#324: read task.turnId once in finishAsyncTask to stop an NPE from ask()'s unlocked forgetting

answer() holds sessionLocks while finishAsyncTask reads the volatile Task.turnId twice — once to
check it is non-null, once as the ConcurrentHashMap.remove key. ask()'s own timeout path mutates
the same field with no lock, via clearAsyncQuestion(turnId, true). volatile makes each read fresh
but not the pair atomic, so the field can go null between the two reads and remove(null, task)
throws NullPointerException on the lead's own answer() call, even though the reply already
completed on the line above.

Capture task.turnId into a local once and use that for both the check and the removal.

Added a package-private test seam (finishAsyncTaskRaceHook + forgetTurnForTest) so a test can force
the exact interleaving deterministically, by running the identical clearAsyncQuestion(turnId, true)
cleanup ask() uses, at the point between finishAsyncTask's former two reads. Both are inert (null)
in production.

.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-bridge",
-  "description": "Tooling for orchestrating a fleet of delegated coding agents through the bridged MCP gateway.",
+  "description": "Tooling for orchestrating a fleet of delegated coding agents through the fleetd MCP gateway.",
   "owner": {
     "name": "LTMS"
   },
@@ -8,7 +8,7 @@
     {
       "name": "claude-bridge",
       "source": "./plugin",
-      "description": "Make a project bridge-ready: mount the bridged MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
+      "description": "Make a project bridge-ready: mount the fleetd MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
       "version": "0.1.0",
       "author": {
         "name": "LTMS"

.claude/agents/architect.md

@@ -3,7 +3,7 @@ name: architect
 description: Refine work into clear, independent units before implementation.
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You are an architect in this fleet. You refine work before anyone builds it: scope,
 acceptance criteria, risks, and a unit split. You read the repo and write analysis.

.claude/agents/dev.md

@@ -3,7 +3,7 @@ name: dev
 description: Implement one assigned unit, test it, and open a pull request.
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You implement the one unit you were given and nothing else. Work in your assigned
 git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm

.claude/agents/reviewer.md

@@ -3,7 +3,7 @@ name: reviewer
 description: Review one assigned scope and report the most important real issue.
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You review the diff you were given. Report bugs, risks, and missing tests. You do
 not change code.

.claude/skills/fleets-status/SKILL.md

@@ -0,0 +1,274 @@
+---
+name: fleets-status
+description: Report the status of every fleet that shares one LavinMQ instance. Use for local daemon health, broker-wide fleet presence, and cross-host lead coordination checks.
+---
+
+# Status of every fleet on the shared LavinMQ instance
+
+**The headline: always report what is missing.** This skill starts with the local fleet, then adds
+broker-wide facts when its read-only credential exists. A missing fleet must appear as `unknown` or
+`not reachable`, with the reason and the fix. Never leave it out.
+
+The known topology has one LavinMQ instance on `10.10.20.13` (`fleet01`). AMQP uses port `5672`,
+and the management API uses port `15672`. The Mac fleet owns vhost `/mac`. The fleet01 fleet owns
+vhost `/fleet01`.
+
+## 1. Protect credentials before any probe
+
+**Hard rule — never print `LAVINMQ_URI`.** It is an AMQP URI with its password inline. It only
+resolves in a login shell because `${SHARED_ENV}/tools/secrets.sh` supplies it. A non-login shell
+can make every broker probe look empty.
+
+- Never run `echo "$LAVINMQ_URI"`.
+- Never put `${LAVINMQ_URI:-something}` in output. That form expands to the secret value when set.
+- Parse the user, host, and password into shell or Python variables. Use them without printing them.
+- Prefer `resolves` or `does not resolve` over any part of the value.
+- Every command that can read `LAVINMQ_URI` must send all output through this redaction before it
+  reaches the report:
+
+```bash
+sed -E 's#://[^@]*@#://<redacted>@#g'
+```
+
+**The `g` flag is not optional.** Without it `sed` replaces only the first match on each line, so a
+line carrying two URIs leaks the second one. `scripts/redeploy-fleetd.sh --check` prints lines like
+that. Checked on 2026-08-27: without `g`, `amqp://u1:p1@h1/mac and http://u2:p2@h2:15672/api`
+redacts the first pair and prints `u2:p2` in the clear.
+
+Keep `pipefail` on when applying that filter. Otherwise the filter can hide a failed probe. Apply
+the same no-print rule to the management password below, even though it is not in an AMQP URI.
+
+## 2. Tier 1 — this fleet (always run)
+
+Start here even when the broker tier is blocked. Work from the local fleetd checkout.
+
+First run the read-only deployment check. It already checks the daemon process, deployed jar versus
+the checkout `HEAD`, launchd state, and whether each configured token resolves in a login shell.
+Do not copy those checks into new shell code. The script reads `LAVINMQ_URI`, so redact all output:
+
+```bash
+set -o pipefail
+scripts/redeploy-fleetd.sh --check 2>&1 \
+  | sed -E 's#://[^@]*@#://<redacted>@#g'
+git rev-parse HEAD
+```
+
+Treat jar drift as a top-level warning. A merge is not a deployment. State the running jar result
+as `matches HEAD`, `drift`, or `unknown`; do not turn an unclear timestamp into a match.
+
+Report the process identifier (PID) and uptime too:
+
+```bash
+PIDS="$(pgrep -f 'target/fleetd.jar' || true)"
+if [ -z "$PIDS" ]; then
+  printf '%s\n' 'fleetd: not running'
+else
+  for PID in $PIDS; do
+    ps -p "$PID" -o pid=,etime=,lstart=,command=
+  done
+fi
+```
+
+Read the full health response. Keep the HTTP status because `503` means fleetd is running but herdr
+is not reachable. Report both `herdr.version` and `herdr.protocol` when present:
+
+```bash
+curl -sS --max-time 5 -w '\nHTTP %{http_code}\n' http://127.0.0.1:8765/healthz
+```
+
+Call `fleet_whoami`, then call `fleet_list`. Preserve its sections in the report:
+
+- `leads`, including which row is this lead;
+- `members`, including state, role, profile, branch, and worktree when present;
+- every per-profile `capacity` row, including `maxLoad`, `live`, `free`, and quarantine facts;
+- the exact `healthCoverage` value.
+
+Do not describe an empty `members` list as an empty fleet. It says only that no members are spawned.
+Also do not hide a profile with `free: 0`; say whether load or credential quarantine caused it.
+
+Show only WARN, ERROR, and SEVERE lines after the last `fleetd listening` line. This anchor stops an
+old incident from looking current:
+
+```bash
+python3 - <<'PY'
+from pathlib import Path
+import re
+
+path = Path("fleetd/fleetd.out")
+if not path.exists():
+    print("cannot check current WARN/ERROR: fleetd/fleetd.out does not exist")
+else:
+    lines = path.read_text(errors="replace").splitlines()
+    starts = [i for i, line in enumerate(lines) if "fleetd listening" in line]
+    if not starts:
+        print("cannot anchor WARN/ERROR: no 'fleetd listening' line exists")
+    else:
+        current = lines[starts[-1]:]
+        alerts = [line for line in current if re.search(r"\b(?:WARN|ERROR|SEVERE)\b", line)]
+        print(f"current WARN/ERROR/SEVERE count: {len(alerts)}")
+        for line in alerts[-50:]:
+            print(line)
+PY
+```
+
+**What this tier cannot see:** it proves facts only about the Mac daemon at `127.0.0.1:8765`.
+It cannot show the fleet01 daemon, broker queue depth, or broker consumers. The fleet01 REST service
+at `10.10.20.13:8765` is not reachable from the Mac. Say this in the report rather than omitting
+fleet01.
+
+**But fleet01 IS reachable over SSH — checked 2026-08-28.** An older version of this line said SSH
+was denied. That is true only for the user `dai.ha`. The host alias `fleet01` maps to user `ltms`,
+and `ssh fleet01` works with key auth:
+
+```bash
+ssh -o BatchMode=yes -o ConnectTimeout=6 fleet01 'echo $(id -un)@$(hostname)'
+```
+
+So fleet01's daemon PID, uptime, jar and `/healthz` **can** be reported — over SSH, not over REST.
+Do that rather than writing `not reachable`. `ltms` also has passwordless sudo there.
+
+## 3. Tier 2 — the shared broker (run when management access exists)
+
+**This tier is blocked today.** The AMQP user in `LAVINMQ_URI` can connect on port `5672`, but gets
+HTTP `401` from the management API on port `15672`. An AMQP connection does not grant monitoring
+access.
+
+The operator must create a separate, read-only LavinMQ management user with the `monitoring` tag.
+It needs access to inspect both `/mac` and `/fleet01`. Store its values as
+`LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD` in
+`${SHARED_ENV}/tools/secrets.sh`. Do not reuse or print the AMQP URI. Full multi-fleet status stays
+blocked until this user exists.
+
+When both variables resolve, run this from a login shell. It calls `GET /api/overview`,
+`GET /api/vhosts`, `GET /api/queues`, and `GET /api/connections`. It prints selected status fields,
+but never the user, password, Authorization header, or AMQP URI:
+
+```bash
+zsh -lc 'python3 - "$@"' -- <<'PY'
+import base64
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+
+base = "http://10.10.20.13:15672"
+user = os.environ.get("LAVINMQ_MANAGEMENT_USER", "")
+password = os.environ.get("LAVINMQ_MANAGEMENT_PASSWORD", "")
+if not user or not password:
+    print("broker tier: BLOCKED — management credential does not resolve in a login shell")
+    sys.exit(0)
+
+token = base64.b64encode(f"{user}:{password}".encode()).decode()
+
+def get(path):
+    request = urllib.request.Request(
+        base + path,
+        headers={"Authorization": "Basic " + token, "Accept": "application/json"},
+    )
+    with urllib.request.urlopen(request, timeout=5) as response:
+        return json.load(response)
+
+try:
+    overview = get("/api/overview")
+    vhosts = get("/api/vhosts")
+    queues = get("/api/queues")
+    connections = get("/api/connections")
+except urllib.error.HTTPError as error:
+    print(f"broker tier: BLOCKED — management API returned HTTP {error.code}")
+    sys.exit(0)
+except Exception as error:
+    print(f"broker tier: BLOCKED — management API is not reachable: {type(error).__name__}")
+    sys.exit(0)
+
+fleet_names = {"/mac": "Mac fleet", "/fleet01": "fleet01 fleet"}
+print(json.dumps({
+    "overview": {
+        "lavinmq_version": overview.get("lavinmq_version"),
+        "rabbitmq_version": overview.get("rabbitmq_version"),
+        "queue_totals": overview.get("queue_totals", {}),
+        "object_totals": overview.get("object_totals", {}),
+    },
+    "fleets": [
+        {
+            "fleet": fleet_names.get(vhost.get("name"), "UNKNOWN FLEET"),
+            "vhost": vhost.get("name"),
+            "queues": [
+                {
+                    "name": queue.get("name"),
+                    "messages": queue.get("messages", 0),
+                    "messages_ready": queue.get("messages_ready", 0),
+                    "messages_unacknowledged": queue.get("messages_unacknowledged", 0),
+                    "consumers": queue.get("consumers", 0),
+                }
+                for queue in queues if queue.get("vhost") == vhost.get("name")
+            ],
+            "connections": [
+                {
+                    "name": connection.get("name"),
+                    "peer_host": connection.get("peer_host"),
+                    "state": connection.get("state"),
+                }
+                for connection in connections if connection.get("vhost") == vhost.get("name")
+            ],
+        }
+        for vhost in vhosts
+    ],
+}, indent=2, sort_keys=True))
+PY
+```
+
+Map `/mac` to the Mac fleet and `/fleet01` to the fleet01 fleet. Keep any other vhost in the
+report as `UNKNOWN FLEET`; do not drop it. For each vhost, total the ready, unacknowledged, and all
+messages. Report every queue's consumer count and each live connection.
+
+**A vhost with queues but zero consumers means that fleet's daemon is down while its durable state
+survives. Call this out as a top-level warning.** This is the main reason to use the management API
+instead of calling each remote daemon.
+
+**What this tier cannot see:** without the new `monitoring` credential it cannot enumerate any
+vhost, queue, depth, consumer, or connection. With the credential it still cannot report fleet01's
+daemon PID, uptime, jar revision, `/healthz`, herdr version, or member capacity. Those need reachable
+fleet01 REST or SSH access, which the Mac does not have today.
+
+## 4. Tier 3 — cross-fleet lead coordination
+
+Use the queue data from Tier 2. Select queues whose names match `lead.<coordId>.inbox`. Report each
+queue's vhost, depth, consumer count, and the `coordId` between the prefix and suffix.
+
+- A lead inbox with a consumer shows that a lead mailbox is live on that vhost.
+- A durable lead inbox with zero consumers shows saved coordination state, but no live receiver.
+- No lead inbox is not proof that coordination is disabled. The daemon may be down before declaring
+  its queue, or this account may not be allowed to see the vhost.
+
+This Mac fleet currently sets both `broker.uriEnv` and `coordinator.uriEnv` to the same variable,
+`LAVINMQ_URI`. Therefore its coordinator connects to `/mac`. Cross-host `fleet_send{coordId}` routes
+only when both leads share the same coordinator vhost. If the fleet01 lead uses `/fleet01` for its
+coordinator, the leads cannot see each other and the send will not route.
+
+**Open question:** the fleet01 coordinator vhost has not been checked. Surface this question in
+every report until a live `lead.<coordId>.inbox` consumer or fleet01's config proves the answer. Do
+not claim that fleet01 uses `/fleet01` just because its member queues do.
+
+Also compare these broker facts with the `leads` rows from local `fleet_list`. A missing remote lead
+is `not visible from this coordinator`, not `down`, unless the broker consumer facts prove it.
+
+**What this tier cannot see:** without Tier 2 management access it cannot list lead inboxes or their
+consumers. Even with that access, a stopped fleet01 daemon leaves only durable queue history. That
+history cannot prove which coordinator URI its current config would use after restart.
+
+## 5. Report all fleets
+
+Use one row per known or discovered fleet. Include blocked rows.
+
+| Fleet | Daemon | Deployment | Herdr | Members/capacity | Queues/consumers | Lead coordination | Cannot check |
+|---|---|---|---|---|---|---|---|
+| Mac (`/mac`) | PID + uptime | jar vs `HEAD` | health + version + protocol | `fleet_list` + `healthCoverage` | facts or blocked reason | inbox facts or open question | exact missing facts |
+| fleet01 (`/fleet01`) | reachable/down/unknown | value or `not reachable` | value or `not reachable` | value or `not reachable` | facts or blocked reason | inbox facts plus coordinator-vhost question | exact missing facts and fix |
+
+Add rows for unknown vhosts. End with three short sections: `Current warnings`, `Checks that were
+blocked`, and `Operator action`. Until the management user exists, `Operator action` must say:
+
+> Create a read-only LavinMQ management user with the `monitoring` tag and access to `/mac` and
+> `/fleet01`. Put its user and password in `${SHARED_ENV}/tools/secrets.sh` as
+> `LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD`.

.claude/skills/hunter/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: hunter
+description: Defect-hunt procedure for a fleetd worker — sweep an assigned package for real bugs and report several ranked findings without fixing anything. Load this when the lead asks you to hunt or audit a scope rather than review one diff. Do NOT load `reviewer` for this; the two want different output.
+---
+
+# Hunter worker — procedure
+
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
+never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies.
+
+**This skill is not `reviewer`.** `reviewer` judges one diff and reports the *single* most
+important issue in about 90 words. A hunt sweeps a whole package and reports *several* findings
+in a long structured form. Loading both gives you two contradictory output contracts, and the
+usual result is a worker that writes a good report into its terminal and ends the turn without
+sending it. Load exactly one.
+
+## 0. Read this before you read code: how the report gets home
+
+Your terminal reaches nobody. The lead sees **only** the text inside your `fleet_reply` call.
+
+A long report is exactly the case where this goes wrong, so plan for it:
+
+- **Write the report into the `fleet_reply` argument itself.** Do not compose it in your terminal
+  and then summarise it into the call.
+- If the report is long, **send it anyway** — one `fleet_reply` with everything.
+- If you end the turn without replying, the bridge scrapes your pane instead. That scrape carries
+  at most the last 4000 characters, and on a hunt it usually captures the tail of the lead's own
+  brief rather than your findings. The lead then has nothing and has to ask you again.
+
+## 1. Change nothing
+
+A hunt is read-only. Do not edit a production file, do not "quickly fix" what you find, and do
+not run a formatter. You may run the build and tests to *check* a claim, and you should say so
+when you did.
+
+## 2. Read the whole scope first
+
+Read every file in the assigned package before you judge any of it. A defect that a caller
+elsewhere in the same package makes unreachable is not a defect, and you cannot know that from
+one file.
+
+Stay inside the scope. If a defect there depends on a class outside it, read that class to
+confirm — but the defect itself must live in the scope you were given.
+
+## 3. The bar — this matters more than the count
+
+**Name the path into the bad state.** Say which caller, in which state, reaches it. A defect on
+paper is not a reachable defect. If you cannot name that path, keep the finding but mark it
+`unproven` and say exactly what you could not check. Do not drop it, and do not dress it up.
+
+**Say which direction the harm goes.** Data loss, privilege escalation and silent wrong answers
+are worth reporting even when the window is narrow. A finding whose worst outcome is a worse log
+line is not worth a block.
+
+Two workers once ran the same scope: the one that applied the direction-of-harm filter found ten
+real defects, the one that did not found none. Fewer findings the lead can act on beat many the
+lead has to triage.
+
+## 4. Shapes that have produced real merged fixes here
+
+Read for these first:
+
+1. **A one-way gate.** A guard added after an incident closes only the direction that incident
+   came from. Do not only ask what closes the gate — ask **which states still open it**.
+2. **A value read once, then used later to authorise something destructive**, after something
+   else has had a chance to change it.
+3. **A failure downgraded to a value that looks like a legitimate result** — `-1`, `null`, an
+   empty list, `false` — which a caller then trusts.
+4. **A lock held for one half of a read-modify-write and not the other**, or two collections
+   updated under different locks.
+5. **A comment or javadoc stating an invariant the code no longer keeps.** Comments are
+   load-bearing in this repo; a stale one has already caused a bug.
+
+## 5. What you cannot check, and must not claim you did
+
+- `fleetd/fleetd.yaml` is gitignored and **absent from your worktree**. You cannot read it. If a
+  finding depends on live configuration, name the key and say you could not check it.
+- `.mcp.json`, `opencode.json` and `.autoenv` in your worktree are neutralised stubs, not the
+  repo's real files.
+- The `wiki/` submodule pointer is months old. Do not cite it.
+
+Reporting a fact you took from the lead's brief as something you measured yourself is a false
+report, even when the fact is correct. Say where each fact came from.
+
+## 6. The report — what goes in `fleet_reply`
+
+One block per finding, most severe first:
+
+```
+FINDING N — <one line>
+file:line
+Path in:        <which caller, in which state, reaches this>
+Direction:      <data loss | escalation | silent wrong answer | outage | ...>
+Window/trigger: <when it actually happens>
+Confidence:     <confirmed by reading | unproven — say what you could not check>
+Why nothing else catches it: <the guard or test you checked, and why it misses>
+```
+
+End with one line naming every file you read, so the lead knows the denominator.
+
+**Nothing clears the bar?** Reply `NO FINDINGS`, name the files you read, and say what you ruled
+out. A clean sweep is a valid result; an invented defect is worse than none.

.claude/skills/implementer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: implementer
-description: Implementer-role procedure for a bridged worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over bridged.
+description: Implementer-role procedure for a fleetd worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over fleetd.
 ---
 
 # Implementer worker — procedure
@@ -39,6 +39,19 @@ a worker made all 59 of its edits in the primary's tree and never noticed.
 test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-toplevel)"
 ```
 
+**Never run `git stash` (or `git stash pop`/`apply`/`drop`).** Your worktree is isolated, but the
+stash is **not**: `refs/stash` is one stack shared by the primary's checkout and every other
+worker's worktree of this repo. Measured on 2026-09-04 — `git stash list` from a worker's worktree
+and from the primary's tree returned byte-identical output. So a `git stash` you run can be popped
+into someone else's tree, and a `git stash pop` you run can drop **another worker's** uncommitted
+edits on top of yours. This has already happened here: two workers were running in parallel and one
+of them had its in-progress edit silently overwritten by the other's stash.
+
+The branch is your isolation, so use it instead. To set work aside, commit it on your own branch
+(`git commit -m "wip: ..."`) and carry on; to try something and back out, use
+`git diff > /tmp/<your-branch>.patch` then `git checkout -- <file>`. Both stay inside your worktree.
+If you find a stash entry you did not create, leave it alone and say so in your report.
+
 ## 2. Implement
 
 - Implement exactly the scope the lead named. Keep the diff focused; note anything out of scope
@@ -49,7 +62,7 @@ test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-t
 your worktree*:
 
 ```bash
-cd "$(git rev-parse --show-toplevel)/bridged" && mvn clean install
+cd "$(git rev-parse --show-toplevel)/fleetd" && mvn clean install
 echo "exit=$?"
 ```
 

.claude/skills/reviewer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reviewer
-description: Reviewer-role procedure for a bridged worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over bridged.
+description: Reviewer-role procedure for a fleetd worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over fleetd.
 ---
 
 # Reviewer worker — procedure
@@ -10,6 +10,11 @@ never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and alrea
 skill is only the *review procedure*: how to work the scope, and the exact shape of what you
 send back.
 
+**Wrong skill for a sweep.** This one reviews *one* diff or scope and reports the *single* most
+important issue. If the lead asked you to hunt or audit a whole package for several defects, load
+`hunter` instead and ignore this file — the two want different output, and following both is how a
+worker ends its turn with a good report that never gets sent.
+
 ## 1. Read the whole scope before you judge
 
 The delegation names your scope — a file, a diff, a PR, a function. **Read all of it first.**

.gitea/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
       # does not depend on the wiki repo being reachable.
       - uses: actions/checkout@v4
 
-      # The runner image ships an older default-jdk; bridged sets maven.compiler.release=25, so
+      # The runner image ships an older default-jdk; fleetd sets maven.compiler.release=25, so
       # provision the JDK explicitly rather than apt-installing whatever "default" means today.
       - name: Set up JDK 25
         uses: actions/setup-java@v4
@@ -32,7 +32,7 @@ jobs:
           mvn -version
 
       - name: Build and test
-        working-directory: bridged
+        working-directory: fleetd
         # This IS the mock-socket surface CB-503 asks for: the pom's `default-excludes` profile
         # already sets excludedGroups=contract, so the @Tag("contract") tests — which need a live
         # herdr socket and a RabbitMQ container — are excluded without any flag here. Everything
@@ -46,7 +46,7 @@ jobs:
       # the log instead, where they are actually readable.
       - name: Failing test output
         if: failure()
-        working-directory: bridged
+        working-directory: fleetd
         run: |
           for f in target/surefire-reports/*.txt; do
             [ -f "$f" ] || continue
@@ -59,7 +59,7 @@ jobs:
   # AmqpReplyInboxContractTest reads AMQP_URI (set below to the service's network alias) and binds
   # straight to it — no Docker, no skipped tests. This separation (build job hermetic and
   # Docker-free; contract job broker-provided) is deliberate — see the default-excludes/contract
-  # profiles in bridged/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
+  # profiles in fleetd/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
   # exactly as in the build job above.
   contract:
     runs-on: ubuntu-latest
@@ -91,12 +91,12 @@ jobs:
       # runs against the RabbitMQ service container (AMQP_URI). Pinned to the one contract test to
       # avoid re-running the unit suite already covered by the `build` job.
       - name: Contract tests
-        working-directory: bridged
+        working-directory: fleetd
         run: mvn -B -Pcontract test -Dtest=AmqpReplyInboxContractTest
 
       - name: Failing test output
         if: failure()
-        working-directory: bridged
+        working-directory: fleetd
         run: |
           for f in target/surefire-reports/*.txt; do
             [ -f "$f" ] || continue

.gitignore

@@ -14,8 +14,8 @@
 .env
 .envrc
 
-# Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
-# repo root and bridged/ collect one; neither belongs in git.
-bridged.out
-bridged/bridged.out
+# Daemon runtime artefacts. fleetd appends its log wherever it is launched from, so both the
+# repo root and fleetd/ collect one; neither belongs in git.
+fleetd.out
+fleetd/fleetd.out
 logs/

.opencode/agent/architect.md

@@ -3,7 +3,7 @@ description: Refine work into clear, independent units before implementation.
 mode: primary
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You are an architect in this fleet. You refine work before anyone builds it: scope,
 acceptance criteria, risks, and a unit split. You read the repo and write analysis.

.opencode/agent/dev.md

@@ -3,7 +3,7 @@ description: Implement one assigned unit, test it, and open a pull request.
 mode: primary
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You implement the one unit you were given and nothing else. Work in your assigned
 git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm

.opencode/agent/reviewer.md

@@ -3,7 +3,7 @@ description: Review one assigned scope and report the most important real issue.
 mode: primary
 ---
 
-<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
 
 You review the diff you were given. Report bugs, risks, and missing tests. You do
 not change code.

CLAUDE.md

@@ -10,7 +10,7 @@
 
 If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.
 
-`bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
+`fleetd` is the **sole communication gateway** between agents here. The orchestrating session (the
 **primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
 through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.
 
@@ -185,24 +185,53 @@ must obey belongs in the charter, not here.
 
 ## Project addendum — claude-bridge (not part of the canonical block)
 
-- **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
+- **This repo is the bridge.** The daemon is `fleetd`, its MCP mount is `http://127.0.0.1:8765/mcp`,
   and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
   `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
-- **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
-  `reviewer` (scoped review → one structured finding). Name one in every delegation.
+- **`fleet_profiles`/`fleet_list` report two separate outage states, and they are not the same
+  thing.** *Quarantined* (CB-578) means the backend told us it is out of capacity — a long,
+  1800s-default cooldown. *Cooling off* (fleetd #201/#227) means a profile's credential threw two
+  distinct backend errors (a non-exhaustion failure such as an HTTP 5xx) within 60 seconds — a
+  short, fixed 60s cooldown, not configurable per profile. Each check runs independently, so a
+  profile can show both at once. In the JSON: a cooling profile carries `credentialId` and
+  `coolingOffForSeconds`; a quarantined profile carries `quarantinedForSeconds`; a profile hit by
+  both carries all three fields, and either state alone already sets that profile's `free` to `0`.
+  A `fleet_spawn` naming a cooling-off profile is refused before it ever reaches the backend
+  adapter, with a message naming the credential and the remaining seconds ("cooling off after
+  repeated backend errors") — distinct wording from a quarantine refusal, so don't conflate the
+  two when reading a spawn failure.
+- **Skills available to delegate:** `implementer` (worktree → commit → push → own PR),
+  `reviewer` (one diff → one structured finding) and `hunter` (sweep a package → several ranked
+  findings, change nothing). Name exactly one in every delegation. **`reviewer` and `hunter` are
+  not interchangeable** — `reviewer` caps the answer at one finding in about 90 words, so naming
+  it for a multi-finding sweep hands the worker two contradictory output contracts. That has
+  already cost three workers' turns: each wrote a good report to its terminal and ended the turn
+  with no `fleet_reply`, and the scrape returned the tail of the brief instead.
 - **Primary-side skills** (not delegation playbooks — a worker cannot use them):
-  `port-to-opencode` (make an OpenCode session a participant in this workspace).
+  `port-to-opencode` (make an OpenCode session a participant in this workspace) and
+  `fleets-status` (report every fleet that shares one LavinMQ instance).
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
   (a submodule with its own remote).
-- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, turn-done fallback —
-  are diagrammed in `docs/MCP-Contract.md` **§6 only**. The rest of that page is a pre-build design
-  doc whose tool names, parameter names and REST paths never caught up with the code, so do not use
-  it as the tool reference (CB-609). Section 6 is kept out of this file because this file loads into
-  every session's context.
+- **A provisioned worktree neutralizes `.mcp.json`, `opencode.json` and `.autoenv`** — the repo's
+  committed copies would otherwise mount the primary's IDE and forge servers (fleetd #134). The
+  worktree's copy of each is a stub, **not** the repo's real file, so a worker that reads one and
+  reports what it found is reporting on the stub. The daemon logs a per-spawn summary, but the
+  worker cannot see that log. From inside its own worktree a worker — or a lead debugging one —
+  reads the list with `git config --worktree --get-all fleet.neutralizedConfig`, and the
+  consequence with `git config --worktree --get fleet.neutralizedConfigNote`. Never brief a worker
+  to edit one of these files: the edit cannot be committed, and it will not tell you so.
+- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, the turn-done
+  fallback and status gating — are diagrammed in `docs/MCP-Contract.md`. That page is now flows
+  only: its pre-build tool catalogue, parameter tables and REST paths were deleted rather than
+  corrected, because a hand-maintained second copy of the tool surface is what drifted for a month
+  while this line pointed every session at it (CB-609 / #114). **The live MCP schema is the tool
+  reference**, with the intent→tool table above as the short form. `McpContractDocTest` fails if
+  that page names a `fleet_*` tool the server does not register. The flows are kept out of this
+  file because this file loads into every session's context.
 
 ### Redeploying the daemon — the lead may do this (primary only)
 
-**A merge is not a deployment.** The running `bridged` holds the jar it was started with, so a
+**A merge is not a deployment.** The running `fleetd` holds the jar it was started with, so a
 feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
 about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
 rather than hand the job back to the operator.
@@ -213,9 +242,9 @@ and stopping it kills the worker's own channel mid-turn.
 **Use the script — do not hand-roll the steps.**
 
 ```bash
-scripts/redeploy-bridged.sh --check   # report state, change nothing
-scripts/redeploy-bridged.sh           # build, confirm drain, restart, verify
-scripts/redeploy-bridged.sh --yes     # skip the drain prompt (fleet already checked)
+scripts/redeploy-fleetd.sh --check   # report state, change nothing
+scripts/redeploy-fleetd.sh           # build, confirm drain, restart, verify
+scripts/redeploy-fleetd.sh --yes     # skip the drain prompt (fleet already checked)
 ```
 
 It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
@@ -241,8 +270,8 @@ if the script is unavailable or a step fails, this is what it was protecting you
 4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
    lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
    demoted to worker, which refuses every orchestration call.
-5. **Prove the new jar is the one running.** Confirm a *fresh* `bridged listening` line at the end of
-   `bridged/bridged.out`, dated after the restart. An old daemon that never died looks identical from
+5. **Prove the new jar is the one running.** Confirm a *fresh* `fleetd listening` line at the end of
+   `fleetd/fleetd.out`, dated after the restart. An old daemon that never died looks identical from
    the outside.
 
 **Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
@@ -251,7 +280,7 @@ it is one auditable command, so the operator allow-lists it once instead of appr
 start every time. The rule lives in the operator's Claude Code settings:
 
