members on the
+ * other ({@code memberHerdrSocket}). A caller's pane can live on <em>either</em> daemon (a lead's
+ * MCP connection resolves against the lead daemon; a member's against the member daemon), so this
+ * must be able to search more than one client. {@link #PaneLocator(HerdrClient, HerdrClient)}
+ * searches the lead client first, then the member client, and collapses to a single scan when the
+ * two are the same object (the historical single-daemon deployment).
+ */
+public final class PaneLocator {
+
+    private final List<HerdrClient> herdrs;
+
+    /** Search only this client — the single-daemon deployment. */
+    public PaneLocator(HerdrClient herdr) {
+        this.herdrs = List.of(herdr);
+    }
+
+    /**
+     * Search {@code lead} first, then {@code member} — the two-daemon deployment (CB-185). When
+     * the caller passes the same client for both (no {@code memberHerdrSocket} configured), this
+     * collapses to one client and one scan, exactly {@link #PaneLocator(HerdrClient)}'s behaviour.
+     */
+    public PaneLocator(HerdrClient lead, HerdrClient member) {
+        this.herdrs = lead == member ? List.of(lead) : List.of(lead, member);
+    }
+
+    /**
+     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
+     * {@code null} if no agent pane on any searched daemon owns it (e.g. the caller is the
+     * primary, or off-host).
+     */
+    public String terminalForPid(long pid) {
+        if (pid <= 0) {
+            return null;
+        }
+        for (HerdrClient herdr : herdrs) {
+            String terminal = terminalForPid(herdr, pid);
+            if (terminal != null) {
+                return terminal;
+            }
+        }
+        return null;
+    }
+
+    private static String terminalForPid(HerdrClient herdr, long pid) {
+        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
+            String paneId = pane.path("pane_id").asText(null);
+            if (paneId != null && paneOwnsPid(herdr, paneId, pid)) {
+                return pane.path("terminal_id").asText(null);
+            }
+        }
+        return null;
+    }
+
+    private static boolean paneOwnsPid(HerdrClient herdr, String paneId, long pid) {
+        JsonNode info;
+        try {
+            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
+        } catch (HerdrException e) {
+            return false; // pane vanished mid-scan — just skip it
+        }
+        if (info.path("shell_pid").asLong(-1) == pid) {
+            return true;
+        }
+        for (JsonNode p : info.path("foreground_processes")) {
+            if (p.path("pid").asLong(-1) == pid) {
+                return true;
+            }
+        }
+        return false;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/Workspace.java

@@ -7,7 +7,7 @@ import com.fasterxml.jackson.databind.JsonNode;
  * dedicated worker space so they never split or clutter the user's real work spaces.
  *
  * @param workspaceId herdr's stable id (e.g. {@code "w4"})
- * @param label       display label shown in herdr's UI (e.g. {@code "bridged-workers"})
+ * @param label       display label shown in herdr's UI (e.g. {@code "fleetd-workers"})
  * @param activeTabId the workspace's currently-focused tab, or {@code null}
  */
 public record Workspace(String workspaceId, String label, String activeTabId) {

fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -6,12 +6,14 @@ import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.time.Duration;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
 import java.util.TreeSet;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.LongSupplier;
 import java.util.regex.Pattern;
 
 /**
@@ -61,6 +63,17 @@ public final class CompletionResolver implements TurnListener {
     /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
     static final int MAX_SCRAPE_CHARS = 4000;
 
+    /**
+     * fleetd#164: the floor below which a {@code BUSY -> DONE} transition cannot be real work. A
+     * backend that rejects a turn outright (e.g. an HTTP 400 from the model, before the worker read
+     * a single file or produced a token) drives the exact same confirmed {@code working -> idle}
+     * transition a genuine completion does — just in about a second instead of the many seconds a
+     * real turn costs. {@link #onTurnComplete} cannot tell those two cases apart from the transition
+     * alone, so a turn that settles inside this floor is treated as a crash signature and resolved
+     * as a failure, never as a (possibly empty) success.
+     */
+    public static final long MIN_TURN_NANOS = Duration.ofSeconds(2).toNanos();
+
     private static final String CLIPPED_PANE_TAIL_MARKER =
             "[Pane tail clipped: member did not call fleet_reply.]";
 
@@ -68,6 +81,7 @@ public final class CompletionResolver implements TurnListener {
     private final Rendezvous rendezvous;
     private final ExhaustedPatternLookup exhaustedPatterns;
     private final ExhaustionSink exhaustionSink;
+    private final LongSupplier nowNanos;
 
     /**
      * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
@@ -79,8 +93,21 @@ public final class CompletionResolver implements TurnListener {
      * reference: a completion scrape equal to it means the worker produced no new output (the previous
      * turn's wind-down sampled as this boundary), so it is suppressed. Overwritten on each delivery;
      * cleared when the turn resolves. Package-private so tests can capture and replay a specific turn.
+     *
+     * <p>{@code deliveredAtNanos} (fleetd#164) is the {@link #nowNanos} reading taken at delivery —
+     * the other half of the {@link #MIN_TURN_NANOS} floor check, compared against a fresh reading at
+     * resolution time.
      */
-    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
+    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline, long deliveredAtNanos) {
+
+        /**
+         * Convenience for tests exercising scrape/suppression logic that don't care about turn
+         * timing: back-dates the delivery far enough that {@link #MIN_TURN_NANOS} can never fire.
+         * Not used by production code — {@link #captureBaseline} always records a real reading.
+         */
+        InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
+            this(waiter, baseline, Long.MIN_VALUE / 2);
+        }
     }
 
     private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();
@@ -97,10 +124,25 @@ public final class CompletionResolver implements TurnListener {
      */
     public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
                               ExhaustionSink exhaustionSink) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink, System::nanoTime);
+    }
+
+    /**
+     * Test constructor with an injectable clock (fleetd#164), matching the {@code LongSupplier}
+     * pattern {@link dev.ltms.fleet.session.SessionManager} and {@link dev.ltms.fleet.msg.MessageService}
+     * already use: lets a test place a turn's delivery and its resolution at an exact, controllable
+     * distance apart around the {@link #MIN_TURN_NANOS} floor, without a real sleep. Public (rather
+     * than package-private like those two) because callers that wire a full {@code MessageService}
+     * fixture — e.g. {@code MessageServiceTest} — construct this resolver directly from another
+     * package.
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                       ExhaustionSink exhaustionSink, LongSupplier nowNanos) {
         this.agents = agents;
         this.rendezvous = rendezvous;
         this.exhaustedPatterns = Objects.requireNonNull(exhaustedPatterns, "exhaustedPatterns");
         this.exhaustionSink = Objects.requireNonNull(exhaustionSink, "exhaustionSink");
+        this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
     }
 
     @Override
@@ -130,7 +172,7 @@ public final class CompletionResolver implements TurnListener {
             baseline = null; // fail open: no baseline ⇒ no suppression
             log.debug("delivery baseline for {} failed: {}", target, e.getMessage());
         }
-        inFlight.put(target, new InFlight(waiter, baseline));
+        inFlight.put(target, new InFlight(waiter, baseline, nowNanos.getAsLong()));
     }
 
     /** The turn currently baselined for {@code target}, or {@code null} — a test hook for the captureBaseline path. */
@@ -176,6 +218,15 @@ public final class CompletionResolver implements TurnListener {
             inFlight.remove(target, turn);
             return;
         }
+        // fleetd#164: a BUSY -> DONE transition inside the floor cannot be real work — it's a crash
+        // signature (e.g. a backend HTTP 400 before the worker did anything), not a fast answer. Fail
+        // it before spending a scrape on the ordinary path; the reason still carries whatever is on
+        // screen, since that is usually the backend's own error.
+        long elapsedNanos = nowNanos.getAsLong() - turn.deliveredAtNanos();
+        if (elapsedNanos < MIN_TURN_NANOS) {
+            fail(target, turn, tooFastReason(target, elapsedNanos));
+            return;
+        }
         String tail;
         String assistantBlock = null;
         int originalLength = 0;
@@ -187,20 +238,25 @@ public final class CompletionResolver implements TurnListener {
             clipped = originalLength > MAX_SCRAPE_CHARS;
             tail = clip(assistantBlock);
         } catch (RuntimeException e) {
-            // The worker finished but we couldn't read its screen — still resolve the send so the
-            // caller unblocks; an empty tail beats hanging until the caller's timeout.
-            log.warn("completion scrape for {} failed; resolving with an empty tail: {}",
-                    target, e.getMessage());
+            log.warn("completion scrape for {} failed: {}", target, e.getMessage());
             tail = "";
             scrapeFailed = true;
         }
+        // fleetd#164: a scrape nobody could read, and a scrape that read cleanly but produced nothing,
+        // both used to resolve the send as a SUCCESS carrying "" — indistinguishable from a worker that
+        // genuinely finished with nothing to say. That is the defect: fail loudly instead, naming the
+        // member, so a caller (including a lead deciding whether to delegate again) can tell a lost
+        // turn from a real empty answer.
+        if (scrapeFailed || tail.isEmpty()) {
+            fail(target, turn, emptyScrapeReason(target, scrapeFailed));
+            return;
+        }
         // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
         // delivery, this turn produced no new output — the boundary belongs to the previous turn's
         // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
         // a stale answer; the real fleet_reply (or a later genuine completion) resolves it instead.
-        // A scrape that failed to read is exempt — an empty tail there is "couldn't see", not "no change".
         String baseline = turn.baseline();
-        if (!scrapeFailed && baseline != null && baseline.equals(tail)) {
+        if (baseline != null && baseline.equals(tail)) {
             log.debug("suppressing misattributed completion for {} (no output change since delivery)",
                     target);
             return; // keep the in-flight record: a later genuine completion still needs it
@@ -208,21 +264,19 @@ public final class CompletionResolver implements TurnListener {
         // CB-578 stage A: a turn that ended with no fleet_reply AND whose scrape matches the
         // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
         // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
-        if (!scrapeFailed) {
-            Pattern exhausted = exhaustedPatterns.patternFor(target);
-            String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
-            if (matchedLine != null) {
-                String reason = "backend exhausted (usage limit): " + matchedLine;
-                if (rendezvous.resolveExhausted(waiter, reason)) {
-                    inFlight.remove(target, turn);
-                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no fleet_reply; scrape "
-                            + "matched the profile's exhausted pattern): {}", target, reason);
-                    // CB-578 stage B: only on the resolution that actually won the race — a late
-                    // duplicate must never quarantine a credential twice for one refusal.
-                    exhaustionSink.onExhausted(target, reason);
-                }
-                return;
+        Pattern exhausted = exhaustedPatterns.patternFor(target);
+        String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
+        if (matchedLine != null) {
+            String reason = "backend exhausted (usage limit): " + matchedLine;
+            if (rendezvous.resolveExhausted(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("completion for {} classified BACKEND_EXHAUSTED (no fleet_reply; scrape "
+                        + "matched the profile's exhausted pattern): {}", target, reason);
+                // CB-578 stage B: only on the resolution that actually won the race — a late
+                // duplicate must never quarantine a credential twice for one refusal.
+                exhaustionSink.onExhausted(target, reason);
             }
+            return;
         }
         String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
         if (rendezvous.resolveCompletion(waiter, completion)) {
@@ -272,6 +326,36 @@ public final class CompletionResolver implements TurnListener {
         }
     }
 
+    /**
+     * fleetd#164: the failure reason for a turn that settled inside {@link #MIN_TURN_NANOS} — names
+     * the member and both timings, and appends whatever the pane shows (usually the backend's own
+     * error) so the caller sees the cause, not just "it failed".
+     */
+    private String tooFastReason(String target, long elapsedNanos) {
+        String scrape;
+        try {
+            scrape = clip(agents.read(target, SCRAPE_SOURCE));
+        } catch (RuntimeException e) {
+            scrape = "";
+        }
+        String reason = String.format(
+                "member %s went BUSY -> DONE in %dms (floor %dms) — too fast to be real work, most "
+                        + "likely a backend error before any work started",
+                target, elapsedNanos / 1_000_000, MIN_TURN_NANOS / 1_000_000);
+        return scrape.isBlank() ? reason : reason + ": " + scrape;
+    }
+
+    /**
+     * fleetd#164: the failure reason for a scrape that produced zero characters — names the member
+     * and says plainly that the turn produced nothing, so a caller (a lead deciding whether to
+     * delegate again included) never mistakes a lost turn for a genuinely empty reply.
+     */
+    private static String emptyScrapeReason(String target, boolean scrapeFailed) {
+        return "member " + target + " turn completed with an empty scrape (0 chars) — "
+                + (scrapeFailed ? "its pane could not be read; " : "")
+                + "treating as a lost turn, not a real answer";
+    }
+
     /**
      * The first line of {@code text} matching {@code pattern}, stripped — the CB-578 stage A
      * evidence carried in a {@code BACKEND_EXHAUSTED} reason so the operator sees the real refusal

fleetd/src/main/java/dev/ltms/fleet/inject/Injector.java

@@ -2,6 +2,7 @@ package dev.ltms.fleet.inject;
 