 ```json
-{ "permissions": { "allow": ["Bash(scripts/redeploy-bridged.sh:*)"] } }
+{ "permissions": { "allow": ["Bash(scripts/redeploy-fleetd.sh:*)"] } }
 ```
 
 Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
@@ -277,7 +306,7 @@ Before you call any work done, check the row that matches what you touched:
 | worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
 | `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
 | a new peer kind (non-Claude adapter) | what that peer can read — anything it must obey belongs in its charter, not in the block |
-| **anything an operator can use, configure, or observe** — an MCP tool, a `bridged.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
+| **anything an operator can use, configure, or observe** — an MCP tool, a `fleetd.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
 
 That last row is not bookkeeping. Chapters 1–10 answer *how is this built* and *why this way*;
 none of them has a home for *what can it do and how do I turn it on*, so for twenty tickets a
@@ -311,10 +340,10 @@ PY
 
 Two IDE MCP servers are connected: **intellij-index** (semantic code intelligence) and
 **jetbrains** (file problems, reformat, debugger). IntelliJ has multiple projects open; our
-module is **`bridged`**. Always pass these to IDE MCP tools:
+module is **`fleetd`**. Always pass these to IDE MCP tools:
 
-- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/bridged`
-- IDE paths are relative to `bridged/` (e.g. `src/main/java/dev/ltms/bridged/...`)
+- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/fleetd`
+- IDE paths are relative to `fleetd/` (e.g. `src/main/java/dev/ltms/fleet/...`)
 
 ### After editing any file — mandatory
 
@@ -328,7 +357,7 @@ module is **`bridged`**. Always pass these to IDE MCP tools:
    whole-project gate before declaring work done or committing.
 
 **Whenever dependencies change (or a `pom.xml` edit), validate CVEs with
-`jetbrains get_file_problems{filePath: "bridged/pom.xml"}`** — its Mend.io check reflects the
+`jetbrains get_file_problems{filePath: "fleetd/pom.xml"}`** — its Mend.io check reflects the
 dependencies on disk. (Note: `ide_diagnostics` / intellij-index does NOT re-resolve dependencies
 after a pom edit without a full Maven reimport, so it reports stale CVE results — don't trust it
 for this.) Treat a CVE warning like any other: bump to a patched version and confirm

README.md

@@ -56,9 +56,8 @@ flowchart LR
    ever addresses a broker, a peer, or the network
    directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
    mounting the bridge is subscription-safe by construction.
-   **Tool naming:** the tools were renamed from `bridge_*` to `fleet_*` (CB-622). The daemon
-   still answers the old `bridge_*` names for one release, but they are deprecated — use the
-   `fleet_*` names.
+   **Tool naming:** the tools are `fleet_*` (renamed from `bridge_*` in CB-622). The old
+   `bridge_*` names were removed in CB-634 — only `fleet_*` answers now.
 - **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
   `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
   `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so

bridged/src/main/java/dev/ltms/fleet/auth/MemberLifecycle.java

@@ -1,21 +0,0 @@
-package dev.ltms.fleet.auth;
-
-import dev.ltms.fleet.peer.MemberRole;
-
-/** Optional session lifecycle hook for live member-slot bindings. */
-public interface MemberLifecycle {
-
-    MemberLifecycle NONE = new MemberLifecycle() {
-        @Override
-        public void acquired(MemberRole role, String profile, String terminal) {
-        }
-
-        @Override
-        public void released(String terminal) {
-        }
-    };
-
-    void acquired(MemberRole role, String profile, String terminal);
-
-    void released(String terminal);
-}

bridged/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -1,151 +0,0 @@
-package dev.ltms.fleet.health;
-
-import dev.ltms.fleet.herdr.Agent;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.AgentStatus;
-import dev.ltms.fleet.msg.MessageService;
-import dev.ltms.fleet.session.MemberSession;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-import java.util.function.BiConsumer;
-import java.util.function.LongSupplier;
-import java.util.function.Supplier;
-
-/** Slow whole-fleet evidence collection. It is deliberately separate from the delivery poller. */
-public final class FleetHealthMonitor {
-    private static final Logger log = LoggerFactory.getLogger(FleetHealthMonitor.class);
-
-    /** Bounded attempts to run {@link #failTarget} for one transition. Never retried tick-to-tick (CB-580). */
-    static final int MAX_FAIL_TARGET_ATTEMPTS = 3;
-
-    private final AgentControl agents;
-    private final Supplier<List<MemberSession>> roster;
-    private final MessageService messages;
-    private final ScheduledExecutorService scheduler;
-    private final LongSupplier clock;
-    private final long intervalSeconds;
-    private final BiConsumer<String, String> failTarget;
-    private final Map<String, HealthPrior> priors = new HashMap<>();
-    private final Map<String, HealthState> states = new HashMap<>();
-
-    // These facts need the evidence publishers introduced by later M4 units. They are not negatives.
-    private static final boolean NOT_YET_OBSERVED = false;
-
-    /**
-     * @param failTarget CB-568's idempotent target-wide failure operation (e.g. {@code messages::abandon}),
-     *                   invoked once when a member transitions into a terminal health state. Required —
-     *                   there is deliberately no defaulting overload; a caller that does not want the
-     *                   fail-tickets-on-terminal-health behavior must pass an explicit inert value (see
-     *                   {@code TestTurnTokens.inert} / {@code FleetMcp.CapacitySource.none()} for the pattern).
-     */
-    public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
-                              ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
-                              BiConsumer<String, String> failTarget) {
-        this.agents = agents;
-        this.roster = roster;
-        this.messages = messages;
-        this.scheduler = scheduler;
-        this.clock = clock;
-        this.intervalSeconds = intervalSeconds;
-        this.failTarget = Objects.requireNonNull(failTarget, "failTarget");
-    }
-
-    /** Pure per-member decision seam. */
-    static HealthDecision decide(HealthSnapshot snapshot, HealthPrior prior, long nowNanos) {
-        return FleetHealth.decide(snapshot, prior, nowNanos);
-    }
-
-    public void start() { scheduler.schedule(this::tick, intervalSeconds, TimeUnit.SECONDS); }
-    public void stop() { scheduler.shutdownNow(); }
-
-    // Package-private so tests can run one tick without waiting.
-    void tick() {
-        try {
-            List<Agent> agentsNow = agents.list(); // Exactly one list call for this complete observation.
-            List<MemberSession> rosterNow = roster.get(); // One in-memory roster snapshot for this tick.
-            Map<String, Agent> live = new HashMap<>();
-            for (Agent agent : agentsNow) live.put(agent.terminalId(), agent);
-            HashSet<String> current = new HashSet<>();
-            for (MemberSession session : rosterNow) {
-                current.add(session.terminalId());
-                Agent agent = live.get(session.terminalId());
-                AgentStatus status = agent == null ? AgentStatus.UNKNOWN : agent.status();
-                boolean accepted = messages.hasAcceptedDelivery(session.terminalId());
-                HealthSnapshot snapshot = new HealthSnapshot(session.state(), status, accepted, NOT_YET_OBSERVED,
-                        messages.hasInboxMessage(session.terminalId()), agent != null, NOT_YET_OBSERVED,
-                        NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED);
-                HealthDecision decision = decide(snapshot, priors.getOrDefault(session.terminalId(), HealthPrior.NONE),
-                        clock.getAsLong());
-                priors.put(session.terminalId(), decision.prior());
-                reportTransition(session.terminalId(), decision.state());
-            }
-            priors.keySet().retainAll(current);
-            states.keySet().retainAll(current);
-        } catch (Throwable error) {
-            // A list failure is health evidence, and must never kill the monitor's only scheduler task.
-            log.warn("fleet health collection failed; will retry next tick", error);
-        } finally {
-            if (!scheduler.isShutdown()) {
-                scheduler.schedule(this::tick, intervalSeconds, TimeUnit.SECONDS);
-            }
-        }
-    }
-
-    void reportTransition(String target, HealthState next) {
-        HealthState previous = states.put(target, next);
-        if (previous == next) return;
-        if (fault(next)) {
-            log.warn("fleet health member={} state={} previous={}", target, next, previous);
-        } else if (previous != null && fault(previous)) {
-            log.info("fleet health member={} recovered state={} previous={}", target, next, previous);
-        }
-        // CB-580: a member entering GONE/NEVER_READY must not leave its waiting tickets pending
-        // forever. Fire exactly once per transition — never on a tick where the state is unchanged,
-        // which is what made the rejected commit call abandon() once per tick for as long as a
-        // member stayed terminal.
-        if (terminal(next)) {
-            failTerminalTarget(target, next);
-        }
-    }
-
-    private void failTerminalTarget(String target, HealthState state) {
-        String reason = "fleet health: member reached terminal state " + state.name();
-        RuntimeException last = null;
-        for (int attempt = 1; attempt <= MAX_FAIL_TARGET_ATTEMPTS; attempt++) {
-            try {
-                failTarget.accept(target, reason);
-                return;
-            } catch (RuntimeException error) {
-                last = error;
-                log.warn("fleet health: failTarget attempt {}/{} failed for member={} state={}",
-                        attempt, MAX_FAIL_TARGET_ATTEMPTS, target, state, error);
-            }
-        }
-        log.warn("fleet health: giving up on failTarget for member={} state={} after {} attempts",
-                target, state, MAX_FAIL_TARGET_ATTEMPTS, last);
-    }
-
-    private static boolean terminal(HealthState state) {
-        return state == HealthState.GONE || state == HealthState.NEVER_READY;
-    }
-
-    private static boolean fault(HealthState state) {
-        return switch (state) {
-            case NEVER_READY, GONE, TURN_BOUNDARY_LOST, ERROR_ON_SCREEN, STALL_SUSPECTED,
-                    MUTE, REPLY_STRANDED, DELEGATION_ORPHANED, CONTROL_LINK_DOWN -> true;
-            default -> false;
-        };
-    }
-
-    public static String coverage(boolean enabled, boolean notificationConfigured) {
-        return !enabled ? "off" : notificationConfigured ? "full" : "detection-only";
-    }
-}

bridged/src/main/java/dev/ltms/fleet/herdr/PaneLocator.java

@@ -1,59 +0,0 @@
-package dev.ltms.fleet.herdr;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-import java.util.Map;
-
-/**
- * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
- * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
- * the agent pane whose process tree contains it, so {@code bridged} can tell <em>which worker</em>
- * is calling without the worker sending anything spoofable.
- *
- * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
- * and foreground process PIDs. This scans agent panes; a spawn-time {@code pid→terminal} cache is
- * the obvious optimization once wired into {@code ClaudeCodeLauncher}.
- */
-public final class PaneLocator {
-
-    private final HerdrClient herdr;
-
-    public PaneLocator(HerdrClient herdr) {
-        this.herdr = herdr;
-    }
-
-    /**
-     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
-     * {@code null} if no agent pane owns it (e.g. the caller is the primary, or off-host).
-     */
-    public String terminalForPid(long pid) {
-        if (pid <= 0) {
-            return null;
-        }
-        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
-            String paneId = pane.path("pane_id").asText(null);
-            if (paneId != null && paneOwnsPid(paneId, pid)) {
-                return pane.path("terminal_id").asText(null);
-            }
-        }
-        return null;
-    }
-
-    private boolean paneOwnsPid(String paneId, long pid) {
-        JsonNode info;
-        try {
-            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
-        } catch (HerdrException e) {
-            return false; // pane vanished mid-scan — just skip it
-        }
-        if (info.path("shell_pid").asLong(-1) == pid) {
-            return true;
-        }
-        for (JsonNode p : info.path("foreground_processes")) {
-            if (p.path("pid").asLong(-1) == pid) {
-                return true;
-            }
-        }
-        return false;
-    }
-}

bridged/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -1,372 +0,0 @@
-package dev.ltms.fleet.inject;
-
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.msg.Rendezvous;
-import dev.ltms.fleet.msg.TurnToken;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-import java.util.TreeSet;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.regex.Pattern;
-
-/**
- * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
- * {@link Rendezvous} so a blocking {@code fleet_send} resolves even when the worker finishes its
- * task without ever calling {@code fleet_reply} — the common case for a real delegated coding task.
- *
- * <p>On a confirmed {@code working → idle} boundary it scrapes the worker's recent transcript and
- * resolves the awaiting send with that tail (a {@link Rendezvous.Kind#COMPLETION} resolution, so the
- * caller can tell a scrape from a structured reply). It scrapes only when a send is actually waiting
- * — a fleet worker's own turns, or a send that already timed out, cost no herdr traffic. An explicit
- * {@code fleet_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
- *
- * <p>It also handles the CB-109 stall signal ({@link #onTurnFailed}): a worker that ran a turn then
- * wedged in an {@code unknown} state resolves the send as a failure (with the error screen as
- * context) rather than leaving it to time out.
- *
- * <p>The scrape is cleaned to the last {@code ⏺} assistant block (stripping TUI chrome) and guarded
- * against misattribution (CB-115): the pane content is baselined on delivery ({@link #onDelivered}),
- * and a completion whose scrape is unchanged from that baseline — the previous turn's wind-down
- * sampled as this turn's boundary on a rapid back-to-back send — is suppressed rather than resolving
- * the send with a stale answer.
- *
- * <p><strong>Waiter-specific resolution (CB-116).</strong> On delivery we also capture the exact
- * {@link Rendezvous} waiter this turn belongs to, and the completion/failure fallbacks resolve
- * <em>that</em> waiter — never "whatever send is waiting now". A completion fallback runs on a virtual
- * thread and can land after the worker's {@code fleet_reply} already resolved the turn and the
- * <em>next</em> send opened its own waiter on the same session; resolving the current waiter would
- * then deliver turn N's stale scrape as turn N+1's answer. Targeting the captured waiter makes a late
- * completion a harmless no-op (its waiter is already done) instead of a cross-turn stale reply.
- *
- * <p>Wired as the {@link Injector}'s {@link TurnListener}; the handlers hand off to a virtual thread
- * so the scrape's herdr round-trip never stalls the status poller. The captured waiter is read on the
- * poller thread (before any next-turn delivery can overwrite it) and passed into the virtual thread.
- */
-public final class CompletionResolver implements TurnListener {
-
-    private static final Logger log = LoggerFactory.getLogger(CompletionResolver.class);
-
-    /**
-     * herdr {@code agent.read} source for the completion scrape. {@code recent} returns the tail of
-     * the transcript (the worker's last output), which is what a delegator wants when the worker
-     * didn't structure a reply.
-     */
-    static final String SCRAPE_SOURCE = "recent";
-
-    /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
-    static final int MAX_SCRAPE_CHARS = 4000;
-
-    private static final String CLIPPED_PANE_TAIL_MARKER =
-            "[Pane tail clipped: member did not call fleet_reply.]";
-
-    private final AgentControl agents;
-    private final Rendezvous rendezvous;
-    private final ExhaustedPatternLookup exhaustedPatterns;
-    private final ExhaustionSink exhaustionSink;
-
-    /**
-     * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
-     * delivering send opened, plus the assistant block present when it was delivered.
-     *
-     * <p>The {@code waiter} is what makes a late fallback safe (CB-116): we resolve it, not "whoever
-     * is waiting now", so a completion that fires after the next send has opened its own waiter is a
-     * no-op rather than a cross-turn stale reply. The {@code baseline} is the CB-115 staleness
-     * reference: a completion scrape equal to it means the worker produced no new output (the previous
-     * turn's wind-down sampled as this boundary), so it is suppressed. Overwritten on each delivery;
-     * cleared when the turn resolves. Package-private so tests can capture and replay a specific turn.
-     */
-    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
-    }
-
-    private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();
-
-    /**
-     * @param exhaustedPatterns CB-578 stage A: per-target lookup for a profile's configured
-     *                          usage-limit refusal pattern. Required — there is deliberately no
-     *                          defaulting overload; a caller that does not want the classification
-     *                          must pass an explicit inert value ({@link ExhaustedPatternLookup#none()}).
-     * @param exhaustionSink    CB-578 stage B: notified when a {@code BACKEND_EXHAUSTED}
-     *                          classification actually resolves a waiter. Required for the same
-     *                          reason as {@code exhaustedPatterns} — pass {@link ExhaustionSink#none()}
-     *                          to opt out.
-     */
-    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
-                              ExhaustionSink exhaustionSink) {
-        this.agents = agents;
-        this.rendezvous = rendezvous;
-        this.exhaustedPatterns = Objects.requireNonNull(exhaustedPatterns, "exhaustedPatterns");
-        this.exhaustionSink = Objects.requireNonNull(exhaustionSink, "exhaustionSink");
-    }
-
-    @Override
-    public void onDelivered(String target, TurnToken token) {
-        // Capture the exact waiter this turn belongs to (CB-116) and snapshot the pane's pre-turn
-        // content — what it shows *before* the just-delivered turn produces output — as the staleness
-        // reference (CB-115). Done synchronously (like the delivering send itself) so both are in
-        // place before this turn's completion can fire.
-        captureBaseline(target, token);
-    }
-
-    /** Capture the in-flight turn: its waiter and pre-turn baseline (the testable core of {@link #onDelivered}). */
-    void captureBaseline(String target, TurnToken token) {
-        CompletableFuture<Rendezvous.Resolution> waiter = token.waiter();
-        if (waiter == null) {
-            inFlight.remove(target); // no send is waiting on this delivery — nothing to resolve later
-            return;
-        }
-        String baseline;
-        try {
-            // Clip to the same cap resolve() applies to the tail (line ~134): the CB-115 misattribution
-            // guard compares baseline.equals(tail), so both sides must be the same capped representation.
-            // An unclipped baseline vs a clipped tail would never match for a >MAX_SCRAPE_CHARS block,
-            // defeating the guard and letting a stale completion resolve the send.
-            baseline = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
-        } catch (RuntimeException e) {
-            baseline = null; // fail open: no baseline ⇒ no suppression
-            log.debug("delivery baseline for {} failed: {}", target, e.getMessage());
-        }
-        inFlight.put(target, new InFlight(waiter, baseline));
-    }
-
-    /** The turn currently baselined for {@code target}, or {@code null} — a test hook for the captureBaseline path. */
-    InFlight inFlight(String target) {
-        return inFlight.get(target);
-    }
-
-    @Override
-    public void onTurnComplete(String target) {
-        // Read the in-flight turn on the poller thread — before any next-turn delivery can overwrite
-        // it — then off-load the scrape (a herdr round-trip we must not block polling on) to a vthread.
-        InFlight turn = inFlight.get(target);
-        Thread.ofVirtual().name("completion-" + target).start(() -> resolve(target, turn));
-    }
-
-    /**
-     * Resolve the completed turn before adapter housekeeping can erase its rendered output. This is
-     * intentionally synchronous and used only when a post-turn context reset is enabled; the normal
-     * path remains off-loaded so polling is not blocked by a scrape.
-     */
-    public void resolveBeforePostAction(String target) {
-        resolve(target, inFlight.get(target));
-    }
-
-    @Override
-    public void onTurnFailed(String target) {
-        InFlight turn = inFlight.get(target);
-        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn, null));
-    }
-
-    @Override
-    public void onTurnFailed(String target, String reason) {
-        InFlight turn = inFlight.get(target);
-        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn, reason));
-    }
-
-    /** Synchronous resolve (the unit-testable core of {@link #onTurnComplete}). */
-    void resolve(String target, InFlight turn) {
-        CompletableFuture<Rendezvous.Resolution> waiter = turn == null ? null : turn.waiter();
-        if (waiter == null || waiter.isDone()) {
-            // Nobody is blocked on THIS turn (it had no send, or its fleet_reply already won). Skip
-            // the scrape; resolving the current waiter here would be the CB-116 cross-turn stale reply.
-            inFlight.remove(target, turn);
-            return;
-        }
-        String tail;
-        String assistantBlock = null;
-        int originalLength = 0;
-        boolean clipped = false;
-        boolean scrapeFailed = false;
-        try {
-            assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
-            originalLength = assistantBlock.strip().length();
-            clipped = originalLength > MAX_SCRAPE_CHARS;
-            tail = clip(assistantBlock);
-        } catch (RuntimeException e) {
-            // The worker finished but we couldn't read its screen — still resolve the send so the
-            // caller unblocks; an empty tail beats hanging until the caller's timeout.
-            log.warn("completion scrape for {} failed; resolving with an empty tail: {}",
-                    target, e.getMessage());
-            tail = "";
-            scrapeFailed = true;
-        }
-        // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
-        // delivery, this turn produced no new output — the boundary belongs to the previous turn's
-        // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
-        // a stale answer; the real fleet_reply (or a later genuine completion) resolves it instead.
-        // A scrape that failed to read is exempt — an empty tail there is "couldn't see", not "no change".
-        String baseline = turn.baseline();
-        if (!scrapeFailed && baseline != null && baseline.equals(tail)) {
-            log.debug("suppressing misattributed completion for {} (no output change since delivery)",
-                    target);
-            return; // keep the in-flight record: a later genuine completion still needs it
-        }
-        // CB-578 stage A: a turn that ended with no fleet_reply AND whose scrape matches the
-        // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
-        // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
-        if (!scrapeFailed) {
-            Pattern exhausted = exhaustedPatterns.patternFor(target);
-            String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
-            if (matchedLine != null) {
-                String reason = "backend exhausted (usage limit): " + matchedLine;
-                if (rendezvous.resolveExhausted(waiter, reason)) {
-                    inFlight.remove(target, turn);
-                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no fleet_reply; scrape "
-                            + "matched the profile's exhausted pattern): {}", target, reason);
-                    // CB-578 stage B: only on the resolution that actually won the race — a late
-                    // duplicate must never quarantine a credential twice for one refusal.
-                    exhaustionSink.onExhausted(target, reason);
-                }
-                return;
-            }
-        }
-        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
-        if (rendezvous.resolveCompletion(waiter, completion)) {
-            inFlight.remove(target, turn);
-            if (clipped) {
-                log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
-                                + "member did not call fleet_reply, so the pane tail is partial",
-                        target, originalLength, MAX_SCRAPE_CHARS);
-            }
-            log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
-                    target, tail.length());
-        }
-    }
-
-    /** Synchronous fail (the unit-testable core of {@link #onTurnFailed}). */
-    void fail(String target, InFlight turn) {
-        fail(target, turn, null);
-    }
-
-    /** Synchronous fail with an optional reason supplied by a dropped worker queue. */
-    void fail(String target, InFlight turn, String explicitReason) {
-        // A never-delivered readiness failure has no in-flight record but still has a blocked send;
-        // fall back to the currently-registered waiter (unambiguous — that send never completed, so
-        // no next turn exists to confuse it with).
-        CompletableFuture<Rendezvous.Resolution> waiter =
-                turn != null ? turn.waiter() : rendezvous.currentWaiter(target);
-        if (waiter == null || waiter.isDone()) {
-            inFlight.remove(target, turn); // nobody blocked on this worker — nothing to fail
-            return;
-        }
-        String reason = explicitReason;
-        if (reason == null || reason.isBlank()) {
-            try {
-                reason = clip(agents.read(target, SCRAPE_SOURCE));
-            } catch (RuntimeException e) {
-                reason = "";
-            }
-            if (reason.isBlank()) {
-                // No screen to scrape — either the worker is stuck (CB-109) or gone (CB-110).
-                reason = "worker did not reply; its turn ended in an unrecoverable state "
-                        + "(worker unreachable or stuck)";
-            }
-        }
-        if (rendezvous.resolveFailure(waiter, reason)) {
-            inFlight.remove(target, turn);
-            log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
-        }
-    }
-
-    /**
-     * The first line of {@code text} matching {@code pattern}, stripped — the CB-578 stage A
-     * evidence carried in a {@code BACKEND_EXHAUSTED} reason so the operator sees the real refusal
-     * text, never a generic label. {@code null} if no line matches.
-     */
-    static String firstMatchingLine(String text, Pattern pattern) {
-        if (text == null || text.isEmpty()) return null;
-        for (String line : text.split("\n", -1)) {
-            if (pattern.matcher(line).find()) {
-                return line.strip();
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
-     * the way {@link dev.ltms.fleet.health.FleetHealthMonitor#coverage} is — so an operator can
-     * see whether the classification is on, and for which profiles, without reading every
-     * profile's config by hand.
-     *
-     * @param allProfiles        every configured profile name
-     * @param configuredProfiles the subset of {@code allProfiles} that carry an exhausted pattern
-     */
-    public static String coverage(Set<String> allProfiles, Set<String> configuredProfiles) {
-        if (configuredProfiles.isEmpty()) {
-            return "off (no profile has an exhaustedPattern configured; profiles: " + sorted(allProfiles) + ")";
-        }
-        Set<String> unconfigured = new TreeSet<>(allProfiles);
-        unconfigured.removeAll(configuredProfiles);
-        return unconfigured.isEmpty()
-                ? "full (all profiles configured: " + sorted(allProfiles) + ")"
-                : "partial (configured: " + sorted(configuredProfiles) + "; not configured: " + sorted(unconfigured) + ")";
-    }
-
-    private static List<String> sorted(Set<String> names) {
-        return names.stream().sorted().toList();
-    }
-
-    private static String clip(String s) {
-        if (s == null) return "";
-        String trimmed = s.strip();
-        return trimmed.length() <= MAX_SCRAPE_CHARS
-                ? trimmed
-                : trimmed.substring(trimmed.length() - MAX_SCRAPE_CHARS);
-    }
-
-    /**
-     * Extract the last assistant message from a raw Claude Code pane scrape (CB-115). Claude Code
-     * prefixes each assistant turn with {@code ⏺}; the delegator wants that answer, not the TUI
-     * chrome around it. Take everything from the final {@code ⏺} onward and stop at the <em>first</em>
-     * hard interface boundary below it — the spinner/status line, input box, {@code ❯} prompt (which
-     * may echo the <em>next</em> turn's text), footer, or tips/warnings. Stopping at the first
-     * boundary (rather than trimming only trailing chrome) is what keeps a following turn's echoed
-     * prompt out of this reply. Blank lines are not boundaries, so a multi-paragraph answer survives;
-     * trailing blanks are trimmed at the end. With no {@code ⏺} marker (an unusual render) the whole
-     * text is scanned the same way, so we never lose the reply.
-     *
-     * <p>Package-private and pure so it is unit-testable without herdr.
-     */
-    static String lastAssistantBlock(String raw) {
-        if (raw == null || raw.isBlank()) return "";
-        int marker = raw.lastIndexOf('⏺');
-        String block = marker >= 0 ? raw.substring(marker + 1) : raw;
-        StringBuilder out = new StringBuilder();
-        int kept = 0;
-        for (String line : block.split("\n", -1)) {
-            if (isBoundary(line)) break; // first TUI boundary ends the assistant message
-            if (kept++ > 0) out.append('\n');
-            out.append(line);
-        }
-        return out.toString().strip();
-    }
-
-    /**
-     * A hard TUI boundary line that marks the end of an assistant message and the start of interface
-     * chrome (input box, prompt, spinner, footer, tips/warnings). Blank lines are <em>not</em>
-     * boundaries — an answer may contain them — so they are kept and trimmed only if trailing.
-     */
-    private static boolean isBoundary(String line) {
-        String t = line.strip();
-        if (t.isEmpty()) return false;
-        // A horizontal rule / all box-drawing separators (e.g. "──────").
-        if (t.chars().allMatch(c -> c == '─' || c == '—' || c == '━' || c == '═' || c == '-')) {
-            return true;
-        }
-        String lower = t.toLowerCase();
-        return t.startsWith("╭") || t.startsWith("│") || t.startsWith("╰") || t.startsWith("┌")
-                || t.startsWith("└") || t.startsWith("❯") || t.startsWith("⏵")
-                || t.startsWith("⎿") || t.startsWith("⚠")
-                // Status/spinner lines Claude Code renders below a settled or in-flight turn,
-                // e.g. "✻ Baked for 21s", "✶ Forming…".
-                || t.startsWith("✻") || t.startsWith("✳") || t.startsWith("✽") || t.startsWith("·")
-                || t.startsWith("●") || t.startsWith("◐") || t.startsWith("✢") || t.startsWith("✶")
-                || lower.contains("auto mode") || lower.contains("for shortcuts")
-                || lower.contains("esc to interrupt") || lower.contains("bypass permissions");
-    }
-}

bridged/src/main/java/dev/ltms/fleet/inject/ExhaustionSink.java

@@ -1,31 +0,0 @@
-package dev.ltms.fleet.inject;
-
-/**
- * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
- * classification to a waiting send (CB-578 stage B) — never on a race that lost (see
- * {@link CompletionResolver#resolve}, which only calls this after
- * {@code Rendezvous.resolveExhausted} returns {@code true}).
- *
- * <p>{@link CompletionResolver} knows only {@code target} (a herdr terminal id); it has no notion of
- * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
- * the sink's job — see {@code Fleetd.main}'s wiring, which resolves target → session → profile →
- * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
- */
-@FunctionalInterface
-public interface ExhaustionSink {
-
-    /**
-     * @param target the herdr terminal id whose turn was classified {@code BACKEND_EXHAUSTED}
-     * @param reason the matched-line reason carried by the classification
-     */
-    void onExhausted(String target, String reason);
-
-    /**
-     * Inert sink — nothing happens on exhaustion. The explicit stand-in a caller (or a test not
-     * exercising this feature) passes instead of a defaulting overload, exactly like
-     * {@link ExhaustedPatternLookup#none()}.
-     */
-    static ExhaustionSink none() {
-        return (target, reason) -> { };
-    }
-}

bridged/src/main/java/dev/ltms/fleet/mcp/ConnectionIdentity.java

@@ -1,66 +0,0 @@
-package dev.ltms.fleet.mcp;
-
-import dev.ltms.fleet.herdr.PaneLocator;
-
-/**
- * Resolves <em>who is calling</em> an MCP tool from the connection alone — the anti-spoofing
- * identity model of the MCP contract. It ties the connection's loopback peer PID (from the OS)
- * to a herdr agent pane (from herdr), yielding the caller's worker {@code terminal_id}. A caller
- * that maps to no worker pane — the primary, or an off-host client — resolves to {@code null}.
- *
- * <p>Both sources are authoritative and unforgeable: the OS reports the real connecting PID, and
- * herdr owns the PID→pane mapping. A worker cannot claim to be another worker, nor the primary.
- * Single-host only (the herd shares the {@code bridged} host); the token path is the split-host
- * fallback.
- */
-public final class ConnectionIdentity {
-
-    private final PaneLocator panes;
-    private final PeerPidLookup pids;
-    private final ProcessCwdLookup cwds;
-
-    /** Identity only (no cwd resolution — {@link #cwdForPid} returns {@code null}). */
-    public ConnectionIdentity(PaneLocator panes, PeerPidLookup pids) {
-        this(panes, pids, _ -> null);
-    }
-
-    /** Identity plus cwd resolution (CB-112 — inherit the primary's directory on spawn). */
-    public ConnectionIdentity(PaneLocator panes, PeerPidLookup pids, ProcessCwdLookup cwds) {
-        this.panes = panes;
-        this.pids = pids;
-        this.cwds = cwds;
-    }
-
-    /**
-     * The caller resolved from the connection: its worker {@code terminal} (or {@code null} for the
-     * primary / an off-host client) and its {@code pid} (or {@code -1} if not resolvable).
-     */
-    public record Caller(String terminal, long pid) {
-    }
-
-    /** Resolve the caller's terminal and PID from one peer-PID lookup. */
-    public Caller resolve(String remoteAddr, int remotePort) {
-        if (!isLoopback(remoteAddr)) {
-            return new Caller(null, -1); // only same-host callers can be workers
-        }
-        long pid = pids.pidForLocalPort(remotePort);
-        return new Caller(panes.terminalForPid(pid), pid);
-    }
-
-    /**
-     * The calling worker's {@code terminal_id}, or {@code null} if the caller is not a known
-     * on-host worker (treat as the primary).
-     */
-    public String callerTerminal(String remoteAddr, int remotePort) {
-        return resolve(remoteAddr, remotePort).terminal();
-    }
-
-    /** The working directory of {@code pid} (the primary's cwd on an MCP spawn), or {@code null}. */
-    public String cwdForPid(long pid) {
-        return pid > 0 ? cwds.cwdForPid(pid) : null;
-    }
-
-    private static boolean isLoopback(String addr) {
-        return "127.0.0.1".equals(addr) || "::1".equals(addr) || "0:0:0:0:0:0:0:1".equals(addr);
-    }
-}

bridged/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -1,546 +0,0 @@
-package dev.ltms.fleet.member;
-
-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.guard.SubscriptionGuard;
-import dev.ltms.fleet.herdr.Agent;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.peer.Capability;
-import dev.ltms.fleet.peer.PeerLauncher;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-import java.io.UncheckedIOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.EnumSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-import java.util.function.Function;
-import java.util.function.LongSupplier;
-import java.util.function.Supplier;
-
-/**
- * The {@link HerdrPeerLauncher} adapter for <strong>Claude Code</strong> — the safe path from a
- * delegation request to a running off-subscription Claude.
- *
- * <p>Everything transport-related (tab/pane placement, the CB-306 spawn-readiness gate, unique
- * naming, CB-117 orphan reap, teardown, listing, cwd resolution) lives in the base. This class
- * supplies only the two Claude-specific seams:
- * <ul>
- *   <li>the {@code claude} name prefix (so reap matches {@code claude-*} panes, never another
- *       adapter's), and</li>
- *   <li>{@link #buildLaunch}, which encodes the subscription boundary: build the worker env with
- *       {@code ANTHROPIC_BASE_URL}, assert that host is on the allowlist <em>before</em> touching
- *       herdr, and mount the bridge MCP + reply charter as inline launch flags. A worker's base_url
- *       lives in the env map handed to herdr and nowhere else; {@code bridged}'s own environment is
- *       never mutated, and nothing is written to the worker's profile.</li>
- * </ul>
- */
-public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
-
-    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
-    private static final String NAME_PREFIX = "claude";
-
-    private static final Logger log = LoggerFactory.getLogger(ClaudeCodeLauncher.class);
-
-    private final SubscriptionGuard guard;
-
-    /**
-     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so
-     * existing deployments and tests keep the legacy non-blocking spawn semantics.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env) {
-        this(agents, spaces, guard, profiles, defaultProfile, env, 0,
-                System::currentTimeMillis, () -> sleepUninterruptibly(300));
-    }
-
-    /**
-     * Production constructor with spawn-ready gate enabled. The gate polls {@code agents.status()}
-     * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs, long spawnReadyPollMs) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, spawnReadyPollMs, null);
-    }
-
-    /**
-     * Production constructor carrying the fleet-wide tab-label template (CB-557). The template comes
-     * from {@code fleet.tabLabel}, which a profile cannot know because it names the member's
-     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<FleetConfig.Fleet> fleet) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs,
-                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                fleet);
-    }
-
-    /**
-     * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<FleetConfig.Fleet> fleet,
-                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs,
-                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                fleet, memberCredentials);
-    }
-
-    /**
-     * Full testability constructor. Every injectable collaborator is explicit so unit tests supply
-     * fakes for the clock ({@code nowMillis}) and poll-loop wait ({@code sleeper}). The
-     * {@code sleeper} is never called when the gate is disabled ({@code spawnReadyTimeoutMs == 0}).
-     *
-     * @param agents               herdr agent control (start, status, close)
-     * @param spaces               workspace / tab control (ensure, create, close)
-     * @param guard                subscription-boundary guard (checked before spawning)
-     * @param profiles             configured worker profiles
-     * @param defaultProfile       profile a no-argument spawn uses (nullable)
-     * @param env                  host env lookup (injectable for tests)
-     * @param spawnReadyTimeoutMs  max ms to wait for injectable state (0 disables the gate)
-     * @param nowMillis            monotonic clock source (e.g. {@code System::currentTimeMillis})
-     * @param sleeper              sleep/wait hook (e.g. {@code () -> Thread.sleep(pollMs)}); it
-     *                             already encodes the poll interval, so the 8th positional argument
-     *                             (poll ms) is accepted for API symmetry but otherwise unused here
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs,
-                              LongSupplier nowMillis, Runnable sleeper) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, null);
-    }
-
-    /**
-     * Full testability constructor, plus the fleet-wide tab-label template (CB-557).
-     *
-     * @param fleet live fleet config, read once for each spawn
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs,
-                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<FleetConfig.Fleet> fleet) {
-        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
-        this.guard = guard;
-    }
-
-    /**
-     * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs,
-                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<FleetConfig.Fleet> fleet,
-                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
-        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
-        this.guard = guard;
-    }
-
-    /**
-     * Full testability constructor, plus an injectable host-env-names source for the CB-596
-     * criterion-4 gap detector. Test seam only — every production call site leaves this at the
-     * default (the real {@code System.getenv()} key set) via the constructor above.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs,
-                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<FleetConfig.Fleet> fleet,
-                              Supplier<FleetConfig.MemberCredentials> memberCredentials,
-                              Supplier<Set<String>> hostEnvNames) {
-        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, hostEnvNames);
-        this.guard = guard;
-    }
-
-    /**
-     * {@inheritDoc}
-     *
-     * <p>The spawn sequence encodes the subscription boundary: assert the profile's base_url is on
-     * the allowlist <em>before</em> any herdr call, then build the worker env with
-     * {@code ANTHROPIC_*}, the parity-neutral git-forge grant, and the bridge MCP + reply charter
-     * mounted as inline launch flags. When the request carries session identity (CB-547a) it is
-     * applied here — see {@link #applySessionIdentity}.
-     */
-    @Override
-    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
-        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
-        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
-        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
-        // requirement is skipped FOR IT ONLY. Every other profile keeps the hard boundary below.
-        boolean onSubscription = cfg.isSubscription();
-        String baseUrl = cfg.baseUrl();
-
-        if (onSubscription) {
-            // NO SILENT CONTRADICTION: subscription:true + a baseUrl state opposite intents; refuse
-            // loudly rather than pick a winner.
-            if (baseUrl != null && !baseUrl.isBlank()) {
-                throw new IllegalStateException("profile '" + cfg.profile()
-                        + "' sets both subscription: true and a baseUrl ('" + baseUrl + "') — the two "
-                        + "are contradictory: a subscription profile must not point at an endpoint. "
-                        + "Drop baseUrl, or drop subscription: true.");
-            }
-            // Visible without anyone going looking for it: this worker bills the subscription.
-            log.warn("spawning profile '{}' on the Claude subscription (subscription: true) — this "
-                    + "worker WILL bill the operator's subscription", cfg.profile());
-        } else {
-            guard.assertWorker(baseUrl); // hard stop before we spawn anything
-        }
-
-        // CB-634: the IDE guidance is delivered as an on-disk CLAUDE.local.md overlay, NOT through
-        // the charter — the charter returns to role -> reply only. Best-effort: a failed overlay
-        // must never fail the spawn, and `writeIdeOverlay` no-ops unless the cwd is a provisioned
-        // worktree (see its .git-file safety gate). The overlay pins, and the auto-open opens, the
-        // module dir (this repo's pom is in `bridged/`, not at the worktree root) — see ideProjectPath.
-        if (cfg.hasIdeMcp()) {
-            String projectPath = PeerLauncher.ideProjectPath(spec.cwd(), cfg.ideProjectDir());
-            writeIdeOverlay(spec.cwd(), projectPath);
-            PeerLauncher.openInIde(projectPath, cfg.ideOpenCommand(), log);
-        }
-
-        Map<String, String> workerEnv = baseEnv(cfg);
-        if (onSubscription) {
-            // CB-542 belt-and-braces: on the subscription path no guard vets these two keys, and the
-            // profile's env: is layered in by baseEnv — so strip any that rode in there. Config load
-            // already rejects this (loudly, naming the profile); this makes the boundary hold even
-            // for a profile built in code that never passed through that validation.
-            workerEnv.remove("ANTHROPIC_BASE_URL");
-            workerEnv.remove("ANTHROPIC_AUTH_TOKEN");
-        } else {
-            workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
-            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
-        }
-        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
-        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
-        applyGitToken(workerEnv, cfg);
-
-        // CB-547a: Claude Code can MINT its own session id, so bridged chooses it — a fresh spawn
-        // gets a UUID we pass as --session-id and return from agentSessionId(), so the resume
-        // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
-        // id via -r and passes no --session-id (the two conflict). Both are injected before the
-        // model flag so --model keeps outranking the operator's own argv.
-        // mutableArgv: argvWithFleet may hand back the profile's own (immutable) List.of when it
-        // has neither MCP nor a charter — session flags must be added into a list we own.
-        List<String> argv = mutableArgv(argvWithFleet(cfg, spec));
-        String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
-        return new Launch(workerEnv, argvWithAutoCompact(argvWithModel(argv, cfg), cfg), agentSessionId);
-    }
-
-    /**
-     * Add the Claude-specific session-identity flags to {@code argv} and return the peer's OWN
-     * session id — the resume handle. A resume request passes the prior id via {@code -r} and
-     * returns that id; a fresh named session mints a new UUID, passes it via {@code --session-id},
-     * and returns the mint. The bridge's logical name rides along as {@code -n} when present. When
-     * <em>no</em> identity is requested (sessionName and resumeSessionId both blank) this adds
-     * nothing and returns {@code null}, keeping the legacy no-identity launch byte-identical.
-     */
-    private static String applySessionIdentity(List<String> argv, String sessionName, String resumeSessionId) {
-        boolean resuming = resumeSessionId != null && !resumeSessionId.isBlank();
-        boolean named = sessionName != null && !sessionName.isBlank();
-        if (!resuming && !named) {
-            return null; // no identity requested — keep the legacy launch byte-identical
-        }
-        if (named) {
-            argv.add("-n");
-            argv.add(sessionName);
-        }
-        if (resuming) {
-            argv.add("-r");
-            argv.add(resumeSessionId);
-            return resumeSessionId;
-        }
-        String minted = UUID.randomUUID().toString();
-        argv.add("--session-id");
-        argv.add(minted);
-        return minted;
-    }
-
-    /**
-     * The launch argv, plus an inline {@code --mcp-config} when {@code worker.mcpUrl} is set, the
-     * CB-617 charter flags, and {@code --agent <role>} when the role has an agent-definition file
-     * under the worker's cwd. Neither touches the profile's config; all are pure command-line flags.
-     * This inline-flag mount is Claude Code specific — other adapters mount MCP and instructions
-     * their own way.
-     *
-     * <p>CB-617: the role charter is operator-authored and often multi-line, so it can never be a
-     * single inline argv element — herdr refuses to shell-encode a multi-line argument
-     * ({@code invalid_agent_argument}). It is written to a temp file instead and mounted with
-     * {@code --append-system-prompt-file}, which this host confirms Claude Code accepts for a
-     * multi-line file.
-     *
-     * <p>CB-618: Claude Code refuses to start when BOTH {@code --append-system-prompt} and
-     * {@code --append-system-prompt-file} are on the command line ("Cannot use both ... Please use
-     * only one"), so the two charters can never travel on separate flags. When both are present they
-     * are concatenated into the one file, role charter first and reply charter last — last is where
-     * the reply rule must sit, because it is the rule that must survive. When only the reply charter
-     * is present it keeps its proven inline {@code --append-system-prompt} delivery, which is also
-     * the only form that reaches a member with no repo checkout.
-     */
-    private List<String> argvWithFleet(FleetConfig.Profile cfg, LaunchSpec spec) {
-        String roleCharter = nonBlank(spec.roleCharter());
-        // CB-634: the IDE guidance is delivered as an on-disk overlay (writeIdeOverlay), not through
-        // the charter. The charter file is role -> reply only.
-        String replyCharter = nonBlank(spec.replyCharter());
-        Path agentFile = agentDefinitionFile(spec.cwd(), spec.role(), ".claude", "agents");
-        if (!cfg.mountsAnyMcp() && roleCharter == null
-                && replyCharter == null && agentFile == null) {
-            return cfg.argv();
-        }
-        List<String> argv = mutableArgv(cfg.argv());
-        if (cfg.mountsAnyMcp()) {
-            argv.add("--mcp-config");
-            argv.add(mcpConfigJson(cfg));
-        }
-        // Combine the charters in order role -> reply, dropping any that are absent. When two
-        // or more survive they must ride one --append-system-prompt-file (CB-618 forbids the inline
-        // flag and the file flag together). A lone reply charter keeps its proven inline delivery.
-        List<String> charters = new java.util.ArrayList<>(2);
-        if (roleCharter != null) charters.add(roleCharter);
-        if (replyCharter != null) charters.add(replyCharter);
-        if (charters.size() == 1 && replyCharter != null && roleCharter == null) {
-            argv.add("--append-system-prompt");
-            argv.add(replyCharter);
-        } else if (!charters.isEmpty()) {
-            argv.add("--append-system-prompt-file");
-            argv.add(writeCharterFile(String.join("\n\n", charters)).toString());
-        }
-        if (agentFile != null) {
-            argv.add("--agent");
-            argv.add(spec.role().wireName());
-        }
-        return argv;
-    }
-
-    /**
-     * The {@code --mcp-config} JSON for this member: always the bridge mount when {@link
-     * FleetConfig.Profile#hasMcp()}, plus the IDE Index MCP as a second server named {@code
-     * intellij} when {@link FleetConfig.Profile#hasIdeMcp()} (CB-634). At least one is present —
-     * the caller only reaches here when {@link FleetConfig.Profile#mountsAnyMcp()} is true.
-     */
-    private static String mcpConfigJson(FleetConfig.Profile cfg) {
-        StringBuilder servers = new StringBuilder();
-        if (cfg.hasMcp()) {
-            servers.append('"').append(PeerLauncher.MCP_MOUNT_NAME)
-                    .append("\":{\"type\":\"http\",\"url\":\"").append(cfg.mcpUrl()).append("\"}");
-        }
-        if (cfg.hasIdeMcp()) {
-            if (servers.length() > 0) servers.append(',');
-            servers.append("\"intellij\":{\"type\":\"http\",\"url\":\"")
-                    .append(cfg.ideMcpUrl()).append("\"}");
-        }
-        return "{\"mcpServers\":{" + servers + "}}";
-    }
-
-    /**
-     * Deliver the shared IDE guidance ({@link PeerLauncher#ideOverlayText}) as an on-disk
-     * {@code CLAUDE.local.md} overlay beside the project's own {@code CLAUDE.md} (CB-634), and
-     * register the overlay in the repository's common {@code info/exclude} so it never shows as
-     * untracked (git reads a worktree's excludes from the common dir, not the per-worktree gitdir).
-     *
-     * <p><strong>Safety gate:</strong> the overlay is written ONLY when {@code cwd/.git} is a
-     * <em>regular file</em> — a provisioned worktree keeps a {@code .git} FILE holding a
-     * {@code gitdir: <path>} pointer, while the primary's real checkout has a {@code .git}
-     * DIRECTORY. Returning without writing when {@code .git} is a directory is the whole safety of
-     * the feature: it must never write into a non-worktree cwd, i.e. never clobber a project that
-     * does not want the overlay.
-     *
-     * <p>Best-effort: a failure is logged at debug and swallowed — a failed overlay must never fail
-     * the spawn.
-     *
-     * @param cwd         the member's worktree root, where the {@code CLAUDE.local.md} file is written
-     * @param projectPath the module dir the overlay pins {@code project_path} to (see
-     *                    {@link PeerLauncher#ideProjectPath}); equals {@code cwd} when no module subdir
-     */
-    private static void writeIdeOverlay(String cwd, String projectPath) {
-        try {
-            Path dotGit = Path.of(cwd, ".git");
-            if (!Files.isRegularFile(dotGit)) {
-                // Not a provisioned worktree (primary's real checkout has a .git directory, or the
-                // cwd is not a repo at all). Never write into it.
-                return;
-            }
-            // The overlay FILE lives at the worktree root (claude-code's cwd), but its CONTENT pins
-            // project_path to the module dir the IDE opened (projectPath), not the worktree root.
-            Files.writeString(Path.of(cwd, "CLAUDE.local.md"), PeerLauncher.ideOverlayText(projectPath));
-            String gitdirLine = Files.readString(dotGit).trim();
-            Path gitDir = Path.of(gitdirLine.replaceFirst("^gitdir:\\s*", ""));
-            if (!gitDir.isAbsolute()) {
-                gitDir = Path.of(cwd).resolve(gitDir).normalize();
-            }
-            // git reads info/exclude from the COMMON dir, never the per-worktree gitdir (only
-            // info/sparse-checkout is per-worktree). A provisioned worktree's gitdir is
-            // <common>/worktrees/<name>, so the common dir is two levels up; writing the entry into
-            // the per-worktree gitdir leaves it un-honoured and the overlay shows as untracked.
-            Path commonDir = gitDir;
-            if (gitDir.getParent() != null && gitDir.getParent().getFileName() != null
-                    && "worktrees".equals(gitDir.getParent().getFileName().toString())) {
-                commonDir = gitDir.getParent().getParent();
-            }
-            Path exclude = commonDir.resolve("info").resolve("exclude");
-            Files.createDirectories(exclude.getParent());
-            String overlayLine = "CLAUDE.local.md";
-            if (!Files.exists(exclude) || Files.readAllLines(exclude).stream().noneMatch(overlayLine::equals)) {
-                Files.writeString(exclude, (Files.exists(exclude) ? System.lineSeparator() : "")
-                        + overlayLine + System.lineSeparator());
-            }
-        } catch (Exception e) {
-            log.debug("cannot write IDE overlay into worktree '{}'", cwd, e);
-        }
-    }
-
-    /** {@code s}, or {@code null} when {@code s} is null/blank — the charter-presence test used above. */
-    private static String nonBlank(String s) {
-        return (s == null || s.isBlank()) ? null : s;
-    }
-
-    /**
-     * Write the role charter to a fresh temp file so it can be mounted with
-     * {@code --append-system-prompt-file} instead of riding inline in argv (CB-617). Best-effort
-     * cleaned via {@code deleteOnExit} — the same disposable-worker-config cleanup
-     * {@link OpenCodeLauncher#writeConfig} already uses for its charter file, since the process that
-     * reads this file (the spawned peer) outlives this JVM call and there is no spawn-scoped teardown
-     * hook to delete it synchronously.
-     */
-    private static Path writeCharterFile(String charterText) {
-        try {
-            Path file = Files.createTempFile("bridged-role-charter-", ".md");
-            Files.writeString(file, charterText);
-            file.toFile().deleteOnExit();
-            return file;
-        } catch (IOException e) {
-            throw new UncheckedIOException("cannot write role charter temp file", e);
-        }
-    }
-
-    /**
-     * Pin the model on the command line as well as in {@code ANTHROPIC_MODEL} (CB-533).
-     *
-     * <p>The env var alone is not a reliable pin for this adapter, because the argv is usually a
-     * launcher rather than {@code claude} itself — {@code ["ccs", "<profile>"]} — and {@code ccs}
-     * exports its profile's own model family ({@code ANTHROPIC_MODEL}, {@code DEFAULT_OPUS/SONNET/
-     * HAIKU}, {@code CLAUDE_CODE_SUBAGENT_MODEL}) over whatever it inherited. A worker profile that
-     * set {@code model:} therefore got silently overruled by its own launcher. Claude Code's
-     * {@code --model} flag outranks the environment, and {@code ccs <profile> [claude-args...]}
-     * passes trailing arguments through, so the flag survives the wrapper.
-     *
-     * <p>Appended last so it also outranks anything in the operator's own {@code argv}. Profiles
-     * that deliberately leave {@code model:} unset (letting {@code ccs} own model selection, as
-     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
-     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
-     */
-    private static List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
-        if (cfg.model() == null || cfg.model().isBlank()) {
-            return argv;
-        }
-        List<String> withModel = mutableArgv(argv);
-        withModel.add("--model");
-        withModel.add(cfg.model());
-        return withModel;
-    }
-
-    /**
-     * Pin a bounded auto-compaction window on the command line via {@code --autocompact <tokens>},
-     * opt-in per profile (CB-634's sibling ticket: a member that runs out of context dies mid-turn
-     * and its {@code fleet_reply} — the whole point of the turn — is lost with it; opencode already
-     * forces {@code compaction.auto: true} unconditionally, CB-523, but Claude Code has no equivalent
-     * and runs at the backend's own default window).
-     *
-     * <p>Mirrors {@link #argvWithModel}: appended after it, so it survives the {@code ccs <profile>}
-     * wrapper the same way {@code --model} does, and outranks env/settings and the operator's own
-     * {@code argv}. Verified: {@code claude 2.1.241 --help} lists {@code --autocompact <auto|tokens>}
-     * (either the literal {@code auto}, or an integer 100k–1M) — {@link FleetConfig#load} rejects a
-     * configured value outside that band before this ever runs, so the flag Claude Code receives here
-     * is always in range.
-     */
-    private static List<String> argvWithAutoCompact(List<String> argv, FleetConfig.Profile cfg) {
-        if (cfg.autoCompactWindow() == null) {
-            return argv;
-        }
-        List<String> withAutoCompact = mutableArgv(argv);
-        withAutoCompact.add("--autocompact");
-        withAutoCompact.add(String.valueOf(cfg.autoCompactWindow()));
-        return withAutoCompact;
-    }
-
-    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
-
-    /** Spawn a worker for the default profile in the resolved default cwd. */
-    public Agent spawn() {
-        return spawnInternal(null, null, null);
-    }
-
-    /** Spawn a worker for a named profile (null → default) in the resolved default cwd. */
-    public Agent spawn(String profileName) {
-        return spawnInternal(profileName, null, null);
-    }
-
-    /** Spawn a worker for a named profile with an explicit requested/caller cwd (CB-112). */
-    public Agent spawn(String profileName, String requestedCwd, String callerCwd) {
-        return spawnInternal(profileName, requestedCwd, callerCwd);
-    }
-
-    // --- capabilities --------------------------------------------------------------------------
-
-    @Override
-    public Set<Capability> capabilities() {
-        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
-                Capability.CONTEXT_RESET, Capability.ORPHAN_REAP,
-                Capability.SESSION_NAME, Capability.SESSION_RESUME);
-        if (hasGitTokenProfile()) {
-            caps.add(Capability.SELF_PR);
-        }
-        return Set.copyOf(caps);
-    }
-
-    @Override
-    public boolean clearContext(String id) {
-        String target = agentTarget(id);
-        if (target == null) {
-            return false;
-        }
-        // This deliberately bypasses Injector: /clear is housekeeping, not a delegated turn.
-        agents().send(target, "/clear");
-        return true;
-    }
-
-    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
-    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
-    }
-
-    // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------
-
-    /**
-     * Whether {@code name} is a Claude Code bridge worker started by a <em>different</em> process
-     * than {@code currentNonce}. A thin {@code claude}-prefix binding of
-     * {@link HerdrPeerLauncher#isForeignWorker(String, String, String)}.
-     */
-    static boolean isForeignWorker(String name, String currentNonce) {
-        return HerdrPeerLauncher.isForeignWorker(NAME_PREFIX, name, currentNonce);
-    }
-}

bridged/src/main/java/dev/ltms/fleet/member/OpenCodeSessionDiscovery.java

@@ -1,122 +0,0 @@
-package dev.ltms.fleet.member;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.stream.Stream;
-
-/**
- * Resolves the opencode session id for a bridged worker from opencode's on-disk storage — the
- * only place this adapter touches opencode's private layout, and deliberately the <em>only</em>
- * class that does.
- *
- * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not a
- * stable contract: opencode writes one JSON file per session under
- * {@code <storageRoot>/session/<projectID>/<ses_*.json>}, and each record carries a
- * {@code "version"} field (e.g. {@code "1.1.31"}), so the exact directory shape, file naming, and
- * field names can move between opencode releases. opencode also ships a headless HTTP server that
- * may supersede file scanning entirely. Everything this adapter knows about that private storage —
- * its shape, naming, and field names — lives here, so a layout change, or a switch to the HTTP
- * server, changes exactly one class and nothing in {@link OpenCodeLauncher}.
- *
- * <p>The determinism that makes this useful is structural, not a guess: every bridged worker runs
- * in its own unique git worktree, so the record's {@code directory} (its project root) equals the
- * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
- * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
- * the CLI listing does not even show the directory.
- *
- * <p>All reads are best-effort and never throw: a missing or unreadable storage root, a record that
- * fails to parse, or a directory with no record yet all yield {@code null}, and the caller (the
- * session handle) treats that as "identity not resolved yet" and retries later.
- */
-final class OpenCodeSessionDiscovery {
-
-    private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
-    private final ObjectMapper json;
-
-    OpenCodeSessionDiscovery(Path storageRoot) {
-        this.storageRoot = storageRoot;
-        this.json = new ObjectMapper();
-    }
-
-    /**
-     * The opencode session id whose record references {@code directory} (the worker's cwd), or
-     * {@code null} when no record matches yet. When several records share the directory — e.g.
-     * repeated spawns into the same worktree — the <em>most recently modified</em> one wins: it is
-     * the session the pane most likely corresponds to.
-     *
-     * <p>Never throws: a missing {@code storageRoot}, an unreadable/malformed record, or a
-     * directory that has not been persisted yet all resolve to {@code null} rather than failing a
-     * spawn. A bridged worker's session record is written lazily (when the session is first
-     * persisted), so {@code null} here is the normal answer right after the pane is ready, and the
-     * caller retries later.
-     *
-     * @param directory the worker's cwd, as resolved for this spawn
-     * @return the matching session id, or {@code null} if none is known yet
-     */
-    String sessionIdForDirectory(String directory) {
-        if (directory == null || directory.isBlank()) {
-            return null;
-        }
-        Path sessionRoot = storageRoot.resolve("session");
-        if (!Files.isDirectory(sessionRoot)) {
-            return null;
-        }
-        String best = null;
-        long bestMtime = Long.MIN_VALUE;
-        try (Stream<Path> projectDirs = Files.list(sessionRoot)) {
-            for (Path projectDir : projectDirs.filter(Files::isDirectory).toList()) {
-                try (Stream<Path> records = Files.list(projectDir)) {
-                    for (Path record : records.toList()) {
-                        String id = matchId(record, directory);
-                        if (id == null) {
-                            continue;
-                        }
-                        long mtime = lastModifiedEpochMillis(record);
-                        if (mtime > bestMtime) {
-                            bestMtime = mtime;
-                            best = id;
-                        }
-                    }
-                } catch (IOException ignored) {
-                    // one project dir unreadable — skip it; another may still match
-                }
-            }
-        } catch (IOException ignored) {
-            // storage root vanished or became unreadable — "no session known yet"
-            return null;
-        }
-        return best;
-    }
-
-    /**
-     * The record's session id when it references {@code directory}, else {@code null}. A record
-     * that is not JSON, lacks {@code id}/{@code directory}, or points at a different directory is
-     * simply not our session; a malformed one is skipped, never fatal.
-     */
-    private String matchId(Path record, String directory) {
-        try {
-            JsonNode node = json.readTree(record.toFile());
-            JsonNode id = node == null ? null : node.get("id");
-            JsonNode dir = node == null ? null : node.get("directory");
-            if (id == null || dir == null || !directory.equals(dir.asText())) {
-                return null;
-            }
-            return id.asText();
-        } catch (IOException e) {
-            return null;
-        }
-    }
-
-    /** The record's last-modified epoch ms, or {@code Long.MIN_VALUE} if unreadable (never wins). */
-    private static long lastModifiedEpochMillis(Path record) {
-        try {
-            return Files.getLastModifiedTime(record).toMillis();
-        } catch (IOException e) {