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrRouter;
 import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -89,6 +90,7 @@ public final class Injector {
     public static final long POLL_INTERVAL_MILLIS = 250;
 
     private final AgentControl agents;
+    private final HerdrRouter router;
     private final TurnListener turnListener;
     private final Predicate<String> ready; // CB-113: a target is deliverable only when available
     private final Consumer<String> forget; // CB-114: clear a gone worker's readiness/presence
@@ -124,11 +126,25 @@ public final class Injector {
     public Injector(AgentControl agents, TurnListener turnListener, Predicate<String> ready,
                     Consumer<String> forget) {
         this.agents = agents;
+        this.router = null;
         this.turnListener = turnListener;
         this.ready = ready;
         this.forget = forget;
     }
 
+    public Injector(HerdrRouter router, TurnListener turnListener, Predicate<String> ready,
+                    Consumer<String> forget) {
+        this.agents = null;
+        this.router = router;
+        this.turnListener = turnListener;
+        this.ready = ready;
+        this.forget = forget;
+    }
+
+    private AgentControl agentsFor(String target) {
+        return router != null ? router.agentsFor(target) : agents;
+    }
+
     /** A pending message and the future that completes when it has been delivered. */
     private record Pending(String text, TurnToken token, CompletableFuture<Void> delivered) {
     }
@@ -253,7 +269,7 @@ public final class Injector {
                         if (p != null && ready.test(target)) {
                             t.notReadySincePoll = 0;
                             try {
-                                agents.send(target, p.text());
+                                agentsFor(target).send(target, p.text());
                                 t.queue.poll();
                                 t.awaitingPickup = true;
                                 t.awaitingCompletion = true;
@@ -313,7 +329,7 @@ public final class Injector {
         // thread while it holds the target lock.
         if (resubmit) {
             try {
-                agents.submit(target); // nudge a raced Enter so the pending paste submits
+                agentsFor(target).submit(target); // nudge a raced Enter so the pending paste submits
             } catch (RuntimeException e) {
                 log.debug("resubmit to {} failed (will retry next poll): {}", target, e.getMessage());
             }

fleetd/src/main/java/dev/ltms/fleet/inject/StatusPoller.java

@@ -3,6 +3,7 @@ package dev.ltms.fleet.inject;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.AgentStatus;
 import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.HerdrRouter;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -22,6 +23,7 @@ public final class StatusPoller {
     private static final Logger log = LoggerFactory.getLogger(StatusPoller.class);
 
     private final AgentControl agents;
+    private final HerdrRouter router;
     private final Injector injector;
     private final StatusRefiner refiner;
     private final long intervalMillis;
@@ -35,11 +37,24 @@ public final class StatusPoller {
     public StatusPoller(AgentControl agents, Injector injector, StatusRefiner refiner,
                         long intervalMillis) {
         this.agents = agents;
+        this.router = null;
         this.injector = injector;
         this.refiner = refiner;
         this.intervalMillis = intervalMillis;
     }
 
+    public StatusPoller(HerdrRouter router, Injector injector, long intervalMillis) {
+        this.agents = null;
+        this.router = router;
+        this.injector = injector;
+        // CB-185: this refiner's own AgentControl (member) is only a default for the legacy 2-arg
+        // refine() overload — the loop below always calls the 3-arg refine(target, raw, control)
+        // with the per-target control from router.agentsFor(target), so a lead target is refined
+        // against the LEAD daemon even though this field points at the member one.
+        this.refiner = new StatusRefiner(router.memberAgents());
+        this.intervalMillis = intervalMillis;
+    }
+
     /** Start the polling loop on a virtual thread. Idempotent. */
     public synchronized void start() {
         if (running) return;
@@ -56,7 +71,11 @@ public final class StatusPoller {
                 try {
                     // herdr's agent_status can misreport a settled worker as `unknown`; refine it
                     // against the pane content before it drives delivery/completion (CB-115).
-                    AgentStatus status = refiner.refine(target, agents.status(target));
+                    // CB-185: refine THROUGH the same control the raw status came from — a router
+                    // splits lead/member targets across two herdr daemons, and reading a lead's pane
+                    // through the (fixed) member refiner never finds it, wedging that lead at UNKNOWN.
+                    AgentControl control = router != null ? router.agentsFor(target) : agents;
+                    AgentStatus status = refiner.refine(target, control.status(target), control);
                     injector.onStatus(target, status);
                 } catch (HerdrException e) {
                     // The worker's agent is gone — stop trying and unblock its waiters.