-            return Long.MIN_VALUE;
-        }
-    }
-}

bridged/src/main/java/dev/ltms/fleet/placement/FixedPlacementPolicy.java

@@ -1,66 +0,0 @@
-package dev.ltms.fleet.placement;
-
-/**
- * Backward-compatible placement: an unqualified spawn always resolves to the configured default
- * profile, exactly as {@code CompositePeerLauncher} did before CB-518. This ignores caps and
- * reachability so that a pre-existing config behaves identically after upgrade.
- *
- * <p>Two exceptions walk past the default instead of returning it unconditionally:
- * <ul>
- *   <li>Quarantine (CB-578 stage B): a quarantined default is a credential that just refused on
- *       a usage limit, not a transient capacity or reachability concern.
- *   <li>Weight 0 (CB-554): {@code fixed} is still automatic selection, so a profile the operator
- *       marked "never auto-select me" ({@code weight <= 0}) must be skipped here exactly as
- *       {@code weighted}/{@code round-robin} skip it — an explicit {@code fleet_spawn} naming
- *       the profile is unaffected, only this automatic fallback walk.
- * </ul>
- * A fleet where nothing is ever quarantined or weight-0 never exercises either path, so today's
- * behaviour is unchanged.
- */
-final class FixedPlacementPolicy implements PlacementPolicy {
-
-    @Override
-    public PlacementCandidate select(PlacementContext ctx) {
-        String d = ctx.defaultProfile();
-        if (d != null && !d.isBlank() && !ctx.quarantined().contains(d) && !weightExcluded(ctx, d)) {
-            return new PlacementCandidate(d, null, 1.0f, null);
-        }
-        for (PlacementCandidate c : ctx.candidates()) {
-            if (!ctx.quarantined().contains(c.profile()) && !c.excluded()) {
-                return new PlacementCandidate(c.profile(), null, c.weight(), c.maxLoad());
-            }
-        }
-        if (d != null && !d.isBlank()) {
-            boolean dQuarantined = ctx.quarantined().contains(d);
-            boolean dWeightExcluded = weightExcluded(ctx, d);
-            if (dQuarantined && dWeightExcluded) {
-                throw new PlacementException("worker profile '" + d + "' is quarantined (backend "
-                        + "exhausted) and has weight 0 (excluded from automatic selection), and no "
-                        + "available candidate remains");
-            }
-            if (dWeightExcluded) {
-                throw new PlacementException("worker profile '" + d + "' has weight 0 (excluded "
-                        + "from automatic selection) and no available candidate remains");
-            }
-            if (dQuarantined) {
-                throw new PlacementException("worker profile '" + d + "' is quarantined (backend "
-                        + "exhausted) and no un-quarantined candidate is available");
-            }
-        }
-        if (!ctx.candidates().isEmpty()) {
-            throw new PlacementException(
-                    "all worker profiles are excluded from automatic selection (quarantined or weight-0)");
-        }
-        throw new PlacementException("no worker profiles configured");
-    }
-
-    /** Whether {@code profile} carries {@code weight <= 0} (CB-554) among {@code ctx}'s candidates. */
-    private static boolean weightExcluded(PlacementContext ctx, String profile) {
-        for (PlacementCandidate c : ctx.candidates()) {
-            if (c.profile().equals(profile)) {
-                return c.excluded();
-            }
-        }
-        return false;
-    }
-}

bridged/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -1,510 +0,0 @@
-package dev.ltms.fleet.session;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.io.UncheckedIOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.security.SecureRandom;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.stream.Collectors;
-
-/**
- * Production {@link Worktrees} implementation that shells {@code git} via {@link ProcessBuilder}.
- * Non-zero exits become {@link WorktreeException}. Worktree directories live under a configurable
- * root (default: a sibling {@code .bridged-worktrees} of the repo root) so they are never nested
- * inside the primary working tree.
- */
-public final class GitWorktrees implements Worktrees {
-
-    private static final Logger log = LoggerFactory.getLogger(GitWorktrees.class);
-
-    /** Project-level MCP config. Present in the repo, so every worktree would otherwise inherit the
-     *  primary's IDE server mounts (a CB-523 worker edited the primary checkout; see the isolation
-     *  javadoc). Neutralized unconditionally. */
-    private static final String MCP_CONFIG = ".mcp.json";
-
-    /** What {@link #isolateToolSurface} writes for {@code .mcp.json}: a valid, explicitly empty server map. */
-    private static final String NEUTRAL_MCP_CONFIG = "{\n  \"mcpServers\": {}\n}\n";
-
-    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree, and it mounts the
-     *  primary's gitea and context7 servers with the primary's credentials. Neutralized so the worker
-     *  gets only the config its launcher writes via {@code OPENCODE_CONFIG}.
-     *
-     *  <p>The reason has changed shape and is now stronger. It used to be a crash: the file carried
-     *  {@code {file:.secrets/...}} references to gitignored files that never reached a worktree, and
-     *  opencode refuses to start on a dangling reference (CB-543). Those credentials now live in one
-     *  shell-level store and the file reads them as {@code {env:...}}, so in a worktree the reference
-     *  resolves instead of failing. That is worse, not better: a member would silently inherit the
-     *  primary's admin-scoped {@code GITEA_ACCESS_TOKEN}. A loud crash became a quiet privilege leak,
-     *  so this entry protects a boundary now rather than papering over a startup error. */
-    private static final String OPENCODE_CONFIG = "opencode.json";
-
-    /** What {@link #isolateToolSurface} writes for {@code opencode.json}: a valid, empty JSON object. */
-    private static final String NEUTRAL_OPENCODE_CONFIG = "{}\n";
-
-    /** Autoenv's repo-level config. Not tracked today, but re-landing it must stay safe: autoenv
-     *  authorizes by path, so a fresh worktree path is always unauthorized and its interactive prompt
-     *  would block every spawn — neutralize it so it can never be committed. */
-    private static final String AUTOENV_CONFIG = ".autoenv";
-
-    /** What {@link #isolateToolSurface} writes for {@code .autoenv}: a valid, empty env file. */
-    private static final String NEUTRAL_AUTOENV_CONFIG = "";
-
-    /**
-     * A tracked project config that is hostile in a provisioned worktree, and what to replace it
-     * with. {@link #file} is the repo-relative path; {@link #stub} is a neutral but VALID payload for
-     * that file's format — a malformed stub would only trade one crash for another;
-     * {@link #createIfAbsent} keeps {@code .mcp.json}'s long-standing behaviour of writing its stub
-     * even when the repo carries no such file, whereas the others are only touched when present.
-     */
-    private record WorktreeHostileConfig(String file, String stub, boolean createIfAbsent) {}
-
-    /** The worktree-hostile configs neutralized in every provisioned worktree, in order. */
-    private static final List<WorktreeHostileConfig> WORKTREE_HOSTILE_CONFIGS = List.of(
-            new WorktreeHostileConfig(MCP_CONFIG, NEUTRAL_MCP_CONFIG, true),
-            new WorktreeHostileConfig(OPENCODE_CONFIG, NEUTRAL_OPENCODE_CONFIG, false),
-            new WorktreeHostileConfig(AUTOENV_CONFIG, NEUTRAL_AUTOENV_CONFIG, false)
-    );
-
-    private final String configuredRoot;
-    private final SecureRandom random = new SecureRandom();
-    private final AtomicLong seq = new AtomicLong();
-
-    /** Default constructor: worktree root is derived per-repo as {@code <repoRoot>/../.bridged-worktrees}. */
-    public GitWorktrees() {
-        this(null);
-    }
-
-    /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
-    public GitWorktrees(String configuredRoot) {
-        this.configuredRoot = configuredRoot;
-    }
-
-    @Override
-    public String add(String repoRoot, String branch, String baseRef) {
-        String base = (baseRef == null || baseRef.isBlank()) ? "HEAD" : baseRef;
-        String nonce = nonce();
-        Path root = resolveRoot(repoRoot);
-        Path path = root.resolve(nonce);
-        try {
-            Files.createDirectories(root);
-        } catch (IOException e) {
-            throw new WorktreeException("cannot create worktree root " + root + ": " + e.getMessage(), e);
-        }
-        String wt = path.toAbsolutePath().toString();
-        log.info("adding worktree branch={} path={} base={}", branch, wt, base);
-        exec("git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base);
-        isolateToolSurface(wt);
-        return wt;
-    }
-
-    /**
-     * Neutralize the worktree's worktree-hostile project configs so a worker inherits only the tools
-     * and environment its launcher mounts (the bridge via {@code --mcp-config}, the opencode config
-     * via {@code OPENCODE_CONFIG}) — never the primary's.
-     *
-     * <p>This is unconditional, and it is not the same job as the parity overlay. The repo's own
-     * committed {@code .mcp.json} declares the primary's IDE servers, so a fresh checkout mounts them
-     * whether or not the overlay copies anything; a worker that inherits them navigates and edits
-     * through tools bound to the <em>primary's</em> IntelliJ project, which silently hands it absolute
-     * paths outside its own worktree. That is not hypothetical: a CB-523 worker made all 59 of its
-     * edits in the primary checkout while compiling its worktree, so every build it ran was of code
-     * that did not contain its changes. {@code opencode.json} is the same trap one tool over — tracked,
-     * so it lands in every worktree, and it mounts gitea and context7 with the primary's own
-     * credentials, which a member must never hold. {@code .autoenv} extends the principle to a
-     * config that is not tracked today: autoenv authorizes by path, so a fresh worktree path is always
-     * unauthorized and its interactive prompt would block every spawn, so re-landing one must be safe.
-     *
-     * <p>Where a config exists it is replaced by a valid neutral stub (an explicitly empty
-     * map/object, or an empty env file — never a deletion, which would still let a later
-     * {@code git checkout} restore the hostile copy). The {@code --skip-worktree} bit keeps the
-     * neutralized copy from ever showing up as a local modification the worker might commit. A config
-     * the repo does not carry is skipped silently — no stub is invented for a file the repo does not
-     * have, and one missing file must never fail provisioning.
-     */
-    private void isolateToolSurface(String worktreePath) {
-        Path root = Path.of(worktreePath).toAbsolutePath().normalize();
-        for (WorktreeHostileConfig cfg : WORKTREE_HOSTILE_CONFIGS) {
-            neutralize(root, worktreePath, cfg);
-        }
-    }
-
-    private void neutralize(Path root, String worktreePath, WorktreeHostileConfig cfg) {
-        Path target = root.resolve(cfg.file());
-        if (!Files.exists(target) && !cfg.createIfAbsent()) {
-            log.debug("{} absent in the worktree — skipping (repo does not carry it)", cfg.file());
-            return;
-        }
-        try {
-            Files.writeString(target, cfg.stub());
-        } catch (IOException e) {
-            throw new WorktreeException("cannot neutralize " + cfg.file() + " in the worktree: "
-                    + e.getMessage(), e);
-        }
-        if (isTracked(root, cfg.file())) {
-            exec("git", "-C", worktreePath, "update-index", "--skip-worktree", cfg.file());
-        }
-        log.debug("neutralized {} — worker tool surface is launcher-mounted only", cfg.file());
-    }
-
-    @Override
-    public void remove(String repoRoot, String worktreePath) {
-        Path p = Path.of(worktreePath);
-        if (!Files.exists(p)) {
-            log.debug("worktree {} already gone — nothing to remove", worktreePath);
-            return;
-        }
-        log.info("removing worktree {}", worktreePath);
-        exec("git", "-C", repoRoot, "worktree", "remove", "--force", worktreePath);
-    }
-
-    @Override
-    public boolean hasUncommitted(String worktreePath) {
-        // A worktree that is already gone holds no work to lose, and it must not break teardown:
-        // git -C <missing-dir> status exits non-zero and would throw where release() is mid-way
-        // through stopping a pane. Mirror remove()'s already-gone tolerance by treating it as clean.
-        Path p = Path.of(worktreePath);
-        if (!Files.exists(p)) {
-            log.debug("worktree {} already gone — nothing can be uncommitted", worktreePath);
-            return false;
-        }
-        // No --untracked-files=no: the exact shape of the work lost in CB-576 was a new file
-        // that was never added, so an untracked-only worktree is still dirty.
-        String out = exec("git", "-C", worktreePath, "status", "--porcelain");
-        return !out.isBlank();
-    }
-
-    @Override
-    public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
-        if (overlay == null || overlay.isEmpty()) {
-            return;
-        }
-        Path srcRoot = Path.of(repoRoot).toAbsolutePath().normalize();
-        Path dstRoot = Path.of(worktreePath).toAbsolutePath().normalize();
-        for (String rel : overlay) {
-            Path src = srcRoot.resolve(rel).normalize();
-            if (!Files.exists(src)) {
-                log.debug("parity overlay source missing — skipping {}", rel);
-                continue;
-            }
-            Path dst = dstRoot.resolve(rel).normalize();
-            try {
-                Files.createDirectories(dst.getParent());
-                Files.copy(src, dst, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.COPY_ATTRIBUTES);
-                log.debug("copied parity overlay {}", rel);
-            } catch (IOException e) {
-                throw new WorktreeException("cannot copy overlay " + rel + ": " + e.getMessage(), e);
-            }
-            if (isTracked(dstRoot, rel)) {
-                exec("git", "-C", worktreePath, "update-index", "--skip-worktree", rel);
-                log.debug("marked overlay --skip-worktree {}", rel);
-            }
-        }
-    }
-
-    @Override
-    public String repoRoot(String cwd) {
-        String out = exec("git", "-C", cwd, "rev-parse", "--show-toplevel");
-        return Path.of(out.trim()).toAbsolutePath().normalize().toString();
-    }
-
-    /**
-     * CB-578 stage C, fixed by CB-587. Stages into a <em>temporary</em> index (never the worktree's
-     * real one, which the worker may still be writing to) — but that temp index is first <em>seeded</em>
-     * from the worktree's real one, rather than starting empty:
-     *
-     * <pre>
-     * cp $(git -C worktree rev-parse --git-path index) &lt;temp&gt;
-     * GIT_INDEX_FILE=&lt;temp&gt; git -C worktree add -A
-     * tree=$(GIT_INDEX_FILE=&lt;temp&gt; git -C worktree write-tree)
-     * commit=$(git -C worktree commit-tree $tree -p HEAD -m message)
-     * git -C worktree update-ref refs/wip/branch $commit
-     * </pre>
-     *
-     * A fresh empty index carries none of the real index's {@code --skip-worktree} /
-     * {@code --assume-unchanged} bits, so {@code add -A} into it stages a skip-worktree file's local
-     * on-disk content even though {@code git status --porcelain} correctly hides that file (CB-587).
-     * Seeding from the real index preserves those bits, so {@code add -A} then skips exactly what
-     * {@code git status} skips. {@code add -A} (never {@code -f}) also still respects
-     * {@code .gitignore} exactly as it would in the real index — a gitignored file staying ignored is
-     * what keeps secrets and local config out of the snapshot's tree. The temporary index file is
-     * removed afterwards regardless of outcome; the worker's real index is never opened for writing.
-     */
-    @Override
-    public Optional<String> snapshot(String worktreePath, String branch, String message) {
-        if (!Files.exists(Path.of(worktreePath))) {
-            log.debug("worktree {} already gone — nothing to snapshot", worktreePath);
-            return Optional.empty();
-        }
-        Path tempIndex;
-        try {
-            tempIndex = Files.createTempFile("bridged-wip-index-", ".tmp");
-        } catch (IOException e) {
-            throw new WorktreeException("cannot create a temporary index for snapshot: " + e.getMessage(), e);
-        }
-        Map<String, String> indexEnv = Map.of("GIT_INDEX_FILE", tempIndex.toAbsolutePath().toString());
-        try {
-            Path realIndex = resolveRealIndex(worktreePath);
-            try {
-                Files.copy(realIndex, tempIndex, StandardCopyOption.REPLACE_EXISTING);
-            } catch (IOException e) {
-                throw new WorktreeException("cannot copy the worktree's real index (" + realIndex
-                        + ") into the temporary snapshot index: " + e.getMessage(), e);
-            }
-            exec(indexEnv, "git", "-C", worktreePath, "add", "-A");
-            String tree = exec(indexEnv, "git", "-C", worktreePath, "write-tree").trim();
-            String commit = exec("git", "-C", worktreePath, "commit-tree", tree, "-p", "HEAD", "-m", message).trim();
-            exec("git", "-C", worktreePath, "update-ref", "refs/wip/" + branch, commit);
-            log.info("snapshotted worktree {} to refs/wip/{} commit={}", worktreePath, branch, commit);
-            return Optional.of(commit);
-        } finally {
-            try {
-                Files.deleteIfExists(tempIndex);
-            } catch (IOException e) {
-                log.debug("could not delete temporary snapshot index {}: {}", tempIndex, e.getMessage());
-            }
-        }
-    }
-
-    /**
-     * Resolve the path of {@code worktreePath}'s real index. Never assume {@code <worktree>/.git/index}:
-     * in a linked worktree {@code .git} is a <em>file</em> pointing at the main repo's
-     * {@code worktrees/<name>/} directory, and that is where the real per-worktree index lives.
-     * {@code git rev-parse --git-path index} resolves this correctly for both a linked worktree and
-     * the main checkout. Throws {@link WorktreeException} — same as every other failure in this
-     * class — if the command fails or the resolved path does not exist, rather than silently
-     * snapshotting from an empty index.
-     */
-    private Path resolveRealIndex(String worktreePath) {
-        String out = exec("git", "-C", worktreePath, "rev-parse", "--git-path", "index").trim();
-        Path index = Path.of(out);
-        if (!index.isAbsolute()) {
-            index = Path.of(worktreePath).resolve(index).normalize();
-        }
-        if (!Files.exists(index)) {
-            throw new WorktreeException("worktree's real index not found at resolved path " + index
-                    + " (git rev-parse --git-path index reported '" + out + "')");
-        }
-        return index;
-    }
-
-    /**
-     * One {@code refs/wip/<branch>} snapshot ref as read by {@link #listWipRefs}: its full ref name,
-     * the snapshot commit's sha, and that commit's committer time in unix millis (the age of the
-     * snapshot — a snapshot is written once and never rewritten, so the commit date is the ref's).
-     */
-    private record WipRef(String refName, String sha, long committerMillis) {
-        String branch() {
-            return refName.substring("refs/wip/".length());
-        }
-    }
-
-    @Override
-    public WipRefStats wipRefs(String repoRoot) {
-        List<WipRef> refs = listWipRefs(repoRoot);
-        long costBytes = 0;
-        for (WipRef ref : refs) {
-            costBytes += treeSize(repoRoot, ref.sha());
-        }
-        return new WipRefStats(refs.size(), costBytes);
-    }
-
-    @Override
-    public int pruneWipRefs(String repoRoot, long minAgeMillis) {
-        // The rule is documented on Worktrees#pruneWipRefs: delete only a snapshot whose tree
-        // content is already reachable from main AND that is older than minAgeMillis. Reachability
-        // is the floor that keeps a worker's last copy; the age floor keeps a just-written snapshot
-        // from being swept while a lead may still be looking at it.
-        List<WipRef> refs = listWipRefs(repoRoot);
-        if (refs.isEmpty()) {
-            return 0;
-        }
-        long nowMillis = System.currentTimeMillis();
-        // Resolve what main carries once per sweep, not once per ref.
-        Set<String> mainObjects = reachableObjectsFromMain(repoRoot);
-        int deleted = 0;
-        for (WipRef ref : refs) {
-            long ageMillis = nowMillis - ref.committerMillis();
-            if (ageMillis <= minAgeMillis) {
-                continue; // too recent — never swept, even if it looks recoverable (CB-586)
-            }
-            String tree = exec("git", "-C", repoRoot, "rev-parse", ref.sha() + "^{tree}").trim();
-            if (!mainObjects.contains(tree)) {
-                // Last copy of the snapshot's content — the worker's work exists nowhere else.
-                // Never delete automatically (CB-586 criterion 2).
-                continue;
-            }
-            exec("git", "-C", repoRoot, "update-ref", "-d", ref.refName());
-            deleted++;
-            log.info("pruned snapshot ref refs/wip/{} commit={} (age {}h): its tree is already "
-                     + "reachable from main, so the work is preserved; recover from reflog via "
-                     + "git update-ref refs/wip/{} {}",
-                    ref.branch(), ref.sha(), TimeUnit.MILLISECONDS.toHours(ageMillis),
-                    ref.branch(), ref.sha());
-        }
-        return deleted;
-    }
-
-    /**
-     * Every {@code refs/wip/*} ref (see {@link WipRef}). The committer date is read as a unix
-     * count of seconds and converted to millis. {@code %00} (NUL) separates the fields because a
-     * branch name may contain spaces.
-     */
-    private List<WipRef> listWipRefs(String repoRoot) {
-        String out = exec("git", "-C", repoRoot, "for-each-ref",
-                "--format=%(refname)%00%(objectname)%00%(committerdate:unix)", "refs/wip/");
-        List<WipRef> refs = new ArrayList<>();
-        for (String line : out.split("\\R")) {
-            if (line.isBlank()) {
-                continue;
-            }
-            String[] parts = line.split("\u0000", -1);
-            if (parts.length == 3 && !parts[1].isBlank()) {
-                refs.add(new WipRef(parts[0], parts[1], Long.parseLong(parts[2]) * 1000L));
-            }
-        }
-        return refs;
-    }
-
-    /**
-     * The set of object shas reachable from {@code main}, or an empty set when {@code main} cannot
-     * be resolved. An empty set is the safe direction: the retention sweep then concludes nothing
-     * is recoverable, so it deletes nothing — a repo with no {@code main} must never cause a
-     * worker's last copy of a snapshot to be dropped on a reachability misreading.
-     */
-    private Set<String> reachableObjectsFromMain(String repoRoot) {
-        if (exitCode("git", "-C", repoRoot, "rev-parse", "--verify", "main") != 0) {
-            log.debug("refs/wip retention: no 'main' ref in {} — treating nothing as reachable", repoRoot);
-            return Set.of();
-        }
-        String out = exec("git", "-C", repoRoot, "rev-list", "--objects", "main");
-        Set<String> objects = new HashSet<>();
-        for (String line : out.split("\\R")) {
-            if (line.isBlank()) {
-                continue;
-            }
-            int sp = line.indexOf(' ');
-            objects.add(sp < 0 ? line : line.substring(0, sp));
-        }
-        return objects;
-    }
-
-    /** Approximate cost of a snapshot: the sum of every blob's size in its committed tree. */
-    private long treeSize(String repoRoot, String sha) {
-        String out = exec("git", "-C", repoRoot, "ls-tree", "-r", "-l", sha);
-        long total = 0;
-        for (String line : out.split("\\R")) {
-            if (line.isBlank()) {
-                continue;
-            }
-            // ls-tree -l row: "<mode> <type> <object> <size>\t<path>"; the size is only numeric for
-            // blobs (trees read "-"), so gate on the type token and take the 4th whitespace field.
-            String[] parts = line.split("\\s+");
-            if (parts.length >= 4 && "blob".equals(parts[1])) {
-                try {
-                    total += Long.parseLong(parts[3]);
-                } catch (NumberFormatException ignored) {
-                    // a '-' size (or any anomaly) contributes nothing to the rough figure
-                }
-            }
-        }
-        return total;
-    }
-
-    /** Resolve the directory that will hold per-session worktree checkouts. */
-    private Path resolveRoot(String repoRoot) {
-        if (configuredRoot != null && !configuredRoot.isBlank()) {
-            return Path.of(configuredRoot).toAbsolutePath().normalize();
-        }
-        Path repo = Path.of(repoRoot).toAbsolutePath().normalize();
-        return repo.resolveSibling(".bridged-worktrees");
-    }
-
-    private String nonce() {
-        return String.format("%06x", random.nextInt(1 << 24)) + "-" + seq.incrementAndGet();
-    }
-
-    private boolean isTracked(Path worktreeRoot, String rel) {
-        return exitCode("git", "-C", worktreeRoot.toString(), "ls-files", "--error-unmatch", rel) == 0;
-    }
-
-    /**
-     * Run a command and return its stdout. Non-zero exit → {@link WorktreeException} with both
-     * stdout and stderr (merged by redirectErrorStream).
-     */
-    private String exec(String... command) {
-        return exec(Map.of(), command);
-    }
-
-    /** Same as {@link #exec(String...)}, with extra environment variables set on the child process. */
-    private String exec(Map<String, String> extraEnv, String... command) {
-        String out;
-        int code;
-        Process p;
-        try {
-            ProcessBuilder pb = new ProcessBuilder(command).redirectErrorStream(true);
-            if (extraEnv != null && !extraEnv.isEmpty()) {
-                pb.environment().putAll(extraEnv);
-            }
-            p = pb.start();
-        } catch (IOException e) {
-            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
-        }
-        try (BufferedReader r = new BufferedReader(new InputStreamReader(p.getInputStream(), StandardCharsets.UTF_8))) {
-            out = r.lines().collect(Collectors.joining("\n"));
-        } catch (IOException e) {
-            p.destroyForcibly();
-            throw new UncheckedIOException(e);
-        }
-        try {
-            if (!p.waitFor(30, TimeUnit.SECONDS)) {
-                p.destroyForcibly();
-                throw new WorktreeException("command timed out: " + String.join(" ", command) + "\n" + out);
-            }
-            code = p.exitValue();
-        } catch (InterruptedException e) {
-            p.destroyForcibly();
-            Thread.currentThread().interrupt();
-            throw new WorktreeException("interrupted waiting for command: " + String.join(" ", command), e);
-        }
-        if (code != 0) {
-            throw new WorktreeException("exit " + code + " for: " + String.join(" ", command)
-                    + (out.isBlank() ? "" : "\n" + out));
-        }
-        return out;
-    }
-
-    private int exitCode(String... command) {
-        Process p;
-        try {
-            p = new ProcessBuilder(command).redirectErrorStream(true).start();
-        } catch (IOException e) {
-            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
-        }
-        try {
-            if (!p.waitFor(30, TimeUnit.SECONDS)) {
-                p.destroyForcibly();
-                throw new WorktreeException("command timed out: " + String.join(" ", command));
-            }
-            return p.exitValue();
-        } catch (InterruptedException e) {
-            p.destroyForcibly();
-            Thread.currentThread().interrupt();
-            throw new WorktreeException("interrupted waiting for command: " + String.join(" ", command), e);
-        }
-    }
-}

bridged/src/test/java/dev/ltms/fleet/health/FleetHealthMonitorTest.java

@@ -1,170 +0,0 @@
-package dev.ltms.fleet.health;
-
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.inject.Injector;
-import dev.ltms.fleet.msg.InMemoryReplyInbox;
-import dev.ltms.fleet.msg.MessageService;
-import dev.ltms.fleet.msg.Rendezvous;
-import dev.ltms.fleet.session.SessionManager;
-import dev.ltms.fleet.member.ClaudeCodeLauncher;
-import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.guard.SubscriptionGuard;
-import dev.ltms.fleet.config.FleetConfig;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.Executors;
-import java.util.function.BiConsumer;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class FleetHealthMonitorTest {
-    @Test void oneTickUsesOneFleetListForAnyRosterSize() {
-        FakeHerdr herdr = new FakeHerdr();
-        AgentControl agents = new AgentControl(herdr);
-        FleetConfig.Profile profile = new FleetConfig.Profile("test", "http://test:1", null,
-                null, null, null, null, null, null, null, null, null);
-        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(agents, new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("test")), Map.of("test", profile), "test", _ -> "token");
-        SessionManager sessions = new SessionManager(launcher);
-        sessions.acquire("test", null, null, null);
-        sessions.acquire("test", null, null, null);
-        herdr.calls.clear();
-        MessageService messages = new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox());
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents, sessions::roster, messages, scheduler, () -> 1, 60,
-                (_, _) -> { });
-        monitor.tick();
-        monitor.stop();
-        assertEquals(1, herdr.calls.stream().filter(call -> call.method().equals("agent.list")).count());
-    }
-
-    @Test void failedTickDoesNotStopTheNextTick() {
-        FakeHerdr herdr = new FakeHerdr().healthy(false);
-        AgentControl agents = new AgentControl(herdr);
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents, java.util.List::of,
-                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                scheduler, () -> 1, 60, (_, _) -> { });
-        monitor.tick();
-        herdr.healthy(true);
-        monitor.tick();
-        monitor.stop();
-        assertEquals(2, herdr.calls.stream().filter(call -> call.method().equals("agent.list")).count());
-    }
-
-    @Test void faultTransitionLogsOnlyOnceUntilItChanges() {
-        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        try {
-            FakeHerdr herdr = new FakeHerdr();
-            AgentControl agents = new AgentControl(herdr);
-            var scheduler = Executors.newSingleThreadScheduledExecutor();
-            FleetHealthMonitor monitor = new FleetHealthMonitor(agents, java.util.List::of,
-                    new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                    scheduler, () -> 1, 60, (_, _) -> { });
-            monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-            monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-            monitor.stop();
-            assertEquals(1, appender.list.stream().filter(event -> event.getFormattedMessage()
-                    .contains("member=term_a state=TURN_BOUNDARY_LOST")).count());
-        } finally {
-            logger.detachAppender(appender);
-        }
-    }
-
-    // --- CB-580: a member that reaches GONE/NEVER_READY must fail its waiting tickets
-
-    private static FleetHealthMonitor monitorWith(BiConsumer<String, String> failTarget) {
-        FakeHerdr herdr = new FakeHerdr();
-        AgentControl agents = new AgentControl(herdr);
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        return new FleetHealthMonitor(agents, java.util.List::of,
-                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                scheduler, () -> 1, 60, failTarget);
-    }
-
-    @Test void terminalTransitionFailsTheTargetOnce() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-        assertEquals("term_a", failTarget.calls.get(0).target());
-        assertTrue(failTarget.calls.get(0).reason().contains("GONE"));
-    }
-
-    @Test void neverReadyNamesItselfAsTheReason() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.NEVER_READY);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-        assertTrue(failTarget.calls.get(0).reason().contains("NEVER_READY"));
-    }
-
-    @Test void stayingInATerminalStateProducesOneFailureNotN() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-    }
-
-    @Test void aNonTerminalFaultStateDoesNotFailTheTarget() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-        monitor.stop();
-        assertEquals(0, failTarget.calls.size());
-    }
-
-    @Test void failTargetRetryIsBounded() {
-        AlwaysThrowingFailTarget failTarget = new AlwaysThrowingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(FleetHealthMonitor.MAX_FAIL_TARGET_ATTEMPTS, failTarget.calls);
-    }
-
-    @Test void exhaustedRetryStillDoesNotRefireOnAnUnchangedTick() {
-        AlwaysThrowingFailTarget failTarget = new AlwaysThrowingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        int afterFirstTransition = failTarget.calls;
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(afterFirstTransition, failTarget.calls);
-    }
-
-    private record RecordedCall(String target, String reason) { }
-
-    private static final class RecordingFailTarget implements BiConsumer<String, String> {
-        final java.util.List<RecordedCall> calls = new java.util.ArrayList<>();
-
-        @Override public void accept(String target, String reason) {
-            calls.add(new RecordedCall(target, reason));
-        }
-    }
-
-    private static final class AlwaysThrowingFailTarget implements BiConsumer<String, String> {
-        int calls = 0;
-
-        @Override public void accept(String target, String reason) {
-            calls++;
-            throw new RuntimeException("boom");
-        }
-    }
-}

bridged/src/test/java/dev/ltms/fleet/herdr/PaneLocatorTest.java

@@ -1,27 +0,0 @@
-package dev.ltms.fleet.herdr;
-
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/** Unit tests for PID → pane resolution (the herdr half of connection-based MCP identity). */
-class PaneLocatorTest {
-
-    private final PaneLocator loc = new PaneLocator(new FakeHerdr());
-
-    @Test
-    void resolvesTerminalForAForegroundPid() {
-        assertEquals("term_a", loc.terminalForPid(FakeHerdr.WORKER_PID));
-    }
-
-    @Test
-    void nullForAPidInNoPane() {
-        assertNull(loc.terminalForPid(999_999));
-    }
-
-    @Test
-    void nullForNonPositivePid() {
-        assertNull(loc.terminalForPid(0));
-        assertNull(loc.terminalForPid(-1));
-    }
-}

bridged/src/test/java/dev/ltms/fleet/inject/CompletionResolverTest.java

@@ -1,501 +0,0 @@
-package dev.ltms.fleet.inject;
-
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.LoggerContext;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.msg.Rendezvous;
-import dev.ltms.fleet.msg.TestTurnTokens;
-import dev.ltms.fleet.msg.TurnToken;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.Set;
-import java.util.regex.Pattern;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/** Unit behaviour of the CB-106 completion resolver in isolation from the injector. */
-class CompletionResolverTest {
-
-    @Test
-    void skipsTheScrapeWhenNoSendIsWaiting() {
-        FakeHerdr herdr = new FakeHerdr();
-        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        resolver.resolve("term_a", null); // no in-flight turn captured for this target
-
-        assertFalse(herdr.called("agent.read"),
-                "a turn nobody is blocked on must not cost a transcript scrape");
-    }
-
-    @Test
-    void failSkipsTheScrapeWhenNoSendIsWaiting() {
-        FakeHerdr herdr = new FakeHerdr();
-        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        resolver.fail("term_a", null); // no in-flight turn, and no registered waiter to fall back to
-
-        assertFalse(herdr.called("agent.read"),
-                "a wedge nobody is blocked on must not cost a transcript scrape");
-    }
-
-    @Test
-    void captureBaselineSkipsTheReadWhenNoSendIsWaiting() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ X\n❯ ");
-        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        resolver.captureBaseline("term_a", TestTurnTokens.inert("term_a")); // no send to attribute a later completion to
-
-        assertFalse(herdr.called("agent.read"),
-                "with no waiting send there is no turn to baseline — skip the scrape");
-    }
-
-    // --- CB-115 clean scrape: extract the last assistant block ----------------
-
-    @Test
-    void extractsTheLastAssistantBlockStrippingChrome() {
-        String raw = """
-                ⏺ Reading the file…
-
-                ⏺ Done. The bug was an off-by-one in the loop bound.
-
-                ╭──────────────────────────────────────╮
-                │ >                                    │
-                ╰──────────────────────────────────────╯
-                  ⏵⏵ auto mode on · ? for shortcuts
-                """;
-        assertEquals("Done. The bug was an off-by-one in the loop bound.",
-                CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    @Test
-    void keepsMultiLineAssistantContent() {
-        String raw = "⏺ Line one.\nLine two.\n❯ ";
-        assertEquals("Line one.\nLine two.", CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    @Test
-    void fallsBackToRawTextWhenThereIsNoMarker() {
-        String raw = "plain worker output with no glyph";
-        assertEquals("plain worker output with no glyph", CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    @Test
-    void blankScrapeYieldsEmpty() {
-        assertTrue(CompletionResolver.lastAssistantBlock("").isEmpty());
-        assertTrue(CompletionResolver.lastAssistantBlock(null).isEmpty());
-    }
-
-    @Test
-    void stripsSpinnerAndRuleChrome() {
-        String raw = """
-                ⏺ Channel check confirmed — your message got through.
-
-                ✻ Brewed for 11s
-
-                ─────────────────────────────────────
-                """;
-        assertEquals("Channel check confirmed — your message got through.",
-                CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    @Test
-    void cutsANextTurnPromptEchoAndTrailingTipsFromTheBlock() {
-        // The exact turn-2 leak: the scrape captured the settled answer, then a "✻ Cooked" spinner,
-        // then the NEXT turn's echoed prompt, then a "✶ Forming…" spinner and trailing tips/warnings
-        // whose lines (⎿, ⚠) are not themselves chrome-terminated. Stopping at the first boundary
-        // (the ✻ spinner) is what keeps every one of those interface lines out of the reply.
-        String raw = """
-                ⏺ Channel confirmed — the bridge reply delivered successfully.
-
-                ✻ Cooked for 9s
-
-                ❯ Thanks. Now a small task: what is 17 * 23? Show just the number.
-
-
-
-                ✶ Forming…
-                  ⎿  Tip: Name your conversations with /rename
-                  ⚠ claude.ai connectors are disabled because ANTHROPIC_API_KEY is set
-                """;
-        assertEquals("Channel confirmed — the bridge reply delivered successfully.",
-                CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    // --- CB-115 misattribution guard: suppress a stale (unchanged) completion -------
-
-    @Test
-    void suppressesACompletionWhoseScrapeIsUnchangedFromDelivery() {
-        // Rapid back-to-back turn: the pane still shows the PREVIOUS turn's answer when this turn's
-        // (misattributed) completion boundary fires. The scrape == the delivery baseline, so the
-        // send must NOT be resolved with the stale answer.
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ 391\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");   // a send is blocked on this turn
-        // The turn as captured at delivery: its waiter, and the previous turn's answer still on screen.
-        var turn = new CompletionResolver.InFlight(waiter, "391");
-        resolver.resolve("term_a", turn);          // scrape still "391" == baseline → suppress
-
-        assertFalse(waiter.isDone(), "a completion with no output change must not resolve the send");
-        assertTrue(rendezvous.isWaiting("term_a"), "the send stays waiting for a real reply");
-    }
-
-    @Test
-    void resolvesACompletionWhoseScrapeChangedSinceDelivery() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ No, 391 = 17 × 23.\n❯ "); // the worker's real answer
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        // Delivery baseline was the previous turn's "391"; the scrape now differs → resolve.
-        var turn = new CompletionResolver.InFlight(waiter, "391");
-        resolver.resolve("term_a", turn);
-
-        assertTrue(waiter.isDone(), "a completion with new output must resolve the send");
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind());
-        assertEquals("No, 391 = 17 × 23.", waiter.getNow(null).text());
-    }
-
-    @Test
-    void marksAClippedCompletionPaneTail() {
-        String block = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 1) + "\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals("x".repeat(CompletionResolver.MAX_SCRAPE_CHARS)
-                        + "\n[Pane tail clipped: member did not call fleet_reply.]",
-                waiter.getNow(null).text());
-    }
-
-    @Test
-    void leavesAnUnclippedCompletionPaneTailUnmarked() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ complete report\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals("complete report", waiter.getNow(null).text());
-    }
-
-    @Test
-    void resolvesSynchronouslyBeforePostTurnContextClearing() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ previous answer\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-        var waiter = rendezvous.open("term_a");
-        resolver.captureBaseline("term_a", new TurnToken("term_a", waiter));
-        herdr.readText("⏺ answer that /clear would erase\n❯ ");
-
-        resolver.resolveBeforePostAction("term_a");
-
-        assertTrue(waiter.isDone(), "the answer is captured before the adapter sends /clear");
-        assertEquals("answer that /clear would erase", waiter.getNow(null).text());
-    }
-
-    @Test
-    void suppressesAnUnchangedCompletionEvenWhenTheBlockExceedsTheScrapeCap() {
-        // The fan-out issue-hunt finding: captureBaseline once stored the RAW (unclipped) assistant
-        // block while resolve compares against a clip()'d tail. For a block longer than MAX_SCRAPE_CHARS
-        // the two capped representations differ even when the pane never changed, so the CB-115
-        // byte-identical guard failed to fire and a stale completion could resolve the send. Both sides
-        // must clip identically. The returned-text marker is added only after this comparison, so an
-        // unchanged >cap block on rapid back-to-back turns still stays suppressed.
-        String longBlock = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 500) + "\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(longBlock);
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");        // a send is blocked on this turn
-        resolver.captureBaseline("term_a", new TurnToken("term_a", waiter)); // baseline is the clipped >cap block
-        var turn = resolver.inFlight("term_a");
-        assertEquals(CompletionResolver.MAX_SCRAPE_CHARS, turn.baseline().length(),
-                "the delivery baseline is clipped to the same cap resolve() applies to the tail");
-
-        resolver.resolve("term_a", turn);              // scrape unchanged → clipped tail == baseline → suppress
-
-        assertFalse(waiter.isDone(),
-                "an unchanged >cap block must still be recognised as stale and suppressed");
-        assertTrue(rendezvous.isWaiting("term_a"), "the send stays waiting for a real reply");
-    }
-
-    @Test
-    void resolvesWhenThereIsNoBaseline() {
-        // No delivery baseline (e.g. the pre-turn read failed) ⇒ never suppress; the completion resolves.
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ hello\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertTrue(waiter.isDone(), "with no baseline a completion resolves as before");
-        assertEquals("hello", waiter.getNow(null).text());
-    }
-
-    @Test
-    void resolvesWhenTheScrapeItselfFailsEvenWithABaselinePresent() {
-        // The most important branch of the CB-115 guard: a failed read means the resolver could not
-        // SEE the screen — "couldn't see", not "no change". It must still resolve the send (an empty
-        // tail beats hanging until the caller's timeout), even though a baseline was captured. The
-        // baseline here is "" (an empty pane at delivery), so without the !scrapeFailed clause the
-        // byte-identical guard would wrongly match the empty tail and suppress.
-        FakeHerdr herdr = new FakeHerdr().healthy(false); // agent.read throws HerdrException
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        var turn = new CompletionResolver.InFlight(waiter, ""); // empty pane baselined at delivery
-        resolver.resolve("term_a", turn);
-
-        assertTrue(waiter.isDone(),
-                "a failed scrape must still resolve the send, not hang until the caller's timeout");
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind());
-        assertEquals("", waiter.getNow(null).text(), "the tail is empty because the screen was unreadable");
-    }
-
-    // --- CB-115/CB-116 fail guard: an already-done or absent waiter is left alone ---------
-
-    @Test
-    void failLeavesAnAlreadyResolvedWaiterUntouchedAndSkipsTheScrape() {
-        // The send was already resolved (e.g. by the worker's explicit reply) before fail fired.
-        // fail must not overwrite that value, and must not even scrape the worker — nobody needs it.
-        FakeHerdr herdr = new FakeHerdr().readText("an error screen");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        var turn = new CompletionResolver.InFlight(waiter, null);
-        assertTrue(rendezvous.resolveCompletion(waiter, "already replied"));
-
-        resolver.fail("term_a", turn);
-
-        assertFalse(herdr.called("agent.read"),
-                "fail must not scrape a waiter that is already done");
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
-                "fail must not overwrite the existing resolution");
-        assertEquals("already replied", waiter.getNow(null).text());
-    }
-
-    @Test
-    void failFallsBackToTheRegisteredWaiterWhenThereIsNoInFlightTurn() {
-        // A never-delivered readiness failure has no in-flight record but still has a blocked send;
-        // fail falls back to the waiter currently registered on the Rendezvous and fails it.
-        FakeHerdr herdr = new FakeHerdr().readText("stuck on an error screen");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a"); // send registered, but no captureBaseline ever ran
-        resolver.fail("term_a", null);          // no in-flight turn → fall back to the registered waiter
-
-        assertTrue(waiter.isDone(), "fail falls back to the registered waiter when no turn is in flight");
-        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind());
-        assertEquals("stuck on an error screen", waiter.getNow(null).text());
-    }
-
-    @Test
-    void failIsLoggedAtWarnWithTheReason() {
-        // CB-564: this used to be a bare DEBUG "failed send to X via turn-stall fallback" — a symptom
-        // with no cause, and below the level anyone watching for member health would see. A fail that
-        // resolves a caller's blocked send is at least WARN and must carry the reason.
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger resolverLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(CompletionResolver.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        resolverLog.addAppender(appender);
-        resolverLog.setLevel(Level.WARN);
-        try {
-            FakeHerdr herdr = new FakeHerdr().readText("stuck on an error screen");
-            Rendezvous rendezvous = new Rendezvous();
-            CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-            var waiter = rendezvous.open("term_a");
-
-            resolver.fail("term_a", null);
-
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .findFirst()
-                    .orElse("no turn-stall WARN logged");
-            assertTrue(warn.contains("term_a"), "the log names the target: " + warn);
-            assertTrue(warn.contains("stuck on an error screen"), "the log carries the reason: " + warn);
-            assertTrue(waiter.isDone());
-        } finally {
-            resolverLog.detachAppender(appender);
-        }
-    }
-
-    // --- CB-116 waiter identity: a late completion never crosses into the next turn ---------
-
-    @Test
-    void aLateCompletionForOneTurnNeverResolvesTheNextTurnsWaiter() {
-        // The cross-turn stale reply the conversation test surfaced: turn N's completion fallback
-        // fires AFTER turn N was resolved by an explicit fleet_reply and turn N+1 has opened its own
-        // waiter on the same session. Resolving "whatever is waiting now" would hand turn N's stale
-        // scrape to turn N+1; targeting turn N's captured waiter makes the late completion a no-op.
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ turn N answer\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiterN = rendezvous.open("term_a"); // turn N's send
-        // The turn as the injector captured it at delivery (waiter + pre-turn baseline).
-        var turnN = new CompletionResolver.InFlight(waiterN, "an earlier answer");
-
-        // Turn N is resolved by the worker's explicit reply, and its send deregisters the waiter.
-        assertTrue(rendezvous.resolve("term_a", "N replied"));
-        rendezvous.close("term_a", waiterN); // the sender's finally, before the next turn opens
-
-        // Turn N+1's send opens its own waiter on the same session (CB-548: open fails if the
-        // previous waiter is still registered, so a clean turn deregisters it first as above).
-        var waiterN1 = rendezvous.open("term_a");
-
-        resolver.resolve("term_a", turnN); // turn N's completion fallback finally fires
-
-        assertFalse(waiterN1.isDone(), "turn N's late completion must not resolve turn N+1's waiter");
-        assertEquals(Rendezvous.Kind.REPLY, waiterN.getNow(null).kind(),
-                "turn N stays resolved by its own reply");
-        assertTrue(rendezvous.isWaiting("term_a"), "turn N+1 is still awaiting its own resolution");
-    }
-
-    // --- CB-578 stage A: backend-exhausted classification ---------------------------------
-
-    @Test
-    void classifiesAMatchingScrapeAsBackendExhaustedInsteadOfACompletedReply() {
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertTrue(waiter.isDone(), "a matching scrape still resolves the blocked send");
-        assertEquals(Rendezvous.Kind.BACKEND_EXHAUSTED, waiter.getNow(null).kind(),
-                "not reported as a completed reply — the classification is distinct");
-    }
-
-    @Test
-    void theExhaustedReasonCarriesTheMatchedLine() {
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals("backend exhausted (usage limit): The usage limit has been reached. Try again later.",
-                waiter.getNow(null).text(), "the reason names the real cause and carries the matched line");
-    }
-
-    @Test
-    void aWinningBackendExhaustedClassificationNotifiesTheExhaustionSink() {
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        java.util.List<String> notified = new java.util.ArrayList<>();
-        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals(1, notified.size(), "the sink is notified exactly once for the winning classification");
-        assertTrue(notified.get(0).startsWith("term_a: "), "the sink is told which target exhausted");
-        assertTrue(notified.get(0).contains("The usage limit has been reached"),
-                "the sink is told the matched reason: " + notified.get(0));
-    }
-
-    @Test
-    void aLosingBackendExhaustedClassificationNeverNotifiesTheExhaustionSink() {
-        // The waiter was already resolved (e.g. by the worker's own reply) before this scrape landed —
-        // resolveExhausted loses the race and must return false, so the sink must not fire either.
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        java.util.List<String> notified = new java.util.ArrayList<>();
-        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
-
-        var waiter = rendezvous.open("term_a");
-        var turn = new CompletionResolver.InFlight(waiter, null);
-        assertTrue(rendezvous.resolveCompletion(waiter, "already replied"));
-
-        resolver.resolve("term_a", turn);
-
-        assertTrue(notified.isEmpty(), "a classification that loses the race must not quarantine anything");
-        assertEquals("already replied", waiter.getNow(null).text(), "the earlier resolution stands untouched");
-    }
-
-    @Test
-    void aNonMatchingScrapeResolvesAsAnOrdinaryCompletion() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ complete report\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
-                "a scrape that does not match the pattern is an ordinary completion");
-        assertEquals("complete report", waiter.getNow(null).text());
-    }
-
-    @Test
-    void aProfileWithNoConfiguredPatternKeepsTodaysCompletionFallbackUnchanged() {
-        // Even a scrape that WOULD have matched some other profile's pattern must resolve as a
-        // plain completion when this target's own profile has none configured (CB-578 criterion 4).
-        String block = "⏺ The usage limit has been reached.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver =
-                new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
-                "no pattern configured for this target's profile ⇒ unchanged completion-fallback behaviour");
-        assertEquals("The usage limit has been reached.", waiter.getNow(null).text());
-    }
-
-    @Test
-    void coverageIsOffWhenNoProfileHasAPatternConfigured() {
-        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",
-                CompletionResolver.coverage(Set.of("terra"), Set.of()));
-    }
-
-    @Test
-    void coverageIsFullWhenEveryProfileHasAPatternConfigured() {
-        assertEquals("full (all profiles configured: [gx10, terra])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra", "gx10")));
-    }
-
-    @Test
-    void coverageIsPartialAndNamesWhichProfilesAreConfigured() {
-        assertEquals("partial (configured: [terra]; not configured: [gx10])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra")));
-    }
-}

bridged/src/test/java/dev/ltms/fleet/member/HerdrPeerLauncherAllowListWiringTest.java

@@ -1,170 +0,0 @@
-package dev.ltms.fleet.member;
-
-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.peer.Capability;
-import dev.ltms.fleet.peer.MemberRole;
-import dev.ltms.fleet.peer.SpawnRequest;
-import org.junit.jupiter.api.Test;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Supplier;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * CB-633: proves the allow-list scrub is actually WIRED INTO the spawn path — not merely that its
- * pieces work when a test calls them directly.
- *
- * <p>Why this test exists, and why it is separate from {@link EnvAllowListScrubTest}. Every other
- * test of this feature calls {@code EnvAllowListScrub} or {@code MemberEnvAllowList} itself. Those
- * prove the scrub is correct. None of them proves anyone runs it: deleting the single
- * {@code applyEnvironmentAllowListPolicy(cfg, launch)} line from {@code spawnInternal} left all 896
- * tests green while turning the control completely off. That is the recurring shape in this
- * codebase — a feature behind one call, with every test on the far side of it (CB-586, CB-611).
- *
- * <p>So this test starts a real spawn through {@link HerdrPeerLauncher#spawn} and asserts on what
- * reached herdr. It deliberately checks the pane-creation parameters rather than the launcher's own
- * map, because the map is an intermediate: {@code ZDOTDIR} only protects anything if it is in the
- * env herdr uses to create the pane, and that is the last point we can observe before the shell
- * starts.
- */
-class HerdrPeerLauncherAllowListWiringTest {
-
-    /** A name the daemon itself injects — it must survive its own scrub, so it must be allowed. */
-    private static final String INJECTED = "ANTHROPIC_BASE_URL";
-
-    @Test
-    void spawningUnderAllowListPolicyGivesThePaneAGeneratedZdotdir() {
-        FakeHerdr herdr = new FakeHerdr();
-        WiringLauncher launcher = new WiringLauncher(herdr, allowList());
-
-        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
-
-        String paneParams = String.valueOf(herdr.lastCall("pane.split").params());
-        assertTrue(paneParams.contains("ZDOTDIR"),
-                "the spawn must hand herdr a ZDOTDIR so the pane's zsh reads our generated startup "
-                        + "files; without it the scrub never runs and the member inherits the whole "
-                        + "host environment. pane.split params were: " + paneParams);
-
-        Path dir = Path.of(launcher.env.get("ZDOTDIR"));
-        assertTrue(Files.isDirectory(dir), "ZDOTDIR must point at a directory that exists: " + dir);
-        // Both startup files must exist and both must source the scrub: .zlogin covers macOS panes
-        // (login shells), .zshrc covers Linux panes (interactive, NOT login). Checking only one
-        // would pass on the platform it was written for and ship a dead control on the other.
-        for (String file : List.of(".zshrc", ".zlogin")) {
-            Path f = dir.resolve(file);
-            assertTrue(Files.isRegularFile(f), file + " must be generated: " + f);
-            assertTrue(readAll(f).contains(EnvAllowListScrub.SCRUB_FILE),
-                    file + " must source " + EnvAllowListScrub.SCRUB_FILE + " — a scrub only one of "
-                            + "them runs is dead on the platform that reads the other");
-        }
-        assertTrue(readAll(dir.resolve(EnvAllowListScrub.SCRUB_FILE)).contains(INJECTED),
-                "the allow-list must include the names this very launch injects (" + INJECTED
-                        + "), or the daemon's own configuration is blanked by its own control");
-    }
-
-    /** The default policy must not generate anything — an upgrade changes nothing until asked. */
-    @Test
-    void spawningUnderTheDefaultPolicyGeneratesNoZdotdir() {
-        FakeHerdr herdr = new FakeHerdr();
-        WiringLauncher launcher = new WiringLauncher(herdr, () -> new FleetConfig.MemberCredentials(
-                null, List.of(), List.of(), null));
-
-        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
-
-        assertFalse(launcher.env.containsKey("ZDOTDIR"),
-                "policy=deny-by-default is the shipped default; it must not silently start "
-                        + "rewriting members' shell startup files");
-    }
-
-    /**
-     * A non-zsh shell cannot read {@code ZDOTDIR} at all. The launcher must fall back rather than
-     * generate a directory nothing will ever read — a directory that would look like protection.
-     */
-    @Test
-    void aNonZshShellGeneratesNothingAndFallsBack() {
-        FakeHerdr herdr = new FakeHerdr();
-        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/bash");
-
-        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
-
-        assertFalse(launcher.env.containsKey("ZDOTDIR"),
-                "bash ignores ZDOTDIR; setting it would be protection theatre");
-    }
-
-    private static Supplier<FleetConfig.MemberCredentials> allowList() {
-        return () -> new FleetConfig.MemberCredentials(
-                FleetConfig.MemberCredentials.POLICY_ALLOW_LIST, List.of(), List.of(), null);
-    }
-
-    private static String readAll(Path p) {
-        try {
-            return Files.readString(p);
-        } catch (java.io.IOException e) {
-            throw new AssertionError("cannot read " + p, e);
-        }
-    }
-
-    private static FleetConfig.Profile profile() {
-        return new FleetConfig.Profile("test", "http://gx00.gw:8000", null, null,
-                "BRIDGED_WORKER_TOKEN", List.of("test"), "pane", null, null, null, null, null);
-    }
-
-    /**
-     * A minimal peer launcher whose {@code buildLaunch} returns a MUTABLE env map holding one name
-     * the daemon injects. Mutable on purpose: the policy adds {@code ZDOTDIR} to this very map, so
-     * an immutable one would throw and the test would pass for the wrong reason.
-     */
-    private static final class WiringLauncher extends HerdrPeerLauncher {
-        private final Map<String, String> env = new HashMap<>(Map.of(INJECTED, "http://gateway"));
-
-        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds) {
-            this(herdr, creds, "/bin/zsh");
-        }
-
-        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell) {
-            super("test", new AgentControl(herdr), new WorkspaceControl(herdr),
-                    Map.of("test", profile()), "test",
-                    name -> "SHELL".equals(name) ? shell : null,
-                    0, () -> 0L, () -> { }, null, creds);
-        }
-
-        @Override
-        protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
-            return new Launch(env, List.of("test"));
-        }
-
-        @Override
-        public Set<Capability> capabilities() {
-            return Set.of();
-        }
-    }
-
-    /** The generated directory is a temp directory; make sure the test does not leave a pile. */
-    @Test
-    void theGeneratedDirectoryIsRemovedWhenThePaneIsStopped() {
-        FakeHerdr herdr = new FakeHerdr();
-        WiringLauncher launcher = new WiringLauncher(herdr, allowList());
-
-        var spawned = launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
-        Path dir = Path.of(launcher.env.get("ZDOTDIR"));
-        assertNotNull(spawned, "spawn returned nothing");
-        assertTrue(Files.isDirectory(dir));
-
-        launcher.stop(spawned.id());
-
-        assertEquals(false, Files.exists(dir),
-                "stopping the pane must remove its generated ZDOTDIR: " + dir);
-    }
-}

bridged/src/test/java/dev/ltms/fleet/member/OpenCodeLauncherTest.java

@@ -1,614 +0,0 @@
-package dev.ltms.fleet.member;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.peer.Capability;
-import dev.ltms.fleet.peer.CharterReceipt;
-import dev.ltms.fleet.peer.MemberRole;
-import dev.ltms.fleet.peer.PeerHandle;
-import dev.ltms.fleet.peer.PeerUnreachableException;
-import dev.ltms.fleet.peer.SpawnRequest;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.function.Supplier;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * The opencode adapter's launch build: a file-based MCP mount + reply-charter instructions (no
- * inline flags, no {@code ANTHROPIC_*}, no guard), the {@code -m} model flag, and the shared base
- * transport (naming, reap, readiness gate) proving the {@link HerdrPeerLauncher} SPI is neutral.
- */
-class OpenCodeLauncherTest {
-
-    private static FleetConfig.Profile opencodeCfg(String model, String mcpUrl, String gitTokenEnv) {
-        return new FleetConfig.Profile("gemini", null, model, null, "BRIDGED_WORKER_TOKEN",
-                List.of("opencode"), "tab", "bridged-workers", "opencode: {model} #{n}", mcpUrl,
-                null, null, gitTokenEnv, null, FleetConfig.Profile.KIND_OPENCODE);
-    }
-
-    /** Gate-disabled launcher whose per-spawn config dirs land under an inspectable temp root. */
-    private static OpenCodeLauncher service(FakeHerdr herdr, Path configRoot, FleetConfig.Profile cfg) {
-        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), k -> "GITEA_ACCESS_TOKEN".equals(k) ? "tok" : null,
-                0, System::currentTimeMillis, () -> { }, configRoot, configRoot);
-    }
-
-    private static OpenCodeLauncher service(FakeHerdr herdr, Path configRoot, FleetConfig.Profile cfg,
-                                            Supplier<FleetConfig.Fleet> fleet) {
-        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
-                0, System::currentTimeMillis, () -> { }, configRoot, configRoot, fleet);
-    }
-
-    private static OpenCodeLauncher serviceWithCredentials(FakeHerdr herdr, Path configRoot,
-                                                            FleetConfig.Profile cfg,
-                                                            FleetConfig.MemberCredentials creds) {
-        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), k -> "GITEA_ACCESS_TOKEN".equals(k) ? "tok" : null,
-                0, System::currentTimeMillis, () -> { }, configRoot, configRoot, null, () -> creds);
-    }
-
-    @SuppressWarnings("unchecked")
-    private static Map<String, Object> lastStart(FakeHerdr herdr) {
-        return (Map<String, Object>) herdr.lastCall("agent.start").params();
-    }
-
-    /** Protocol 19: the worker's env is injected at pane creation (tab.create), not agent.start. */
-    @SuppressWarnings("unchecked")
-    private static Map<String, String> startEnv(FakeHerdr herdr) {
-        Map<String, String> env =
-                (Map<String, String>) ((Map<String, Object>) herdr.lastCall("tab.create").params()).get("env");
-        return env == null ? Map.of() : env;
-    }
-
-    /** Protocol 19: agent.start carries only the args after the kind-resolved executable. */
-    @SuppressWarnings("unchecked")
-    private static List<String> startArgs(FakeHerdr herdr) {
-        return (List<String>) lastStart(herdr).get("args");
-    }
-
-    @Test
-    void writesRemoteMcpConfigAndCharterInstructionsWhenMcpUrlSet(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Fleet fleet = new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null),
-                () -> fleet).spawn();
-
-        Map<String, String> env = startEnv(herdr);
-        assertNull(env.get("ANTHROPIC_BASE_URL"), "opencode carries no ANTHROPIC_* / subscription boundary");
-        String cfgPath = env.get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "OPENCODE_CONFIG points the worker at the generated config file");
-        assertTrue(Path.of(cfgPath).startsWith(root), "config file is generated under the injected root");
-
-        // Assert on parsed structure, not substrings: the generated config is real JSON and its
-        // whitespace is the formatter's business, not the contract's.
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        assertTrue(json.path("compaction").path("auto").asBoolean(),
-                "spawned opencode peers explicitly enable automatic compaction");
-        JsonNode mount = json.path("mcp").path("fleet");
-        assertEquals("remote", mount.path("type").asText(), "the fleet MCP server is mounted as remote");
-        assertEquals("http://127.0.0.1:8765/mcp", mount.path("url").asText(),
-                "the profile's fleet MCP url is present");
-        assertTrue(mount.path("enabled").asBoolean(), "the fleet server is enabled");
-        assertTrue(json.path("mcp").path("bridge").isMissingNode(),
-                "the mount is named fleet since CB-632, not bridge");
-        assertTrue(json.path("instructions").isArray() && !json.path("instructions").isEmpty(),
-                "the member charter is mounted via instructions");
-
-        // The instructions entry is a real file path holding the composed member charter.
-        Path charter = Path.of(cfgPath).resolveSibling("member-charter.md");
-        assertTrue(Files.exists(charter), "the charter file the config references was written");
-        assertEquals("role rule\n\n" + HerdrPeerLauncher.REPLY_CHARTER, Files.readString(charter),
-                "the composed charter keeps the role rule first and the reply rule last");
-        assertEquals(charter.toAbsolutePath().toString(), json.path("instructions").get(0).asText(),
-                "instructions names the charter file by its absolute path");