fleetd/src/main/java/dev/ltms/fleet/inject/StatusRefiner.java

@@ -41,15 +41,32 @@ public final class StatusRefiner {
     }
 
     /**
-     * Return a trustworthy status for {@code target}. Any non-{@code UNKNOWN} {@code raw} is returned
-     * unchanged; an {@code UNKNOWN} triggers a pane read and content classification. A read failure
-     * leaves it {@code UNKNOWN} (the safe default: no delivery, and the stall path still applies).
+     * Return a trustworthy status for {@code target}, reading its pane through this refiner's own
+     * {@link AgentControl}. Equivalent to {@link #refine(String, AgentStatus, AgentControl)} with
+     * that control — kept for callers that only ever talk to one herdr daemon.
      */
     public AgentStatus refine(String target, AgentStatus raw) {
+        return refine(target, raw, agents);
+    }
+
+    /**
+     * Return a trustworthy status for {@code target}. Any non-{@code UNKNOWN} {@code raw} is returned
+     * unchanged; an {@code UNKNOWN} triggers a pane read (through {@code control}) and content
+     * classification. A read failure leaves it {@code UNKNOWN} (the safe default: no delivery, and
+     * the stall path still applies).
+     *
+     * <p>CB-185: {@code control} must be the {@link AgentControl} for the <em>same</em> daemon the
+     * raw status was sampled from — a router splits lead and member targets across two herdr
+     * daemons, and reading a lead's pane through the member client (or vice versa) fails to find
+     * the pane and leaves the target wedged at {@code UNKNOWN} forever. Callers that route per
+     * target (e.g. {@code StatusPoller}) must pass that target's control explicitly rather than
+     * relying on the control fixed at construction.
+     */
+    public AgentStatus refine(String target, AgentStatus raw, AgentControl control) {
         if (raw != AgentStatus.UNKNOWN) return raw;
         String pane;
         try {
-            pane = agents.read(target, PROBE_SOURCE);
+            pane = control.read(target, PROBE_SOURCE);
         } catch (RuntimeException e) {
             log.debug("status refine read for {} failed; leaving UNKNOWN: {}", target, e.getMessage());
             return AgentStatus.UNKNOWN;

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -15,8 +15,6 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Set;
-import java.util.stream.Collectors;
 import dev.ltms.fleet.peer.PeerLauncher;
 
 /**
@@ -41,7 +39,7 @@ import dev.ltms.fleet.peer.PeerLauncher;
  * broken later, quietly.
  *
  * <p><strong>Liveness, and the label round-trip.</strong> {@code LeadTabScanner} used to be able to
- * promise that bridged never writes a lead label. That is no longer true — an auto-launched lead is
+ * promise that fleetd never writes a lead label. That is no longer true — an auto-launched lead is
  * labelled by this class, and the scanner reads that label back. The risk this opens is not
  * privilege escalation (the tab label never granted anything a pane could take for itself; see that
  * class's javadoc), but <em>staleness</em>: a label left behind by a crashed session would otherwise
@@ -106,7 +104,7 @@ public final class LeadLauncher {
                 // A lead with a `tab:` but no `profile:` is recognise-only by design: the operator
                 // opens it by hand. Say so once rather than looking like a silent failure.
                 log.info("lead '{}' is not live, and names no profile — it can be recognised but not "
-                        + "launched. Add `profile:` under fleet.leaders.{} to have bridged start it.",
+                        + "launched. Add `profile:` under fleet.leaders.{} to have fleetd start it.",
                         name, name);
                 continue;
             }
@@ -140,15 +138,15 @@ public final class LeadLauncher {
      * auto-launched one is — by labelling its tab to match.
      */
     private Map<String, Integer> liveLeads(Map<String, FleetConfig.Leader> leaders) {
-        Set<String> memberSpaces = cfg.profiles().values().stream()
-                .map(FleetConfig.Profile::workspace)
-                .filter(w -> w != null && !w.isBlank())
-                .collect(Collectors.toSet());
-
-        // tabId → the lead name its label declares.
+        // A lead and the members share ONE workspace now (the operator asked for a single "session"
+        // with many tabs), so a workspace can no longer be excluded wholesale — the lead lives in the
+        // member workspace by design. The sole discriminator is the exact tab label: a lead carries
+        // its configured `fleet.leaders.<name>.tab` ("lead: opus"), while a member carries its
+        // profile's `worker: {profile} #{n}` template. These never collide, so an exact-label match
+        // separates them without needing to know which workspace anyone is in.
         Map<String, String> nameByTab = new LinkedHashMap<>();
         for (Workspace ws : spaces.listWorkspaces()) {
-            if (ws.workspaceId() == null || memberSpaces.contains(ws.label())) {
+            if (ws.workspaceId() == null) {
                 continue;
             }
             for (Tab tab : spaces.listTabs(ws.workspaceId())) {

fleetd/src/main/java/dev/ltms/fleet/mcp/ConnectionIdentity.java

@@ -10,7 +10,7 @@ import dev.ltms.fleet.herdr.PaneLocator;
  *
  * <p>Both sources are authoritative and unforgeable: the OS reports the real connecting PID, and
  * herdr owns the PID→pane mapping. A worker cannot claim to be another worker, nor the primary.
- * Single-host only (the herd shares the {@code bridged} host); the token path is the split-host
+ * Single-host only (the herd shares the {@code fleetd} host); the token path is the split-host
  * fallback.
  */
 public final class ConnectionIdentity {

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -76,14 +76,6 @@ public final class FleetMcp {
     private static final long ASK_MAX_TIMEOUT_MS = 115_000;
     private static final ObjectMapper MAPPER = new ObjectMapper(); // worker-view JSON projections
 
-    /**
-     * CB-622: the product is renaming {@code bridge_*} tools to {@code fleet_*}. Both names reach
-     * the same handler (registered below); this set makes the "old name used" WARN fire once per
-     * old name for the life of the process, not once per call — a per-name flag, not a numeric
-     * sentinel, so it survives concurrent callers cleanly and reads unambiguously in a log.
-     */
-    private static final Set<String> WARNED_DEPRECATED_NAMES = ConcurrentHashMap.newKeySet();
-
     /** Transport-context key under which the extractor stashes the resolved caller identity. */
     static final String CALLER_TERMINAL = "callerTerminal";
     /** Transport-context key under which the extractor stashes the caller's PID (for cwd inherit). */
@@ -180,8 +172,7 @@ public final class FleetMcp {
                             CALLER_NAME, orEmpty(p.name())));
                 })
                 .build();
-        // CB-622: each handler is built once and reused for BOTH its fleet_* tool and its
-        // deprecated bridge_* twin (registered below), so the two names can never drift apart.
+        // Each handler is built once and wired to its fleet_* tool below.
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> sendHandler =
                 (exchange, req) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SEND,
@@ -320,30 +311,19 @@ public final class FleetMcp {
         McpSchema.Tool fleetWhoami = whoamiTool();
 