-    }
-
-    @Test
-    void noConfigFileWhenMcpUrlAbsent(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null)).spawn();
-
-        assertNull(startEnv(herdr).get("OPENCODE_CONFIG"),
-                "no bridge MCP url → no config file and no OPENCODE_CONFIG");
-    }
-
-    @Test
-    void roleCharterWithoutMcpOrCustomProviderStillWritesAConfig(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Fleet fleet = new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        Path configRoot = Files.createDirectory(root.resolve("configs"));
-        Path checkout = Files.createDirectory(root.resolve("checkout"));
-        service(herdr, configRoot, opencodeCfg("google/gemini-2.5-pro", null, null), () -> fleet).spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "a role charter needs a config even without MCP or custom provider");
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        Path charter = Path.of(json.path("instructions").get(0).asText());
-        assertEquals("role rule", Files.readString(charter), "the base-composed role charter is unchanged");
-        assertTrue(json.path("mcp").isMissingNode(), "a charter does not add an MCP mount");
-        assertTrue(charter.startsWith(configRoot), "the charter is written under the temp config root");
-        try (var files = Files.walk(checkout)) {
-            assertFalse(files.anyMatch(path -> path.getFileName().toString().equals("member-charter.md")),
-                    "the worker checkout receives no charter file");
-        }
-    }
-
-    @Test
-    void nullCharterWritesNoCharterFileOrInstructions(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, pinnedCfg("local-vllm/model", "http://127.0.0.1:8000", null),
-                () -> new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(), Map.of(), null)).spawn();
-
-        String config = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(config, "the custom provider still needs a config");
-        JsonNode json = new ObjectMapper().readTree(Path.of(config).toFile());
-        assertTrue(json.path("instructions").isMissingNode(), "a null charter adds no instructions entry");
-        try (var files = Files.walk(root)) {
-            assertFalse(files.anyMatch(path -> path.getFileName().toString().equals("member-charter.md")),
-                    "a null charter creates no charter file");
-        }
-    }
-
-    @Test
-    void concurrentSpawnsWriteSeparateCharterDirectories(@TempDir Path root) throws Exception {
-        FleetConfig.Profile cfg = opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null);
-        ExecutorService executor = Executors.newFixedThreadPool(2);
-        try {
-            Future<String> first = executor.submit(() -> spawnConfigPath(root, cfg));
-            Future<String> second = executor.submit(() -> spawnConfigPath(root, cfg));
-
-            Path firstCharter = Path.of(first.get()).resolveSibling("member-charter.md");
-            Path secondCharter = Path.of(second.get()).resolveSibling("member-charter.md");
-            assertNotEquals(firstCharter.getParent(), secondCharter.getParent(),
-                    "each concurrent spawn owns a separate config directory");
-            assertTrue(Files.exists(firstCharter));
-            assertTrue(Files.exists(secondCharter));
-        } finally {
-            executor.shutdownNow();
-        }
-    }
-
-    private static String spawnConfigPath(Path root, FleetConfig.Profile cfg) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, cfg).spawn();
-        return startEnv(herdr).get("OPENCODE_CONFIG");
-    }
-
-    @Test
-    void passesTheModelAsDashMFlagAlongsideAutoApprove(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null)).spawn();
-
-        List<String> args = startArgs(herdr);
-        assertTrue(args.contains("--auto"),
-                "--auto is present alongside -m so a spawned peer never blocks on approval");
-        int m = args.indexOf("-m");
-        assertTrue(m >= 0, "model is selected with -m");
-        assertEquals("google/gemini-2.5-pro", args.get(m + 1), "the provider/model selector follows -m");
-    }
-
-    @Test
-    void autoApproveIsUnconditionalWhenModelBlank(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg(null, null, null)).spawn();
-        assertEquals(List.of("--auto"), startArgs(herdr),
-                "--auto is unconditional: a model-less worker still must never block on approval");
-    }
-
-    // --- CB-617: --agent <role> when the role has an agent-definition file --------------------
-
-    @Test
-    void agentFlagIsPassedWhenTheRoleAgentDefinitionFileExists(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        Path agentsDir = Files.createDirectories(root.resolve(".opencode/agent"));
-        Files.writeString(agentsDir.resolve("dev.md"), "You are a dev.");
-        OpenCodeLauncher svc = service(herdr, root, opencodeCfg(null, null, null));
-
-        svc.spawn(new SpawnRequest(null, root.toString(), null, null, null, MemberRole.DEV));
-
-        List<String> args = startArgs(herdr);
-        int flag = args.indexOf("--agent");
-        assertTrue(flag >= 0, "--agent is passed when the role's agent file exists: " + args);
-        assertEquals("dev", args.get(flag + 1));
-    }
-
-    @Test
-    void noAgentFlagWhenTheRoleAgentDefinitionFileIsAbsent(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        OpenCodeLauncher svc = service(herdr, root, opencodeCfg(null, null, null));
-
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, root.toString(), null, null, null, MemberRole.DEV));
-
-        assertNotNull(handle, "the member still spawns with no agent-definition file");
-        assertFalse(startArgs(herdr).contains("--agent"),
-                "no --agent flag when the role has no agent-definition file");
-    }
-
-    @Test
-    void injectsForgeTokenWhenProfileGrantsIt(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg(null, null, "GITEA_ACCESS_TOKEN")).spawn();
-        assertEquals("tok", startEnv(herdr).get("GITEA_TOKEN"),
-                "a git-token profile gets the peer-neutral GITEA_TOKEN grant, same as Claude");
-    }
-
-    /**
-     * CB-596: the config-driven shadow lives in {@link HerdrPeerLauncher#baseEnv}, shared by every
-     * adapter — this pins that the opencode path gets it too, not just Claude's. See the matching
-     * tests in {@code ClaudeCodeLauncherTest} for the full rationale (gitea #82, superseding CB-592's
-     * single hardcoded name).
-     */
-    @Test
-    void aKnownNameNotAllowedIsShadowedWithTheSentinel(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.MemberCredentials creds = new FleetConfig.MemberCredentials(
-                null, List.of("AI_GATEWAY_TOKEN"), List.of("AI_GATEWAY_TOKEN", "GITEA_ACCESS_TOKEN"));
-        serviceWithCredentials(herdr, root, opencodeCfg(null, null, null), creds).spawn();
-
-        String shadowed = startEnv(herdr).get("GITEA_ACCESS_TOKEN");
-        assertNotNull(shadowed, "GITEA_ACCESS_TOKEN must be explicitly overlaid, not left unmentioned");
-        assertFalse(shadowed.isBlank(), "a blank overlay value's override behaviour is unverified — must be non-blank");
-        assertFalse(startEnv(herdr).containsKey("AI_GATEWAY_TOKEN"),
-                "an allow-listed name must get no overlay entry at all");
-    }
-
-    /** No {@code memberCredentials} configured (the pre-CB-596 constructor overloads) blocks nothing. */
-    @Test
-    void noMemberCredentialsConfiguredBlocksNothing(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg(null, null, null)).spawn();
-
-        assertNull(startEnv(herdr).get("GITEA_ACCESS_TOKEN"),
-                "with no memberCredentials configured, nothing is shadowed — config must supply the policy");
-    }
-
-    @Test
-    void capabilitiesDeclareOrphanReapAndMcpAskAndConditionalSelfPr(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        assertEquals(java.util.Set.of(Capability.MID_TURN_ASK, Capability.WORKTREE, Capability.ORPHAN_REAP,
-                        Capability.SESSION_RESUME),
-                service(herdr, root, opencodeCfg(null, null, null)).capabilities(),
-                "opencode can be resumed by its own session id, so SESSION_RESUME is always declared");
-        assertFalse(service(herdr, root, opencodeCfg(null, null, null))
-                        .capabilities().contains(Capability.SESSION_NAME),
-                "opencode has no display-name flag, so SESSION_NAME must NOT be declared");
-        assertTrue(service(herdr, root, opencodeCfg(null, null, "GITEA_ACCESS_TOKEN"))
-                        .capabilities().contains(Capability.SELF_PR),
-                "a git-token profile adds SELF_PR");
-    }
-
-    // --- CB-547: resume + post-hoc session discovery --------------------------------------------
-
-    @Test
-    void aResumeSpawnPassesTheSessionIdAsDashS(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null))
-                .spawn(new SpawnRequest(null, null, null, null, "ses_41b79fc90ffeI9E8uZv6VprUn2"));
-
-        List<String> args = startArgs(herdr);
-        int s = args.indexOf("-s");
-        assertTrue(s >= 0, "a resumed spawn carries opencode's -s flag");
-        assertEquals("ses_41b79fc90ffeI9E8uZv6VprUn2", args.get(s + 1),
-                "the resume target id follows -s");
-    }
-
-    @Test
-    void aFreshSpawnCarriesNoSessionFlag(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg(null, null, null))
-                .spawn(new SpawnRequest(null, null, null, null, null));
-
-        assertFalse(startArgs(herdr).contains("-s"),
-                "no resume target → a fresh session with no -s flag");
-    }
-
-    @Test
-    void theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears(@TempDir Path root,
-                                                                          @TempDir Path discRoot)
-            throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
-                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
-                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
-
-        PeerHandle handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
-
-        // opencode writes the record only when the session is first persisted — the instant the
-        // pane is ready it does not exist, so agentSessionId() is null (never a spawn failure).
-        assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
-        // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
-        // session id matches its own worktree, not another's.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "p1", "ses_a.json",
-                "ses_resolved", "/work/dir", 1000L);
-        assertEquals("ses_resolved", handle.agentSessionId(),
-                "agentSessionId() re-scans and picks up a record that has since been written");
-    }
-
-    @Test
-    void foreignWorkerMatchesOpencodePrefixButNotClaude() {
-        String nonce = "abc123";
-        assertTrue(OpenCodeLauncher.isForeignWorker("opencode-gemini-def456-1", nonce),
-                "an opencode pane from another process is foreign");
-        assertFalse(OpenCodeLauncher.isForeignWorker("opencode-gemini-" + nonce + "-1", nonce),
-                "our own opencode pane (same nonce) is not foreign");
-        assertFalse(OpenCodeLauncher.isForeignWorker("claude-ltms-local-def456-1", nonce),
-                "a claude pane is never reaped by the opencode adapter");
-    }
-
-    @Test
-    void productionConstructorsWireThroughToTheBase() {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Profile cfg = opencodeCfg(null, null, null);
-        // 5-arg (gate disabled) and 7-arg (gate enabled) production constructors both expose the profile.
-        OpenCodeLauncher disabled = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        OpenCodeLauncher gated = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null, 5000, 100);
-        assertEquals(java.util.Set.of("gemini"), disabled.profiles());
-        assertEquals("gemini", gated.defaultProfile());
-    }
-
-    @Test
-    void spawnGateThrowsPeerUnreachableWhenNeverInjectable(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        herdr.agentStatus("unknown"); // never injectable
-        long[] clock = {0};
-        OpenCodeLauncher svc = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of("gemini", opencodeCfg(null, null, null)), "gemini", _ -> null,
-                1000, () -> clock[0], () -> clock[0] += 50, root, root);
-
-        PeerUnreachableException ex = assertThrows(PeerUnreachableException.class,
-                () -> svc.spawn(new SpawnRequest(null, null, null)));
-        assertTrue(clock[0] >= 1000, "the fake clock advanced past the timeout: " + clock[0]);
-        long closes = herdr.calls.stream()
-                .filter(c -> c.method().equals("pane.close"))
-                .filter(c -> "w9:pRoot_1".equals(((Map<?, ?>) c.params()).get("pane_id")))
-                .count();
-        assertEquals(1, closes, "the worker pane was reaped on timeout (no orphan)");
-        assertNotNull(ex.getMessage());
-    }
-
-    @Test
-    void spawnReturnsHandleWhenGateDisabled(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        PeerHandle handle = service(herdr, root, opencodeCfg(null, null, null))
-                .spawn(new SpawnRequest(null, null, null));
-        assertNotNull(handle, "spawn returns a handle when the gate is disabled");
-        assertFalse(herdr.called("agent.get"), "no polling when the gate is disabled");
-    }
-
-    @Test
-    void handleCarriesTheRealCharterReceiptNotTheInterfaceDefault(@TempDir Path root) {
-        // The base's WorkerHandle computes a real CharterReceipt (CB-571), but the opencode adapter
-        // wraps it in SessionAwareHandle for lazy session discovery. Before this fix that decorator
-        // did not override charterReceipt(), so it silently inherited PeerHandle's `null` default
-        // and the real receipt sitting on its delegate was lost.
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Fleet fleet = new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        PeerHandle handle = service(herdr, root,
-                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null), () -> fleet)
-                .spawn(new SpawnRequest(null, null, null));
-
-        assertNotNull(handle.charterReceipt(),
-                "an opencode spawn's charterReceipt() must not silently be null");
-        String composed = "role rule\n\n" + HerdrPeerLauncher.REPLY_CHARTER;
-        assertEquals(CharterReceipt.digestOf(composed), handle.charterReceipt().charterSha256(),
-                "the receipt on the wrapped handle must match the exact composed charter bytes");
-    }
-
-    // --- CB-508: pinned OpenAI-compatible endpoint (e.g. a local vLLM) ---------------------------
-
-    /** A profile with a baseUrl but no model provider prefix cannot be resolved — fail loudly. */
-    private static FleetConfig.Profile pinnedCfg(String model, String baseUrl, String mcpUrl) {
-        return new FleetConfig.Profile("local", baseUrl, model, null, "BRIDGED_WORKER_TOKEN",
-                List.of("opencode"), "tab", "bridged-workers", "opencode: {model} #{n}", mcpUrl,
-                null, null, null, null, FleetConfig.Profile.KIND_OPENCODE);
-    }
-
-    @Test
-    void baseUrlDeclaresACustomOpenAiCompatibleProvider(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, pinnedCfg("local-vllm/deepseek-v4-flash", "http://127.0.0.1:8000", null))
-                .spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "a pinned endpoint needs a config file even with no bridge MCP url");
-        JsonNode provider = new ObjectMapper().readTree(Path.of(cfgPath).toFile())
-                .path("provider").path("local-vllm");
-
-        assertFalse(provider.isMissingNode(), "the provider id comes from the model selector");
-        assertEquals("@ai-sdk/openai-compatible", provider.path("npm").asText());
-        assertEquals("http://127.0.0.1:8000/v1", provider.path("options").path("baseURL").asText(),
-                "a bare host:port gets /v1 appended — that is where these servers mount the API");
-        assertFalse(provider.path("options").path("apiKey").asText().isBlank(),
-                "the AI SDK requires a non-empty key even when the server ignores it");
-        assertFalse(provider.path("models").path("deepseek-v4-flash").isMissingNode(),
-                "the model half of the selector is declared under the provider");
-    }
-
-    @Test
-    void aBaseUrlThatAlreadyCarriesAPathIsUsedVerbatim(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, pinnedCfg("local-vllm/m", "http://127.0.0.1:8000/openai/v1", null)).spawn();
-
-        JsonNode json = new ObjectMapper()
-                .readTree(Path.of(startEnv(herdr).get("OPENCODE_CONFIG")).toFile());
-        assertEquals("http://127.0.0.1:8000/openai/v1",
-                json.path("provider").path("local-vllm").path("options").path("baseURL").asText(),
-                "an endpoint mounted on a custom path must not have /v1 bolted on");
-    }
-
-    @Test
-    void aPinnedEndpointRejectsAModelWithNoProviderPrefix(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        OpenCodeLauncher launcher =
-                service(herdr, root, pinnedCfg("deepseek-v4-flash", "http://127.0.0.1:8000", null));
-
-        // Silently falling back to the default gateway would point the worker at the wrong LLM
-        // while looking healthy — the one failure mode worth being loud about.
-        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, launcher::spawn);
-        assertTrue(e.getMessage().contains("<provider>/<model>"), "the error says how to fix it");
-    }
-
-    @Test
-    void aPinnedEndpointAndTheFleetMcpCoexistInOneConfig(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, pinnedCfg("local-vllm/deepseek-v4-flash",
-                "http://127.0.0.1:8000", "http://127.0.0.1:8766/mcp")).spawn();
-
-        JsonNode json = new ObjectMapper()
-                .readTree(Path.of(startEnv(herdr).get("OPENCODE_CONFIG")).toFile());
-        assertEquals("remote", json.path("mcp").path("fleet").path("type").asText(),
-                "pinning an endpoint must not drop the fleet MCP mount");
-        assertFalse(json.path("provider").path("local-vllm").isMissingNode(),
-                "and the provider block is still declared alongside it");
-        assertTrue(json.path("instructions").isArray() && !json.path("instructions").isEmpty(),
-                "the reply charter survives too");
-    }
-
-    @Test
-    void noBaseUrlDeclaresNoProviderSoTheDefaultGatewayIsUsed(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("opencode/some-free-model", "http://127.0.0.1:8766/mcp", null))
-                .spawn();
-
-        JsonNode json = new ObjectMapper()
-                .readTree(Path.of(startEnv(herdr).get("OPENCODE_CONFIG")).toFile());
-        assertTrue(json.path("provider").isMissingNode(),
-                "without a baseUrl opencode resolves its own provider as before");
-    }
-
-    // --- autoCompactWindow: opencode has no absolute compact-at-N knob, so this is applied as the
-    //     model's own limit.context, only when model: resolves to "provider/model" -----------------
-
-    private static FleetConfig.Profile opencodeCfgWithAutoCompactWindow(String model, String baseUrl,
-                                                                        Integer window) {
-        return new FleetConfig.Profile("gemini", baseUrl, model, null, "BRIDGED_WORKER_TOKEN",
-                List.of("opencode"), "tab", "bridged-workers", "opencode: {model} #{n}", null,
-                null, null, null, null, FleetConfig.Profile.KIND_OPENCODE, Map.of(), null, null,
-                null, null, null, null, null, null, window);
-    }
-
-    @Test
-    void autoCompactWindowIsAppliedAsThePerModelContextLimit(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfgWithAutoCompactWindow("openai/gpt-5", null, 250_000)).spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "autoCompactWindow alone must trigger config generation, with no MCP"
-                + " and no custom provider set");
-        JsonNode limit = new ObjectMapper().readTree(Path.of(cfgPath).toFile())
-                .path("provider").path("openai").path("models").path("gpt-5").path("limit");
-        assertEquals(250_000, limit.path("context").asInt());
-        assertEquals(16384, limit.path("output").asInt(),
-                "opencode's limit schema requires both keys; output gets a safe documented default");
-    }
-
-    @Test
-    void autoCompactWindowMergesIntoACustomProviderRatherThanOverwritingIt(@TempDir Path root)
-            throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfgWithAutoCompactWindow(
-                "local-vllm/deepseek-v4-flash", "http://127.0.0.1:8000", 300_000)).spawn();
-
-        JsonNode provider = new ObjectMapper()
-                .readTree(Path.of(startEnv(herdr).get("OPENCODE_CONFIG")).toFile())
-                .path("provider").path("local-vllm");
-        assertEquals("@ai-sdk/openai-compatible", provider.path("npm").asText(),
-                "addCustomProvider's own fields must survive the later limit merge");
-        assertEquals(300_000, provider.path("models").path("deepseek-v4-flash")
-                .path("limit").path("context").asInt());
-        assertEquals("deepseek-v4-flash", provider.path("models").path("deepseek-v4-flash")
-                .path("name").asText(),
-                "the model's pre-existing 'name' field must survive the limit merge too");
-    }
-
-    @Test
-    void autoCompactWindowWithNoProviderSlashInModelGetsNoLimitAndAWarn(@TempDir Path root)
-            throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        // mcpUrl set too, only so a config file gets written at all to inspect; a bare model name
-        // with no other config-triggering knob would leave OPENCODE_CONFIG unset entirely, which is
-        // also correct (nothing to write) but not what this test is asserting.
-        service(herdr, root, new FleetConfig.Profile("gemini", null, "some-free-model", null,
-                "BRIDGED_WORKER_TOKEN", List.of("opencode"), "tab", "bridged-workers",
-                "opencode: {model} #{n}", "http://127.0.0.1:8765/mcp", null, null, null, null,
-                FleetConfig.Profile.KIND_OPENCODE, Map.of(), null, null, null, null, null, null,
-                null, null, 250_000)).spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        assertTrue(json.path("provider").isMissingNode(),
-                "a bare model name cannot be targeted at a specific provider/model limit entry — "
-                        + "no silent no-op, but also no broken partial write");
-    }
-
-    // --- CB-634: IDE Index MCP + guidance overlay (opencode does not read CLAUDE.local.md) -------
-
-    private static FleetConfig.Profile opencodeIdeCfg(String mcpUrl, String ideUrl, String cwd) {
-        return new FleetConfig.Profile("gemini", null, null, null, "BRIDGED_WORKER_TOKEN",
-                List.of("opencode"), "tab", "bridged-workers", "opencode: {model} #{n}", mcpUrl,
-                cwd, null, null, null, FleetConfig.Profile.KIND_OPENCODE,
-                null, null, null, null, null, null, ideUrl);
-    }
-
-    @Test
-    void ideMcpUrlAddsTheIntellijServerAndAnInstructionsRulesEntry(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        Path cwd = Files.createDirectory(root.resolve("checkout"));
-        service(herdr, root, opencodeIdeCfg("http://127.0.0.1:8765/mcp",
-                "http://127.0.0.1:29170/index-mcp/streamable-http", cwd.toString())).spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "an IDE profile needs a config file");
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        JsonNode ide = json.path("mcp").path("intellij");
-        assertEquals("remote", ide.path("type").asText(),
-                "the IDE server uses the same remote shape as the bridge mount");
-        assertEquals("http://127.0.0.1:29170/index-mcp/streamable-http", ide.path("url").asText());
-        assertTrue(ide.path("enabled").asBoolean(), "the IDE server is enabled");
-        assertEquals("remote", json.path("mcp").path("fleet").path("type").asText(),
-                "the bridge mount still coexists with the IDE server");
-
-        // The instructions array gains an entry pointing at a real rules file pinning the worktree.
-        String rulesContent = null;
-        for (JsonNode n : json.path("instructions")) {
-            Path p = Path.of(n.asText());
-            if (p.getFileName().toString().equals("ide-rules.md")) {
-                rulesContent = Files.readString(p);
-            }
-        }
-        assertNotNull(rulesContent, "an ide-rules.md instructions entry is present");
-        assertTrue(rulesContent.contains("project_path: \"" + cwd + "\""),
-                "the rules pin every ide_* call to the worker's own cwd");
-    }
-
-    @Test
-    void noIdeServerWhenIdeMcpUrlUnset(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null))
-                .spawn();
-
-        JsonNode json = new ObjectMapper()
-                .readTree(Path.of(startEnv(herdr).get("OPENCODE_CONFIG")).toFile());
-        assertTrue(json.path("mcp").path("intellij").isMissingNode(),
-                "no IDE server when ideMcpUrl is unset");
-    }
-}

bridged/src/test/java/dev/ltms/fleet/member/OpenCodeSessionDiscoveryTest.java

@@ -1,90 +0,0 @@
-package dev.ltms.fleet.member;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * {@link OpenCodeSessionDiscovery} matches an opencode session record by the worker's cwd (its
- * {@code directory}) against opencode's on-disk storage. These tests populate a TEMP storage root
- * themselves — never the operator's real {@code ~/.local/share/opencode}.
- */
-class OpenCodeSessionDiscoveryTest {
-
-    /**
-     * Write a session record {@code {"id":..., "directory":...}} under
-     * {@code <root>/session/<projectID>/<fileName>} and stamp it with a known last-modified time,
-     * so "most recently modified wins" is deterministic. Static so the launcher test can reuse it.
-     */
-    static void writeRecord(Path root, String projectId, String fileName, String id,
-                            String directory, long lastModifiedEpochMillis) throws Exception {
-        Path dir = root.resolve("session").resolve(projectId);
-        Files.createDirectories(dir);
-        Path file = dir.resolve(fileName);
-        Files.writeString(file, "{\"id\":\"" + id + "\",\"directory\":\"" + directory
-                + "\",\"projectID\":\"" + projectId + "\",\"version\":\"1.1.31\"}");
-        Files.setLastModifiedTime(file, FileTime.fromMillis(lastModifiedEpochMillis));
-    }
-
-    @Test
-    void findsTheRecordWhoseDirectoryEqualsTheCwd(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
-        writeRecord(root, "p2", "ses_b.json", "ses_bbb", "/w/b", 2000L);
-
-        assertEquals("ses_bbb", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/b"),
-                "the record whose directory equals the cwd is the one found");
-        assertEquals("ses_aaa", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
-    }
-
-    @Test
-    void aNonMatchingDirectoryYieldsNullRatherThanAMismatch(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
-
-        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/other"),
-                "no record for this cwd yet → null, not a wrong session");
-    }
-
-    @Test
-    void prefersTheMostRecentlyModifiedRecordWhenSeveralMatch(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "old.json", "ses_old", "/w/a", 1000L);
-        writeRecord(root, "p2", "new.json", "ses_new", "/w/a", 5000L);
-
-        assertEquals("ses_new", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
-                "the freshest record for the cwd wins");
-    }
-
-    @Test
-    void aMissingOrEmptyStorageRootYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
-        // Missing: no session dir at all under the root.
-        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
-
-        // Present but empty: a session dir with nothing in it produces no match, not a throw.
-        Path emptyRoot = root.resolve("empty");
-        Files.createDirectories(emptyRoot.resolve("session"));
-        assertNull(new OpenCodeSessionDiscovery(emptyRoot).sessionIdForDirectory("/w/a"));
-    }
-
-    @Test
-    void aBlankOrNullDirectoryYieldsNull(@TempDir Path root) {
-        OpenCodeSessionDiscovery discovery = new OpenCodeSessionDiscovery(root);
-        assertNull(discovery.sessionIdForDirectory(null));
-        assertNull(discovery.sessionIdForDirectory("   "));
-    }
-
-    @Test
-    void aMalformedRecordIsSkippedRatherThanFatal(@TempDir Path root) throws Exception {
-        // A record that fails to parse must not abort the scan of its siblings.
-        Path dir = root.resolve("session").resolve("p1");
-        Files.createDirectories(dir);
-        Files.writeString(dir.resolve("broken.json"), "{not valid json");
-        writeRecord(root, "p1", "good.json", "ses_good", "/w/a", 1000L);
-
-        assertEquals("ses_good", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
-                "an unreadable record is skipped; a later valid one still matches");
-    }
-}

bridged/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -1,625 +0,0 @@
-package dev.ltms.fleet.session;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-525 acceptance test for tool-surface isolation. This is one of the few tests that drives real
- * {@code git} — the behaviour under test is precisely what {@link GitWorktrees} does to a checkout,
- * so a fake would assert nothing. Everything happens inside a {@link TempDir} throwaway repo.
- */
-class GitWorktreesTest {
-
-    /** A project MCP config with servers in it — what this repo actually commits. */
-    private static final String WITH_SERVERS = """
-            {
-              "mcpServers": {
-                "jetbrains": { "type": "sse", "url": "http://localhost:64342/sse" }
-              }
-            }
-            """;
-
-    /** An opencode config carrying a {@code {file:.secrets/...}} reference — CB-543's crash repro. */
-    private static final String OPENCODE_WITH_FILE_REF = """
-            {
-              "env": {
-                "CONTEXT7_TOKEN": "{file:.secrets/context7-token}"
-              }
-            }
-            """;
-
-    /** A non-empty autoenv file — the form that would prompt for authorization in a worktree. */
-    private static final String AUTOENV_WITH_DIRECTIVE = "export HELLO=world\n";
-
-    private static Path initRepo(Path dir) throws Exception {
-        Files.createDirectories(dir);
-        git(dir, "init", "-q", "-b", "main");
-        git(dir, "config", "user.email", "test@example.invalid");
-        git(dir, "config", "user.name", "Test");
-        Files.writeString(dir.resolve(".mcp.json"), WITH_SERVERS);
-        Files.writeString(dir.resolve("README.md"), "seed\n");
-        git(dir, "add", ".mcp.json", "README.md");
-        git(dir, "commit", "-q", "-m", "seed");
-        return dir;
-    }
-
-    private static void git(Path cwd, String... args) throws Exception {
-        List<String> cmd = new java.util.ArrayList<>(List.of("git"));
-        cmd.addAll(List.of(args));
-        Process p = new ProcessBuilder(cmd).directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git timed out: " + String.join(" ", cmd));
-        assertEquals(0, p.exitValue(), "git " + String.join(" ", args) + " failed:\n" + out);
-    }
-
-    /** Pending changes to {@code file} in {@code cwd}, empty when git considers it unmodified. */
-    private static String status(Path cwd, String file) throws Exception {
-        Process p = new ProcessBuilder("git", "status", "--porcelain", "--", file)
-                .directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git status timed out");
-        return out;
-    }
-
-    /** Every pending change in {@code cwd} — the whole-tree porcelain status, unlike {@link #status}. */
-    private static String fullStatus(Path cwd) throws Exception {
-        Process p = new ProcessBuilder("git", "status", "--porcelain")
-                .directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git status timed out");
-        return out;
-    }
-
-    private static String revParse(Path cwd, String ref) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "rev-parse", ref)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes()).trim();
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git rev-parse timed out");
-        assertEquals(0, p.exitValue(), "git rev-parse " + ref + " failed:\n" + out);
-        return out;
-    }
-
-    /** The recursive file list of a commit's tree — used to check what a snapshot actually committed. */
-    private static String lsTree(Path cwd, String ref) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "ls-tree", "-r", "--name-only", ref)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git ls-tree timed out");
-        assertEquals(0, p.exitValue(), "git ls-tree " + ref + " failed:\n" + out);
-        return out;
-    }
-
-    /** The set of paths in {@code git diff --name-only from..to} — used to check exactly what a
-     *  snapshot's tree changed relative to its parent, the same shape {@code git status --porcelain}
-     *  reports for the worktree it was taken from. */
-    private static Set<String> diffNameOnly(Path cwd, String from, String to) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "diff", "--name-only", from, to)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git diff timed out");
-        assertEquals(0, p.exitValue(), "git diff " + from + ".." + to + " failed:\n" + out);
-        Set<String> paths = new HashSet<>();
-        for (String line : out.split("\\R")) {
-            if (!line.isBlank()) {
-                paths.add(line.trim());
-            }
-        }
-        return paths;
-    }
-
-    /** The set of paths a {@code git status --porcelain} listing names, stripping the two-char status
-     *  code prefix each line carries. */
-    private static Set<String> porcelainPaths(String porcelain) {
-        Set<String> paths = new HashSet<>();
-        for (String line : porcelain.split("\\R")) {
-            if (!line.isBlank()) {
-                paths.add(line.substring(3).trim());
-            }
-        }
-        return paths;
-    }
-
-    private static String forEachRef(Path cwd, String pattern) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "for-each-ref", pattern)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git for-each-ref timed out");
-        assertEquals(0, p.exitValue(), "git for-each-ref " + pattern + " failed:\n" + out);
-        return out;
-    }
-
-    /** Write {@code content} as a blob into the object database; returns its sha. */
-    private static String blobOf(Path cwd, String content) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "hash-object", "-w", "--stdin")
-                .redirectErrorStream(true).start();
-        p.getOutputStream().write(content.getBytes(StandardCharsets.UTF_8));
-        p.getOutputStream().close();
-        String out = new String(p.getInputStream().readAllBytes()).trim();
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git hash-object timed out");
-        assertEquals(0, p.exitValue(), "git hash-object failed:\n" + out);
-        return out;
-    }
-
-    /** Build a single-file tree object from {@code blob}; returns the tree's sha. */
-    private static String treeOf(Path cwd, String path, String blob) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "mktree")
-                .redirectErrorStream(true).start();
-        p.getOutputStream().write(("100644 blob " + blob + "\t" + path + "\n").getBytes(StandardCharsets.UTF_8));
-        p.getOutputStream().close();
-        String out = new String(p.getInputStream().readAllBytes()).trim();
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git mktree timed out");
-        assertEquals(0, p.exitValue(), "git mktree failed:\n" + out);
-        return out;
-    }
-
-    /** {@code git commit-tree} rooted at {@code tree} with a chosen committer date; returns the sha. */
-    private static String commitTree(Path cwd, String tree, String parent, String committerDate,
-                                     String message) throws Exception {
-        ProcessBuilder pb = new ProcessBuilder("git", "-C", cwd.toString(), "commit-tree",
-                tree, "-p", parent, "-m", message);
-        pb.environment().put("GIT_COMMITTER_DATE", committerDate);
-        Process p = pb.redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes()).trim();
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git commit-tree timed out");
-        assertEquals(0, p.exitValue(), "git commit-tree failed:\n" + out);
-        return out;
-    }
-
-    /** {@code git update-ref <ref> <sha>} — create the snapshot ref directly. */
-    private static void updateRef(Path cwd, String ref, String sha) throws Exception {
-        git(cwd, "update-ref", ref, sha);
-    }
-
-    /** True when {@code ref} exists in the repo (for-each-ref on a missing ref is empty, not an error). */
-    private static boolean refExists(Path cwd, String ref) throws Exception {
-        return !forEachRef(cwd, ref).trim().isEmpty();
-    }
-
-    /**
-     * The heart of CB-525: a provisioned worktree must not inherit the primary's MCP servers. Without
-     * the isolation step the checked-out {@code .mcp.json} carries them in, and a worker navigating
-     * through the primary's IDE servers edits the primary's tree while building its own.
-     */
-    @Test
-    void aProvisionedWorktreeInheritsNoMcpServers(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-a", "HEAD");
-
-        Path mcp = Path.of(wt).resolve(".mcp.json");
-        assertTrue(Files.exists(mcp), ".mcp.json must still exist — present and explicitly empty");
-        String body = Files.readString(mcp);
-        assertFalse(body.contains("jetbrains"), "worktree inherited the primary's MCP servers:\n" + body);
-        assertTrue(body.replaceAll("\\s+", "").contains("\"mcpServers\":{}"),
-                "expected an explicitly empty server map, got:\n" + body);
-    }
-
-    /** Neutralizing must not look like work in progress, or a worker would commit it into its PR. */
-    @Test
-    void theNeutralizedConfigIsNotAPendingLocalModification(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-b", "HEAD");
-
-        assertEquals("", status(Path.of(wt), ".mcp.json"),
-                "the neutralized .mcp.json shows as modified — --skip-worktree did not take");
-    }
-
-    /** Isolation is the worktree's business only; the primary's own checkout must be untouched. */
-    @Test
-    void thePrimaryCheckoutIsLeftAlone(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-525-c", "HEAD");
-
-        assertEquals(WITH_SERVERS, Files.readString(repo.resolve(".mcp.json")),
-                "the primary's .mcp.json was rewritten — isolation reached out of the worktree");
-    }
-
-    /** A repo that commits no {@code .mcp.json} still gets one, so nothing can be inherited later. */
-    @Test
-    void aRepoWithoutAnMcpConfigStillGetsANeutralOne(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-d", "HEAD");
-
-        // Untracked is the normal case here, so the --skip-worktree branch must be skipped rather
-        // than run and fail: `update-index --skip-worktree` on an unknown path exits non-zero.
-        String body = Files.readString(Path.of(wt).resolve(".mcp.json"));
-        assertTrue(body.replaceAll("\\s+", "").contains("\"mcpServers\":{}"), body);
-    }
-
-    /**
-     * CB-543's repro: a tracked {@code opencode.json} carries a {@code {file:.secrets/...}} reference
-     * to a gitignored secret that never reaches a worktree, and opencode refuses to start on it. The
-     * worktree's copy must be neutralized and hidden like {@code .mcp.json}.
-     */
-    @Test
-    void aTrackedOpencodeConfigIsNeutralizedAndHidden(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve(".mcp.json"), WITH_SERVERS);
-        Files.writeString(repo.resolve("opencode.json"), OPENCODE_WITH_FILE_REF);
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", ".mcp.json", "opencode.json", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-543-a", "HEAD");
-
-        String body = Files.readString(Path.of(wt).resolve("opencode.json"));
-        assertFalse(body.contains(".secrets"),
-                "worktree kept a dangling {file:...} secret reference:\n" + body);
-        assertEquals("{}", body.replaceAll("\\s+", ""),
-                "expected an empty JSON object stub, got:\n" + body);
-        assertEquals("", status(Path.of(wt), "opencode.json"),
-                "the neutralized opencode.json shows as modified — --skip-worktree did not take");
-    }
-
-    /** A config the repo does not carry must be skipped — no stub invented, provisioning still succeeds. */
-    @Test
-    void anAbsentConfigIsSkippedWithoutError(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));   // only .mcp.json + README are committed
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-543-b", "HEAD");
-
-        assertFalse(Files.exists(Path.of(wt).resolve("opencode.json")),
-                "a stub was invented for a config the repo does not carry");
-        assertFalse(Files.exists(Path.of(wt).resolve(".autoenv")),
-                "a stub was invented for a config the repo does not carry");
-        // .mcp.json's long-standing create-always behaviour must be unchanged.
-        assertTrue(Files.exists(Path.of(wt).resolve(".mcp.json")), ".mcp.json stub was dropped");
-    }
-
-    /**
-     * CB-576. {@code hasUncommitted} must treat a freshly-provisioned worktree as clean, but a
-     * worktree holding a brand-new, never-added file as dirty. The untracked-file-only shape is
-     * exactly the work lost in the incident — a worker's draft that compiled but was never
-     * committed because it stopped to ask its lead a question.
-     */
-    @Test
-    void anUntrackedOnlyWorktreeCountsAsDirty(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String wt = gitWorktrees.add(repo.toString(), "cb-576-u", "HEAD");
-
-        assertFalse(gitWorktrees.hasUncommitted(wt),
-                "a freshly provisioned worktree must read as clean");
-
-        Files.writeString(Path.of(wt).resolve("brand-new.txt"), "draft that was never added\n");
-
-        assertTrue(gitWorktrees.hasUncommitted(wt),
-                "an untracked-only file must count as dirty");
-
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-        assertTrue(gitWorktrees.hasUncommitted(wt),
-                "a tracked modification must also count as dirty");
-    }
-
-    /**
-     * CB-576 review. {@code hasUncommitted} must tolerate a missing worktree exactly like
-     * {@code remove}: an already-gone directory holds no work to lose, and throwing here would
-     * break teardown — SessionManager.release() calls it before stopping the pane, so an
-     * exception would orphan a live pane and skip the release notification (CB-516).
-     */
-    @Test
-    void hasUncommittedOnAMissingWorktreeReturnsFalseWithoutThrowing(@TempDir Path tmp) {
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String gone = tmp.resolve("wts").resolve("does-not-exist").toString();
-
-        assertFalse(gitWorktrees.hasUncommitted(gone),
-                "a missing worktree is reported clean, not an error");
-    }
-
-    /** All three protected configs are covered: each one present in a worktree is neutralized and hidden. */
-    @Test
-    void allThreeConfigsAreNeutralizedWhenPresent(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve(".mcp.json"), WITH_SERVERS);
-        Files.writeString(repo.resolve("opencode.json"), OPENCODE_WITH_FILE_REF);
-        Files.writeString(repo.resolve(".autoenv"), AUTOENV_WITH_DIRECTIVE);
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", ".mcp.json", "opencode.json", ".autoenv", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-543-c", "HEAD");
-
-        assertTrue(Files.readString(Path.of(wt).resolve(".mcp.json"))
-                        .replaceAll("\\s+", "").contains("\"mcpServers\":{}"),
-                ".mcp.json was not neutralized");
-        assertEquals("{}", Files.readString(Path.of(wt).resolve("opencode.json")).replaceAll("\\s+", ""),
-                "opencode.json was not neutralized");
-        assertEquals("", Files.readString(Path.of(wt).resolve(".autoenv")),
-                ".autoenv was not neutralized");
-
-        assertEquals("", status(Path.of(wt), ".mcp.json"), ".mcp.json still shows as modified");
-        assertEquals("", status(Path.of(wt), "opencode.json"), "opencode.json still shows as modified");
-        assertEquals("", status(Path.of(wt), ".autoenv"), ".autoenv still shows as modified");
-    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 1. A dirty worktree — a tracked edit plus a brand-new
-     * untracked file, exactly the shape lost in CB-576 — must land in {@code refs/wip/<branch>}'s
-     * tree, and that ref must live outside {@code refs/heads} so it never shows up in
-     * {@code git branch} or gets swept by a branch cleanup.
-     */
-    @Test
-    void dirtySnapshotCreatesARefWhoseTreeContainsUntrackedAndTrackedChanges(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-a";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent(), "a dirty worktree snapshot returns a commit sha");
-        String tree = lsTree(repo, "refs/wip/" + branch);
-        assertTrue(tree.contains("untracked.txt"), "snapshot tree must include the untracked file:\n" + tree);
-        assertTrue(tree.contains("README.md"), "snapshot tree must include the tracked edit:\n" + tree);
-        String heads = forEachRef(repo, "refs/heads");
-        assertFalse(heads.contains("refs/wip/"), "the snapshot ref must not live under refs/heads:\n" + heads);
-    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 2. Building the commit through a temporary
-     * {@code GIT_INDEX_FILE} must leave the worker's own index, working tree, and HEAD exactly as
-     * they were — the worker may still be mid-write, and staging into the real index would corrupt
-     * that.
-     */
-    @Test
-    void snapshotDoesNotTouchTheWorkersOwnIndexWorkingTreeOrHead(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-b";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-        String headBefore = revParse(Path.of(wt), "HEAD");
-        String statusBefore = fullStatus(Path.of(wt));
-
-        gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertEquals(headBefore, revParse(Path.of(wt), "HEAD"), "snapshot must not move HEAD");
-        assertEquals(statusBefore, fullStatus(Path.of(wt)),
-                "snapshot must not change the worker's own index or working tree status");
-    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 3. {@code add -A} (never {@code -f}) respects
-     * {@code .gitignore}, and that is the only thing keeping a gitignored file (secrets, local
-     * config) out of a snapshot commit — an untracked file that is NOT ignored must still be
-     * included, so this isn't just "untracked files are dropped".
-     */
-    @Test
-    void gitignoredFileIsExcludedButOtherUntrackedFilesAreNot(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve(".gitignore"), ".env\n");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", ".gitignore", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-c";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve(".env"), "SECRET=shh\n");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent());
-        String tree = lsTree(repo, "refs/wip/" + branch);
-        assertFalse(tree.contains(".env"), "a gitignored file must never enter the snapshot:\n" + tree);
-        assertTrue(tree.contains("untracked.txt"),
-                "a non-ignored untracked file must still be included:\n" + tree);
-    }
-
-    /** CB-578 stage C. A clean worktree still produces a valid, if tree-identical, commit — the caller
-     *  (SessionManager) is the one that decides not to call this on a clean worktree. */
-    @Test
-    void snapshotOfAMissingWorktreeReturnsEmptyWithoutThrowing(@TempDir Path tmp) {
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String gone = tmp.resolve("wts").resolve("does-not-exist").toString();
-
-        assertTrue(gitWorktrees.snapshot(gone, "some-branch", "msg").isEmpty(),
-                "a missing worktree has nothing to snapshot, and must not throw");
-    }
-
-    /**
-     * CB-587, acceptance criteria 1 and 2. A file with a REAL {@code --skip-worktree} bit set in the
-     * worktree's own index must never enter the snapshot, even though its on-disk content has locally
-     * diverged from what is committed — that is exactly the divergence {@code --skip-worktree} exists
-     * to hide from {@code git status}, and a snapshot built from a fresh empty temp index (the bug)
-     * stages that local content anyway because the fresh index carries none of the real index's flags.
-     * The snapshot's diff against its parent must list exactly what {@code git status --porcelain}
-     * reports for the worktree — no more, no less.
-     */
-    @Test
-    void dirtySnapshotHonoursARealSkipWorktreeBit(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve("protected.cfg"), "committed-value\n");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", "protected.cfg", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-587-a";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-
-        git(Path.of(wt), "update-index", "--skip-worktree", "protected.cfg");
-        Files.writeString(Path.of(wt).resolve("protected.cfg"), "locally-diverged-never-commit\n");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-
-        String porcelain = fullStatus(Path.of(wt));
-        assertFalse(porcelain.contains("protected.cfg"),
-                "test setup invalid — protected.cfg must not show in git status once skip-worktree is set:\n"
-                        + porcelain);
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent(), "a dirty worktree snapshot returns a commit sha");
-        Set<String> diffPaths = diffNameOnly(repo, "HEAD", "refs/wip/" + branch);
-        assertFalse(diffPaths.contains("protected.cfg"),
-                "a --skip-worktree file's local drift leaked into the snapshot:\n" + diffPaths);
-        assertEquals(porcelainPaths(porcelain), diffPaths,
-                "snapshot diff must list exactly what git status --porcelain reports, no more, no less");
-    }
-
-    /**
-     * CB-587, acceptance criterion 6. If the worktree's real index cannot be resolved/read, snapshot
-     * must fail loudly (throw) rather than silently falling back to an empty temp index and producing
-     * a wrong snapshot. SessionManager's caller already catches and WARNs on any exception here — this
-     * only needs to confirm the failure is not swallowed inside snapshot() itself.
-     */
-    @Test
-    void snapshotThrowsWhenTheWorktreesRealIndexCannotBeResolved(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-587-b";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-
-        // Break git's ability to resolve the worktree's real index by removing the linked worktree's
-        // `.git` file (which normally points at the main repo's worktrees/<name>/ directory).
-        Files.delete(Path.of(wt).resolve(".git"));
-
-        assertThrows(WorktreeException.class, () -> gitWorktrees.snapshot(wt, branch, "test snapshot"),
-                "an unresolvable real index must fail loudly, not silently snapshot from an empty index");
-    }
-
-    /**
-     * CB-586, criterion 2. A snapshot whose content is NOT reachable from {@code main} is the last
-     * copy of a worker's work, and must never be deleted automatically — even when it is old and
-     * even when the caller passes a zero age floor. Uses the real snapshot path on a dirty worktree,
-     * so the unreachable tree is exactly the shape CB-576/CB-578 stage C exist to protect.
-     */
-    @Test
-    void anUnreachableSnapshotIsNeverPruned(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-586-unreachable";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve("worker-draft.txt"), "work that exists nowhere else\n");
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "snapshot with unreachable content");
-        assertTrue(ref.isPresent());
-
-        // Age floor 0 makes age a non-issue: only reachability can save it — and it must.
-        assertEquals(0, gitWorktrees.pruneWipRefs(repo.toString(), 0),
-                "the unreachable snapshot is the last copy and must not be pruned");
-        assertTrue(refExists(repo, "refs/wip/" + branch),
-                "an unreachable snapshot must survive the sweep");
-    }
-
-    /**
-     * CB-586, criterion 1 (the reachable half). A snapshot whose tree content IS already reachable
-     * from {@code main} and which is older than the age floor is pure duplication — the work is
-     * recovered — so it must be pruned.
-     */
-    @Test
-    void aReachableSnapshotOlderThanTheFloorIsPruned(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-
-        // A snapshot whose tree is exactly main's current tree: fully reachable from main.
-        String mainTree = revParse(repo, "main^{tree}");
-        String old = commitTree(repo, mainTree, revParse(repo, "HEAD"), "2020-01-01T00:00:00", "snapshot");
-        updateRef(repo, "refs/wip/recovered", old);
-
-        assertEquals(1, gitWorktrees.pruneWipRefs(repo.toString(), TimeUnit.HOURS.toMillis(24)),
-                "an old, main-reachable snapshot must be pruned");
-        assertFalse(refExists(repo, "refs/wip/recovered"),
-                "the reachable snapshot's ref must be gone after the sweep");
-    }
-
-    /**
-     * CB-586, the age floor. A snapshot whose content IS reachable from {@code main} but which is
-     * younger than the age floor must not be swept — a lead may still be looking at it.
-     */
-    @Test
-    void aReachableButRecentSnapshotIsNotPruned(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-
-        // Reachable from main, but committed "now" — a fresh snapshot. The 24h floor must protect it.
-        String mainTree = revParse(repo, "main^{tree}");
-        String fresh = commitTree(repo, mainTree, revParse(repo, "HEAD"),
-                "2038-01-01T00:00:00", "snapshot just taken");
-        updateRef(repo, "refs/wip/fresh", fresh);
-
-        assertEquals(0, gitWorktrees.pruneWipRefs(repo.toString(), TimeUnit.HOURS.toMillis(24)),
-                "a recent snapshot must be kept even when reachable");
-        assertTrue(refExists(repo, "refs/wip/fresh"),
-                "the recent reachable snapshot must survive the sweep");
-    }
-
-    /**
-     * CB-586, criterion 5. A fleet that has never snapshotted anything has no {@code refs/wip/*},
-     * so a sweep is a no-op and the census reports none — identical to before CB-586 existed.
-     */
-    @Test
-    void aFleetWithNoSnapshotsPrunesNothingAndReportsNothing(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-
-        assertEquals(0, gitWorktrees.pruneWipRefs(repo.toString(), 0),
-                "no snapshot refs means nothing to prune");
-        Worktrees.WipRefStats stats = gitWorktrees.wipRefs(repo.toString());
-        assertEquals(0, stats.count(), "a never-snapshotted fleet has zero refs/wip refs");
-        assertEquals(0L, stats.costBytes(), "a never-snapshotted fleet costs zero bytes");
-    }
-
-    /** CB-586, criterion 4: the census reports how many refs exist and roughly what they cost. */
-    @Test
-    void wipRefsReportsCountAndCost(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-
-        String blob = blobOf(repo, "a recoverable snapshot's worth of content");
-        String tree = treeOf(repo, "snapshot.txt", blob);
-        updateRef(repo, "refs/wip/one", commitTree(repo, tree, revParse(repo, "HEAD"),
-                "2020-01-01T00:00:00", "snapshot"));
-        updateRef(repo, "refs/wip/two", commitTree(repo, tree, revParse(repo, "HEAD"),
-                "2020-01-02T00:00:00", "snapshot"));
-
-        Worktrees.WipRefStats stats = gitWorktrees.wipRefs(repo.toString());
-        assertEquals(2, stats.count(), "two snapshot refs are reported");
-        assertTrue(stats.costBytes() > 0, "the cost of the snapshots is a positive byte count");
-    }
-}

bridged/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -1,930 +0,0 @@
-package dev.ltms.fleet.session;
-
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.LoggerContext;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.guard.SubscriptionGuard;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.member.ClaudeCodeLauncher;
-import dev.ltms.fleet.msg.TestTurnTokens;
-import dev.ltms.fleet.peer.Capability;
-import dev.ltms.fleet.peer.CharterReceipt;
-import dev.ltms.fleet.peer.MemberRole;
-import dev.ltms.fleet.peer.PeerHandle;
-import dev.ltms.fleet.peer.PeerLauncher;
-import dev.ltms.fleet.peer.PeerUnreachableException;
-import dev.ltms.fleet.peer.SpawnRequest;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.function.LongSupplier;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-301 / CB-303 acceptance tests for the authoritative session registry, one-shot lifecycle FSM,
- * and configurable lifecycle limits (idle TTL, context cap, drain).
- * No live herdr — everything runs against the same {@link FakeHerdr} the rest of the project uses.
- */
-class SessionManagerTest {
-
-    private SessionManager sessionManager(FakeHerdr herdr) {
-        FleetConfig.Profile cfg = new FleetConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        return new SessionManager(workers);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock) {
-        return sessionManager(herdr, clock, 0);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, Worktrees worktrees) {
-        return sessionManager(herdr, worktrees, System::nanoTime);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, Worktrees worktrees, LongSupplier clock) {
-        FleetConfig.Profile cfg = new FleetConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        return new SessionManager(workers, worktrees, clock);
-    }
-
-    /**
-     * CB-581: a {@link Worktrees} test double whose {@code hasUncommitted} and {@code remove} can
-     * be told to throw, so {@link SessionManager#release} can be exercised against exactly the
-     * failure {@code GitWorktrees} produces when {@code git status}/{@code git worktree remove}
-     * exits non-zero.
-     */
-    private static final class RecordingWorktrees implements Worktrees {
-        private final List<String> removeCalls = new java.util.ArrayList<>();
-        private final List<String> snapshotCalls = new java.util.ArrayList<>();
-        private final java.util.Set<String> failRemoveFor = new java.util.HashSet<>();
-        private volatile boolean dirty = false;
-        private volatile RuntimeException hasUncommittedFailure;
-        private volatile RuntimeException snapshotFailure;
-        private final java.util.concurrent.atomic.AtomicLong snapshotSeq = new java.util.concurrent.atomic.AtomicLong();
-
-        RecordingWorktrees dirty(boolean dirty) {
-            this.dirty = dirty;
-            return this;
-        }
-
-        RecordingWorktrees failHasUncommittedWith(RuntimeException e) {
-            this.hasUncommittedFailure = e;
-            return this;
-        }
-
-        RecordingWorktrees failRemoveFor(String worktreePath) {
-            failRemoveFor.add(worktreePath);
-            return this;
-        }
-
-        RecordingWorktrees failSnapshotWith(RuntimeException e) {
-            this.snapshotFailure = e;
-            return this;
-        }
-
-        @Override
-        public String add(String repoRoot, String branch, String baseRef) {
-            return "/wt/" + branch.replace('/', '_');
-        }
-
-        @Override
-        public void remove(String repoRoot, String worktreePath) {
-            if (failRemoveFor.contains(worktreePath)) {
-                throw new WorktreeException("simulated remove failure for " + worktreePath);
-            }
-            removeCalls.add(worktreePath);
-        }
-
-        @Override
-        public boolean hasUncommitted(String worktreePath) {
-            if (hasUncommittedFailure != null) {
-                throw hasUncommittedFailure;
-            }
-            return dirty;
-        }
-
-        @Override
-        public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
-        }
-
-        @Override
-        public String repoRoot(String cwd) {
-            return "/repo";
-        }
-
-        @Override
-        public java.util.Optional<String> snapshot(String worktreePath, String branch, String message) {
-            snapshotCalls.add(worktreePath);
-            if (snapshotFailure != null) {
-                throw snapshotFailure;
-            }
-            return java.util.Optional.of("wip" + snapshotSeq.incrementAndGet());
-        }
-
-        @Override
-        public WipRefStats wipRefs(String repoRoot) {
-            return new WipRefStats(0, 0L);
-        }
-
-        @Override
-        public int pruneWipRefs(String repoRoot, long minAgeMillis) {
-            return 0;
-        }
-
-        List<String> removeCalls() {
-            return List.copyOf(removeCalls);
-        }
-
-        List<String> snapshotCalls() {
-            return List.copyOf(snapshotCalls);
-        }
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap) {
-        return sessionManager(herdr, clock, contextCap, false);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap,
-                                          boolean clearAfterTurn) {
-        FleetConfig.Profile cfg = new FleetConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        return new SessionManager(workers, new GitWorktrees(), clock, contextCap, clearAfterTurn);
-    }
-
-    @Test
-    void primaryContactWithNoTerminalIsNotAReadinessSignal() {
-        // The MCP context extractor calls presence.markPresent(p.terminal()) on EVERY request,
-        // and the primary's terminal is null — the presence bridge must treat that as a no-op,
-        // not feed it into the READY transition (which NPEd on the first real primary contact).
-        SessionManager sessions = sessionManager(new FakeHerdr());
-
-        assertDoesNotThrow(() -> sessions.asPresence().markPresent(null));
-        assertDoesNotThrow(() -> sessions.asPresence().markPresent("  "));
-    }
-
-    @Test
-    void acquireRegistersSpawningSessionWithDistinctPaneId() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        MemberSession a = sessions.acquire("ltms-local", "/work/a", "/caller/a", "term_primary");
-        MemberSession b = sessions.acquire("ltms-local", "/work/b", "/caller/b", "term_primary");
-
-        assertEquals(MemberSession.State.SPAWNING, a.state(), "fresh session starts spawning");
-        assertEquals("ltms-local", a.profile());
-        assertEquals("/work/a", a.cwd(), "explicit requested cwd is recorded");
-        assertEquals("term_primary", a.ownerTerminal());
-        assertTrue(a.spawnedAtNanos() > 0);
-        assertNotNull(a.paneId());
-        assertNotNull(a.terminalId());
-
-        assertNotEquals(a.paneId(), b.paneId(), "no pane reuse");
-        assertNotEquals(a.terminalId(), b.terminalId(), "no terminal reuse");
-        assertEquals(2, sessions.roster().size(), "both sessions are registered");
-    }
-
-    @Test
-    void rosterViewExposesTheCharterReceiptButNeverTheCharterText() {
-        // The roster (fleet_list and GET /members both render through rosterView) must let a lead
-        // see which charter a member got, without ever carrying the charter prose itself (CB-571).
-        MemberSession s = new MemberSession("p1", "term1", "prof", MemberRole.DEV, "/cwd", null,
-                0, 0, 0, MemberSession.State.READY, null, null,
-                CharterReceipt.compose(MemberRole.DEV, "prof", "role charter", "role charter\n\nreply"), null);
-
-        Map<String, Object> view = SessionManager.rosterView(s, null);
-
-        assertEquals("fleet.charters.dev", view.get("charterSource"),
-                "the config key that supplied the role charter is reported");
-        assertEquals(CharterReceipt.digestOf("role charter\n\nreply"), view.get("charterSha256"),
-                "the digest of the exact composed charter bytes is reported");
-        assertFalse(view.values().toString().contains("role charter"),
-                "the roster row must not embed the charter text itself");
-    }
-
-    @Test
-    void aNullTerminalFromThePrimaryIsANoOpEvenWithSessionsRegistered() {
-        // The primary resolves to a Principal with no terminal, and FleetMcp's context extractor
-        // forwards that null into markPresent on EVERY MCP call. It only reached the registry scan
-        // once a session existed, so this NPE'd the primary's second spawn while the first passed.
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-
-        assertDoesNotThrow(() -> sessions.asPresence().markPresent(null),
-                "the primary's null terminal must not blow up an unrelated tool call");
-        assertDoesNotThrow(() -> sessions.onDelivered(null, TestTurnTokens.inert(null)));
-        assertDoesNotThrow(() -> sessions.onTurnComplete(null));
-        assertDoesNotThrow(() -> sessions.onTurnFailed(null));
-
-        assertEquals(MemberSession.State.SPAWNING, sessions.get(session.paneId()).orElseThrow().state(),
-                "and must not transition any registered session");
-    }
-
-    @Test
-    void presenceMovesSpawningToReadyAndDeliveredTurnMovesToDone() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-
-        sessions.asPresence().markPresent(terminal);
-        assertEquals(MemberSession.State.READY, sessions.get(session.paneId()).orElseThrow().state(),
-                "MCP presence moves SPAWNING → READY");
-        assertTrue(sessions.asPresence().isPresent(terminal), "presence is also recorded");
-
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-        assertEquals(MemberSession.State.BUSY, sessions.get(session.paneId()).orElseThrow().state(),
-                "delivery moves READY → BUSY");
-
-        sessions.onTurnComplete(terminal);
-        assertEquals(MemberSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state(),
-                "turn completion moves BUSY → DONE");
-    }
-
-    @Test
-    void releaseTearsDownWorkerAndRemovesFromRosterAndIsIdempotent() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", null);
-        String paneId = session.paneId();
-
-        sessions.release(paneId);
-
-        assertTrue(herdr.called("pane.close"), "release tears the worker pane down");
-        assertTrue(sessions.get(paneId).isEmpty(), "released session is no longer retrievable");
-        assertTrue(sessions.roster().isEmpty(), "released session is no longer in the roster");
-
-        assertDoesNotThrow(() -> sessions.release(paneId), "a second release is harmless");
-    }
-
-    @Test
-    void onTurnFailedMovesSessionToFailed() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-
-        sessions.onTurnFailed(terminal);
-
-        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
-        assertEquals(MemberSession.State.FAILED, updated.state(), "turn failure moves to FAILED");
-        assertTrue(sessions.roster().contains(updated), "FAILED is still in acquired-minus-released roster");
-    }
-
-    @Test
-    void onTurnFailedIsLoggedAtWarnWithThePriorState() {
-        // CB-564: this transition used to be a bare DEBUG "session marked failed" — a symptom with no
-        // cause. A member that can no longer be delegated to must be at least WARN, and should name
-        // what stage it failed at (here: BUSY, i.e. a turn was in flight and never resolved).
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger sessionLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        sessionLog.addAppender(appender);
-        sessionLog.setLevel(Level.WARN);
-        try {
-            FakeHerdr herdr = new FakeHerdr();
-            SessionManager sessions = sessionManager(herdr);
-            MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-            String terminal = session.terminalId();
-            sessions.asPresence().markPresent(terminal);
-            sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-
-            sessions.onTurnFailed(terminal);
-
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .findFirst()
-                    .orElse("no turn-failed WARN logged");
-            assertTrue(warn.contains(terminal), "the log names the member: " + warn);
-            assertTrue(warn.contains("BUSY"), "the log names the stage it failed at: " + warn);
-        } finally {
-            sessionLog.detachAppender(appender);
-        }
-    }
-
-    @Test
-    void rosterReflectsAcquiredMinusReleased() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        MemberSession a = sessions.acquire("ltms-local", "/a", "/caller", "ownerA");
-        MemberSession b = sessions.acquire("ltms-local", "/b", "/caller", "ownerB");
-
-        assertEquals(2, sessions.roster().size());
-        assertTrue(sessions.roster().stream().anyMatch(s -> s.paneId().equals(a.paneId())));
-        assertTrue(sessions.roster().stream().anyMatch(s -> s.paneId().equals(b.paneId())));
-
-        sessions.release(a.paneId());
-
-        assertEquals(1, sessions.roster().size());
-        assertEquals(b.paneId(), sessions.roster().getFirst().paneId());
-    }
-
-    // --- CB-303 lifecycle limits ----------------------------------------------------
-
-    @Test
-    void reapIdleDoesNothingWhenNoSessions() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L);
-
-        assertEquals(0, sessions.reapIdle(10));
-        assertTrue(sessions.roster().isEmpty());
-    }
-
-    @Test
-    void readySessionPastIdleTtlIsReaped() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-
-        clock[0] = 11;
-        assertEquals(1, sessions.reapIdle(10), "READY session past TTL is reaped");
-        assertTrue(sessions.get(session.paneId()).isEmpty(), "reaped session is removed from registry");
-        assertTrue(herdr.called("pane.close"), "reaped session tears the pane down");
-    }
-
-    @Test
-    void readySessionWithinIdleTtlSurvives() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-
-        clock[0] = 5;
-        assertEquals(0, sessions.reapIdle(10), "READY session within TTL is not reaped");
-        assertEquals(MemberSession.State.READY,
-                sessions.get(session.paneId()).orElseThrow().state(),
-                "READY session survives");
-    }
-
-    @Test
-    void busySessionPastIdleTtlIsNotReaped() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-
-        clock[0] = 100;
-        assertEquals(0, sessions.reapIdle(10), "BUSY session past TTL is never reaped");
-        assertEquals(MemberSession.State.BUSY,
-                sessions.get(session.paneId()).orElseThrow().state(),
-                "BUSY session remains");
-    }
-
-    @Test
-    void doneSessionPastIdleTtlIsReaped() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-        sessions.onTurnComplete(terminal);
-
-        clock[0] = 21;
-        assertEquals(1, sessions.reapIdle(20), "DONE session past TTL is reaped");
-        assertTrue(sessions.get(session.paneId()).isEmpty(), "DONE session is removed");
-    }
-
-    @Test
-    void reapIdleReturnsCorrectCountAndSkipsBusy() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-
-        MemberSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "owner1");
-        MemberSession busy = sessions.acquire("ltms-local", "/busy", "/caller", "owner2");
-        sessions.asPresence().markPresent(ready.terminalId());
-        sessions.asPresence().markPresent(busy.terminalId());
-        sessions.onDelivered(busy.terminalId(), TestTurnTokens.inert(busy.terminalId()));
-
-        clock[0] = 50;
-        assertEquals(1, sessions.reapIdle(30), "only READY past TTL is reaped");
-        assertTrue(sessions.get(ready.paneId()).isEmpty(), "READY session is gone");
-        assertEquals(MemberSession.State.BUSY,
-                sessions.get(busy.paneId()).orElseThrow().state(),
-                "BUSY session is still registered");
-    }
-
-    @Test
-    void contextCapDisabledSessionSurvivesMultipleTurns() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 0);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-        sessions.onTurnComplete(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-        sessions.onTurnComplete(terminal);
-
-        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
-        assertEquals(MemberSession.State.DONE, updated.state(), "session finishes second turn");
-        assertEquals(2, updated.turnCount(), "turn count tracks both deliveries");
-        long releaseCloseCount = paneCloseCallsFor(herdr, "w9:pRoot_1"); // the real pane coordinate
-        assertEquals(0, releaseCloseCount, "cap disabled — no forced release of the worker pane");
-    }
-
-    @Test
-    void contextCapTwoReleasesAfterSecondComplete() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 2);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-        sessions.onTurnComplete(terminal);
-        assertEquals(MemberSession.State.DONE,
-                sessions.get(session.paneId()).orElseThrow().state(),
-                "first turn completes without release");
-
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-        sessions.onTurnComplete(terminal);
-
-        assertTrue(sessions.get(session.paneId()).isEmpty(), "session released after cap reached");
-        assertTrue(sessions.roster().isEmpty(), "released session leaves roster");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"),
-                "forced release tears the worker pane down exactly once");
-    }
-
-    @Test
-    void clearAfterTurnResetsContextWithoutDoubleCountingTheTurn() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 0, true);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        sessions.asPresence().markPresent(session.terminalId());
-
-        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
-        assertTrue(sessions.onTurnCompleteWithPostAction(session.terminalId()));
-
-        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
-        assertEquals(1, updated.turnCount(), "the reset is housekeeping, not a second delegation");
-        assertEquals(List.of("/clear"), promptTexts(herdr));
-    }
-
-    @Test
-    void contextCapReleaseWinsOverClearAfterTurn() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 1, true);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        sessions.asPresence().markPresent(session.terminalId());
-        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
-
-        assertFalse(sessions.hasPostTurnAction(session.terminalId()),
-                "a session at its cap will be released, not reset for reuse");
-        assertFalse(sessions.onTurnCompleteWithPostAction(session.terminalId()));
-        assertTrue(sessions.get(session.paneId()).isEmpty());
-        assertTrue(promptTexts(herdr).isEmpty(), "never send /clear into a worker being torn down");
-    }
-
-    @Test
-    void clearAfterTurnFalsePreservesCompletionWithoutAControlPrompt() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 0, false);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        sessions.asPresence().markPresent(session.terminalId());
-        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
-
-        sessions.onTurnComplete(session.terminalId());
-
-        assertEquals(MemberSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state());
-        assertTrue(promptTexts(herdr).isEmpty());
-    }
-
-    @Test
-    void drainAllReleasesBusyAndReadySessionsAndWaitsForBusy() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-
-        MemberSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "ownerR");
-        MemberSession busy = sessions.acquire("ltms-local", "/busy", "/caller", "ownerB");
-        sessions.asPresence().markPresent(ready.terminalId());
-        sessions.asPresence().markPresent(busy.terminalId());
-        sessions.onDelivered(busy.terminalId(), TestTurnTokens.inert(busy.terminalId()));
-
-        sessions.drainAll(TimeUnit.MILLISECONDS.toNanos(100));
-
-        assertTrue(sessions.roster().isEmpty(), "drain clears the roster");
-        assertTrue(sessions.get(ready.paneId()).isEmpty(), "ready session is released");
-        assertTrue(sessions.get(busy.paneId()).isEmpty(), "busy session is released after timeout");
-        // ready is the first spawn → pane w9:pRoot_1, busy the second → w9:pRoot_2 (FakeHerdr order).
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"),
-                "ready worker pane is torn down");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_2"),
-                "busy worker pane is torn down");
-    }
-
-    private static long paneCloseCallsFor(FakeHerdr herdr, String paneId) {
-        return herdr.calls.stream()
-                .filter(c -> "pane.close".equals(c.method()))
-                .filter(c -> paneId.equals(((Map<?, ?>) c.params()).get("pane_id")))
-                .count();
-    }
-
-    private static List<String> promptTexts(FakeHerdr herdr) {
-        return herdr.calls.stream()
-                .filter(c -> "agent.prompt".equals(c.method()))
-                .map(c -> String.valueOf(((Map<?, ?>) c.params()).get("text")))
-                .toList();
-    }
-
-    // --- CB-306 spawn-readiness gate: no half-registered session on timeout ----------------
-
-    @Test
-    void acquireThrowsPeerUnreachableWhenGateTimesOutAndRegistersNoSession() {
-        FakeHerdr herdr = new FakeHerdr();
-        herdr.agentStatus("unknown"); // never becomes injectable
-        long[] clock = {0};
-
-        // Gate-enabled launcher (1 ms timeout + no-op sleeper that advances clock past deadline)
-        FleetConfig.Profile cfg = new FleetConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(
-                new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
-                1, () -> clock[0], () -> clock[0] += 10);
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(), () -> 0L, 0);
-
-        assertThrows(PeerUnreachableException.class,
-                () -> sessions.acquire("ltms-local", null, "/caller", "term_primary"),
-                "acquire must throw PeerUnreachableException when spawn times out");
-
-        // No half-registered session — the error happened inside spawn, before
-        // SessionManager could put() anything into the registry.
-        assertTrue(sessions.roster().isEmpty(),
-                "no session is registered when spawn times out (roster empty)");
-    }
-
-    // --- CB-516: release must notify, so a blocked send can be failed --------------------------
-
-    @Test
-    void releaseNotifiesTheListenerWithTheReleasedTerminal() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(detail -> released.add(detail.terminalId()));
-
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller", null);
-        sessions.release(s.paneId());
-
-        assertEquals(java.util.List.of(s.terminalId()), released,
-                "every teardown path funnels through release, so one hook must see the terminal");
-    }
-
-    @Test
-    void releasingAnUnknownPaneNotifiesNobody() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(detail -> released.add(detail.terminalId()));
-
-        sessions.release("w9:p404"); // idempotent teardown of something already gone
-
-        assertTrue(released.isEmpty(), "no session removed ⇒ no send was waiting on it");
-    }
-
-    @Test
-    void aThrowingReleaseListenerDoesNotBlockTheTeardown() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        sessions.onRelease(_ -> {
-            throw new IllegalStateException("listener blew up");
-        });
-
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller", null);
-        assertDoesNotThrow(() -> sessions.release(s.paneId()),
-                "a listener failure must never prevent the teardown it is reacting to");
-        assertTrue(sessions.get(s.paneId()).isEmpty(), "and the session is still deregistered");
-    }
-
-    // --- CB-581: a throw inside release() must not orphan the pane or abort reapIdle -----------
-
-    @Test
-    void releasePreservesWorktreeWhenDirtyCheckThrows() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581a", null));
-        worktrees.failHasUncommittedWith(new WorktreeException("git status exited 128"));
-
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger sessionLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        sessionLog.addAppender(appender);
-        sessionLog.setLevel(Level.WARN);
-        try {
-            assertDoesNotThrow(() -> sessions.release(s.paneId()),
-                    "a throwing dirty check must not abort the release");
-
-            assertTrue(worktrees.removeCalls().isEmpty(),
-                    "the worktree is preserved when its dirty state cannot be determined");
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .filter(m -> m.contains(s.worktree()))
-                    .findFirst()
-                    .orElse("no warn logged naming the worktree");
-            assertTrue(warn.contains(s.paneId()), "the WARN names the pane: " + warn);
-            assertTrue(warn.contains(s.terminalId()), "the WARN names the terminal: " + warn);
-        } finally {
-            sessionLog.detachAppender(appender);
-        }
-    }
-
-    @Test
-    void releaseStillStopsThePaneWhenDirtyCheckThrows() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581b", null));
-        worktrees.failHasUncommittedWith(new WorktreeException("git status exited 128"));
-
-        sessions.release(s.paneId());
-
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"),
-                "the pane is stopped exactly once even though the dirty check threw");
-    }
-
-    @Test
-    void releaseStillNotifiesTheListenerWhenDirtyCheckThrows() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(detail -> released.add(detail.terminalId()));
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581c", null));
-        worktrees.failHasUncommittedWith(new WorktreeException("git status exited 128"));
-
-        sessions.release(s.paneId());
-
-        assertEquals(java.util.List.of(s.terminalId()), released,
-                "a blocked caller must still be told the terminal was released, even though the "
-                        + "dirty check threw");
-    }
-
-    @Test
-    void reapIdleSurvivesOneSessionThatFailsToRelease() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees, () -> clock[0]);
-        MemberSession a = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581d", null));
-        MemberSession b = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581e", null));
-        MemberSession c = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581f", null));
-        sessions.asPresence().markPresent(a.terminalId());
-        sessions.asPresence().markPresent(b.terminalId());
-        sessions.asPresence().markPresent(c.terminalId());
-        // The middle session's worktree removal fails — release() propagates that, so this is the
-        // one call reapIdle's per-session guard must survive without skipping the rest of the pass.
-        worktrees.failRemoveFor(b.worktree());
-
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger sessionLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        sessionLog.addAppender(appender);
-        sessionLog.setLevel(Level.WARN);
-        int reaped;
-        try {
-            clock[0] = 100;
-            reaped = sessions.reapIdle(10);
-
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .filter(m -> m.contains(b.paneId()))
-                    .findFirst()
-                    .orElse("no reap-failure WARN logged");
-            assertTrue(warn.contains(b.terminalId()), "the WARN names the failed session's terminal: " + warn);
-            assertTrue(warn.contains(b.worktree()), "the WARN names the failed session's worktree: " + warn);
-        } finally {
-            sessionLog.detachAppender(appender);
-        }
-
-        assertEquals(2, reaped, "the middle session's failure is logged, not counted as reaped");
-        assertTrue(sessions.get(a.paneId()).isEmpty(), "the first session is still released");
-        assertTrue(sessions.get(c.paneId()).isEmpty(), "the third session is still released");
-        assertTrue(sessions.get(b.paneId()).isEmpty(),
-                "the middle session is still deregistered even though its worktree removal threw");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"), "the first pane is stopped");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_2"),
-                "the middle pane is still stopped even though its worktree removal failed");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_3"), "the third pane is stopped");
-    }
-
-    @Test
-    void unchangedRegressionCleanCompletedReleaseStillRemovesTheWorktree() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581g", null));
-
-        sessions.release(s.paneId());
-
-        assertEquals(List.of(s.worktree()), worktrees.removeCalls(),
-                "COMPLETED release of a clean worktree still removes it");
-    }
-
-    @Test
-    void unchangedRegressionDirtyCompletedReleaseStillPreservesTheWorktree() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees().dirty(true);
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581h", null));
-
-        sessions.release(s.paneId());
-
-        assertTrue(worktrees.removeCalls().isEmpty(),
-                "COMPLETED release of a dirty worktree still preserves it");
-    }
-
-    @Test
-    void unchangedRegressionShutdownDrainStillPreservesTheWorktree() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581i", null));
-        sessions.asPresence().markPresent(s.terminalId());
-
-        sessions.drainAll(TimeUnit.MILLISECONDS.toNanos(100));
-
-        assertTrue(worktrees.removeCalls().isEmpty(), "SHUTDOWN drain still preserves the worktree");
-    }
-
-    // ── CB-584: agentSessionId recorded at acquire, and gated by Capability.SESSION_RESUME ─────
-
-    /**
-     * A minimal {@link PeerLauncher} whose capabilities exclude SESSION_RESUME — the "does not
-     * support it" case. {@link #requireResumeCapability} throws before ever reaching {@link #spawn},
-     * so every method beyond {@link #capabilitiesFor} is unreachable in these tests and left unimplemented.
-     */
-    private static final class NoResumeLauncher implements PeerLauncher {
-        @Override
-        public Set<Capability> capabilities() {
-            return Set.of(Capability.WORKTREE); // deliberately no SESSION_RESUME
-        }
-
-        @Override
-        public Set<Capability> capabilitiesFor(String profileName) {
-            return capabilities();
-        }
-
-        @Override
-        public PeerHandle spawn(SpawnRequest req) {
-            throw new UnsupportedOperationException("not reachable — the capability check refuses first");
-        }
-
-        @Override
-        public Set<String> profiles() {
-            return Set.of("stub-profile");
-        }
-
-        @Override
-        public String defaultProfile() {
-            return "stub-profile";
-        }
-
-        @Override
-        public String effectiveCwd(SpawnRequest req) {
-            throw new UnsupportedOperationException("not reachable — the capability check refuses first");
-        }
-
-        @Override
-        public List<String> parityOverlay(String profileName) {
-            return List.of();
-        }
-
-        @Override
-        public List<?> list() {
-            return List.of();
-        }
-
-        @Override
-        public int reapOrphanWorkers() {
-            return 0;
-        }
-
-        @Override
-        public void stop(String id) {
-        }
-
-        @Override
-        public boolean clearContext(String id) {
-            return false;
-        }
-    }
-
-    @Test
-    void acquireRecordsTheAgentSessionIdFromTheHandle() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        MemberSession s = sessions.acquire("ltms-local", MemberRole.DEV, null, null, null, null,
-                "my-session-name", null);
-
-        assertNotNull(s.agentSessionId(), "a spawn that asked for session identity gets one back");
-        Map<String, Object> view = SessionManager.rosterView(s, null);
-        assertEquals(s.agentSessionId(), view.get("agentSessionId"),
-                "the roster exposes the same id the session recorded");
-    }
-
-    @Test
-    void acquireWithNeitherSessionFieldLeavesAgentSessionIdNull() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        MemberSession s = sessions.acquire("ltms-local", null, null, null);
-
-        assertNull(s.agentSessionId(), "no identity requested — unchanged from before CB-584");
-        assertFalse(SessionManager.rosterView(s, null).containsKey("agentSessionId"),
-                "a null id is omitted from the roster, like charterSha256 for a receipt-less session");
-    }
-
-    @Test
-    void resumeSessionIdResumesTheSameConversationOnASupportingAdapter() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        MemberSession s = sessions.acquire("ltms-local", MemberRole.DEV, null, null, null, null,
-                null, "cb-resume-77");
-
-        assertEquals("cb-resume-77", s.agentSessionId(),
-                "a resume adopts the prior id as its own agentSessionId");
-    }
-
-    @Test
-    void resumeSessionIdWithoutAnExplicitProfileIsRefused() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
-                sessions.acquire(null, MemberRole.DEV, null, null, null, null, null, "cb-resume-1"));
-
-        assertTrue(e.getMessage().contains("explicit profile"), e.getMessage());
-    }
-
-    @Test
-    void resumeSessionIdOnAnAdapterWithoutTheCapabilityIsRefusedNamingIt() {
-        SessionManager sessions = new SessionManager(new NoResumeLauncher());
-
-        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
-                sessions.acquire("stub-profile", MemberRole.DEV, null, null, null, null, null, "cb-resume-1"));
-
-        assertTrue(e.getMessage().contains("SESSION_RESUME"), e.getMessage());
-        assertTrue(e.getMessage().contains("stub-profile"), e.getMessage());
-    }
-}

deploy/bridged.service

@@ -1,61 +0,0 @@
-# CB-504 — systemd unit for bridged (Linux).
-#
-# The macOS launchd agent (deploy/dev.ltms.bridged.plist) is the supervision target for the
-# current single-host deployment. This unit exists for the per-host gateways CB-308 introduces,
-# which will run on Linux.
-#
-# Install (user service — bridged drives the user's herdr, not a system daemon):
-#   mkdir -p ~/.config/systemd/user
-#   cp deploy/bridged.service ~/.config/systemd/user/
-#   # edit ExecStart / WorkingDirectory / Environment below, then:
-#   systemctl --user daemon-reload
-#   systemctl --user enable --now bridged
-#   journalctl --user -u bridged -f
-
-[Unit]
-Description=bridged — claude-bridge message server
-Documentation=https://git.ltms.dev/fleet/fleetd/wiki
-# Ordering only: herdr is a user process and its socket may appear after us. This is advisory —
-# bridged retries the herdr socket rather than exiting, which is what actually makes a late
-# socket survivable. Do NOT add Requires=: a herdr restart must not take bridged down with it.
-After=herdr.service
-Wants=herdr.service
-
-[Service]
-Type=simple
-WorkingDirectory=%h/src/claude-bridge/bridged
-ExecStart=/usr/lib/jvm/temurin-25-jdk/bin/java -jar target/bridged.jar bridged.yaml
-
-Environment=HERDR_SOCKET_PATH=%h/.config/herdr/herdr.sock
-# PATH matters more than it looks (CB-511): bridged propagates its own PATH to every worker it
-# spawns, so this line decides whether the fleet can run a build at all. systemd does not source a
-# login shell, so without it the daemon — and every worker — gets a bare default with no JDK/Maven.
-Environment=PATH=/usr/lib/jvm/temurin-25-jdk/bin:/usr/share/maven/bin:/usr/local/bin:/usr/bin:/bin
-# Secrets are NOT set here — this file is committed. Put the API/worker tokens in a private
-# drop-in that systemd reads with restrictive permissions:
-#   systemctl --user edit bridged     →  [Service] / Environment=BRIDGED_API_TOKEN=...
-# or point EnvironmentFile at a 0600 file:
-# EnvironmentFile=%h/.config/bridged/env
-
-Restart=on-failure
-RestartSec=10s
-# A bad config (e.g. a non-loopback bind without token auth) makes bridged fail fast by design.
-# Give up rather than restart-loop on a permanent error.
-StartLimitBurst=5
-StartLimitIntervalSec=120
-
-# The daemon reads the repo, writes worktrees, and talks to a Unix socket — it needs no more.
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=read-write
-ProtectKernelTunables=true
-ProtectControlGroups=true
-RestrictSUIDSGID=true
-
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=bridged
-
-[Install]
-WantedBy=default.target

deploy/dev.ltms.fleetd.plist

@@ -1,36 +1,36 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <!--
-  CB-504 / CB-594 — launchd agent for bridged (macOS).
+  CB-504 / CB-594 — launchd agent for fleetd (macOS).
 
   This is the real supervision target today: the dogfooded daemon runs on macOS, where there is
-  no systemd. A systemd unit ships alongside (deploy/bridged.service) for the Linux gateways
+  no systemd. A systemd unit ships alongside (deploy/fleetd.service) for the Linux gateways
   CB-308 introduces.
 
   Install:
-    cp deploy/dev.ltms.bridged.plist ~/Library/LaunchAgents/
-    launchctl load -w ~/Library/LaunchAgents/dev.ltms.bridged.plist
-    launchctl list | grep bridged
+    cp deploy/dev.ltms.fleetd.plist ~/Library/LaunchAgents/
+    launchctl load -w ~/Library/LaunchAgents/dev.ltms.fleetd.plist
+    launchctl list | grep fleetd
 
   The paths below are already filled in for this host (resolved 2026-08-16 from
   `/usr/libexec/java_home`... except that reported the system Applet-plugin JVM, not the jenv-
-  managed JDK 25 actually used to build/run bridged, so JAVA_HOME here is the real one:
+  managed JDK 25 actually used to build/run fleetd, so JAVA_HOME here is the real one:
   `JENV_VERSION=25.0.3 java -XshowSettings:properties -version 2>&1 | grep java.home`; `which mvn`;
   `echo $HOME`). If this file is copied to a different host, re-resolve all three paths and check
-  no placeholder path is left behind; scripts/redeploy-bridged.sh's check mode does not (and
+  no placeholder path is left behind; scripts/redeploy-fleetd.sh's check mode does not (and
   cannot) check this file for you.
 
   CB-594 — launchd cannot run a login shell (see the PATH comment on EnvironmentVariables below,
-  and scripts/bridged-launchd-wrapper.sh for the fix): ProgramArguments below execs THAT wrapper,
+  and scripts/fleetd-launchd-wrapper.sh for the fix): ProgramArguments below execs THAT wrapper,
   not java directly, so WORKER_GITEA_TOKEN and AI_GATEWAY_TOKEN still get sourced from
   ${SHARED_ENV}/tools/secrets.sh even though launchd itself never sources anything.
 
   Note on ordering: launchd has no "start after herdr" primitive for user agents, and neither
-  does systemd in a way that survives a socket appearing late. bridged retries the herdr socket
+  does systemd in a way that survives a socket appearing late. fleetd retries the herdr socket
   on startup instead, so an agent that comes up before herdr converges rather than dying — that
   retry is the actual fix; KeepAlive below is the backstop.
 
-  CB-594 — KeepAlive vs. scripts/redeploy-bridged.sh: a bare SIGTERM makes this JVM exit 143 even
+  CB-594 — KeepAlive vs. scripts/redeploy-fleetd.sh: a bare SIGTERM makes this JVM exit 143 even
   with its shutdown hook running to completion (measured, see the CB-594 report), which
   SuccessfulExit:false below reads as a crash and races to restart the OLD jar. The redeploy
   script now detects a loaded agent and uses `launchctl unload`/`load` instead of a raw kill, so
@@ -40,20 +40,20 @@
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>dev.ltms.bridged</string>
+    <string>dev.ltms.fleetd</string>
 
     <key>ProgramArguments</key>
     <array>
-        <string>/Users/dai.ha/LTMS/claude-bridge/scripts/bridged-launchd-wrapper.sh</string>
+        <string>/Users/dai.ha/LTMS/claude-bridge/scripts/fleetd-launchd-wrapper.sh</string>
         <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin/java</string>
         <string>-jar</string>
-        <string>/Users/dai.ha/LTMS/claude-bridge/bridged/target/bridged.jar</string>
-        <string>bridged.yaml</string>
+        <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/target/fleetd.jar</string>
+        <string>fleetd.yaml</string>
     </array>
 
     <!-- Config path in ProgramArguments is relative, so the working directory must be the module. -->
     <key>WorkingDirectory</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd</string>
 
     <key>EnvironmentVariables</key>
     <dict>
@@ -62,7 +62,7 @@
         <key>HERDR_SOCKET_PATH</key>
         <string>/Users/dai.ha/.config/herdr/herdr.sock</string>
         <!--
-          PATH matters more than it looks (CB-511): bridged propagates its own PATH to every worker
+          PATH matters more than it looks (CB-511): fleetd propagates its own PATH to every worker
           it spawns, so this line decides whether the fleet can run a build at all. launchd does NOT
           source .zprofile/.zshrc, so without this the daemon (and therefore every worker) gets a
           bare /usr/bin:/bin and no JDK or Maven. Keep the toolchain entries first.
@@ -71,10 +71,10 @@
         <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin:/Users/dai.ha/Softwares/apache-maven/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
         <!--
           Worker/API tokens are NOT set here: this file is committed. CB-594 —
-          scripts/bridged-launchd-wrapper.sh (named in ProgramArguments above) is what supplies
+          scripts/fleetd-launchd-wrapper.sh (named in ProgramArguments above) is what supplies
           them, by execing a login shell that sources ${SHARED_ENV}/tools/secrets.sh before the
-          daemon itself starts. bridged also reads the API token from the env var named by
-          auth.tokenEnv (default BRIDGED_API_TOKEN) and only in auth.mode: token — the wrapper
+          daemon itself starts. fleetd also reads the API token from the env var named by
+          auth.tokenEnv (default FLEETD_API_TOKEN) and only in auth.mode: token — the wrapper
           covers that one too, since it is the same login shell.
         -->
     </dict>
@@ -84,21 +84,21 @@
 
     <!--
       CB-600 — read this before assuming ThrottleInterval bounds anything. It paces restarts to at
-      most one per 10s; it does NOT cap how many times launchd retries. If bridged fails fast on
-      every start — a bad bridged.yaml, for example auth.mode: token with the token env var unset,
+      most one per 10s; it does NOT cap how many times launchd retries. If fleetd fails fast on
+      every start — a bad fleetd.yaml, for example auth.mode: token with the token env var unset,
       which throws in main() before the daemon ever binds a port — launchd restarts it forever,
       once every 10s, until a human intervenes. LaunchAgents have no "give up after N attempts"
       primitive, so this is not something a config change here can fix.
 
-      That loop stops only two ways: (1) `launchctl unload -w ~/Library/LaunchAgents/dev.ltms.bridged.plist`,
+      That loop stops only two ways: (1) `launchctl unload -w ~/Library/LaunchAgents/dev.ltms.fleetd.plist`,
       or (2) the underlying cause gets fixed, so the process starts successfully and stays up (no
-      more exits to restart). scripts/redeploy-bridged.sh does not add a third way — it does not
-      make bridged self-disable on a config error, on purpose: a fail-fast exit path that
+      more exits to restart). scripts/redeploy-fleetd.sh does not add a third way — it does not
+      make fleetd self-disable on a config error, on purpose: a fail-fast exit path that
       sometimes decides "this is unrecoverable, stop trying" is one more thing that can misfire,
       and a wrongly self-disabled daemon needs the exact same manual `launchctl load -w` recovery
       this comment already names — so it buys nothing an operator watching for the crash loop
       doesn't already have, at the cost of a new way to be silently down. Watch for it with
-      `launchctl list dev.ltms.bridged` (a high restart count) or by tailing bridged.out for the
+      `launchctl list dev.ltms.fleetd` (a high restart count) or by tailing fleetd.out for the
       same startup error repeating every ~10s.
     -->
     <key>KeepAlive</key>
@@ -110,16 +110,16 @@
     <integer>10</integer>
 
     <!--
-      CB-594 — same file scripts/redeploy-bridged.sh already tails ($BRIDGED/bridged.out), and both
+      CB-594 — same file scripts/redeploy-fleetd.sh already tails ($BRIDGED/fleetd.out), and both
       streams point at it, not two separate log files: the script's fresh-line / ERROR-count checks
       after a restart read this one path regardless of whether launchd or the script started the
       process, and a stdout/stderr split would make half of what happens during a launchd-driven
       restart invisible to it.
     -->
     <key>StandardOutPath</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged/bridged.out</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/fleetd.out</string>
     <key>StandardErrorPath</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged/bridged.out</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/fleetd.out</string>
 
     <key>ProcessType</key>
     <string>Background</string>

deploy/fleetd.service

@@ -0,0 +1,77 @@
+# CB-504 — systemd unit for fleetd (Linux).
+#
+# The macOS launchd agent (deploy/dev.ltms.fleetd.plist) is the supervision target for the
+# current single-host deployment. This unit exists for the per-host gateways CB-308 introduces,
+# which will run on Linux.
+#
+# Install (user service — fleetd drives the user's herdr, not a system daemon):
+#   mkdir -p ~/.config/systemd/user
+#   cp deploy/fleetd.service ~/.config/systemd/user/
+#   # edit ExecStart / WorkingDirectory / Environment below, then:
+#   systemctl --user daemon-reload
+#   systemctl --user enable --now fleetd
+#   journalctl --user -u fleetd -f
+
+[Unit]
+Description=fleetd — claude-bridge message server
+Documentation=https://git.ltms.dev/fleet/fleetd/wiki
+# Ordering only: herdr is a user process and its socket may appear after us. This is advisory —
+# fleetd retries the herdr socket rather than exiting, which is what actually makes a late
+# socket survivable. Do NOT add Requires=: a herdr restart must not take fleetd down with it.
+After=herdr.service
+Wants=herdr.service
+
+[Service]
+Type=simple
+WorkingDirectory=%h/src/claude-bridge/fleetd
+ExecStart=/usr/lib/jvm/temurin-25-jdk/bin/java -jar target/fleetd.jar fleetd.yaml
+
+Environment=HERDR_SOCKET_PATH=%h/.config/herdr/herdr.sock
+# PATH matters more than it looks (CB-511): fleetd propagates its own PATH to every worker it
+# spawns, so this line decides whether the fleet can run a build at all. systemd does not source a
+# login shell, so without it the daemon — and every worker — gets a bare default with no JDK/Maven.
+Environment=PATH=/usr/lib/jvm/temurin-25-jdk/bin:/usr/share/maven/bin:/usr/local/bin:/usr/bin:/bin
+# Secrets are NOT set here — this file is committed. Put ALL three tokens in a private drop-in
+# that systemd reads with restrictive permissions. In `systemctl --user edit fleetd`, add:
+#   [Service]
+#   Environment=FLEETD_API_TOKEN=...
+#   Environment=WORKER_GITEA_TOKEN=...
+#   Environment=AI_GATEWAY_TOKEN=...
+# FLEETD_API_TOKEN protects fleetd's API. WORKER_GITEA_TOKEN lets members open pull requests; if
+# it is missing, fleetd still starts, but a member fails when it later tries to open a pull request.
+# AI_GATEWAY_TOKEN authenticates gateway profiles; if it is missing, fleetd still starts, but a
+# gateway profile later returns HTTP 401. Or, put the same three variables in a 0600 file and add:
+# EnvironmentFile=%h/.config/fleetd/env
+# After starting, check which of them actually resolved. The daemon reports every secret a
+# configured profile references, by name, never by value:
+#   journalctl --user -u fleetd | grep 'startup secret'
+# A resolved one logs "startup secret NAME: set (profile 'x' tokenEnv)". A missing one logs
+# "startup secret NAME: MISSING" at WARN — and the daemon starts anyway, which is the whole
+# problem: without this grep the first sign is a member that cannot open a pull request, hours
+# later and in a different component.
+# Note what the report can and cannot tell you. It lists only names some profile actually
+# references (tokenEnv, gitTokenEnv, and the broker uriEnv). A secret nothing references is never
+# reported, because nothing needs it.
+
+Restart=on-failure
+RestartSec=10s
+# A bad config (e.g. a non-loopback bind without token auth) makes fleetd fail fast by design.
+# Give up rather than restart-loop on a permanent error.
+StartLimitBurst=5
+StartLimitIntervalSec=120
+
+# The daemon reads the repo, writes worktrees, and talks to a Unix socket — it needs no more.
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=read-write
+ProtectKernelTunables=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=fleetd
+
+[Install]
+WantedBy=default.target

deploy/lavinmq/compose.yaml

@@ -1,8 +1,8 @@
-# LavinMQ — the AMQP broker behind bridged's durable ReplyInbox (CB-307 Stage 2).
+# LavinMQ — the AMQP broker behind fleetd's durable ReplyInbox (CB-307 Stage 2).
 #
 # Why this file exists: the broker was previously run ad hoc and simply vanished from the host,
-# which takes bridged down with it — AmqpReplyInbox.open throws on an unreachable broker and
-# Bridged.java:187 does not guard it, so a missing broker is a hard startup failure, not a
+# which takes fleetd down with it — AmqpReplyInbox.open throws on an unreachable broker and
+# Fleetd.java:187 does not guard it, so a missing broker is a hard startup failure, not a
 # degraded mode. This pins the version, keeps the data, and brings itself back after a reboot.
 #
 # Usage:
@@ -14,27 +14,27 @@
 #
 # Management UI: http://127.0.0.1:15672  (guest / guest)
 #
-# This is bridged's OWN broker. Do not point bridged at any other AMQP server on this host —
+# This is fleetd's OWN broker. Do not point fleetd at any other AMQP server on this host —
 # notably not the `local-rabbitmq` container, which belongs to a different project and would end
 # up carrying this project's queues.
 
-name: bridged-broker
+name: fleetd-broker
 
 services:
   lavinmq:
     # Pinned deliberately: :latest silently moves the broker under a running daemon.
     image: cloudamqp/lavinmq:2.9.1
-    container_name: bridged-lavinmq
+    container_name: fleetd-lavinmq
 
     # The failure this deployment exists to prevent — survive reboots and Docker restarts, but
     # stay down if it was stopped on purpose.
     restart: unless-stopped
 
     # Loopback-bound on purpose. LavinMQ ships a default guest/guest account, which is only
-    # acceptable because nothing off-host can reach it. bridged connects over 127.0.0.1, and
+    # acceptable because nothing off-host can reach it. fleetd connects over 127.0.0.1, and
     # binding 0.0.0.0 here would expose a broker with default credentials to the network.
     ports:
-      - "127.0.0.1:5672:5672"      # AMQP — bridged.yaml broker.uri points here
+      - "127.0.0.1:5672:5672"      # AMQP — fleetd.yaml broker.uri points here
       - "127.0.0.1:15672:15672"    # HTTP management API + UI
 
     # The whole point of Stage 2. Held-but-unacked replies live here; without a named volume a
@@ -57,4 +57,4 @@ services:
 
 volumes:
   lavinmq-data:
-    name: bridged-lavinmq-data
+    name: fleetd-lavinmq-data

docs/CB-201-227-Refinement.md

@@ -0,0 +1,531 @@
+# CB-201 and CB-227 refinement
+
+Date: 2026-09-03
+
+## Decision
+
+#201 and #227 are one delivery program, but they are not one implementation unit.
+
+#201 has a real seam: `CompletionResolver` can publish a typed backend-error event only after its
+waiter resolution wins. #227 can consume that event without knowing any pane text. The classifier
+must land before the final #227 wiring. However, the policy engine, roster state, and lead nudge can
+be built in parallel with the classifier.
+
+I propose five units. Units 1 to 4 own separate files and can run in parallel. Unit 5 owns all
+composition files and lands after them. It also depends on the #234 defect 2 fix named in the task.
+
+```mermaid
+flowchart LR
+    U1["Unit 1: typed backend-error classification"] --> U5["Unit 5: wire policy, spawn gate, and fleet views"]
+    U2["Unit 2: credential outage policy"] --> U5
+    U3["Unit 3: lead outage nudge"] --> U5
+    U4["Unit 4: durable member outcome"] --> U5
+    D234["#234 defect 2: fail-loud target resolution"] --> U5
+```
+
+*Figure 1. Four file-disjoint foundations feed one composition unit.*
+
+This split keeps `Fleetd.java` under one owner. It also keeps every other production file under one
+unit in this plan.
+
+## Evidence checked in the current branch
+
+I read both issue pages in full. Each page reports zero comments.
+
+| Evidence | What the code says now |
+|---|---|
+| `inject/CompletionResolver.java:229-237` | A turn below two seconds fails before normal scrape classification. A matching fast backend error is therefore only a generic failure today. |
+| `inject/CompletionResolver.java:260-276` and `:332-367` | #211 already added raw-screen classification when `lastAssistantBlock` is empty. The “dead-code question” in #201 is stale on this branch. |
+| `inject/CompletionResolver.java:288-317` | Exhaustion wins before the hard-coded `API Error:` match. A backend error then goes through generic `fail(...)`. |
+| `inject/CompletionResolver.java:311-316` | The code admits that the pattern is a heuristic. A member report which quotes an API error may match it. |
+| `inject/CompletionResolver.java:449-467` | Startup coverage exists only for `exhaustedPattern`. |
+| `inject/ExhaustedPatternLookup.java:13-25` | The current lookup and explicit `none()` value are a good shape for the new classifier seam. |
+| `Fleetd.java:196-207` | One `BackendQuarantine` is shared by placement and the exhaustion sink. Its cooldown comes from `quarantineCooldownSeconds`. |
+| `Fleetd.java:322-363` | Pattern compilation, target-to-profile lookup, and the live `ExhaustionSink` are composed in `Fleetd.main`. The sink on this branch still ends in `.ifPresent(...)`. This plan assumes #234 replaces that silent path. |
+| `placement/BackendQuarantine.java:60-87` | A repeated exhaustion restarts one long quarantine. The store is credential-keyed and uses an injected monotonic clock. |
+| `member/CompositePeerLauncher.java:260-317` | Explicit and policy-selected spawns have separate gates. Both paths must learn about outage cool-off. |
+| `member/CompositePeerLauncher.java:347-379` | Exhaustion refusal already checks a credential for explicit spawns and filters policy candidates. Its error text says “exhausted”. |
+| `placement/PlacementContext.java:10-22` and `PlacementPolicyUtil.java:14-83` | Automatic placement has only one transient exclusion set named `quarantined`. Reusing it would make outage errors say “backend exhausted”. |
+| `mcp/FleetMcp.java:913-1025` | `fleet_list` sets `free: 0` and adds `credentialId` plus `quarantinedForSeconds` when quarantine is active. |
+| `session/MemberSession.java:51-59` | The roster has `DONE` and generic `FAILED`, but no backend-error state or stored reason. |
+| `session/SessionManager.java:695-773` | A normal boundary moves `BUSY` to `DONE`. A failure moves any non-released session to `FAILED`. The async completion resolver can race the `DONE` update. |
+| `session/SessionManager.java:648-687` | `rosterView` reports the session state, but it reports no terminal reason. |
+| `msg/MessageService.java:922-940` | CB-588 already nudges for every terminal async ticket, including failures. Current code would report failed tickets, but it would not report one correlated outage. |
+| `msg/ReplyPushLoop.java:20-48` | Replies, terminal tickets, and questions share one per-lead schedule. This prevents two push sources from injecting competing turns. |
+| `msg/ReplyPushLoop.java:305-395` | Each push entry point resolves the owning lead through `PrimaryRegistry`. Missing ownership is logged and the durable or pending item remains the backstop. |
+| `msg/ReplyPushLoop.java:496-547` | One tick builds one combined nudge. Pending items have separate reminder counts. |
+| `health/FleetHealthMonitor.java:91-143` | Health is a slow periodic observer of members and message-layer facts. It does not receive completion classifications. |
+| `health/FleetHealthMonitor.java:206-208` | `healthCoverage` means health enabled plus webhook configured. It does not describe lead-pane alerts. |
+| `Fleetd.java:465-486` | Health stays `detection-only` without the webhook notification setting. |
+
+I also read the related unit tests for `CompletionResolver`, `ReplyPushLoop`, `BackendQuarantine`,
+`CompositePeerLauncher`, `PlacementPolicyUtil`, `SessionManager`, `MessageService`, and `FleetMcp`.
+
+I did not inspect the in-progress #234 branch. I only used the two measured facts in the task. No
+peer architect was named, so I did not exchange a design with one.
+
+## Required behaviour
+
+The policy should use these first values:
+
+- Threshold: **2** classified backend errors.
+- Window: **60 seconds**, measured from the first error to the second.
+- Cool-off: **60 seconds**, starting when the threshold is reached.
+- Correlation key: `credentialId`, never profile name and never error text.
+- Incident rule: one active incident per credential. Errors during its cool-off do not extend it and
+  do not create more lead notices.
+- Rearm rule: after cool-off ends, two fresh errors are needed for another incident.
+
+Two errors are the smallest threshold which protects the honest one-turn failure. A 60-second window
+fits the measured two-member outage. A 60-second cool-off blocks immediate repeat spawns without
+turning a short backend fault into the default 1,800-second exhaustion quarantine.
+
+A single classified error still fails its send and marks its member `backend_error`. It does not
+cool a credential and does not send an outage notice. This is what “a single error changes nothing”
+must mean at the credential level. It cannot mean that the failed member still looks successful.
+
+```mermaid
+sequenceDiagram
+    participant R1 as Resolver for member A
+    participant R2 as Resolver for member B
+    participant P as Outage policy
+    participant S as Spawn gate
+    participant N as Lead push loop
+    participant L as Lead pane
+
+    R1->>P: backend error for credential C
+    Note over P: Count 1, no cool-off
+    R2->>P: backend error for credential C within 60s
+    P->>P: Start one 60s incident
+    P->>S: Credential C is cooling off
+    P->>N: Queue one incident notice
+    N->>L: Inject when lead is idle, blocked, or done
+    L->>S: Request another spawn on credential C
+    S-->>L: Refuse and report remaining cool-off
+```
+
+*Figure 2. The second independent classification creates the fleet-level event.*
+
+Against the 2026-09-01 case, the second failed member would start cool-off. `fleet_list` would show
+zero free capacity and both members as `backend_error`. The push loop would inject one outage notice
+even if the lead had not polled either ticket yet. The design reports the outage. It does not recover
+uncommitted work from the members.
+
+## Unit 1 — Typed backend-error classification
+
+### Scope
+
+Replace the direct hard-coded check inside `CompletionResolver` with a lookup and a sink. Keep the
+public send result as a failed send. The typed internal event is the seam #227 consumes.
+
+The lookup returns the pattern for a target. The sink receives the target, matched line, and full
+failure reason. It fires only after `Rendezvous.resolveFailure(...)` wins for that exact captured
+waiter. This copies the race rule already used by `ExhaustionSink`.
+
+The classifier must run in all three current paths:
+
+1. a normal non-empty assistant block;
+2. the #211 raw scrape fallback;
+3. a turn inside `MIN_TURN_NANOS`, before it becomes a generic too-fast failure.
+
+In every path, the order stays: stale-baseline guard, exhaustion, backend error, then generic
+failure or completion. A fast turn still fails when no configured pattern matches.
+
+Keep `(?i)\bAPI Error\s*:` as a compatibility pattern for profiles without `errorPattern` until the
+operator config is updated. Do not call this full coverage. Startup reporting in Unit 5 must name
+profiles using this weaker legacy default.
+
+### Files owned
+
+- Add `fleetd/src/main/java/dev/ltms/fleet/inject/BackendErrorPatternLookup.java`.
+- Add `fleetd/src/main/java/dev/ltms/fleet/inject/BackendErrorSink.java`.
+- Change `fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/inject/CompletionResolverTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. A target-specific error pattern matches a normal assistant block and resolves the send as failed.
+2. The same match calls `BackendErrorSink` exactly once after the waiter resolution wins.
+3. A late classification which loses to `fleet_reply` does not call the sink.
+4. An exhausted line that also matches the generic error pattern stays `BACKEND_EXHAUSTED`. It calls
+   only `ExhaustionSink`.
+5. A raw pane with leading Terminal User Interface (TUI) chrome and no assistant marker still uses
+   the #211 fallback and calls the backend-error sink.
+6. A matching error inside the two-second floor is typed and sent to the sink. A non-matching fast
+   turn stays a generic failure.
+7. An unchanged delivery baseline which contains old backend-error text is suppressed. It never
+   increments outage evidence.
+8. A non-match keeps the existing completion result and text.
+9. Constructors used by current callers keep compiling. They use the legacy default lookup and an
+   explicit inert sink until Unit 5 supplies the production objects.
+10. Unit tests pass. The developer runs the focused test first, then `mvn clean install` from
+    `fleetd/`.
+
+### Dependencies
+
+None. Unit 1 can run with Units 2, 3, and 4.
+
+Unit 5 depends on its new lookup, sink, and constructor.
+
+### What to report back
+
+- The exact classifier order in all three paths.
+- The focused test command and result.
+- The test which proves a losing waiter race does not publish an event.
+- The test which proves a fast matching failure is typed.
+- The final `mvn clean install` result.
+- Any constructor kept only for transition and where Unit 5 replaces it.
+
+## Unit 2 — Credential outage policy
+
+### Scope
+
+Build a small credential-keyed state machine. It accepts already-classified backend-error events.
+It does not read pane text, profiles, sessions, or lead state.
+
+Use an injected monotonic clock. A call records `credentialId`, target, and reason. It returns a new
+incident only on the threshold crossing. The incident contains a stable event id, credential id,
+the distinct affected targets, evidence count, window, and remaining cool-off.
+
+This class owns both correlation and short cool-off. Keeping them together makes threshold crossing
+and the cool-off deadline one atomic state change.
+
+### Files owned
+
+- Add `fleetd/src/main/java/dev/ltms/fleet/placement/BackendOutagePolicy.java`.
+- Add `fleetd/src/test/java/dev/ltms/fleet/placement/BackendOutagePolicyTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. One error creates no incident and no cool-off.
+2. Two errors for one credential within 60 seconds create exactly one incident and a 60-second
+   cool-off.
+3. Two errors more than 60 seconds apart do not create an incident.
+4. The exact 60-second boundary has a pinned result. Use inclusive `<= 60s` so scheduler delay does
+   not discard evidence at the boundary.
+5. Different credentials never share evidence.
+6. Different profiles which supply the same credential id do share evidence. The policy itself only
+   sees the credential id.
+7. More errors during active cool-off do not extend its deadline and do not return another incident.
+8. After expiry, old evidence is cleared. Two fresh errors are needed to create the next incident.
+9. Remaining seconds round up, matching `BackendQuarantine` reporting.
+10. Concurrent second and third errors cannot return two incidents.
+11. The focused tests and `mvn clean install` pass.
+
+### Dependencies
+
+None. Unit 2 can run with Units 1, 3, and 4.
+
+Unit 5 depends on the policy API.
+
+### What to report back
+
+- The state transition table and locking method.
+- The exact threshold, window, cool-off, and boundary rule.
+- The test which proves one incident under concurrent calls.
+- The focused test and `mvn clean install` results.
+
+## Unit 3 — Lead outage nudge
+
+### Scope
+
+Add backend incidents as a fourth pending source in `ReplyPushLoop`. Do not create another scheduler
+or call `AgentControl.send` from `Fleetd`. The existing combined per-lead schedule is the control
+which prevents competing injected turns.
+
+The entry point takes an incident id, affected worker targets, credential id, affected profile
+names, and remaining cool-off. It resolves distinct owning leads through `PrimaryRegistry`.
+
+Each `(incidentId, lead)` item is one-shot. It waits while the lead is not injectable. After one
+successful `agents.send`, remove it. A send exception keeps it pending for a bounded retry. It never
+uses the repeated reminder behaviour of an uncollected ticket.
+
+Also add a fail-loud entry point for a classified target that Unit 5 cannot map to a credential. It
+uses `PrimaryRegistry.nudgeTargetFor(target)` and says that correlation could not run. If no lead is
+known, log at `WARN`, not `DEBUG`.
+
+### Files owned
+
+- Change `fleetd/src/main/java/dev/ltms/fleet/msg/ReplyPushLoop.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/msg/ReplyPushLoopTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. One incident affecting two workers owned by one lead causes one successful pane injection.
+2. Two affected workers owned by two leads cause one successful injection per affected lead. This
+   is one notice per event per lead, not one notice per member.
+3. Repeating the same incident id is idempotent.
+4. A busy or unknown lead is not injected. The item stays pending until the lead becomes injectable
+   or its attempt cap is reached.
+5. After one successful injection, later ticks do not mention that incident again.
+6. A failed `agents.send` is retried within the existing bound. A successful retry still gives only
+   one successful send.
+7. A pending ticket and an outage incident for one lead appear in one combined nudge, not two
+   competing turns.
+8. The text names the credential, profiles, affected workers, and remaining cool-off. It tells the
+   lead to run `fleet_list`.
+9. An unmapped target produces a direct warning notice when a lead is known. If no lead is known,
+   the code logs a `WARN` naming the target and reason.
+10. `stop()` clears incident state as it clears other push state.
+11. Existing reply, ticket, and question tests stay green. The focused tests and
+    `mvn clean install` pass.
+
+### Dependencies
+
+None. The API uses plain values, not the Unit 2 incident class. This lets Unit 3 run in parallel.
+
+Unit 5 adapts the Unit 2 incident into this entry point.
+
+### What to report back
+
+- The exact one-shot and retry rules.
+- The test showing one combined nudge with a failed ticket.
+- The test showing one successful send for two affected workers.
+- The focused test and `mvn clean install` results.
+
+## Unit 4 — Durable member backend-error outcome
+
+### Scope
+
+Make a classified backend failure remain visible after its ticket is collected or expires.
+
+Add `BACKEND_ERROR` to `MemberSession.State`. Add a nullable failure detail to `MemberSession` and
+render it as `failureReason` in `SessionManager.rosterView`. Add
+`SessionManager.onBackendError(target, reason)`.
+
+The transition must handle both completion orderings:
+
+- `BUSY -> BACKEND_ERROR` when classification wins before the normal completion state update;
+- `DONE -> BACKEND_ERROR` when the async resolver runs after `SessionManager.onTurnComplete`.
+
+It must use a compare-and-set retry or another atomic update. `RELEASED` must never return to the
+roster. A backend-error member is terminal and cannot accept another delivery.
+
+### Files owned
+
+- Change `fleetd/src/main/java/dev/ltms/fleet/session/MemberSession.java`.
+- Change `fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. `onBackendError` moves a `BUSY` member to `BACKEND_ERROR` and stores the reason.
+2. It also moves `DONE` to `BACKEND_ERROR`, covering the resolver race.
+3. A later normal `onTurnComplete` cannot change `BACKEND_ERROR` back to `DONE`.
+4. A released or unknown member is not recreated. The unknown case logs at `WARN` and returns an
+   explicit false result to its caller.
+5. `onDelivered` refuses a `BACKEND_ERROR` member, just as it refuses generic `FAILED`.
+6. `rosterView` reports `state: backend_error` and `failureReason` after the send ticket is gone.
+7. Ordinary members do not gain a blank or invented `failureReason` field.
+8. Existing constructors keep source compatibility for tests and adapters.
+9. The focused tests and `mvn clean install` pass.
+
+### Dependencies
+
+None. Unit 4 can run with Units 1, 2, and 3.
+
+Unit 5 calls the new session method from the production sink.
+
+### What to report back
+
+- The two race orderings and the tests for both.
+- The exact roster JSON shape.
+- The unknown-target result and log level.
+- The focused test and `mvn clean install` results.
+
+## Unit 5 — Production wiring, spawn gate, and fleet views
+
+### Scope
+
+Compose Units 1 to 4 in production. This is the only unit which edits `Fleetd.java`.
+
+Add per-profile `errorPattern` config beside `exhaustedPattern`. Compile both once at startup. A
+configured pattern wins over the legacy default. Report configured profiles and legacy-default
+profiles separately at startup. A bad regex must stop startup with the profile and key in the
+message.
+
+Wire one production `BackendErrorSink` with this order:
+
+1. mark the member `backend_error` with its reason;
+2. resolve the profile and its current `effectiveCredentialId()` through the fail-loud #234 seam;
+3. record the error in `BackendOutagePolicy`;
+4. on a new incident, submit one event to `ReplyPushLoop`.
+
+If target metadata cannot be resolved, do not end in `Optional.ifPresent`. Log an error and call the
+Unit 3 unmapped-target notice. The failed send still reaches its ticket through CB-588.
+
+Teach both spawn paths about a separate cool-off source. Exhaustion quarantine has priority when
+both states are active. Automatic placement needs a distinct `coolingOff` set so its refusal does
+not say “exhausted”.
+
+Extend the MCP (Model Context Protocol) views:
+
+- A cooling profile has `free: 0`, `credentialId`, and `coolingOffForSeconds` in `fleet_list`.
+- It does not have `quarantinedForSeconds` unless exhaustion quarantine is also active.
+- `fleet_profiles` has a separate `coolingOff` map, not an entry in `quarantined`.
+- A direct spawn refusal says the credential is cooling off after repeated backend errors and gives
+  the remaining seconds.
+
+Do not change `FleetHealthMonitor.coverage`. It still describes the periodic health webhook path.
+Lead-pane outage delivery is a separate capability.
+
+### Files owned
+
+- `fleetd/src/main/java/dev/ltms/fleet/Fleetd.java`
+- `fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java`
+- `fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java`
+- `fleetd/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java`
+- `fleetd/src/main/java/dev/ltms/fleet/placement/PlacementContext.java`
+- `fleetd/src/main/java/dev/ltms/fleet/placement/PlacementPolicyUtil.java`
+- `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java`
+- `fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/member/CompositePeerLauncherTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/placement/PlacementPolicyTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java`
+- Add `fleetd/src/test/java/dev/ltms/fleet/BackendOutageFlowTest.java`.
+- `fleetd/fleetd.example.yaml`
+- `CLAUDE.md`
+
+No earlier unit edits these files.
+
+The lead, not a worker, must update `wiki/7-Use-Cases.md`, `wiki/9-Implementation.md`, and
+`wiki/11-Features.md`. Project rules forbid workers from committing `wiki/`. The portable block in
+`CLAUDE.md` and `wiki/7-Use-Cases.md` must remain byte-identical.
+
+### Acceptance criteria
+
+1. `errorPattern` binds per profile. Blank uses the legacy default and is reported as degraded
+   coverage. A config reload which changes it is reported as deferred because patterns are compiled
+   at startup.
+2. A malformed `errorPattern` stops startup and names `profiles.<name>.errorPattern`.
+3. The real production sink never silently drops an unknown target. A test captures its error log
+   and the fallback notice call.
+4. One real backend-error classification through `CompletionResolver` marks only its member. It does
+   not cool the credential and does not send an outage notice.
+5. Two real classifications for one credential within 60 seconds start one incident.
+6. The integration test then calls the real explicit-profile spawn gate. It is refused before any
+   adapter spawn call, with “cooling off” and remaining seconds in the message.
+7. The same test calls an automatic placement path. A cooling candidate is skipped. If every
+   candidate is cooling, the error names cool-off rather than exhaustion.
+8. Profiles sharing the credential are all blocked. A profile on another credential stays usable.
+9. `fleet_list` from the same fixture shows both members as `backend_error`, preserves each failure
+   reason, and reports `free: 0`, the credential, and `coolingOffForSeconds`.
+10. `fleet_profiles` reports cool-off separately from quarantine.
+11. The real `ReplyPushLoop` receives one incident and makes one successful lead-pane send. Existing
+    failed-ticket notice content may share that same combined send.
+12. Exhaustion still wins when a line matches both patterns. A simultaneous exhaustion quarantine
+    also wins in spawn errors and fleet views.
+13. After the 60-second cool-off, spawn is allowed again. A new incident needs two fresh errors.
+14. `healthCoverage` has the same value before and after this change for the same health config.
+15. `fleetd.example.yaml` explains `errorPattern`, the legacy fallback, 2/60/60 policy, and the
+    difference between cool-off and exhaustion quarantine.
+16. `CLAUDE.md` tells leads how `fleet_profiles` and `fleet_list` report cool-off. The lead later
+    applies the matching wiki updates and runs the documented byte-sync check.
+17. The developer records the new end-to-end test failing before implementation, then passing. The
+    focused suites and `mvn clean install` pass.
+
+### Dependencies
+
+Unit 5 starts only after Units 1 to 4 are merged or rebased into its branch. It also starts after the
+#234 defect 2 fix lands, because both areas touch the same target-resolution control path.
+
+### What to report back
+
+- The exact commits used for Units 1 to 4 and #234.
+- The startup coverage line with one configured and one legacy-default profile.
+- The red test output before the implementation and its green result after.
+- The explicit and automatic spawn refusal text.
+- Sample `fleet_list` and `fleet_profiles` JSON for cool-off and exhaustion.
+- The number and text of lead-pane sends in the real-path test.
+- The focused test commands and final `mvn clean install` result.
+- The exact `CLAUDE.md` change and the wiki edits the lead must apply.
+
+## File ownership summary
+
+| Area | Unit | Shared edit risk |
+|---|---:|---|
+| Completion classification | 1 | Only Unit 1 edits `CompletionResolver` and its test. |
+| Correlation and cool-off state | 2 | New files only. |
+| Lead push scheduling | 3 | Only Unit 3 edits `ReplyPushLoop` and its test. |
+| Member terminal state | 4 | Only Unit 4 edits `MemberSession`, `SessionManager`, and their test. |
+| Main composition, config, placement, MCP views, shipped prompt | 5 | Only Unit 5 edits `Fleetd`, `FleetConfig`, `CompositePeerLauncher`, placement context, `FleetMcp`, and `CLAUDE.md`. |
+| Wiki propagation | Lead after Unit 5 | Workers do not commit the wiki submodule. |
+
+## What I would not build
+
+1. **Do not reuse `BackendQuarantine` for outages.** Its repeat call restarts a long credential
+   quarantine. Its fields and errors say “exhausted”. That is wrong for a short outage.
+2. **Do not merge the exhaustion and generic error patterns.** Exhaustion must win because it has a
+   different policy and duration.
+3. **Do not group by error string.** One outage can produce different text. The shared operational
+   limit is the credential.
+4. **Do not mark a profile unusable until config changes.** The current classifier cannot safely
+   tell a permanent malformed request from a transient service fault. A permanent state would need
+   a stronger error taxonomy first.
+5. **Do not quarantine on the first generic backend error.** That would turn one bad request or one
+   false pattern match into a fleet-wide capacity loss.
+6. **Do not add this to `FleetHealthMonitor`.** The monitor samples slow member health. The exact
+   backend event already exists at completion resolution, and moving it to polling would lose type
+   and time.
+7. **Do not add another direct lead injector.** `ReplyPushLoop` already owns status gating,
+   per-lead coalescing, retry bounds, and heartbeat stand-down.
+8. **Do not change `healthCoverage` to `full`.** That field still means a webhook notification sink
+   exists for periodic health. A backend outage nudge does not make every health event visible.
+9. **Do not persist incident history across daemon restart in this work.** Existing exhaustion
+   quarantine is also in memory. A 60-second state does not justify a new durable store.
+10. **Do not build work recovery.** The PR-body survival story proves why checkpoint-first work is
+    useful, but these tickets are about detection, capacity, and signalling.
+11. **Do not remove the legacy `API Error:` fallback in the first release.** Doing so would turn an
+    unedited config back into a false successful completion. Report it as degraded coverage instead.
+12. **Do not reorder or add the old `visibleTurn` fallback from #201.** #211 already implemented the
+    narrow raw-scrape fallback at `CompletionResolver.classifyRawScrapeFallback`.
+
+## Riskiest assumption and cheapest experiment
+
+The riskiest assumption is that a configured error regex means “the backend failed this turn”. The
+current code and test already show the counterexample: a worker may quote `API Error:` while writing
+a valid report. Two such false matches on one credential would now remove capacity for 60 seconds.
+
+The cheapest experiment is a replay corpus before Unit 5 ships:
+
+1. Save the full pane text from the measured 2026-09-01 outage.
+2. Produce one safe failure per backend with a disposable invalid endpoint or request.
+3. Save one valid member report which quotes each error line.
+4. Replay all samples through the real `CompletionResolver` test fixture.
+5. Require outage samples to match and quoted-report samples not to match after assistant-block
+   extraction and baseline checks.
+
+This costs no outage deployment and no real sleep. If quoted reports still match, narrow the profile
+patterns before enabling correlation. Do not raise the threshold to hide a bad classifier.
+
+## Sequencing with three developers
+
+First wave:
+
+1. Developer A: Unit 1, typed classification.
+2. Developer B: Unit 2, credential outage policy.
+3. Developer C: Unit 3, lead outage nudge.
+
+As soon as one slot is free, start Unit 4. It is file-disjoint from every first-wave unit. Merge and
+review Units 1 to 4 independently.
+
+Start Unit 5 only after all four foundations and #234 are available. Unit 5 is the only high-conflict
+integration branch, so no other active unit should touch its file list.
+
+## Checks performed for this refinement
+
+- Read issue #201 and issue #227 through their Gitea pages. Both showed zero comments.
+- Read the source and tests named in the evidence section.
+- Ran `git status --short --branch`; the branch was clean before this document was added.
+- Ran `git log --oneline -12` to identify the branch base.
+- I did not run Maven because this change adds only a design document.
+- Rendered both Mermaid blocks with `npx @mermaid-js/mermaid-cli`; both commands succeeded.

docs/CB-306-Spawn-Readiness-Gate.md

@@ -79,7 +79,7 @@ Unit tests (add to the existing `ClaudeCodeLauncher` test):
 
 ## 5. Config
 
-Add to the launcher-level config (a bridged-level knob, not per-profile) in `bridged.yaml` +
+Add to the launcher-level config (a fleetd-level knob, not per-profile) in `fleetd.yaml` +
 `FleetConfig`:
 