         this.server = McpServer.sync(transport)
-                .serverInfo("bridge", "0.1.0")
+                .serverInfo("fleet", "0.1.0")
                 .capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
                 .toolCall(fleetSend, sendHandler)
-                .toolCall(deprecatedTwin(fleetSend, "bridge_send"), deprecatedHandler(fleetSend, "bridge_send", sendHandler))
                 .toolCall(fleetReply, replyHandler)
-                .toolCall(deprecatedTwin(fleetReply, "bridge_reply"), deprecatedHandler(fleetReply, "bridge_reply", replyHandler))
                 .toolCall(fleetAsk, askHandler)
-                .toolCall(deprecatedTwin(fleetAsk, "bridge_ask"), deprecatedHandler(fleetAsk, "bridge_ask", askHandler))
                 .toolCall(fleetStatus, statusHandler)
-                .toolCall(deprecatedTwin(fleetStatus, "bridge_status"), deprecatedHandler(fleetStatus, "bridge_status", statusHandler))
                 .toolCall(fleetPoll, pollHandler)
-                .toolCall(deprecatedTwin(fleetPoll, "bridge_poll"), deprecatedHandler(fleetPoll, "bridge_poll", pollHandler))
                 .toolCall(fleetAck, ackHandler)
-                .toolCall(deprecatedTwin(fleetAck, "bridge_ack"), deprecatedHandler(fleetAck, "bridge_ack", ackHandler))
                 .toolCall(fleetSpawn, spawnHandler)
-                .toolCall(deprecatedTwin(fleetSpawn, "bridge_spawn"), deprecatedHandler(fleetSpawn, "bridge_spawn", spawnHandler))
                 .toolCall(fleetList, listHandler)
-                .toolCall(deprecatedTwin(fleetList, "bridge_list"), deprecatedHandler(fleetList, "bridge_list", listHandler))
                 .toolCall(fleetStop, stopHandler)
-                .toolCall(deprecatedTwin(fleetStop, "bridge_stop"), deprecatedHandler(fleetStop, "bridge_stop", stopHandler))
                 .toolCall(fleetProfiles, profilesHandler)
-                .toolCall(deprecatedTwin(fleetProfiles, "bridge_profiles"), deprecatedHandler(fleetProfiles, "bridge_profiles", profilesHandler))
                 .toolCall(fleetWhoami, whoamiHandler)
-                .toolCall(deprecatedTwin(fleetWhoami, "bridge_whoami"), deprecatedHandler(fleetWhoami, "bridge_whoami", whoamiHandler))
                 .build();
         this.authz = callers;
         this.metrics = metrics;
@@ -647,7 +627,7 @@ public final class FleetMcp {
         if (leadChannel == null) {
             return error("lead coordination is not configured (no coordinator: block) — cannot send to "
                     + "peer lead \"" + coordId + "\". Add a coordinator: block with a shared broker uri "
-                    + "and this daemon's selfId, then restart bridged.");
+                    + "and this daemon's selfId, then restart fleetd.");
         }
         LeadMessage msg = new LeadMessage(UUID.randomUUID().toString(), leadChannel.selfCoordId(),
                 coordId, content);
@@ -993,7 +973,7 @@ public final class FleetMcp {
     }
 
     /**
-     * Capacity is advisory only. {@code reclaimable} says there is no bridge work, not that bridged
+     * Capacity is advisory only. {@code reclaimable} says there is no bridge work, not that fleetd
      * may stop the member: the bridge has capacity facts but no work list, and choosing work needs
      * authority it does not have. {@code idleForSeconds} is derived from monotonic nanoTime and has
      * no wall-clock meaning across a daemon restart.
@@ -1265,44 +1245,6 @@ public final class FleetMcp {
                 objectSchema(Map.of(), List.of()));
     }
 
-    // --- CB-622: bridge_* -> fleet_* rename, kept working under both names -------------------
-
-    /**
-     * The deprecated {@code bridge_*} twin of {@code fleetTool}: same name-minus-prefix schema,
-     * with a description that leads with the deprecation notice so a client listing tools sees it
-     * immediately. Reuses {@code fleetTool}'s input schema rather than restating it, so the two
-     * can never drift on parameters.
-     */
-    static McpSchema.Tool deprecatedTwin(McpSchema.Tool fleetTool, String oldName) {
-        return tool(oldName, "DEPRECATED: use " + fleetTool.name() + " instead. " + fleetTool.description(),
-                fleetTool.inputSchema());
-    }
-
-    /**
-     * Wrap {@code handler} so a call under the deprecated {@code oldName} logs one WARN naming
-     * the old and new name, then runs the exact SAME handler {@code fleetTool}'s name uses — no
-     * logic is duplicated between the two registrations.
-     */
-    static BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> deprecatedHandler(
-            McpSchema.Tool fleetTool, String oldName,
-            BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> handler) {
-        return (exchange, req) -> {
-            warnDeprecatedOnce(oldName, fleetTool.name());
-            return handler.apply(exchange, req);
-        };
-    }
-
-    /**
-     * Log one WARN naming {@code oldName} and {@code newName} — once per {@code oldName} for the
-     * life of the process, not once per call. {@link #WARNED_DEPRECATED_NAMES} is a per-name flag
-     * (a {@link Set}), not a call counter, so this never conflates "warned" with any numeric state.
-     */
-    static void warnDeprecatedOnce(String oldName, String newName) {
-        if (WARNED_DEPRECATED_NAMES.add(oldName)) {
-            log.warn("{} is deprecated; use {} instead", oldName, newName);
-        }
-    }
-
     // --- small helpers -------------------------------------------------------------------------
 
     // The SDK 2.0.0 deprecates its own Tool builders without a stable replacement — isolate it here.

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -36,7 +36,7 @@ import java.util.function.Supplier;
  *   <li>{@link #buildLaunch}, which encodes the subscription boundary: build the worker env with
  *       {@code ANTHROPIC_BASE_URL}, assert that host is on the allowlist <em>before</em> touching
  *       herdr, and mount the bridge MCP + reply charter as inline launch flags. A worker's base_url
- *       lives in the env map handed to herdr and nowhere else; {@code bridged}'s own environment is
+ *       lives in the env map handed to herdr and nowhere else; {@code fleetd}'s own environment is
  *       never mutated, and nothing is written to the worker's profile.</li>
  * </ul>
  */
@@ -216,7 +216,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         // the charter — the charter returns to role -> reply only. Best-effort: a failed overlay
         // must never fail the spawn, and `writeIdeOverlay` no-ops unless the cwd is a provisioned
         // worktree (see its .git-file safety gate). The overlay pins, and the auto-open opens, the
-        // module dir (this repo's pom is in `bridged/`, not at the worktree root) — see ideProjectPath.
+        // module dir (this repo's pom is in `fleetd/`, not at the worktree root) — see ideProjectPath.
         if (cfg.hasIdeMcp()) {
             String projectPath = PeerLauncher.ideProjectPath(spec.cwd(), cfg.ideProjectDir());
             writeIdeOverlay(spec.cwd(), projectPath);
@@ -239,7 +239,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
         applyGitToken(workerEnv, cfg);
 