 ```yaml

docs/CB-307-Reliable-Delivery.md

@@ -140,7 +140,7 @@ Stage-2 AMQP adapter: absent → in-memory, present → AMQP).
 
 ## 5. Build & verification (worker side)
 
-- Build with Maven from the worktree's `bridged/` dir. **Capture the exit code without a masking pipe**
+- Build with Maven from the worktree's `fleetd/` dir. **Capture the exit code without a masking pipe**
   (`mvn clean install; echo "MVN_EXIT=$?"` — never `mvn … | tail`, which hides failures).
 - Read the real test totals from `target/surefire-reports/TEST-*.xml`, not from stdout scroll.
 - You do **not** have IDE MCP access — do not claim `ide_diagnostics` results. The **primary** runs the

docs/CB-308-Multi-Host-Federation.md

@@ -208,7 +208,7 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
    never an argument* — across the broker: cross-host, identity comes from the key. Complements
    (not replaces) per-gateway broker logins over TLS.
 2. **Profiles are owned by the worker's host.** `fleet_spawn(profile, host)` resolves the name in
-   the *target* gateway's `bridged.yaml`. Gateways advertise their profile names in presence
+   the *target* gateway's `fleetd.yaml`. Gateways advertise their profile names in presence
    heartbeats, so a leader sees what each host offers before spawning; an unknown name is a clear
    error from the target. Secrets (base URLs, tokens) never leave the host that uses them.
 3. **Repo provisioning — clone from the forge, pinned.** A cross-host spawn names the repo URL and
@@ -275,11 +275,11 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
 - **Gateway discovery:** how gateways find the broker and each other (static config vs. discovery).
 - **Control authorization — THE GATE ON U4.** Signing (§7.1) settles *who sent it*; authorization
   is *who may do what*. **Cross-host spawn must not land before the minimal version exists**: a
-  per-host allowlist in `bridged.yaml` — beside the peer public keys — of gateway ids permitted to
+  per-host allowlist in `fleetd.yaml` — beside the peer public keys — of gateway ids permitted to
   publish control to this host, checked against the verified signature. A few lines of config and
   check; without them, any principal holding broker credentials can start processes on every host
   in the fleet.
-- **Key distribution & rotation:** static config (host → public key in each `bridged.yaml`) is
+- **Key distribution & rotation:** static config (host → public key in each `fleetd.yaml`) is
   fine at the current 2–3 host scale; rotation is manual. A refinement, not a blocker.
 - **Gateway death mid-turn:** the roster reaps it by missed heartbeat, and in-flight primary-bound
   messages survive by broker durability; still open is reconciling *worker* state when the dead

docs/CB-402-OpenCode-Adapter.md

@@ -11,7 +11,7 @@ All five increments of §4 are done, including increment 5 (the §5 live checkli
 
 ## 1. Goal
 
-Prove the [`PeerLauncher`](../bridged/src/main/java/dev/ltms/fleet/peer/PeerLauncher.java) SPI
+Prove the [`PeerLauncher`](../fleetd/src/main/java/dev/ltms/fleet/peer/PeerLauncher.java) SPI
 actually holds for a **non-Claude** coding agent by shipping a second, first-class in-tree
 adapter: **opencode** (`opencode` 1.1.31, a provider-agnostic terminal coding agent).
 

docs/CB-591-Gateway-Migration.md

@@ -9,7 +9,7 @@ with no terminator, and our third-party members cannot detect it (§7.2).
 · **Upstream issue:** [systems/vms#31](https://git.ltms.dev/systems/vms/issues/31)
 
 The gateway went live on 2026-08-15 and replaced Bifrost. This plan says what that means for a
-**member definition** in `bridged.yaml`, because that is the part of this repo the change actually
+**member definition** in `fleetd.yaml`, because that is the part of this repo the change actually
 touches.
 
 ---
@@ -134,16 +134,16 @@ own provider credentials. So 3b needs **no allowlist change**; only 3a does.
 `HerdrPeerLauncher.resolveEnv` → `env.apply(name)`, which reads the **daemon's own process
 environment**. The running `fleetd` inherited its environment when it started, so a variable added to
 `secrets.sh` afterwards is simply not there — the launcher would inject an empty token and the
-gateway would answer 401. This is the same failure as trap 1 in `scripts/redeploy-bridged.sh`
+gateway would answer 401. This is the same failure as trap 1 in `scripts/redeploy-fleetd.sh`
 (`WORKER_GITEA_TOKEN`), and it has the same fix: **restart from a login shell**, and use
-`scripts/redeploy-bridged.sh --check` to confirm the name resolves before restarting anything.
+`scripts/redeploy-fleetd.sh --check` to confirm the name resolves before restarting anything.
 
 ### 3c. What this does to `ccs`
 
 Once a profile carries `baseUrl`, `tokenEnv` and `model` itself, the ccs instance stops being what
 routes a member. Be precise about what is left, though: `configDir` still supplies **folder trust**
 and `settings.json`, and dropping it is what produced the trust dialog and the wrong-model error
-recorded in `bridged.yaml`. So ccs goes from *deciding where the tokens go* to *holding client-side
+recorded in `fleetd.yaml`. So ccs goes from *deciding where the tokens go* to *holding client-side
 state*. Less load-bearing, not removable.
 
 ### Why `/anthropic` and never `/v1/chat/completions`
@@ -217,7 +217,7 @@ defensible; picking one is not mine to do.
 ### D3 — token scope
 
 One consumer, `claude-bridge`, its token in `${SHARED_ENV}/tools/secrets.sh` as `AI_GATEWAY_TOKEN`,
-referenced by name only. Never the literal value in `bridged.yaml` — `tokenEnv` exists for this.
+referenced by name only. Never the literal value in `fleetd.yaml` — `tokenEnv` exists for this.
 
 ---
 
@@ -226,7 +226,7 @@ referenced by name only. Never the literal value in `bridged.yaml` — `tokenEnv
 ```mermaid
 flowchart TB
     U1["U1 · consumer token<br/>issue via cockpit, add to secrets.sh"]
-    U2["U2 · profile + guard<br/>bridged.yaml, restart"]
+    U2["U2 · profile + guard<br/>fleetd.yaml, restart"]
     U3["U3 · verify live<br/>spawn, prove thinking survives"]
     U4["U4 · context7 via gateway<br/>.mcp.json + opencode.json"]
     U5["U5 · docs<br/>CLAUDE.md, wiki 11-Features"]
@@ -238,7 +238,7 @@ flowchart TB
 | # | Scope | Who | Why |
 |---|---|---|---|
 | U1 | Issue the `claude-bridge` consumer at `auth.ltms.dev`; store as `AI_GATEWAY_TOKEN` | **operator** | touches secrets and a host we do not own |
-| U2a | New `gx` opencode profile on `/v1` — pure config, no guard change | **lead** | `bridged.yaml` is gitignored, so a worker cannot see or edit it |
+| U2a | New `gx` opencode profile on `/v1` — pure config, no guard change | **lead** | `fleetd.yaml` is gitignored, so a worker cannot see or edit it |
 | U2b | `local` → `/anthropic`; add `local-direct` weight 0; add `llm.ltms.dev` to the guard allowlist | **lead** | same |
 | U2c | One restart from a **login shell**, after U2a and U2b | **lead** | picks up `AI_GATEWAY_TOKEN` into the daemon env *and* the guard allowlist, in one stop |
 | U3 | Live spawn on both new profiles; confirm reasoning survives on each surface | **lead** | needs real spawns and the running daemon |
@@ -372,7 +372,7 @@ one turn; this one costs the whole task and is indistinguishable from a slow wor
 
 > **Diagnosing a stuck opencode member.** Do not read its pane. The launcher writes its config to a
 > temp dir and passes it as `OPENCODE_CONFIG` — find it with
-> `ls -dt /var/folders/*/*/T/bridged-opencode-* | head -1`, check the provider block and the key's
+> `ls -dt /var/folders/*/*/T/fleetd-opencode-* | head -1`, check the provider block and the key's
 > length and prefix (never its value), then reproduce with `opencode run --auto -m <provider>/<model>`
 > using the same `OPENCODE_CONFIG`. That is what turned "it hangs" into a one-line error.
 

docs/CB-5xx-Hardening.md

@@ -67,7 +67,7 @@ it will be disabled and the stage is wasted. So:
 auth:
   mode: loopback-trust   # default — behaves exactly like today: loopback ⇒ PRIMARY, no token needed
   # mode: token          # every non-worker caller must present a valid bearer token
-  # tokenEnv: BRIDGED_API_TOKEN   # host env var holding the token; never the literal value
+  # tokenEnv: FLEETD_API_TOKEN   # host env var holding the token; never the literal value
 ```
 
 `mode: loopback-trust` is the current behaviour, named honestly and now *chosen* rather than
@@ -114,7 +114,7 @@ not found), and the daemon that has been dogfooded for weeks runs as a bare fore
 
 - `deploy/dev.ltms.fleet.plist` — launchd agent, the *actual* runtime here, with `KeepAlive` and
   ordered start after herdr.
-- `deploy/bridged.service` — systemd unit for the Linux gateways CB-308 introduces.
+- `deploy/fleetd.service` — systemd unit for the Linux gateways CB-308 introduces.
 
 Ordering after herdr is advisory in both: the herdr socket may not exist at boot, so the daemon
 must **retry the socket rather than exit** — supervision ordering is a nicety, socket-retry is the

docs/M4-Fleet-Health.md

@@ -807,7 +807,7 @@ Checked against `main` at `e09cac6` on 2026-08-15. Unit 2 was written as one blo
 have since been built by separate CB tickets. Read this before planning the rest, or that work gets
 done twice.
 
-The check was a symbol survey of `bridged/src/main/java` plus the merge history. It tells you whether
+The check was a symbol survey of `fleetd/src/main/java` plus the merge history. It tells you whether
 the machinery exists at all. It is **not** a line-by-line audit of whether each criterion is fully
 met, and I did not run one.
 

docs/MCP-Contract.md

@@ -1,311 +1,162 @@
-# MCP Contract — `fleetd`'s unified gateway
+# MCP flows and error model — `fleetd`
 
-> **Status: 🔴 HISTORICAL DESIGN — do NOT use as the tool reference.** Written 2026-07-14, before
-> any MCP code existed. The system shipped and this page never caught up, so **its tool names,
-> parameter names and REST paths are wrong today**. Audited 2026-08-17; the specific drift:
+> **What this page is.** The **flows**: how a delegation, a clarification, a detached task and a
+> silent member each travel through `fleetd`. These shapes are what shipped, and they are hard to
+> read off the code because they span the MCP face, the rendezvous registry, the `Injector` and
+> herdr.
 >
-> - **Tools it names that do not exist:** `bridge_read`, `bridge_cancel`.
-> - **Shipped tools it omits:** `bridge_poll`, `bridge_ack`, `bridge_profiles`, `bridge_whoami`.
-> - **Parameter names are wrong nearly everywhere** — it says `message`/`target`/`timeout_seconds`/
->   `block` where the code takes `content`/`sessionId`/`timeoutMs`/`wait`; `text` where
->   `bridge_reply` takes `content`; `target` where `bridge_stop` takes `paneId`.
-> - **REST paths are wrong:** it says `POST /workers` and `DELETE /workers/{paneId}`; the daemon
->   serves `POST /members` and `DELETE /members/{paneId}`.
+> **What this page is NOT: a tool reference.** It deliberately holds no tool catalogue, no
+> parameter tables and no REST paths. **The live MCP schema is the authority** — each tool's own
+> description and parameters, as mounted — with the intent→tool table in `CLAUDE.md` as the short
+> form.
 >
-> **The authoritative tool surface is the live MCP schema** (each tool's own description and
-> parameters, as mounted), with the intent→tool table in `CLAUDE.md` as the short form. Both were
-> checked against `mcp/FleetMcp.java` on 2026-08-17 and are accurate.
+> That absence is the fix for fleetd #114 (CB-609), and it is worth stating why. This page used to
+> carry a full tool catalogue written in July 2026, before any MCP code existed. The code shipped;
+> the page did not follow. By August it named two tools that do not exist, omitted five that do,
+> had the wrong name for nearly every parameter, pointed at REST paths the daemon does not serve,
+> and — worst — still described an identity model (*"any connection that does not map to a known
+> worker is treated as a primary"*) that was a real privilege bug, fixed since by the ancestry
+> walk in fleetd #161. Every one of those errors is the same error: **a second, hand-maintained
+> copy of something the code already states**. So the second copy is gone rather than corrected.
+> Only the flows remain, because a flow is a shape rather than a name, and shapes are what this
+> page was ever good for.
 >
-> What is still worth reading here is **§6 — the flows and the error model** (rendezvous,
-> `fleet_ask`, detached delivery, the turn-done fallback). The shapes it describes are the ones
-> that shipped; only the names around them drifted. Rewriting this page is tracked as **CB-609**.
-
-`fleetd` is the **sole communication gateway** for every Claude session in the bridge. Both
-the **primary** (Opus, on subscription) and every **worker** (off-subscription Claude Code)
-mount the *same* MCP server with a single `claude mcp add` line, and talk only through its
-tools. No Claude session ever addresses a broker, a peer, or the network directly.
-
-This document defines every MCP tool that face must expose, who may call it, its blocking
-semantics, and how it maps onto the code already in the tree.
+> The names that do appear below are checked by `McpContractDocTest`, which fails if this page
+> names a `fleet_*` tool the server does not register. That test is the whole reason it is safe to
+> write a tool name here at all.
 
 ---
 
-## 1. Design constraints (non-negotiable)
+## 1. Rendezvous flows
 
-These come from the project's core invariants and bound every decision below.
+### 1.1 Delegation — happy path
 
-1. **One server, both roles.** The primary and all workers mount an identical server. The
-   catalog must serve both, and `fleetd` must decide *who is calling* from the connection —
-   never from a caller-supplied argument that could be spoofed.
-2. **Subscription-safe by construction.** No MCP tool ever reads, sets, or forwards
-   `ANTHROPIC_BASE_URL`. Mounting the bridge cannot move a session off subscription.
-   Enforced today by [`SubscriptionGuard`](1-Architecture).
-3. **Blocking rendezvous, no busy-poll.** The primary consumes a worker's reply through a
-   *single* MCP call that `fleetd` holds open — never a cross-turn poll loop that would burn
-   subscription quota.
-4. **Status-gated delivery.** Anything that puts text into a worker flows through the existing
-   [`Injector`](1-Architecture): delivered only when the worker is `idle`/`blocked`, at most
-   one message per turn.
-5. **`fleetd` owns policy; herdr owns PTYs.** MCP tools express *intent*; `fleetd`
-   translates it into guard checks, rendezvous bookkeeping, and herdr `agent.*` calls.
-
----
-
-## 2. Topology
-
-Both faces live in the one daemon. The **north face** is MCP (this document); the **south
-face** is the herdr Unix socket. REST/SSE remains only for non-Claude clients and dashboards.
-
-```mermaid
-flowchart LR
-    OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["fleetd — standalone daemon"]
-        MCP["MCP server (north face)<br/>bridge_send · bridge_reply<br/>bridge_ask · bridge_status · lifecycle"]
-        RDV["rendezvous registry<br/>(blocking-call waiters)"]
-        INJ["Injector + StatusPoller<br/>(status-gated writer)"]
-        SOCK["herdr socket client (south face)"]
-        MCP --> RDV
-        RDV --> INJ
-        INJ --> SOCK
-        MCP --> SOCK
-    end
-    HERDR["herdr<br/>panes · agent-status"]
-    W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
-
-    OPUS -->|"bridge_send (blocks)"| MCP
-    W -.->|"bridge_reply / bridge_ask"| MCP
-    SOCK -->|"agent.start · agent.send<br/>agent.get · pane.close"| HERDR
-    HERDR -->|"drives PTY"| W
-
-    classDef ext fill:#2b6cb0,stroke:#1a365d,color:#ffffff;
-    classDef core fill:#2f855a,stroke:#22543d,color:#ffffff;
-    class OPUS,W ext
-    class MCP,RDV,INJ,SOCK core
-```
-
----
-
-## 3. Identity & addressing
-
-Because the same server is mounted by everyone, `fleetd` resolves the caller's role on every
-request — this is the linchpin of the whole contract and has no code yet.
-
-- **Workers are known.** `fleetd` spawns every worker
-  ([`WorkerService`](1-Architecture)) and records its herdr session UUID / `terminal_id` on
-  the returned [`Agent`]. When a call arrives on a connection that maps to a known worker,
-  the caller is *that* worker — so **workers never pass a target**; routing is implicit.
-- **The primary is "not a worker".** Any connection that does not map to a known worker is
-  treated as a primary. It addresses workers **explicitly** by `target` — a session UUID,
-  a `terminal_id`, or a friendly `profile` name.
-- **Turn correlation.** A blocking `bridge_send` registers a *waiter* keyed by worker
-  identity. A worker's later `bridge_reply` / `bridge_ask` on the same identity resolves that
-  waiter. A `turn_id` is minted per exchange so a clarification round-trip
-  (§6.2) rejoins the right turn.
-
----
-
-## 4. Transport
-
-`fleetd` is a long-lived daemon serving **multiple** concurrent clients (one primary + N
-workers), so a per-client stdio child is the wrong shape. The recommended transport is
-**streamable-HTTP / SSE** on the same bind as the REST face:
-
-```bash
-# identical on primary and every worker
-claude mcp add --transport http fleetd http://127.0.0.1:8080/mcp
-```
-
-This adds an MCP-server dependency the pom does not yet carry. See [Open decisions](#10-open-decisions).
-
----
-
-## 5. Tool catalog
-
-| Tool | Caller | Blocks? | Backing (exists today?) |
-|---|---|---|---|
-| [`bridge_send`](#bridge_send) | primary | yes (default) | `Injector.enqueue` ✅ · rendezvous registry ❌ (CB-104) |
-| [`bridge_reply`](#bridge_reply) | worker | no | rendezvous ❌ · pane injection via `Injector` ✅ |
-| [`bridge_ask`](#bridge_ask) | worker | yes | reverse rendezvous ❌ |
-| [`bridge_status`](#bridge_status) | either | no | `AgentControl.status` ✅ · `Injector.activeTargets` ✅ |
-| [`bridge_spawn`](#lifecycle) | primary | no | `WorkerService.spawn` ✅ (`POST /workers`) |
-| [`bridge_list`](#lifecycle) | either | no | `WorkerService.list` ✅ (`/agents`) |
-| [`bridge_stop`](#lifecycle) | primary | no | `WorkerService.stop` ✅ (`DELETE /workers/{paneId}`) |
-| [`bridge_read`](#bridge_read) | primary | no | `AgentControl.read` ✅ |
-| [`bridge_cancel`](#bridge_cancel) | primary | no | — ❌ (future) |
-
-### Core: delegation & rendezvous
-
-#### `bridge_send`
-*(primary → worker — the headline tool, CB-104)*
-
-- **Params:** `message` (required); `target` (optional — defaults to the sole worker / default
-  profile); `timeout_seconds` (default 600); `block` (default `true`); `auto_spawn`
-  (default `true`); `turn_id` (optional — supplied when answering a worker's `bridge_ask`).
-- **Blocking (`block:true`):** enqueue `message` via the `Injector`, then hold the call open
-  until exactly one of:
-  - worker calls `bridge_reply` → `{ outcome:"reply", text }`
-  - worker calls `bridge_ask` → `{ outcome:"question", text, turn_id }`
-  - worker's `agent_status` reaches done/idle with no reply → `{ outcome:"turn_done", text:<terminal tail> }`
-  - deadline elapses → `{ outcome:"timeout" }`
-  - worker gone → error `worker_gone`
-- **Detached (`block:false`):** enqueue and return `{ outcome:"dispatched", dispatch_id }`
-  immediately. The eventual reply is injected into the primary's idle pane (§6.3), or drained
-  via `bridge_status` on a split-host primary.
-
-#### `bridge_reply`
-*(worker → primary)*
-
-- **Params:** `text` (required); `final` (default `true`).
-- **Behavior:** resolve the primary waiter registered against this worker with `text`. If no
-  waiter exists (detached delegation), `fleetd` **injects the primary's idle pane** instead.
-  Returns `{ delivered:true, mode:"resolved"|"injected" }`. No `target` — identity is implicit.
-
-#### `bridge_ask`
-*(worker → primary — the reverse rendezvous)*
-
-- **Params:** `question` (required); `timeout_seconds`.
-- **Behavior:** blocks the *worker's* call. Surfaces the question to the primary (resolving its
-  open `bridge_send` with `outcome:"question"`, or injecting its pane). When the primary
-  answers — a `bridge_send` carrying the matching `turn_id` — that unblocks this call and
-  returns `{ answer }` to the worker, which continues **in the same turn**.
-
-### Worker lifecycle
-<a id="lifecycle"></a>
-Thin adapters over [`WorkerService`](1-Architecture) — parity with the existing REST routes.
-
-- **`bridge_spawn`** — `{ profile? }` → worker view (`sessionId`, `terminalId`, `paneId`,
-  `status`). Guard-checked; a boundary breach returns error `subscription_boundary` (the
-  REST `403`).
-- **`bridge_list`** — no params → all workers + `agent_status`. Read-only, either role.
-- **`bridge_stop`** — `{ target }` → tears down the pane and its dedicated tab. Idempotent.
-
-### Observability
-
-#### `bridge_status`
-*(either role — the README's 4th named tool)*
-
-- **Params:** `target?`.
-- **Behavior:** per-worker `agent_status`, queue depth (`Injector.activeTargets`), whether a
-  rendezvous is open, and ids. For the *calling* session it also reports/drains **pending
-  messages addressed to me** — the path a split-host primary's `Stop`-hook uses to wake and
-  collect replies without being injectable. Read-only, non-blocking.
-
-#### `bridge_read`
-*(primary)*
-
-- **Params:** `target`; `source` ∈ `visible | recent | recent_unwrapped | detection`.
-- **Behavior:** returns the worker's terminal text so the primary can peek at a *detached*
-  worker's progress. Adapter over `AgentControl.read`.
-
-### Control (future)
-
-#### `bridge_cancel`
-*(primary)*
-
-- **Params:** `target`. Interrupt the worker's current turn / abandon the rendezvous. No
-  backing code yet.
-
----
-
-## 6. Rendezvous flows
-
-### 6.1 Delegation — happy path
-
-One blocking call, zero polls.
+One blocking call, zero polls. The lead's call is held open by `fleetd` until the member answers.
 
 ```mermaid
 sequenceDiagram
-    participant P as Primary (Opus)
-    participant B as fleetd (MCP + Injector)
+    participant P as "Lead (primary)"
+    participant B as "fleetd (MCP + Injector)"
     participant H as herdr
-    participant W as Worker (Claude)
+    participant W as "Member"
 
-    P->>B: fleet_send("do X", target=w) — blocks
-    B->>B: register waiter(w)
-    B->>H: agent.send(w, "do X")  (idle window)
-    H-->>W: prompt injected
-    W->>W: works the turn
-    W->>B: fleet_reply("result")
-    B->>B: resolve waiter(w)
-    B-->>P: { outcome:"reply", text:"result" }
+    P->>B: "fleet_send{sessionId, content} — blocks"
+    B->>B: "register waiter(sessionId)"
+    B->>H: "agent.send — only in an injectable window"
+    H-->>W: "prompt injected"
+    W->>W: "works the turn"
+    W->>B: "fleet_reply{content}"
+    B->>B: "resolve waiter"
+    B-->>P: "{ outcome: reply }"
 ```
 
-### 6.2 Clarification — reverse rendezvous (`fleet_ask`)
+**The cap that matters:** a blocking `fleet_send` is bounded by the *caller's own* MCP client
+timeout, about 60 seconds — not by the task. Anything slower than that must use the detached flow
+in §1.3, or the lead's call returns while the member is still working.
 
-The worker pauses mid-turn to ask; the primary answers; the worker resumes in the same turn.
+### 1.2 Clarification — reverse rendezvous
+
+The member pauses mid-turn to ask, the lead answers, and the member resumes **the same turn** with
+its context intact.
 
 ```mermaid
 sequenceDiagram
-    participant P as Primary
+    participant P as "Lead"
     participant B as fleetd
-    participant W as Worker
+    participant W as "Member"
 
-    P->>B: fleet_send("do X", target=w) — blocks
-    B-->>W: "do X" (injected)
-    W->>B: fleet_ask("which config?") — worker blocks
-    B-->>P: { outcome:"question", text:"which config?", turn_id }
-    P->>B: fleet_send("config.yaml", target=w, turn_id) — blocks again
-    B-->>W: resolve fleet_ask → { answer:"config.yaml" }
-    W->>W: resumes same turn
-    W->>B: fleet_reply("done")
-    B-->>P: { outcome:"reply", text:"done" }
+    P->>B: "fleet_send{sessionId, content} — blocks"
+    B-->>W: "content injected"
+    W->>B: "fleet_ask{question} — member blocks"
+    B-->>P: "{ outcome: question, turnId }"
+    P->>B: "fleet_send{turnId, content} — answers THIS turn"
+    B-->>W: "fleet_ask returns the answer"
+    W->>W: "resumes the same turn"
+    W->>B: "fleet_reply{content}"
+    B-->>P: "{ outcome: reply }"
 ```
 
-### 6.3 Detached delegation — pane injection
+**Answer with `turnId`, never `sessionId`.** A `sessionId` send starts a new turn; it does not
+resolve the waiting `fleet_ask`.
 
-The primary does not block; the reply arrives later in its idle pane.
+**The window is about 55 seconds and no nudge extends it.** So never brief a member to "ask me":
+decide before delegating, or give the member an explicit default to fall back on.
+
+### 1.3 Detached delegation — the lead does not block
+
+The lead gets a ticket immediately and collects the answer later. This is the flow for any real
+task, because of the ~60s cap in §1.1.
 
 ```mermaid
 sequenceDiagram
-    participant P as Primary
+    participant P as "Lead"
     participant B as fleetd
-    participant W as Worker
+    participant W as "Member"
 
-    P->>B: fleet_send("do X", target=w, block=false)
-    B-->>P: { outcome:"dispatched", dispatch_id }
-    P->>P: continues its own work
-    W->>B: fleet_reply("result")
-    Note over B: no waiter → detached path
-    B->>B: Injector.enqueue(primary_pane, "result")
-    B-->>P: injected into idle pane (status-gated)
+    P->>B: "fleet_send{sessionId, content, wait:false}"
+    B-->>P: "accepted — ticket"
+    P->>P: "continues its own work"
+    W->>B: "fleet_reply{content}"
+    Note over B: "no waiter is blocked — the reply is held"
+    B->>B: "nudge the lead's own pane (status-gated)"
+    P->>B: "fleet_poll{ticket}"
+    B-->>P: "the member's report"
+    P->>B: "fleet_ack{target, msgId}"
 ```
 
-### 6.4 Uncooperative worker — turn-done fallback
+A terminal ticket nudges the lead's pane by itself, so a detached task does not need watching. The
+nudge needs an injectable lead pane and is capped, so it is a convenience rather than a guarantee.
 
-A worker that never calls `fleet_reply` still returns a result: `fleetd` reads its terminal
-tail when the turn completes.
+### 1.4 The member never replies — turn-done fallback
+
+A member that ends its turn without `fleet_reply` still produces something: `fleetd` reads its
+pane tail. This is a **fallback, not a channel** — it is lossy in three separate ways, and every
+one of them has produced a wrong answer in practice.
 
 ```mermaid
 sequenceDiagram
-    participant P as Primary
+    participant P as "Lead"
     participant B as fleetd
-    participant W as Worker
+    participant W as "Member"
 
-    P->>B: fleet_send("do X", target=w) — blocks
-    B-->>W: "do X" (injected)
-    W->>W: works, never calls fleet_reply
-    B->>B: StatusPoller sees agent_status → idle/done
-    B->>B: AgentControl.read(w, "recent")
-    B-->>P: { outcome:"turn_done", text:<terminal tail> }
+    P->>B: "fleet_send — blocks or detaches"
+    B-->>W: "content injected"
+    W->>W: "works, never calls fleet_reply"
+    B->>B: "StatusPoller sees the turn end"
+    B->>B: "read the pane tail"
+    B->>B: "classify: exhausted? echoed brief? real report?"
+    B-->>P: "{ outcome: turn_done } or a named failure"
 ```
 
+The three ways it goes wrong, and what each looks like now:
+
+| What happened | What the lead used to get | What it gets today |
+|---|---|---|
+| The report is longer than the scrape window | The **end** silently cut off | Still clipped, but marked partial |
+| The member never started — spent credential | The lead's **own brief** echoed back as a report | A named failure: backend exhausted |
+| The member is simply slow | A tail of work in progress | Unchanged — read it as a hint, not a result |
+
+The echoed-brief case is the one to remember: it reads as a long, on-topic report with nothing in
+it from the member. It is suppressed now, but the general rule stands — **check the member's
+worktree with `git log` before believing a report you did not watch arrive.**
+
 ---
 
-## 7. Status gating
+## 2. Status gating
 
-Delivery only happens in a safe window. This is the state machine the `Injector` already
-enforces via `AgentStatus.injectable()`; MCP `bridge_send` is simply its producer.
+Delivery only happens in a safe window. `fleet_send` is a producer for the `Injector`, which
+already enforces this through `AgentStatus.injectable()`.
 
 ```mermaid
 stateDiagram-v2
     [*] --> IDLE
-    IDLE --> WORKING: message delivered / picks up
-    WORKING --> IDLE: turn done
-    WORKING --> BLOCKED: awaits input
-    BLOCKED --> WORKING: input delivered
-    IDLE --> UNKNOWN: detection glitch
-    BLOCKED --> UNKNOWN: detection glitch
-    UNKNOWN --> IDLE: re-detected
+    IDLE --> WORKING: "message delivered, picked up"
+    WORKING --> IDLE: "turn done"
+    WORKING --> BLOCKED: "awaits input"
+    BLOCKED --> WORKING: "input delivered"
+    IDLE --> UNKNOWN: "detection glitch"
+    BLOCKED --> UNKNOWN: "detection glitch"
+    UNKNOWN --> IDLE: "re-detected"
 
     note right of IDLE
         injectable — deliver head of FIFO
@@ -321,69 +172,17 @@ stateDiagram-v2
     end note
 ```
 
-At most one message is delivered per turn: after a send the `Injector` waits for a `WORKING`
-pickup before delivering the next, with a `PICKUP_GRACE_POLLS` fallback for turns faster than
-the poll interval. A herdr `events.subscribe` stream can later replace the sampling without
-touching this state machine.
+**At most one message per turn.** After a send, the `Injector` waits for a `WORKING` pickup before
+delivering the next, with a grace-poll fallback for turns that finish faster than the poll
+interval.
 
----
+Two consequences a lead feels directly:
 
-## 8. Error model
+- **A second send to a busy member never lands.** It reports as queued and times out. The member
+  is fine; the message simply waits, and then restarts the member when it next goes idle.
+- **A spawned member is not deliverable until it has mounted the MCP.** Until then a send waits on
+  that gate for about 60 seconds and then fails without ever reaching the pane.
 
-| Condition | `bridge_send` result | Notes |
-|---|---|---|
-| Worker replies | `{ outcome:"reply" }` | normal |
-| Worker asks | `{ outcome:"question", turn_id }` | answer with `bridge_send(turn_id)` |
-| Turn ends, no reply | `{ outcome:"turn_done" }` | terminal tail as text |
-| Deadline elapsed | `{ outcome:"timeout" }` | message may still be queued/delivered |
-| Worker vanished | error `worker_gone` | `Injector.drop` fails the queued future |
-| Guard breach on spawn | error `subscription_boundary` | REST `403` parity |
-| Delivery failed at herdr | error, message dropped | poisoned message not left blocking the FIFO |
-
-`bridge_reply` from a worker with no open waiter is **not** an error — it falls through to
-detached pane injection (§6.3).
-
----
-
-## 9. Mapping to existing code
-
-The MCP face is a thin adapter layer; nearly every capability already exists behind the REST
-seam. Only the **rendezvous registry** and the **caller-identity resolver** are new.
-
-| MCP tool | Existing collaborator | New work |
-|---|---|---|
-| `bridge_send` | `Injector.enqueue`, `AgentControl.send` | waiter registry, timeout, outcome mux (CB-104) |
-| `bridge_reply` / `bridge_ask` | `Injector` (pane injection) | reverse rendezvous, identity resolver |
-| `bridge_status` | `AgentControl.status`, `Injector.activeTargets` | pending-drain projection |
-| `bridge_spawn` / `list` / `stop` | `WorkerService.{spawn,list,stop}` | MCP adapter only |
-| `bridge_read` | `AgentControl.read` | MCP adapter only |
-
-Because the REST routes in `FleetApp` already exercise the collaborators, MCP tools are
-validated by **parity** against those routes, not by re-testing behavior.
-
----
-
-## 10. Open decisions
-
-1. **`bridge_ask` direction.** This page defines it as *worker-asks-primary* (a genuine reverse
-   channel, matching the "inject the primary's pane" language). The alternative — a synonym for
-   a blocking primary→worker send — is weaker and produces different plumbing. **Recommend
-   worker-asks-primary.**
-2. **Detached delivery shape.** A `block:false` param on `bridge_send` (keeps the catalog
-   small) vs. a separate `bridge_dispatch` tool. **Recommend the param.**
-3. **Auto-spawn on send.** `bridge_send` provisions a worker per profile when none exists
-   (simplest primary UX) vs. requiring an explicit `bridge_spawn` first. **Recommend
-   auto-spawn, defaulting on.**
-4. **Transport & SDK.** Streamable-HTTP/SSE co-located with the REST bind (recommended) vs.
-   stdio. Requires choosing a Java MCP server SDK and adding it to the pom.
-
----
-
-## 11. Implementation staging
-
-- **CB-104** — blocking `bridge_send` + rendezvous registry + caller-identity resolver
-  (the producer that finally drives the inert `StatusPoller`).
-- **CB-1xx** — `bridge_reply` / `bridge_ask` reverse rendezvous + detached pane injection.
-- **CB-1xx** — lifecycle + observability adapters (`bridge_spawn/list/stop/status/read`).
-- **CB-1xx** — transport wiring + `claude mcp add` docs; parity tests vs. REST.
-- **Later** — `bridge_cancel`; swap `StatusPoller` for herdr `events.subscribe`.
+`UNKNOWN` is deliberately neither injectable nor a pickup. A pane whose status cannot be read is
+not a pane that is safe to write to — see fleetd #176 for what happens when a gate treats an
+unreadable pane as a ready one.

docs/wiki-audit.md

@@ -0,0 +1,208 @@
+# Wiki audit for #168
+
+**Source checked:** `.wiki-snapshot/` at `68e32c6` (2026-08-31). I did not use
+`wiki/`. Code references below are from the current `fleetd` source tree. A quoted
+line is a concrete claim that needs correction, unless the table says `KEEP`.
+
+| Page | Verdict | One-line reason |
+|---|---|---|
+| `Home.md` | REVISE | Good overview, but it still names the retired product. |
+| `_Sidebar.md` | REVISE | The heading still says `claude-bridge`. |
+| `1-Architecture.md` | REBUILD | Its component contract mixes current names with removed tools, routes, and planned backends. |
+| `2-Message-Server.md` | REBUILD | The claimed MCP schema, mount command, REST/SSE surface, and fallback paths are pre-build design. |
+| `3-Approaches.md` | REVISE | Useful research history, but it presents unbuilt AgentAPI as a selectable fallback. |
+| `4-Setup.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `5-Operations.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `6-Team.md` | REBUILD | It teaches role-addressed sends and a Claude-only team model that the shipped API does not have. |
+| `7-Use-Cases.md` | REBUILD | Its flagship flow depends on removed `ccs` profiles and removed send parameters. |
+| `8-Roadmap.md` | REBUILD | It is a historical plan, but it presents old implementation choices and planned work as the current stack. |
+| `9-Implementation.md` | REBUILD | Its package, class, endpoint, and outcome map has drifted from the source. |
+| `10-Cross-Host-Messaging.md` | REVISE | It labels most federation work proposed, but misses the shipped `coordinator:` lead channel. |
+| `11-Features.md` | REVISE | It is the right catalogue, but code-path names are old and it misses the second-herdr-daemon capability. |
+| `12-Claude-to-OpenCode.md` | REVISE | The porting guide is mostly current, but calls the product and spawned-member path a bridge. |
+| `13-User-Guide.md` | REVISE | It is the best operator page, but needs the product rename and the second-herdr-daemon setup. |
+
+## Pages needing work
+
+### `Home.md` — REVISE
+
+- Quote: `# claude-bridge` (line 1) and `` `claude-bridge` keeps`` (line 11).
+  The product is `fleet` / `fleetd`. The MCP server identifies itself as `fleet` in
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:313-315`.
+- Quote: `AgentAPI ... swappable fallback injector` (lines 73-76).
+  There is no AgentAPI implementation under `fleetd/src/main/java`; the actual
+  launchers are selected by `Profile.kind` in
+  `fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java:265-270`.
+
+### `_Sidebar.md` — REVISE
+
+- Quote: `### 📖 claude-bridge` (line 1).
+  Rename it to `fleet`. `FleetMcp` registers the current product-facing tool set at
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:301-326`.
+
+### `1-Architecture.md` — REBUILD
+
+- Quote: `` `claude-bridge` lets`` (line 3). The product was renamed; the MCP
+  server name is `fleet` (`FleetMcp.java:313-315`).
+- Quote: ``fleet_read`` in the tool list (line 102). No such tool is registered.
+  The complete registered list is `fleet_send` through `fleet_whoami` at
+  `FleetMcp.java:301-326`; `fleet_read` is absent.
+- Quote: `SSE (GET /events)` (line 143). `FleetApp.build()` registers no `/events`
+  route; its routes are listed at `FleetApp.java:143-159`.
+- Quote: `Redis Streams / NATS JetStream, or an embedded queue` (line 106).
+  The shipped durable inbox is AMQP, configured by `broker`, at
+  `FleetConfig.java:49-50` and `FleetConfig.java:655-714`.
+- Quote: `AgentAPI (fallback)` (line 107). No AgentAPI adapter exists; shipped
+  launcher kinds are `claude-code` and `opencode` (`FleetConfig.java:265-270`).
+
+### `2-Message-Server.md` — REBUILD
+
+- Quote: `claude mcp add --transport http bridge http://127.0.0.1:8080/mcp`
+  (line 67). The daemon defaults to port `8765` in `FleetConfig.java:183-187`,
+  and identifies its server as `fleet` at `FleetMcp.java:313-315`.
+- Quote: ``fleet_send(message, target?, {block, timeout_seconds, auto_spawn,
+  turn_id})`` (line 80). The real parameters are `sessionId`, `content`,
+  `timeoutMs`, `wait`, `turnId`, and `coordId` (`FleetMcp.java:1096-1108`).
+- Quote: ``fleet_read(target, source)`` (line 85). It is not registered; see the
+  complete registration at `FleetMcp.java:301-326`.
+- Quote: `docs/MCP-Contract.md ... normative` (lines 87-88). That is not a valid
+  reference: only §6 is current, as the current operator guide itself says at
+  `.wiki-snapshot/13-User-Guide.md:466`.
+- Quote: `SSE (GET /events)` (line 45). No route exists in the built REST surface,
+  `FleetApp.java:143-159`.
+
+### `3-Approaches.md` — REVISE
+
+- Quote: `AgentAPI ... remains a swappable fallback injector` (lines 78-84).
+  It was never built. The shipped adapter selection is only `claude-code` or
+  `opencode` (`FleetConfig.java:265-270`). Keep it as discarded research, not an
+  operational fallback.
+- Quote: `claude-bridge` (line 109). Rename the product to `fleet`; the runtime
+  package is `dev.ltms.fleet`, for example `FleetMcp.java:1`.
+
+### `4-Setup.md` — RETIRE
+
+It is a 25-line redirect and says its procedure was never written (lines 3-9).
+Chapter 13 is the maintained install procedure. Keeping a second navigation page
+adds no working documentation.
+
+### `5-Operations.md` — RETIRE
+
+It is a 35-line redirect and says its runbook was never written (lines 3-14).
+Chapter 13 now owns run and recovery instructions.
+
+### `6-Team.md` — REBUILD
+
+- Quote: `fleet_send {role: w-claude, prompt: A}` (line 98). `fleet_send` accepts
+  `sessionId` and `content`, not `role` or `prompt` (`FleetMcp.java:1096-1108`).
+- Quote: `some on Claude, some on the remote local LLM` (lines 3-5) and `Every
+  worker is ... Claude Code` (line 25). `opencode` is a first-class launcher kind,
+  not a Claude worker (`FleetConfig.java:265-270`).
+- Quote: `fleetd's concurrency policy` (line 121). The configured capacity control
+  is per-profile `maxLoad` (`FleetConfig.java:251-264`), not the role routing model
+  described here.
+
+### `7-Use-Cases.md` — REBUILD
+
+- Quote: `ccs profile` (line 10), `ccs + herdr` (line 22), and `ccs-spawn`
+  (line 45). The configuration has `profiles` and `fleet`, not `ccs`:
+  `FleetConfig.java:34-58` and `FleetConfig.java:81-101`.
+- Quote: `fleet_send({"to", "kind", "body", "block"})` (lines 55-62).
+  None of those are the shipped send parameters. The schema is
+  `FleetMcp.java:1096-1108`.
+- Quote: `fleet_list() → { "profiles": ... }` (lines 74-80). `fleet_list` is a
+  roster view; `fleet_profiles` is the configured-backend view, as registered at
+  `FleetMcp.java:307-311` and described at `FleetMcp.java:1176-1182`.
+
+### `8-Roadmap.md` — REBUILD
+
+- Quote: `Java 21+` (line 43). The current project guidance and source use Java 25;
+  the `FleetConfig` source itself uses Java 25 unnamed lambda parameters, for
+  example `FleetConfig.java:102`.
+- Quote: `herdr 0.7.0 / protocol 14` (line 46). The current REST health endpoint
+  reports the live protocol returned by herdr (`FleetApp.java:240-244`), while the
+  current operator guide records protocol 19 at
+  `.wiki-snapshot/13-User-Guide.md:76-85`.
+- Quote: `ccs <profile> claude` and `ccs env <profile>` (lines 47-48). Shipped
+  configuration uses `Profile` records and launcher `kind`,
+  `FleetConfig.java:313-330` and `FleetConfig.java:265-270`.
+- Quote: `Redis Streams via Lettuce` (line 50). The actual durable inbox is AMQP
+  `broker`, `FleetConfig.java:655-714`.
+
+### `9-Implementation.md` — REBUILD
+
+- Quote: `rest.FleetdApp` and `mcp.BridgeMcp` (lines 29-30). The classes are
+  `rest.FleetApp` and `mcp.FleetMcp` (`FleetApp.java:46`; `FleetMcp.java:67`).
+- Quote: `dev.ltms.fleetd` (line 67). The source package is `dev.ltms.fleet`
+  (`FleetMcp.java:1`).
+- Quote: `WorkerPresence` (line 110). The current class is `MemberPresence`, as
+  imported and used by `FleetMcp` at `FleetMcp.java:12` and `465-469`.
+- Quote: the outcome list ending in `STALE_TURN` (lines 128-131). The code also
+  has `BACKEND_EXHAUSTED` (`FleetMcp.java:550-554`) and async `ASKING` handling
+  (`FleetMcp.java:664-668`).
+- Quote: `FleetdApp` (line 207) and `FleetdConfig` (line 211). These names do not
+  resolve; current classes are `FleetApp` and `FleetConfig`.
+
+### `10-Cross-Host-Messaging.md` — REVISE
+
+- Quote: the chapter says the cross-host fabric is proposed except for the
+  single-host inbox (lines 3-8). Cross-host **lead-to-lead** delivery shipped:
+  `fleet_send` accepts `coordId` (`FleetMcp.java:1094-1107`) and publishes it at
+  `FleetMcp.java:616-641`; configuration has `coordinator` at
+  `FleetConfig.java:74-78` and `99-101`.
+- Quote: `bridge.dlx` (line 90). This product name is stale. The shipped lead path
+  uses `LeadChannel`, not the proposed exchange flow (`FleetMcp.java:95-96` and
+  `616-641`). Keep the proposed federation design, but add a clear shipped/proposed
+  boundary for CB-637.
+
+### `11-Features.md` — REVISE
+
+- Quote: `mcp/BridgeMcp` (line 22), `config/FleetdConfig` (lines 25-27), and other
+  index references. These paths no longer resolve; the source classes are
+  `mcp/FleetMcp` (`FleetMcp.java:67`) and `config/FleetConfig`
+  (`FleetConfig.java:81`).
+- Quote: `fleet_whoami` returns only `primary` or `worker` (lines 99-100).
+  It also returns `architect` (`FleetMcp.java:1235-1244`).
+- The page needs the missing separate member-herdr-daemon feature listed below.
+
+### `12-Claude-to-OpenCode.md` — REVISE
+
+- Quote: `same bridge mount` (line 5) and `a bridge-spawned worker` (line 94).
+  Rename the product path to `fleet`. The daemon exposes the MCP server as `fleet`
+  (`FleetMcp.java:313-315`), and profiles select OpenCode with `kind: opencode`
+  (`FleetConfig.java:332-335`).
+- Quote: the sample mount name is `fleetd` (line 67). The server name is `fleet`;
+  update the sample to avoid teaching a second product name.
+
+### `13-User-Guide.md` — REVISE
+
+- Quote: `The bridge is the only channel` (line 63). The invariant is correct, but
+  the product term needs the `fleet` rename. The daemon's MCP server name is
+  `fleet` (`FleetMcp.java:313-315`).
+- Quote: it describes one herdr socket (lines 72-85). It needs the optional
+  `memberHerdrSocket` setup and two-daemon health meaning. The config key is in
+  `FleetConfig.java:34-37`, and `/healthz` checks both daemons when configured at
+  `FleetApp.java:210-245`.
+
+## MISSING
+
+`11-Features.md` has a body section for **routing members through a separate herdr daemon**
+(`## memberHerdrSocket`, line 2174), but **no row in the index table** at the top of the page
+(lines 20-95). That table is how the page is meant to be read, so a capability absent from it is
+effectively undiscoverable. Lead note: this is my own omission — I added the section on 2026-08-31
+and did not add the matching row. Fixed in the wiki at `68e32c6`'s successor.
+
+The original audit stated the feature had no entry at all. That was wrong: the section exists. The
+gap is the index row. Recorded here rather than silently corrected, because the difference matters —
+"undocumented" and "documented but unindexed" are different jobs.
+
+Evidence for the feature itself: `FleetConfig.java:34-37` and `FleetApp.java:103-115`, `210-245`,
+and `247-263`.
+
+## Audit method and coverage
+
+I checked all 15 pages. I checked concrete tool, route, config, class, file, and
+product-name claims claim-by-claim on 11 pages: Home, Sidebar, 1, 2, 4, 5, 6, 7, 9,
+11, and 13. I skimmed the remaining four long historical or research pages (3, 8, 10,
+12), then checked their concrete claims that affect the verdict. This is an audit of
+the supplied snapshot, not a wiki rewrite.

e2e/README.md

@@ -2,7 +2,7 @@
 
 A standard, repeatable **live** end-to-end test of the two-way channel: it drives a real
 multi-turn conversation between a primary and an off-subscription worker **through the
-running `bridged` daemon**, captures the full transcript, and grades the channel.
+running `fleetd` daemon**, captures the full transcript, and grades the channel.
 