-        // CB-547a: Claude Code can MINT its own session id, so bridged chooses it — a fresh spawn
+        // CB-547a: Claude Code can MINT its own session id, so fleetd chooses it — a fresh spawn
         // gets a UUID we pass as --session-id and return from agentSessionId(), so the resume
         // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
         // id via -r and passes no --session-id (the two conflict). Both are injected before the
@@ -428,7 +428,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      */
     private static Path writeCharterFile(String charterText) {
         try {
-            Path file = Files.createTempFile("bridged-role-charter-", ".md");
+            Path file = Files.createTempFile("fleetd-role-charter-", ".md");
             Files.writeString(file, charterText);
             file.toFile().deleteOnExit();
             return file;

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -64,7 +64,7 @@ public final class EnvAllowListScrub {
     static final String SCRUB_FILE = "scrub.zsh";
 
     /** Prefix of every generated directory — also what {@link #reapOrphans} matches on. */
-    static final String DIR_PREFIX = "bridged-zdotdir-";
+    static final String DIR_PREFIX = "fleetd-zdotdir-";
 
     /**
      * How old an orphan must be before {@link #reapOrphans} removes it. Comfortably longer than any

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -926,10 +926,10 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * start a login shell, and it makes the intent explicit at the one place every adapter passes.
      */
     private static final String BLOCKED_CREDENTIAL_SENTINEL =
-            "blocked-by-bridged-cb596-see-gitea-issue-82";
+            "blocked-by-fleetd-cb596-see-gitea-issue-82";
 
     /**
-     * CB-592: marks a pane as a bridged member so a shell startup file can decline to export
+     * CB-592: marks a pane as a fleetd member so a shell startup file can decline to export
      * operator-only credentials into it (gitea issue #77).
      *
      * <p>This name is deliberately one that {@code secrets.sh} never exports, which is exactly why
@@ -952,7 +952,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * Seed a worker's environment (CB-511): the daemon's own {@code PATH}, then the profile's
      * {@code env:} entries, then the CB-592 admin-token shadow.
      *
-     * <p>Why this exists: bridged passes herdr an explicit env map, and herdr merges it into
+     * <p>Why this exists: fleetd passes herdr an explicit env map, and herdr merges it into
      * <em>its own</em> process environment. So before this, a worker inherited whatever PATH the
      * herdr server happened to be started with — on this host, one from weeks earlier with no JDK
      * and no Maven, which left workers unable to run the build they were being asked to run. The
@@ -1033,34 +1033,40 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * pass it through {@code tab.create}/{@code pane.split}. Returns the directory for teardown
      * registration, or {@code null} when the policy does not apply.
      *
-     * <p>The allow-list handed to the generator is the derived profile set ({@link
-     * MemberEnvAllowList#derive}) UNIONed with the exact keys of THIS launch's env map — names the
-     * daemon itself injects must survive its own control. {@code SSH_AUTH_SOCK} is added ONLY when
-     * the config explicitly allows it; by default it is absent, so the scrub blanks it like any
-     * other non-derived name.
+     * <p>The allow-list handed to the generator is the derived profile set UNIONed with the
+     * operator's own {@code memberCredentials.allow:} names ({@link MemberEnvAllowList#derive(
+     * Collection, Set)} — CB-633 follow-up) and with the exact keys of THIS launch's env map —
+     * names the daemon itself injects must survive its own control. {@code SSH_AUTH_SOCK} is added
+     * ONLY when the config explicitly allows it, EVEN IF the operator also listed it under
+     * {@code allow:}; by default it is absent, so the scrub blanks it like any other non-derived
+     * name. It stays a one-off decision because it is a live handle to the operator's ssh-agent, not
+     * a value — a member holding it can sign with every key the agent holds, so letting it ride in
+     * on the generic {@code allow:} list would hand that out for an unrelated reason.
      */
     private Path applyEnvironmentAllowListPolicy(FleetConfig.Profile cfg, Launch launch) {
         FleetConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
         if (creds == null || !creds.isAllowList()) {
             return null;
         }
+        Set<String> allowed = derivedAllowedNames(creds, launch);
         String loginShell = resolveEnv("SHELL");
         boolean zsh = loginShell != null && (loginShell.endsWith("/zsh") || loginShell.equals("zsh"));
         if (!zsh) {
             // A non-zsh login shell ignores ZDOTDIR entirely: NO scrub would run, so pretending
             // otherwise would be worse than saying so. Warn loudly and fall back to the CB-596
             // sentinel overlay over the enumerated known: names — weaker (a sourced file can undo
-            // it), but strictly better than nothing.
+            // it), but strictly better than nothing. Deliberately no "allowed N of M" line here: the
+            // scrub this count describes does not run on this path, so printing it would tell an
+            // operator that a fraction of names were blocked when the real number blocked is zero.
+            // logCredentialGap's WARN (below) is the only signal for this path.
             warnNonZsh(loginShell);
             overlayBlockedCredentials(launch.env(), creds);
             logCredentialGap(creds);
             return null;
         }
-        Set<String> allowed = new java.util.TreeSet<>(MemberEnvAllowList.derive(profiles.values()));
-        if (creds.sshAuthSockAllowed()) {
-            allowed.add(SSH_AUTH_SOCK);
-        } // blocked by default: absent from the set ⇒ blanked by the scrub like any other name
-        allowed.addAll(launch.env().keySet());
+        // Only reached when the scrub is actually about to run — the count below describes that
+        // scrub, so it must not be logged before this gate (see the non-zsh branch above).
+        logAllowListCoverage(allowed);
         Path dir = EnvAllowListScrub.generate(Path.of(System.getProperty("java.io.tmpdir")), allowed);
         launch.env().put("ZDOTDIR", dir.toAbsolutePath().toString());
         log.info("memberCredentials policy=allow-list: profile={} generated ZDOTDIR {} — derived "
@@ -1069,8 +1075,42 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         return dir;
     }
 
+    /**
+     * The full kept-name set for this spawn: the profile-derived names, unioned with {@code
+     * memberCredentials.allow:} (CB-633 follow-up — previously ignored by this whole policy), the
+     * ssh-agent handle when explicitly allowed, and the exact keys of THIS launch's own env map.
+     */
+    private Set<String> derivedAllowedNames(FleetConfig.MemberCredentials creds, Launch launch) {
+        Set<String> allowed = new java.util.TreeSet<>(
+                MemberEnvAllowList.derive(profiles.values(), creds.allowSet()));
+        if (creds.sshAuthSockAllowed()) {
+            allowed.add(SSH_AUTH_SOCK);
+        } // blocked by default: absent from the set ⇒ blanked by the scrub like any other name
+        allowed.addAll(launch.env().keySet());
+        return allowed;
+    }
+
+    /**
+     * CB-633 follow-up: one INFO line per allow-list spawn WHOSE SCRUB ACTUALLY RUNS, so an operator
+     * can read a single log line and know the scrub ran and how much of the visible environment it
+     * will keep. Callable ONLY from the zsh branch of {@link #applyEnvironmentAllowListPolicy}, after
+     * the shell gate — logging it before that gate (or on the non-zsh fallback, where nothing is
+     * scrubbed) would tell an operator a fraction of names were blocked when the real number blocked
+     * is zero, which is worse than not logging at all. {@code M} is {@link #hostEnvNames}' size (the
+     * daemon's own environment — see that field's javadoc for why it stands in for the pane's, which
+     * the daemon has no channel to inspect at spawn time) and {@code N} is how many of those names
+     * survive {@code allowed} (including the {@code LC_*} prefix rule). Neither number is a constant:
+     * both come from the actual derived set and the actual environment this spawn sees. Never logs a
+     * variable NAME or VALUE — only the counts.
+     */
+    private void logAllowListCoverage(Set<String> allowed) {
+        Set<String> hostNames = hostEnvNames.get();
+        long kept = hostNames.stream().filter(name -> MemberEnvAllowList.keeps(allowed, name)).count();
+        log.info("member credentials: allowed {} of {}", kept, hostNames.size());
+    }
+
     /** The operator ssh-agent handle — kept ONLY by explicit config decision, never by default. */
-    private static final String SSH_AUTH_SOCK = "SSH_AUTH_SOCK";
+    private static final String SSH_AUTH_SOCK = MemberEnvAllowList.SSH_AUTH_SOCK;
 
     /**
      * CB-633: a non-zsh login shell means the allow-list control CANNOT run — say so once per

fleetd/src/main/java/dev/ltms/fleet/member/MemberEnvAllowList.java

@@ -35,9 +35,27 @@ import java.util.TreeSet;
  * <p>{@code SSH_AUTH_SOCK} is deliberately NOT here. It is a handle to the operator's ssh-agent — a
  * member holding it can sign with the operator's keys — so keeping it is a config decision
  * ({@code memberCredentials.sshAuthSock: allow}), not a derivation default.
+ *
+ * <p><b>CB-633 follow-up:</b> the union also includes {@code memberCredentials.allow:} — the
+ * operator's own explicit list. Before this, {@code policy: allow-list} silently ignored every name
+ * an operator wrote under {@code allow:} unless a profile happened to carry it too, which meant
+ * turning the policy on could blank credentials working members already depended on. {@code
+ * SSH_AUTH_SOCK} is the one exception: even when the operator lists it under {@code allow:}, it is
+ * excluded here and added back ONLY by the caller when {@code sshAuthSock: allow} is explicitly set
+ * (see {@link #SSH_AUTH_SOCK}'s javadoc) — it is a live handle to the operator's own ssh-agent, not
+ * a value, so treating it like any other allow-listed name would hand a member every key the
+ * operator's agent holds the moment they typed the name under {@code allow:} for an unrelated
+ * reason.
  */
 public final class MemberEnvAllowList {
 
+    /**
+     * The operator's ssh-agent socket path. Deliberately excluded from {@link #derive}'s union of
+     * {@code memberCredentials.allow:} — see the class javadoc's CB-633 follow-up note. Governed
+     * ONLY by {@code memberCredentials.sshAuthSock}, never by appearing in {@code allow:}.
+     */
+    public static final String SSH_AUTH_SOCK = "SSH_AUTH_SOCK";
+
     /**
      * Names that are not credentials and that a login shell or agent binary genuinely needs.
      *
@@ -73,9 +91,21 @@ public final class MemberEnvAllowList {
 
     /**
      * Derive the allowed NAME set from the given profiles plus {@link #INFRASTRUCTURE_PASSTHROUGH}.
-     * Deterministic (sorted) so generated scrub files are diffable run-to-run.
+     * Equivalent to {@link #derive(Collection, Set)} with no operator-configured names — kept for
+     * callers (and existing tests) that only care about the profile-derived half.
      */
     public static Set<String> derive(Collection<FleetConfig.Profile> profiles) {
+        return derive(profiles, Set.of());
+    }
+
+    /**
+     * Derive the allowed NAME set: the profile-derived union above, PLUS {@code configuredAllow} —
+     * the operator's own {@code memberCredentials.allow:} list (CB-633 follow-up). {@code
+     * SSH_AUTH_SOCK} is dropped from {@code configuredAllow} even if the operator listed it there;
+     * see the class javadoc for why. Deterministic (sorted) so generated scrub files are diffable
+     * run-to-run.
+     */
+    public static Set<String> derive(Collection<FleetConfig.Profile> profiles, Set<String> configuredAllow) {
         Set<String> derived = new TreeSet<>(INFRASTRUCTURE_PASSTHROUGH);
         if (profiles != null) {
             for (FleetConfig.Profile p : profiles) {
@@ -87,6 +117,13 @@ public final class MemberEnvAllowList {
                 }
             }
         }
+        if (configuredAllow != null) {
+            for (String name : configuredAllow) {
+                if (name != null && !name.isBlank() && !SSH_AUTH_SOCK.equals(name)) {
+                    derived.add(name);
+                }
+            }
+        }
         return Set.copyOf(derived);
     }
 

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -308,14 +308,14 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      */
     private Path writeConfig(FleetConfig.Profile cfg, String charterText, String cwd) {
         try {
-            Path dir = Files.createTempDirectory(configRoot, "bridged-opencode-");
+            Path dir = Files.createTempDirectory(configRoot, "fleetd-opencode-");
             dir.toFile().deleteOnExit();
 
             ObjectNode root = JSON.createObjectNode();
             root.put("$schema", "https://opencode.ai/config.json");
             // CB-523, opencode side: a worker that runs out of context dies mid-turn, and its reply
             // — the entire point of the turn — is lost with it. Auto-compaction is therefore not an
-            // operator preference for a bridged worker, it is a condition of the turn contract.
+            // operator preference for a fleetd worker, it is a condition of the turn contract.
             //
             // Stated deliberately even though it is redundant today: OPENCODE_CONFIG is MERGED over
             // ~/.config/opencode/config.json rather than replacing it, so a worker already inherits
@@ -324,7 +324,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             //
             // Know the cost before removing it: this key WINS over the home config (verified — an
             // OPENCODE_CONFIG value overrides the home value, it does not defer to it), so an
-            // operator who sets `compaction.auto: false` at home cannot turn it off for bridged
+            // operator who sets `compaction.auto: false` at home cannot turn it off for fleetd
             // workers. That is the intended trade for peers we spawn and whose turns we must land;
             // if per-profile control is ever wanted, add a profile knob rather than dropping this.
             root.putObject("compaction").put("auto", true);
@@ -357,7 +357,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                     ide.put("enabled", true);
 
                     // CB-634: pin the overlay and open the IDE at the module dir (this repo's pom is
-                    // in `bridged/`, not at the worktree root) — see PeerLauncher.ideProjectPath.
+                    // in `fleetd/`, not at the worktree root) — see PeerLauncher.ideProjectPath.
                     String projectPath = PeerLauncher.ideProjectPath(cwd, cfg.ideProjectDir());
                     Path rules = dir.resolve("ide-rules.md");
                     Files.writeString(rules, PeerLauncher.ideOverlayText(projectPath));
@@ -400,7 +400,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
 
         ObjectNode provider = root.putObject("provider").putObject(providerId);
         provider.put("npm", "@ai-sdk/openai-compatible");
-        provider.put("name", providerId + " (bridged)");
+        provider.put("name", providerId + " (fleetd)");
 
         ObjectNode options = provider.putObject("options");
         options.put("baseURL", openAiBaseUrl(cfg.baseUrl()));

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeSessionDiscovery.java

@@ -9,7 +9,7 @@ import java.nio.file.Path;
 import java.util.stream.Stream;
 
 /**
- * Resolves the opencode session id for a bridged worker from opencode's on-disk storage — the
+ * Resolves the opencode session id for a fleetd worker from opencode's on-disk storage — the
  * only place this adapter touches opencode's private layout, and deliberately the <em>only</em>
  * class that does.
  *
@@ -22,7 +22,7 @@ import java.util.stream.Stream;
  * its shape, naming, and field names — lives here, so a layout change, or a switch to the HTTP
  * server, changes exactly one class and nothing in {@link OpenCodeLauncher}.
  *
- * <p>The determinism that makes this useful is structural, not a guess: every bridged worker runs
+ * <p>The determinism that makes this useful is structural, not a guess: every fleetd worker runs
  * in its own unique git worktree, so the record's {@code directory} (its project root) equals the
  * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
  * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
@@ -50,7 +50,7 @@ final class OpenCodeSessionDiscovery {
      *
      * <p>Never throws: a missing {@code storageRoot}, an unreadable/malformed record, or a
      * directory that has not been persisted yet all resolve to {@code null} rather than failing a
-     * spawn. A bridged worker's session record is written lazily (when the session is first
+     * spawn. A fleetd worker's session record is written lazily (when the session is first
      * persisted), so {@code null} here is the normal answer right after the pane is ready, and the
      * caller retries later.
      *

fleetd/src/main/java/dev/ltms/fleet/msg/AmqpReplyInbox.java

@@ -29,8 +29,9 @@ import java.util.concurrent.TimeoutException;
  *
  * <p><strong>Mapping — consume-and-hold with deferred manual ack.</strong> Each target has a durable
  * queue {@code agent.<target>.inbox}. The gateway that owns the target starts a manual-ack consumer
- * ({@link #own}) that pulls persistent messages off that queue into an in-memory <em>held</em> map
- * (keyed by {@code msgId}) but does <em>not</em> ack them. {@link #peek} returns that snapshot;
+ * ({@link #own}) that pulls persistent messages, up to its prefetch window, off that queue into an
+ * in-memory <em>held</em> map (keyed by {@code msgId}) but does <em>not</em> ack them.
+ * {@link #peek} returns that snapshot;
  * {@link #ack} acks the broker delivery-tag and drops the entry. Because messages stay unacked until
  * the owning gateway actually drains them, a crash (or a {@code java -jar} bounce) before caller-ack
  * leaves them on the broker — it redelivers on reconnect. That is the durability the in-memory
@@ -141,7 +142,7 @@ public final class AmqpReplyInbox implements ReplyInbox, AutoCloseable {
             // Self-heal transient blips; topology recovery re-declares queues and re-attaches consumers.
             factory.setAutomaticRecoveryEnabled(true);
             factory.setTopologyRecoveryEnabled(true);
-            return new AmqpReplyInbox(factory.newConnection("bridged-reply-inbox"), prefetch);
+            return new AmqpReplyInbox(factory.newConnection("fleetd-reply-inbox"), prefetch);
         } catch (Exception e) {
             throw new IllegalStateException("cannot connect to AMQP broker at " + uri, e);
         }

fleetd/src/main/java/dev/ltms/fleet/msg/InMemoryReplyInbox.java

@@ -16,7 +16,7 @@ import java.util.concurrent.ConcurrentHashMap;
  * non-broker path stays interchangeable.
  *
  * <p><strong>This is soft-state, NOT persistence.</strong> Lost on a {@code java -jar} bounce — that
- * is correct and consistent with "bridged stays soft-state." The Stage-2 AMQP adapter replaces this.
+ * is correct and consistent with "fleetd stays soft-state." The Stage-2 AMQP adapter replaces this.
  */
 public final class InMemoryReplyInbox implements ReplyInbox {