 This is the committed form of the ad-hoc channel test that discovered the CB-115 gaps
 (herdr `unknown` misclassification wedging delivery, dirty completion scrapes, and workers
@@ -20,7 +20,7 @@ construction** — it only calls the bridge's loopback REST face.
 ```mermaid
 sequenceDiagram
     participant T as conversation_test.py
-    participant B as bridged (REST)
+    participant B as fleetd (REST)
     participant W as worker (off-sub)
     T->>B: POST /workers  (spawn)
     T->>B: GET /sessions/{id}/status  (await ready)
@@ -37,7 +37,7 @@ sequenceDiagram
 
 ## Prerequisites
 
-- `bridged` is running (default REST on `http://127.0.0.1:8765`) with at least one worker
+- `fleetd` is running (default REST on `http://127.0.0.1:8765`) with at least one worker
   profile configured and its backend reachable.
 - herdr is up (the daemon needs it).
 - Python 3 (standard library only — no pip installs).

e2e/conversation_sustained_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Sustained back-and-forth bridge test — ONE primary, ONE worker, many dependent turns
-over a fixed wall-clock window (default 5 minutes), through the running `bridged` daemon.
+over a fixed wall-clock window (default 5 minutes), through the running `fleetd` daemon.
 
 Where conversation_test.py proves a handful of turns work and issue_hunt_test.py proves
 fan-out isolation, this proves the channel stays healthy under a *sustained, stateful*

e2e/conversation_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Standard bridge conversation test — a multi-turn primary↔worker exchange through
-the running `bridged` daemon, fully captured, with automatic gap analysis.
+the running `fleetd` daemon, fully captured, with automatic gap analysis.
 
 This is the repeatable form of the ad-hoc channel test that surfaced the CB-115 gaps
 (herdr `unknown` misclassification, dirty completion scrape, workers not calling

e2e/fleet_ask_test.py

@@ -24,7 +24,7 @@ Like the rest of the suite it talks ONLY to the bridge's REST face on loopback
 ANTHROPIC_BASE_URL and never touches herdr, so it is subscription-safe by construction.
 
 Usage:
-    python3 bridge_ask_test.py [--base URL] [--profile NAME] [--repo DIR] [--out DIR]
+    python3 fleet_ask_test.py [--base URL] [--profile NAME] [--repo DIR] [--out DIR]
                                [--send-timeout SECS] [--answer-timeout SECS] [--keep-worker]
 
     --base            bridge REST base URL              (default http://127.0.0.1:8765)

e2e/fleet_ask_transcript.md

@@ -1,12 +1,12 @@
-# Live bridge_ask — reverse rendezvous — 2026-07-16 16:30
+# Live fleet_ask — reverse rendezvous — 2026-07-16 16:30
 
 One worker paused its delegated turn to ask the primary, then resumed with the answer (profile `default`). Result: **`OK`**.
 
 ## Round-trip
 
 1. **primary → worker** (delegation): the ask-forcing task.
-2. **worker → primary** (`bridge_ask`, 6.6s): 'PICK A COLOR: red or blue?' — surfaced on the primary's blocked send as a `question` with `turnId=term_656bb47d2c42a9e#1`.
+2. **worker → primary** (`fleet_ask`, 6.6s): 'PICK A COLOR: red or blue?' — surfaced on the primary's blocked send as a `question` with `turnId=term_656bb47d2c42a9e#1`.
 3. **primary → worker** (answer on that turn): `blue`.
-4. **worker → primary** (`bridge_reply`, 7.9s, source=reply): 'CHOSEN=BLUE'
+4. **worker → primary** (`fleet_reply`, 7.9s, source=reply): 'CHOSEN=BLUE'
 
 > **OK:** asked, resumed the same turn, and the reply reflected the primary's answer

e2e/issue_hunt_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Standard bridge fan-out test — ONE primary vs MANY workers, concurrently, for
-issue hunting through the running `bridged` daemon, fully captured, with gap analysis.
+issue hunting through the running `fleetd` daemon, fully captured, with gap analysis.
 
 Where conversation_test.py exercises a single worker over multiple turns, this drives
 the path that only appears under fan-out: the primary spawns N workers, sends each a
@@ -53,11 +53,11 @@ REPO_ROOT = HERE.parent
 # hot files this project has been iterating on, so a real issue is plausible to find.
 DEFAULT_ASSIGNMENTS = [
     {"id": "completion", "probe": "CompletionResolver",
-     "target": "bridged/src/main/java/dev/ltms/bridged/inject/CompletionResolver.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java"},
     {"id": "worker", "probe": "WorkerService",
-     "target": "bridged/src/main/java/dev/ltms/bridged/worker/WorkerService.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/worker/WorkerService.java"},
     {"id": "rendezvous", "probe": "Rendezvous",
-     "target": "bridged/src/main/java/dev/ltms/bridged/msg/Rendezvous.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/msg/Rendezvous.java"},
 ]
 
 PROMPT_TMPL = (

fleetd/.gitignore

@@ -2,8 +2,8 @@
 target/
 dependency-reduced-pom.xml
 
-# Local runtime config (copy from fleetd.example.yaml). Both names: the live file is still
-# bridged.yaml until the cutover, and Fleetd reads either one.
+# Local runtime config (copy from fleetd.example.yaml). Both names are ignored: fleetd.yaml is
+# the current name, and bridged.yaml is the legacy name Fleetd still falls back to.
 fleetd.yaml
 bridged.yaml
 

fleetd/fleetd.example.yaml

@@ -1,10 +1,10 @@
-# bridged configuration (example). Copy to bridged.yaml and adjust.
+# fleetd configuration (example). Copy to fleetd.yaml and adjust.
 #
-# bridged is the sole gateway between primary/worker Claude sessions and herdr.
+# fleetd is the sole gateway between primary/worker Claude sessions and herdr.
 # It is NOT a Claude process and must never carry ANTHROPIC_BASE_URL.
 
 # REST + MCP listen address. Keep it on loopback unless you also switch auth.mode to `token`
-# below — bridged REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
+# below — fleetd REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
 bind:
   host: 127.0.0.1
   port: 8765
@@ -21,7 +21,7 @@ bind:
 #                           bind — the daemon fails fast otherwise, because "unauthenticated ⇒
 #                           primary" on a reachable port would hand spawn/stop/send to anyone.
 #   tokenEnv              → host env var holding the token (never the literal value). Default
-#                           BRIDGED_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
+#                           FLEETD_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
 #
 # TLS is deliberately NOT terminated in the daemon (CB-501 D3): run a reverse proxy in front and
 # let it own certificate lifecycle, e.g.
@@ -29,7 +29,7 @@ bind:
 # The broker link gets TLS from its own URI (amqps://…) — see `broker` below.
 # auth:
 #   mode: token
-#   tokenEnv: BRIDGED_API_TOKEN
+#   tokenEnv: FLEETD_API_TOKEN
 
 # Optional pinned primary terminal (CB-307). Names the herdr pane the PRIMARY itself runs in:
 # a caller whose connection maps to this pane resolves as the primary (no credential needed —
@@ -48,10 +48,10 @@ bind:
 # every orchestration call. List each lead's pane here and all of them resolve as leads.
 #
 #   tab → the ONLY field identity depends on (CB-579); the exact label of the tab hosting the lead.
-#         Label the tab yourself, or let bridged label one it launches — see `fleet.leaders:` below.
+#         Label the tab yourself, or let fleetd label one it launches — see `fleet.leaders:` below.
 #   kind/model → descriptive; they document what runs in the pane and are echoed by fleet_whoami
 #
-# A lead's tab must already carry its label (or be launched by bridged, which labels it) — there is
+# A lead's tab must already carry its label (or be launched by fleetd, which labels it) — there is
 # no terminal id to paste in and nothing to re-pin when the session restarts: the tab survives, so
 # the same label resolves the same lead again on the next scan.
 # `fleet_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
@@ -63,7 +63,7 @@ bind:
 # Leads are configured under `fleet.leaders:` — see THE FLEET further down.
 #
 # Two things stop the tab-name convention from becoming a way to claim leadership: the configured
-# member spaces are excluded from the scan, so nothing bridged places can land in a matching tab;
+# member spaces are excluded from the scan, so nothing fleetd places can land in a matching tab;
 # and startup REFUSES a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel`
 # override, also matches — so the two namespaces cannot overlap by accident. The label is a NAME,
 # never a capability: what a pane may do is decided by the role the daemon resolves for it.
@@ -93,21 +93,20 @@ bind:
 #   intervalSeconds → how often a tick runs (default 30). ENFORCED floor of 15: the code computes
 #                      Math.max(15, intervalSeconds), so a lower value is silently raised, not
 #                      rejected.
-#   workingSuspectAfterSeconds, paneProbeIntervalSeconds → accepted and parsed, but NOT YET READ by
-#                      anything — the dormant monitor only consumes intervalSeconds today (CB-573
-#                      shipped ahead of the evidence publishers these two knobs are for). Setting
-#                      them changes nothing right now, and no minimum is enforced on either, because
-#                      nothing reads them to enforce one. They exist so a later build can start
-#                      honouring them without another config-shape change.
+#   workingSuspectAfterSeconds → age before a BUSY member is suspected of a stall (default 600).
+#                      ENFORCED floor of 300: a lower value is silently raised.
+#   paneProbeIntervalSeconds → accepted and parsed, but NOT YET READ by anything. Setting it changes
+#                      nothing right now. It exists so a later build can start honouring it without
+#                      another config-shape change.
 #   notifications.mode → "webhook" flips what fleet_list REPORTS (healthCoverage: "full" instead
-#                      of "detection-only") — it does NOT make bridged send any webhook call; no
+#                      of "detection-only") — it does NOT make fleetd send any webhook call; no
 #                      delivery mechanism is implemented yet. Any other value, or omitting the
 #                      block, reports "detection-only".
 # health:
 #   enabled: true
-#   intervalSeconds: 30
-#   workingSuspectAfterSeconds: 600
-#   paneProbeIntervalSeconds: 60
+#   intervalSeconds: 30               # floor 15
+#   workingSuspectAfterSeconds: 600   # floor 300 — how long BUSY with no activity means STALL_SUSPECTED
+#   paneProbeIntervalSeconds: 60      # parsed, but nothing reads it yet — changing it changes nothing
 #   notifications:
 #     mode: disabled
 
@@ -115,6 +114,18 @@ bind:
 # (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
 herdrSocket: ~/.config/herdr/herdr.sock
 
+# Optional socket for member panes. Omit this to use herdrSocket for both leads and members.
+# memberHerdrSocket: /Users/member/.config/herdr/herdr.sock
+
+# fleetd #213: the login shell the member OS user (memberHerdrSocket above) actually runs. ONLY
+# read when memberHerdrSocket is set — fleetd's own $SHELL says nothing about a pane running
+# under a different OS user, and there is no channel to ask herdr for that user's shell, so this
+# must be told rather than guessed. Absent, blank, or anything not ending in "zsh" is treated the
+# same as "not zsh": the memberCredentials.policy: allow-list ZDOTDIR scrub (see worktreeGroup
+# below) is skipped in favour of the weaker CB-596 sentinel overlay — a degraded control, never a
+# refusal to spawn. When memberHerdrSocket is absent this key is never consulted at all.
+# memberLoginShell: /bin/zsh
+
 # How member sessions are spawned. Define one or more named profiles (backends) under
 # `profiles`; each key is the profile name (also the ccs profile). A profile says only WHICH
 # BACKEND — model, CLI adapter, credentials, cost. It says nothing about what a member spawned on
@@ -124,16 +135,16 @@ herdrSocket: ~/.config/herdr/herdr.sock
 # Shared knobs (placement/workspace) can be repeated per profile; they usually match.
 #   placement: tab   → each worker lands in its OWN tab in a dedicated worker space (default).
 #                      Use `pane` for the legacy behaviour (split the focused tab).
-#   mcpUrl           → bridged mounts the bridge MCP (--mcp-config, inline) + reply charter
+#   mcpUrl           → fleetd mounts the bridge MCP (--mcp-config, inline) + reply charter
 #                      (--append-system-prompt) as launch flags; nothing is written to the profile.
-#   ideMcpUrl        → opt-in (CB-634), default off. When set, bridged mounts the IDE Index MCP as a
+#   ideMcpUrl        → opt-in (CB-634), default off. When set, fleetd mounts the IDE Index MCP as a
 #                      second inline server named `intellij`, and adds an IDE charter that pins every
 #                      ide_* call to the member's own worktree. A URL, not a boolean — host and port
 #                      are host-specific. Set it only on a host where the IDE actually runs.
 #   ideProjectDir    → repo-relative module dir the IDE opens and the overlay pins (CB-634). Only read
-#                      when ideMcpUrl is set. This repo's Maven pom lives in `bridged/`, not at the
+#                      when ideMcpUrl is set. This repo's Maven pom lives in `fleetd/`, not at the
 #                      worktree root, so opening the root imports no module and ide_* resolves nothing;
-#                      set this to `bridged`. Omit for a repo whose project is the worktree root.
+#                      set this to `fleetd`. Omit for a repo whose project is the worktree root.
 #   ideOpenCommand   → host command that opens ideProjectDir in the IDE at spawn (CB-634 auto-open).
 #                      Only read when ideMcpUrl is set. `{dir}` is replaced with the absolute module
 #                      dir and the command runs through `/bin/sh -c`, so set env inline if needed —
@@ -151,7 +162,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      already), so this is instead applied as the model's `limit.context` in the
 #                      generated opencode.json — the member compacts WITHIN this window, not exactly
 #                      at it — and only when this profile's `model:` is in `provider/model` form; if it
-#                      isn't, bridged logs a WARN naming the profile rather than silently doing nothing.
+#                      isn't, fleetd logs a WARN naming the profile rather than silently doing nothing.
 #   tokenEnv         → host env var holding the worker's auth token (value never stored in config);
 #                      omit for a backend that needs no token (e.g. a local ollama).
 #   cwd              → pin this profile's working directory (CB-112). Omit to inherit the primary's
@@ -161,7 +172,11 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      skills/MCP/hooks. Omit to leave the worker on the host default.
 #   parityOverlay    → repo-relative paths copied primary→worktree so a worker in a provisioned
 #                      worktree sees the same local config (CB-301-ext). Omit for the default set:
-#                      [.env, .envrc]. (.claude/settings.local.json is NOT in the default — it
+#                      [.env] only (CB-148). .envrc is left out of the default on purpose: it is
+#                      executable shell that direnv runs on every cd, so copying it carries
+#                      behaviour into the worker, not just values, unlike .env. An operator who
+#                      wants it copied can still write parityOverlay: [.env, .envrc] explicitly.
+#                      (.claude/settings.local.json is NOT in the default — it
 #                      pre-approves IDE/tool grants a member must not hold ambiently; CB-525/CB-634.)
 #
 #                      Do NOT add .mcp.json (CB-525). A worker's tools are whatever its launcher
@@ -170,7 +185,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      checkout, so its navigation returned paths OUTSIDE its own worktree: one
 #                      worker made all 59 of its edits in the primary tree while compiling its
 #                      worktree, and every build it ran was of code that did not contain them.
-#                      bridged neutralizes a provisioned worktree's .mcp.json for this reason;
+#                      fleetd neutralizes a provisioned worktree's .mcp.json for this reason;
 #                      listing it here would copy the primary's back over that.
 #   gitTokenEnv      → host env var holding the git-forge API token. When set, its value is injected
 #                      as GITEA_TOKEN so the worker can open its OWN PR at checkpoint (CB-302).
@@ -183,7 +198,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      refused on a subscription usage limit, rather than a real answer. Opt-in —
 #                      omit and this profile's completion fallback behaves exactly as before.
 #                      Every backend words its refusal differently, so this is config, never a
-#                      vendor string baked into bridged itself.
+#                      vendor string baked into fleetd itself.
 #                      DEFERRED: compiled once into a startup pattern map — editing it needs a
 #                      daemon restart, same as this profile's model/baseUrl/argv.
 #   credentialId     → CB-578 stage B: the credential this profile quarantines WITH when a
@@ -195,18 +210,51 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      profile quarantines alone, under its own name, exactly as if the field did
 #                      not exist. Cooldown length is the top-level quarantineCooldownSeconds below.
 #                      HOT: read live at every spawn/exhaustion check — no restart needed.
+#   errorPattern     → fleetd #201 / #227: regex matched against a completion-fallback scrape to
+#                      classify a turn that ended with no fleet_reply as a BACKEND ERROR — a
+#                      credential outage or a provider 5xx — rather than a real answer or a
+#                      usage-limit exhaustion (exhaustedPattern above always wins when a line
+#                      matches both). Opt-in. Omit it and this profile falls back to fleetd's
+#                      built-in legacy pattern `(?i)\bAPI Error\s*:` — classification still
+#                      happens, just without a profile-specific match; every backend words its
+#                      failure differently, so a hardcoded sentence would only ever match one
+#                      of them.
+#                      DEFERRED: compiled once into a startup pattern map, same as exhaustedPattern
+#                      — editing it needs a daemon restart.
+#                      # errorPattern: "503 Service Unavailable"   # opt-in: classify a backend outage
+#
+#                      What happens once a match fires (BackendOutagePolicy, credentialId-keyed,
+#                      SEPARATE from the CB-578 stage B quarantine above and never merged with it):
+#                        - threshold 2 — TWO DISTINCT TARGETS (never raw events) on the same
+#                          effective credential inside a 60-second window start an "incident" and a
+#                          60-second cool-off for that credential. One member repeating the same
+#                          classified line twice never cools anything off — a real outage hits
+#                          every target on that credential, so requiring a second, independent
+#                          target loses nothing against the case this guards against, while
+#                          protecting against a heuristic misfire on one flaky member.
+#                        - a fresh error while a credential is already cooling off is ignored
+#                          outright: it neither extends the 60s deadline nor starts a new incident.
+#                        - `fleet_list`/`fleet_profiles` report a cooling credential with
+#                          `coolingOffForSeconds` (never `quarantinedForSeconds`, unless CB-578
+#                          exhaustion quarantine is ALSO independently active for the same
+#                          credential — the two checks can both fire at once). A spawn onto a
+#                          cooling profile is refused with a message naming the credential and
+#                          remaining seconds — "cooling off", never "exhausted", so an operator can
+#                          tell a short transient fault from a spent subscription at a glance.
+#                        - the lead gets ONE nudge per incident (not one per affected target), via
+#                          the same push loop that already delivers ticket/question reminders.
 #   env              → extra environment for this profile's workers, as a literal key/value map
 #                      (CB-511). Use it to give workers a toolchain.
 #
-#                      A worker's environment does NOT come from your shell. bridged hands herdr an
+#                      A worker's environment does NOT come from your shell. fleetd hands herdr an
 #                      explicit env map and herdr merges it into ITS OWN process env — so before
 #                      CB-511 a worker inherited whatever PATH the herdr server happened to be
 #                      started with, which on a long-lived herdr can predate your toolchain entirely
 #                      and leave workers unable to run `mvn` or `java` at all.
-#                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
+#                      fleetd now propagates ITS OWN PATH to every worker by default; set `env:`
 #                      only to override that or add more (JAVA_HOME, …). Since the default is the
 #                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
-#                      lines in deploy/dev.ltms.fleet.plist and deploy/bridged.service.
+#                      lines in deploy/dev.ltms.fleet.plist and deploy/fleetd.service.
 #
 #                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
 #                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
@@ -219,10 +267,10 @@ profiles:
     baseUrl: http://gx01.gw:8000     # the vLLM host this profile targets (gx00.gw / gx01.gw)
     model: coder
     placement: tab
-    workspace: bridged-workers
+    workspace: fleetd-workers
     # tabLabel: an optional per-profile override; the fleet template usually covers it
     mcpUrl: http://127.0.0.1:8765/mcp
-    tokenEnv: BRIDGED_WORKER_TOKEN
+    tokenEnv: FLEETD_WORKER_TOKEN
     argv: ["ccs", "gx10"]
     # weight: relative selection weight for automatic placement (weighted, round-robin, and
     # fixed's fallback walk). Absent defaults to 1.0. An explicit 0 or negative value means
@@ -258,21 +306,57 @@ profiles:
     #   GOTCHA 2 — `maxLoad` is the ONLY throttle you have here. There is no metering, no budget
     #   and no refusal on cost; the cap on live members is the single thing standing between a
     #   fan-out and your monthly limit. Set it deliberately and keep it small.
+    #
+    #   GOTCHA 3 (fleetd #176, corrected by fleetd #257) — `maxLoad` counts members, never the lead
+    #   itself. The lead is a live `claude` session on this SAME account (a lead is never moved
+    #   off-subscription, whatever its own profile says), so it already holds one seat before any
+    #   member spawns. If a lead's `fleet.leaders.<name>.profile` names THIS profile — or ANY OTHER
+    #   `subscription: true` profile that shares this one's account (see THE SENTINEL, just below,
+    #   next to `credentialId:`) — `fleet_list` reports that seat count under `leadSeats`; see
+    #   `profile:` under THE FLEET below. `free` itself is NEVER reduced by `leadSeats`: `free` means
+    #   "what the real placement gate (`CompositePeerLauncher#enforceMaxLoad`) will actually grant a
+    #   fresh `fleet_spawn` right now", and that gate only ever compares live members against
+    #   `maxLoad` — it has no notion of the lead's own seat. An earlier cut of this feature
+    #   subtracted `leadSeats` from `free` on the theory it made `free` describe the true ceiling on
+    #   the account, but no backend seat ceiling shared with the lead has ever actually been
+    #   measured, and the subtraction just made `free` disagree with the one thing it is supposed to
+    #   describe — the fleetd #257 fix. `maxLoad: 3` means 3 member slots, full stop; a lead sharing
+    #   the account is a fact you can see in `leadSeats`, not a reason `free` undercounts spawns that
+    #   will, in practice, succeed.
+    #
+    #   THE SENTINEL (fleetd #176 stage 2, correcting an inert stage 1 fix): every `subscription:
+    #   true` profile that leaves `credentialId` unset shares ONE implicit account-wide credential
+    #   id with every other such profile on this host — because a subscription profile doesn't
+    #   authenticate with a credential of its own, it authenticates as the operator's own Claude
+    #   login, and there is exactly one of those. So on a typical host, `opus` (the lead's profile)
+    #   and `sonnet` (the members' profile) are linked automatically, with NOTHING to set here — that
+    #   is what makes GOTCHA 3 above work without also writing matching `credentialId:` values on
+    #   both. This linkage is not just cosmetic: it is the same key `BackendQuarantine`/cool-off use,
+    #   so a usage-limit hit on `opus` now quarantines `sonnet` too (and vice versa) — correct, since
+    #   they are one Claude account, but worth knowing before you wonder why an unrelated-looking
+    #   profile went quarantined.
+    #
+    #   WHEN TO OVERRIDE — set explicit, DIFFERENT `credentialId:` values on two `subscription: true`
+    #   profiles only when they are genuinely two separate Claude logins on the same host (a real,
+    #   if unusual, setup). An explicit `credentialId` always wins over the sentinel, so this is the
+    #   one way to keep two subscription profiles from being treated as one account for lead-seat
+    #   counting AND for quarantine/cool-off grouping alike.
     # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
     # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
     # exhaustedPattern: "usage limit has been reached"   # opt-in: classify a usage-limit refusal (CB-578)
     # credentialId: shared-openai   # opt-in: quarantine together with every other profile sharing this id (CB-578)
+    # errorPattern: "503 Service Unavailable"   # opt-in: classify a backend outage (fleetd #201/#227) — see the key doc above
     # configDir: /Users/me/.ccs/instances/gx10   # CLAUDE_CONFIG_DIR — inherit that profile's skills/MCP
     # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
-    # parityOverlay: [".env", ".envrc"]   # the default; never add .mcp.json or .claude/settings.local.json — see above
+    # parityOverlay: [".env"]   # the default; add ".envrc" explicitly if you want it copied too (CB-148) — never add .mcp.json or .claude/settings.local.json — see above
     # ideMcpUrl: http://127.0.0.1:29170/index-mcp/streamable-http   # opt-in (CB-634): IDE code intelligence, pinned to the worktree
-    # ideProjectDir: bridged          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in bridged/)
+    # ideProjectDir: fleetd          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in fleetd/)
     # ideOpenCommand: env DISPLAY=:10.0 idea {dir}   # CB-634 auto-open: opens {dir} in the IDE at spawn; omit to open by hand
     # autoCompactWindow: 250000   # opt-in: bound member context; claude-code compacts AT this, opencode within it (model limit.context)
   gx11:                              # a second backend, so `placement: weighted` has a choice
     baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
     placement: tab
-    workspace: bridged-workers
+    workspace: fleetd-workers
     # tabLabel: an optional per-profile override; the fleet template usually covers it
     mcpUrl: http://127.0.0.1:8765/mcp
     argv: ["ccs", "gx11"]
@@ -298,7 +382,7 @@ profiles:
   #     kind: opencode
   #     model: opencode/north-mini-code-free  # `provider/model` selector, injected as `-m`
   #     placement: tab
-  #     workspace: bridged-workers
+  #     workspace: fleetd-workers
   #     tabLabel: "opencode: {profile} #{n}"
   #     mcpUrl: http://127.0.0.1:8765/mcp
   #     argv: ["opencode"]
@@ -323,7 +407,7 @@ profiles:
   #     baseUrl: http://127.0.0.1:8000
   #     model: local-vllm/deepseek-v4-flash
   #     placement: tab
-  #     workspace: bridged-workers
+  #     workspace: fleetd-workers
   #     tabLabel: "opencode: {profile} #{n}"
   #     mcpUrl: http://127.0.0.1:8765/mcp
   #     argv: ["opencode"]
@@ -358,11 +442,17 @@ placement: weighted
 # DEFERRED: baked once into the BackendQuarantine built at startup — a running quarantine keeps
 # its original cooldown regardless; a new value only applies to a quarantine that starts after a
 # restart. Editing this needs a daemon restart to take effect.
+#
+# This does NOT govern the fleetd #201 / #227 backend-error cool-off documented under errorPattern
+# above — that mechanism is a separate, shorter-lived, NOT-configurable policy (threshold 2 distinct
+# targets, 60-second window, 60-second cool-off), on purpose: it exists to survive a brief transient
+# fault, not to replace this 30-minute exhaustion quarantine. Do not conflate the two when reading
+# fleet_list/fleet_profiles — coolingOffForSeconds and quarantinedForSeconds are independent facts.
 # quarantineCooldownSeconds: 1800
 
 # Re-read this file without restarting the daemon (CB-559). Off unless you add this block, so an
-# upgraded bridged keeps the old behaviour: the file is read once at boot and never again.
-#   enabled          → turn the watch on. bridged checks the file's modified time on a timer and
+# upgraded fleetd keeps the old behaviour: the file is read once at boot and never again.
+#   enabled          → turn the watch on. fleetd checks the file's modified time on a timer and
 #                      reloads when it moves.
 #   intervalSeconds  → how often to check (default 10). One `stat` per tick, so this is cheap.
 #
@@ -384,8 +474,10 @@ placement: weighted
 #               stage B — baked once into the quarantine tracker built at startup), ADDING or
 #               REMOVING a profile (a new backend needs its own launcher, and launchers are built
 #               once), AND an existing profile's launch settings — model, baseUrl, argv, env,
-#               configDir, mcpUrl, tabLabel, exhaustedPattern. The launcher takes a copy of
-#               `profiles:` at startup and resolves every spawn out of that copy, so those never
+#               configDir, mcpUrl, tabLabel, exhaustedPattern, errorPattern (fleetd #201 / #227 —
+#               compiled once into a startup pattern map the same way exhaustedPattern is). The
+#               launcher takes a copy of `profiles:` at startup and resolves every spawn out of
+#               that copy, so those never
 #               reach a launch until you restart. The reload logs them by name rather than
 #               pretending they applied.
 #   COLD      → cannot change at all: `bind:`, `herdrSocket:`, `broker:` and `auth:`. The socket is
@@ -446,6 +538,23 @@ fleet:
   # recognised: give it a `profile:` and the daemon launches the shortfall when fewer than
   # `instances` are live. Omit `profile:` and it is recognise-only, as before.
   #
+  # `profile:` has a SECOND job as of fleetd #176, even for a recognise-only lead you never want
+  # auto-launched: it is also how fleetd learns which account this lead's own session shares. A
+  # `subscription: true` profile bills the operator's Claude account, and the lead itself is always
+  # a live `claude` session on that same account — `maxLoad` never counted that seat. If a lead
+  # entry here names a profile that shares a worker profile's account, `fleet_list` reports the
+  # lead's live seat(s) on that worker profile under `leadSeats` — informational only, as of fleetd
+  # #257 it is NEVER subtracted from `free` (see GOTCHA 3, next to `maxLoad:`, in THE WORKERS above,
+  # for why). "Shares the account" is decided by matching `effectiveCredentialId()`, which (fleetd
+  # #176 stage 2 — see THE SENTINEL, next to `credentialId:`, in THE WORKERS above) means: an
+  # explicit, matching `credentialId:` on both, OR — the common case, needing NO extra config — both
+  # being `subscription: true` with `credentialId` left unset, since those all share one implicit
+  # account-wide id. A lead on `opus` and workers on `sonnet` link automatically this way; they do
+  # NOT need the same profile name. Setting `profile:` on an already-running, recognise-only lead is
+  # safe — the daemon only launches the SHORTFALL below `instances`, so naming a profile here does
+  # not, by itself, start anything. Omit it and fleetd has no way to derive the sharing — there is
+  # no other reliable signal on the daemon's side — so that lead's seat never appears in `leadSeats`.
+  #
   # `tab:` (CB-579) is REQUIRED and is the only field identity depends on — the exact label of the
   # tab hosting the lead, matched case-insensitively. Label the tab yourself and put that same
   # string here, and the pane is recognised on the next rescan. Reopen the tab later, or the session
@@ -477,7 +586,7 @@ fleet:
   #     workspace: leads             # where a launched lead's tab is created (default "leads").
   #                                  # MUST NOT be a member workspace — those are excluded from the
   #                                  # scan, so a lead placed in one is never found again.
-  #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
+  #     cwd: /path/to/repo           # the launched lead's working directory (default: fleetd's own)
   #     kind: claude                 # descriptive; reported by fleet_whoami
   #   gpt-sol-5.6:
   #     tab: "lead: gpt-sol-5.6"
@@ -506,7 +615,7 @@ guard:
 
 # Member credential policy (CB-596, gitea issue #82). A herdr pane runs a LOGIN shell, and that
 # shell re-sources the operator's own secret store — so a spawned member inherits every credential
-# the operator's shell holds, not just the ones bridged means to give it. Measured on this host:
+# the operator's shell holds, not just the ones fleetd means to give it. Measured on this host:
 # 31 credential names, all set, with only ONE (GITEA_ACCESS_TOKEN) blocked before this — and that
 # block was a single name hardcoded in HerdrPeerLauncher.java, not driven by this file. This block
 # replaces that hardcoded shadow with a config-driven list of names.
@@ -567,20 +676,35 @@ guard:
 #            every name here NOT also in `allow` is overlaid with a non-secret sentinel value before
 #            the pane's login shell runs — real protection only for names that shell does not itself
 #            re-export (see the ROUND-2 CORRECTION note above). Under allow-list: reporting only.
-#   sshAuthSock → whether SSH_AUTH_SOCK may pass through under allow-list ("allow") or must be
-#            blanked like any other non-derived name ("block", the default). This is a decision you
-#            have to make explicitly: SSH_AUTH_SOCK is a handle to YOUR ssh-agent, and a member
-#            holding it can sign with your keys — it sits in no secret file and looks like no
-#            credential, which is why it slipped past three earlier tickets (gitea #110). Blocking
-#            it breaks git over SSH inside members (push/fetch authenticate as you); use HTTPS
-#            remotes or scoped deploy keys instead of allowing it lightly.
+#   sshAgentEnv → whether SSH_AUTH_SOCK may pass through under allow-list ("inherit") or is omitted
+#            from the member environment ("omit", the default). Omitting it only omits the
+#            inherited ssh-agent path. It discourages automatic use of the operator's agent.
+#            It does not deny same-user access to that socket. It also does not block SSH keys that
+#            are readable on disk. Git over SSH may still work from inside a member. Keep the block:
+#            it is correct and costs nothing, but it is not a control. A member runs as the same OS
+#            user as the lead. Inside one uid, ordinary Unix permissions provide no meaningful
+#            confidentiality boundary. A real boundary needs a different OS user or OS-level
+#            confinement, such as a container or VM. That is the open question in fleetd #184.
+#
+#            Still do not set this to "inherit" casually. SSH_AUTH_SOCK is a live handle to YOUR
+#            ssh-agent, so a member holding it can sign with EVERY key the agent holds. It sits in
+#            no secret file and looks like no credential, which is why it slipped past three
+#            earlier tickets (gitea #110). Blocking it does not contain a member, but allowing it
+#            hands one a signing capability for no gain — the block costs nothing, so keep it.
+#
+#            Both halves of this are measured, not argued. 2026-08-28: a member with
+#            SSH_AUTH_SOCK blanked pushed to the forge over SSH successfully, because `ssh -G`
+#            resolves an IdentityFile outside ~/.ssh that is readable and has no passphrase. An
+#            earlier version of this comment claimed blocking the socket BREAKS git over SSH. It
+#            does not. That claim came from looking only in ~/.ssh, which holds nothing but four
+#            `Include` lines — looking in one place and concluding about the whole host.
 #
 # HOT-RELOADABLE the same way `fleet:` is (CB-559): read fresh on every spawn, so editing this list
 # and reloading config (or restarting) changes what the NEXT spawn inherits; already-running members
 # are unaffected either way.
 # memberCredentials:
 #   policy: deny-by-default        # or "deny-list", or "allow-list" (CB-633) — see above
-#   sshAuthSock: block             # allow-list only; see the sshAuthSock note above
+#   sshAgentEnv: omit              # allow-list only; see the sshAgentEnv note above
 #   allow:
 #     - AI_GATEWAY_TOKEN     # named in a profile's tokenEnv (local/gx) — a member reaching the
 #                            # gateway is by design, not a leak
@@ -632,6 +756,24 @@ guard:
 # to a sibling directory of the repo root.
 # worktreeRoot: /Users/me/src/.bridged-worktrees
 
+# Worktree group sharing (fleetd #185 stage 3). OPTIONAL, off by default. Names an OS group
+# that a provisioned worktree's repo is made group-writable for (git config
+# core.sharedRepository group, plus a one-time chgrp/chmod/setgid fix-up), so a member spawned
+# under a DIFFERENT OS user (see memberHerdrSocket) can write its own worktree, its
+# per-worktree git metadata, and its own commit objects — without it, every file GitWorktrees
+# creates is owned by fleetd's own uid and unwritable by another user.
+# CAUTION: this isolates credentials, not the repository — a member in the group can still
+# write the operator's git objects and refs in the shared repo. The operator running fleetd
+# must already be a member of the named group, or every provisioning spawn fails loudly.
+#
+# fleetd #213: this is also the ONE group the memberCredentials.policy: allow-list ZDOTDIR scrub
+# reuses when memberHerdrSocket is set — deliberately not a second config key. Under
+# memberHerdrSocket, the scrub directory is generated under worktreeRoot (never java.io.tmpdir,
+# which the member OS user cannot reach) and shared read-only with this group. If worktreeGroup
+# is unset while memberHerdrSocket is set, the scrub cannot be guaranteed reachable by the member,
+# so fleetd falls back to the weaker CB-596 sentinel overlay instead (a WARN names the gap).
+# worktreeGroup: fleet-workers
+
 # Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
 # the feature disabled. By default the daemon never reaps, caps, or drains sessions.
 #   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)
@@ -695,7 +837,7 @@ guard:
 #
 #                    REQUIRED (CB-522) if the primary itself runs inside a herdr pane. Caller
 #                    identity resolves a loopback PID to its herdr pane, and PaneLocator scans
-#                    EVERY pane — not just bridged-spawned ones — so such a primary is otherwise
+#                    EVERY pane — not just fleetd-spawned ones — so such a primary is otherwise
 #                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
 #                    self-locking: the learned terminal is populated by the very orchestration
 #                    calls being refused, so only this pinned value can break the cycle. Read the

fleetd/pom.xml

@@ -28,6 +28,8 @@
         <testcontainers.version>1.20.4</testcontainers.version>
         <commons-compress.version>1.27.1</commons-compress.version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
+        <sqlite-jdbc.version>3.53.4.0</sqlite-jdbc.version>
+        <archunit.version>1.5.0</archunit.version>
     </properties>
 
     <!--
@@ -44,6 +46,12 @@
           3.0-rc5; bumping Jackson 3 to the patched 3.2.x breaks the SDK (annotation mismatch).
           Only the loopback /mcp endpoint parses this JSON, from trusted local Claude clients.
       The 11.0.23 -> 11.0.25 bump did clear jetty CVE-2024-8184 (5.9) and CVE-2024-6763.
+
+      fleetd #206: org.xerial:sqlite-jdbc 3.53.4.0 (added for OpenCodeSessionDiscovery) — the
+      only known advisory against this artifact is CVE-2023-32697 (RCE via an attacker-controlled
+      JDBC URL), fixed in 3.41.2.2; 3.53.4.0 is well past that fix and OSV.dev reports no open
+      advisory against it. Checked via the OSV.dev API (no Mend.io/JetBrains IDE MCP mount
+      available from this worktree) on 2026-08-31.
     -->
 
     <!-- Force the latest patched Jetty 11.x across all Javalin-pulled Jetty modules (no version
@@ -106,7 +114,7 @@
         </dependency>
 
         <!-- MCP server: the SERVER face. Streamable-HTTP servlet mounted on Javalin's Jetty at
-             /mcp, exposing bridge_send/bridge_reply/bridge_status as thin adapters over REST. -->
+             /mcp, exposing fleet_send/fleet_reply/fleet_status as thin adapters over REST. -->
         <dependency>
             <groupId>io.modelcontextprotocol.sdk</groupId>
             <artifactId>mcp</artifactId>
@@ -123,6 +131,17 @@
             <version>${amqp.version}</version>
         </dependency>
 
+        <!-- fleetd #206: opencode moved its session store from a JSON tree to SQLite
+             (opencode.db). This is the JDBC driver OpenCodeSessionDiscovery uses to read it
+             read-only. Ships bundled native libraries (linux/mac/windows, several archs), so it
+             is a heavier jar than most deps here — see the pom's dependency-security note below
+             for the size/CVE tradeoff actually measured. -->
+        <dependency>
+            <groupId>org.xerial</groupId>
+            <artifactId>sqlite-jdbc</artifactId>
+            <version>${sqlite-jdbc.version}</version>
+        </dependency>
+
         <!-- Logging -->
         <dependency>
             <groupId>org.slf4j</groupId>
@@ -158,13 +177,21 @@
             <version>${testcontainers.version}</version>
             <scope>test</scope>
         </dependency>
+
+        <!-- fleetd #131: package-boundary and cycle enforcement (PackageCyclesTest). -->
+        <dependency>
+            <groupId>com.tngtech.archunit</groupId>
+            <artifactId>archunit-junit5</artifactId>
+            <version>${archunit.version}</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
-        <!-- CB-632: stays 'bridged' until the cutover renames the module dir and the launchd
-         plist together. The installed plist names bridged/target/bridged.jar and
-         KeepAlive is armed, so renaming the jar alone strands a restart. -->
-        <finalName>bridged</finalName>
+        <!-- CB-634: the cutover renamed the module dir (bridged/ -> fleetd/), the jar, and the
+         launchd plist together. The installed plist names fleetd/target/fleetd.jar and
+         KeepAlive is armed, so this name, the plist, and the wrapper must move as one. -->
+        <finalName>fleetd</finalName>
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -206,7 +233,7 @@
                 </configuration>
             </plugin>
 
-            <!-- Runnable fat jar: java -jar target/bridged.jar -->
+            <!-- Runnable fat jar: java -jar target/fleetd.jar -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -7,11 +7,14 @@ import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.HerdrRouter;
 import dev.ltms.fleet.herdr.LeadTabScanner;
 import dev.ltms.fleet.lead.LeadLauncher;
 import dev.ltms.fleet.herdr.PaneLocator;
 import dev.ltms.fleet.herdr.UnixSocketHerdrClient;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.BackendErrorPatternLookup;
+import dev.ltms.fleet.inject.BackendErrorSink;
 import dev.ltms.fleet.inject.CompletionResolver;
 import dev.ltms.fleet.inject.ExhaustedPatternLookup;
 import dev.ltms.fleet.inject.ExhaustionSink;
@@ -48,7 +51,9 @@ import dev.ltms.fleet.session.SessionReaper;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
 import dev.ltms.fleet.member.CompositePeerLauncher;
 import dev.ltms.fleet.member.HerdrPeerLauncher;
+import dev.ltms.fleet.member.MemberCredentialPolicyView;
 import dev.ltms.fleet.member.OpenCodeLauncher;
+import dev.ltms.fleet.placement.BackendOutagePolicy;
 import dev.ltms.fleet.placement.BackendQuarantine;
 import io.javalin.Javalin;
 import org.slf4j.Logger;
@@ -60,7 +65,7 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
@@ -70,12 +75,11 @@ import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;
 
 /**
- * {@code bridged} entry point. Wires the real herdr socket client to the REST app and
+ * {@code fleetd} entry point. Wires the real herdr socket client to the REST app and
  * starts listening. Before anything else it asserts its own environment is clean —
- * {@code bridged} is not a Claude process and must never carry a base_url.
+ * {@code fleetd} is not a Claude process and must never carry a base_url.
  */
 public final class Fleetd {
 
@@ -94,9 +98,10 @@ public final class Fleetd {
     private static final long HERDR_WAIT_POLL_MILLIS = 500;
 
     /**
-     * CB-632: prefer {@code fleetd.yaml} in {@code dir}; fall back to {@code bridged.yaml} when
-     * the new name is not there. The operator's live file is still named {@code bridged.yaml},
-     * so the old name keeps working until that file moves.
+     * CB-632/CB-634: prefer {@code fleetd.yaml} in {@code dir}; fall back to the legacy
+     * {@code bridged.yaml} when the new name is not there. The product renamed to {@code fleetd},
+     * but a deployment whose local config file is still {@code bridged.yaml} keeps working until
+     * that file is renamed.
      */
     static Path chooseDefaultConfigFile(Path dir) {
         Path fleetd = dir.resolve("fleetd.yaml");
@@ -108,14 +113,15 @@ public final class Fleetd {
 
     static void main(String[] args) {
         Path configPath = args.length > 0 ? Path.of(args[0]) : chooseDefaultConfigFile(Path.of(""));
-        // CB-632: the config file is being renamed bridged.yaml -> fleetd.yaml. Name the file we
-        // actually loaded, whichever of the two names it carries.
+        // The config file was renamed bridged.yaml -> fleetd.yaml. Name the file we actually
+        // loaded, whichever of the two names it carries.
         log.info("Using configuration file {}", configPath);
         FleetConfig cfg = FleetConfig.load(configPath);
         // CB-594: report which secret env vars the config actually needs, by name, before anything
         // else can fail on a silently-empty one. A daemon started without a login shell (launchd)
         // boots fine either way — this is the only thing that says so out loud.
         reportRequiredSecrets(cfg);
+        reportMemberTrustModel(cfg);
         // CB-596: an absent (or empty) memberCredentials: block blocks NOTHING — no credential
         // name is hardcoded any more to fall back on. Say so loudly, the same way a missing
         // secret is reported above, so upgrading past this commit never silently drops CB-592's
@@ -127,7 +133,7 @@ public final class Fleetd {
         // contract; adding a reader here does not make a key reloadable by itself.
         ConfigRef config = new ConfigRef(configPath, cfg);
 
-        // The primary/host env that launched bridged must not be tainted.
+        // The primary/host env that launched fleetd must not be tainted.
         SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
         guard.assertPrimaryClean(System.getenv());
 
@@ -150,9 +156,12 @@ public final class Fleetd {
                 : UnixSocketHerdrClient.defaultSocketPath();
 
         UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect(socket, new com.fasterxml.jackson.databind.ObjectMapper());
-
-        AgentControl agents = new AgentControl(herdr);
-        WorkspaceControl spaces = new WorkspaceControl(herdr);
+        UnixSocketHerdrClient memberHerdr = cfg.memberHerdrSocket() != null && !cfg.memberHerdrSocket().isBlank()
+                ? UnixSocketHerdrClient.connect(Path.of(cfg.memberHerdrSocket()), new com.fasterxml.jackson.databind.ObjectMapper())
+                : herdr;
+        AtomicReference<Supplier<Map<String, String>>> leadsRef = new AtomicReference<>(Map::of);
+        HerdrRouter router = new HerdrRouter(herdr, memberHerdr,
+                target -> leadsRef.get().get().containsKey(target));
         // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
         // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
         // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
@@ -166,22 +175,34 @@ public final class Fleetd {
             }
         });
         List<HerdrPeerLauncher> adapters = new ArrayList<>();
+        // fleetd #175: the daemon's real ExhaustionSink can only be built once `sessions` exists
+        // (below), but `sessions` needs `workers`, which needs the adapters built right here — a
+        // genuine cycle. Break it exactly like liveCountRef below: a forwarding sink built now,
+        // pointed at the real one once it exists.
+        AtomicReference<ExhaustionSink> exhaustionSinkRef = new AtomicReference<>(ExhaustionSink.none());
+        // fleetd #234, round 4: routed through the shared ExhaustionSink.forwardingTo factory
+        // rather than written inline here — not because a lambda at this call site is unsafe
+        // anymore (it is not: the 3-arg overload is now the interface's single abstract method, so
+        // there is no 2-arg overload left for any lambda to silently bind to instead), but so a
+        // test can call the exact same object this line builds, instead of asserting a copy of its
+        // shape (round 3's lesson).
+        ExhaustionSink forwardingExhaustionSink = ExhaustionSink.forwardingTo(exhaustionSinkRef::get);
         // The claude-code adapter is the always-present default; keep it even with no profiles (so a
         // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
         // unless opencode is the only kind configured.
         if (!claudeProfiles.isEmpty() || opencodeProfiles.isEmpty()) {
-            adapters.add(new ClaudeCodeLauncher(agents, spaces, guard,
+            adapters.add(new ClaudeCodeLauncher(router.memberAgents(), router.memberSpaces(), guard,
                     claudeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                     () -> config.get().fleet(),
-                    () -> config.get().memberCredentials()));
+                    () -> config.get().memberCredentials(), null, config::get));
         }
         if (!opencodeProfiles.isEmpty()) {
-            adapters.add(new OpenCodeLauncher(agents, spaces,
+            adapters.add(new OpenCodeLauncher(router.memberAgents(), router.memberSpaces(),
                     opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                     () -> config.get().fleet(),
-                    () -> config.get().memberCredentials()));
+                    () -> config.get().memberCredentials(), config::get, forwardingExhaustionSink));
         }
         AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
         // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
@@ -190,13 +211,19 @@ public final class Fleetd {
         // here, at startup, and a config reload only changes it for a daemon restart.
         BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
                 TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
+        // fleetd #201 Unit 5: one outage-cool-off tracker for the whole daemon, shared between the
+        // launcher (checked at spawn, like `quarantine` above) and the backend-error sink wired in
+        // below (written on a classified backend error). A SEPARATE, shorter-lived mechanism from
+        // `quarantine` — see BackendOutagePolicy's class doc — never merged with it.
+        BackendOutagePolicy outagePolicy = new BackendOutagePolicy(System::nanoTime);
         PeerLauncher workers = new CompositePeerLauncher(
                 adapters,
                 cfg.effectiveDefaultProfile(),
                 config,
                 profileName -> liveCountRef.get().apply(profileName),
-                quarantine);
-        // CB-504: under supervision (launchd/systemd) bridged can start before herdr's socket
+                quarantine,
+                outagePolicy);
+        // CB-504: under supervision (launchd/systemd) fleetd can start before herdr's socket
         // exists. The client itself is lazy — it connects per call — but the orphan reap below is
         // the first thing that actually talks to herdr, so without this wait a boot-order race
         // would crash the daemon into a restart loop. Wait, then degrade rather than die: serving
@@ -221,11 +248,9 @@ public final class Fleetd {
             contextCap = cfg.lifecycle().contextCap();
         }
         boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup()),
                 System::nanoTime, contextCap, clearAfterTurn);
-        liveCountRef.set(profileName -> (int) sessions.roster().stream()
-                .filter(s -> profileName.equals(s.profile()))
-                .count());
+        liveCountRef.set(profileName -> liveSessionCount(sessions.roster(), profileName));
 
         // CB-303 part 1: idle-ttl reaper — only when configured, defaults to disabled.
         final SessionReaper reaper;
@@ -255,34 +280,39 @@ public final class Fleetd {
         final Supplier<Map<String, String>> leads;
         var leaders = cfg.fleet().leaders();
         if (!leaders.isEmpty()) {
-            Set<String> memberSpaces = cfg.profiles().values().stream()
-                    .map(FleetConfig.Profile::workspace)
-                    .filter(Objects::nonNull)
-                    .collect(Collectors.toSet());
             Map<String, String> tabToName = new LinkedHashMap<>();
             leaders.forEach((name, leader) -> {
                 if (leader != null && leader.tab() != null && !leader.tab().isBlank()) {
                     tabToName.put(leader.tab(), name);
                 }
             });
+            // The lead and the members now share ONE workspace (the operator asked for a single
+            // "session" with many tabs), so no workspace can be excluded — the lead lives in the
+            // members' space by design. A lead is told from a member by its exact tab label alone:
+            // a lead carries its configured `tab`, a member its `worker: {profile} #{n}` template,
+            // and the two never collide. (The scanner still supports an exclusion set for a split
+            // layout; the fleet's policy here is simply not to use one.)
+            //
             // One shared rescan cadence: still taken from the first entry, as before — it is an
             // operational cadence, not identity, so there is no correctness reason to give every
             // lead its own scanner.
             int scanIntervalSeconds = leaders.values().iterator().next().scanIntervalSeconds();
-            leads = new LeadTabScanner(herdr, tabToName, memberSpaces,
+            // This must use the lead daemon: scanning member tabs would demote the lead to a worker.
+            leads = new LeadTabScanner(herdr, tabToName, Set.of(),
                     TimeUnit.SECONDS.toNanos(scanIntervalSeconds), System::nanoTime);
-            log.info("lead scan: tabs {} host a lead (rescan every {}s, member spaces {} excluded)",
-                    tabToName.keySet(), scanIntervalSeconds, memberSpaces);
+            log.info("lead scan: tabs {} host a lead (rescan every {}s, shared fleet space)",
+                    tabToName.keySet(), scanIntervalSeconds);
         } else {
             leads = () -> leadTerminals;
         }
+        leadsRef.set(leads);
 
         // CB-558: start any declared lead that is not already running. After the scanner is built,
         // because both read the same tab labels and the ordering makes that dependency visible; and
         // only when herdr answered, because the launcher's whole safety property is that it can
         // count live leads first — it must never guess and risk a second orchestrator.
         if (herdrUp && !leaders.isEmpty()) {
-            int launched = new LeadLauncher(agents, spaces, cfg).ensureLeads();
+            int launched = new LeadLauncher(router.leadAgents(), router.leadSpaces(), cfg).ensureLeads();
             if (launched > 0) {
                 log.info("lead auto-launch: {} lead(s) started", launched);
             }
@@ -321,24 +351,100 @@ public final class Fleetd {
                 .map(session -> exhaustedPatternsByProfile.get(session.profile()))
                 .orElse(null);
         log.info("backend-exhausted classification (CB-578 stage A): {}",
-                CompletionResolver.coverage(cfg.profiles().keySet(), exhaustedPatternsByProfile.keySet()));
+                CompletionResolver.coverage("exhaustedPattern", cfg.profiles().keySet(),
+                        exhaustedPatternsByProfile.keySet()));
+        // fleetd #201 Unit 5: classify a completion-fallback scrape that matches a profile's
+        // configured backend-error refusal (a credential outage, a provider 5xx) as a backend error
+        // rather than handing it back as a real answer. Compiled once at startup, keyed by profile
+        // name, mirroring exhaustedPatternsByProfile above — a profile with no configured
+        // errorPattern is simply absent here, so CompletionResolver falls back to its built-in
+        // narrow {@code (?i)\bAPI Error\s*:} compatibility pattern for that profile's targets
+        // (BackendErrorPatternLookup#legacy's contract — see backendErrorPatterns below).
+        Map<String, Pattern> errorPatternsByProfile = new LinkedHashMap<>();
+        cfg.profiles().forEach((name, profile) -> {
+            if (profile.hasErrorPattern()) {
+                errorPatternsByProfile.put(name, Pattern.compile(profile.errorPattern()));
+            }
+        });
+        // fleetd #248: extracted to a static factory (see backendErrorPatternLookup below) so a
+        // test can prove main() actually PASSES this into CompletionResolver, not only that the
+        // lookup itself behaves correctly — the exact gap fleetd #248 exists to close.
+        BackendErrorPatternLookup backendErrorPatterns = backendErrorPatternLookup(sessions::roster,
+                errorPatternsByProfile);
+        log.info("backend-error classification (fleetd #201 Unit 5): {}",
+                CompletionResolver.coverage("errorPattern", cfg.profiles().keySet(),
+                        errorPatternsByProfile.keySet()));
         // CB-578 stage B: on a classification that actually wins, quarantine the exhausted profile's
         // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
         // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
         // the profile config live off `config`, so a credentialId edit is hot: no restart needed.
-        ExhaustionSink exhaustionSink = (target, reason) -> sessions.roster().stream()
-                .filter(session -> target.equals(session.terminalId()))
-                .findFirst()
-                .map(MemberSession::profile)
-                .map(profileName -> config.get().profiles().get(profileName))
-                .ifPresent(profile -> {
-                    String credentialId = profile.effectiveCredentialId();
-                    quarantine.quarantine(credentialId);
-                    log.warn("credential '{}' quarantined for {}s (profile '{}' classified "
-                                    + "BACKEND_EXHAUSTED): {}", credentialId,
-                            cfg.quarantineCooldownSeconds(), profile.profile(), reason);
-                });
-        CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns, exhaustionSink);
+        //
+        // fleetd #175: this sink is now also the quarantine target for OpenCodeLauncher's
+        // model-mismatch check — it needs nothing profile-specific from the caller beyond `target`
+        // (a herdr terminal id) and `reason`, so reusing it here is exactly "the existing
+        // ExhaustionSink path", not a new mechanism.
+        //
+        // fleetd #234: that check fires from SessionAwareHandle.agentSessionId(), which runs during
+        // SessionManager.acquire() BEFORE this session is registered in sessions.roster() — so the
+        // roster-only lookup below used to find nothing, .ifPresent silently no-op'd, and the
+        // ERROR the check had just logged ("quarantining this profile's credential") was a lie:
+        // nothing was quarantined, and nothing said so. Two changes: (1) OpenCodeLauncher now
+        // passes its OWN profile name via ExhaustionSink's 3-arg overload — it already has the
+        // FleetConfig.Profile in hand and does not need the roster at all — used here as a
+        // fallback whenever the roster lookup misses; (2) if a profile still cannot be resolved
+        // (neither the roster nor the hint names a configured one), this logs loudly at ERROR
+        // instead of silently doing nothing — a control that cannot act must say so.
+        // fleetd #234, round 4: the 3-arg overload is now ExhaustionSink's single abstract method,
+        // so this is safely a lambda — there is no separate 2-arg overload left for it to bind to
+        // instead and silently drop profileHint (that was rounds 1-3's whole hazard).
+        ExhaustionSink exhaustionSink = (target, reason, profileHint) -> {
+            String profileName = sessions.roster().stream()
+                    .filter(session -> target.equals(session.terminalId()))
+                    .findFirst()
+                    .map(MemberSession::profile)
+                    .orElse(profileHint);
+            FleetConfig.Profile profile = profileName == null ? null : config.get().profiles().get(profileName);
+            if (profile == null) {
+                log.error("quarantine requested for target '{}' ({}) but no profile could be "
+                                + "resolved — the target is not (yet) in the roster, and {} — "
+                                + "credential NOT quarantined (fleetd #234)",
+                        target, reason,
+                        profileHint == null ? "no profile hint was given"
+                                : "the hinted profile '" + profileHint + "' is not configured");
+                return;
+            }
+            String credentialId = profile.effectiveCredentialId();
+            quarantine.quarantine(credentialId);
+            log.warn("credential '{}' quarantined for {}s (profile '{}'): {}", credentialId,
+                    cfg.quarantineCooldownSeconds(), profile.profile(), reason);
+        };
+        // fleetd #175: point the forwarding sink handed to OpenCodeLauncher above at the real one,
+        // now that `sessions` exists to resolve target -> session -> profile.
+        exhaustionSinkRef.set(exhaustionSink);
+        // fleetd #201 Unit 5: the production BackendErrorSink needs `pushLoop` (built further below,
+        // after `sessions`) to tell a lead about an incident or an unmapped target — the same
+        // construction-order cycle `exhaustionSinkRef` breaks above, broken the same way: a mutable
+        // holder set once `pushLoop` exists, read lazily from inside the lambda built here.
+        AtomicReference<ReplyPushLoop> pushLoopRef = new AtomicReference<>();
+        // fleetd #248: extracted to a static factory (see backendErrorSink below), public rather
+        // than package-private like the other two factories here, so
+        // dev.ltms.fleet.inject.BackendOutageFlowTest can exercise the REAL production sink
+        // directly instead of a hand-mirrored copy of this lambda — that copy was precisely the
+        // gap fleetd #248 exists to close (see that test's class doc for the history).
+        BackendErrorSink backendErrorSink = backendErrorSink(sessions, () -> config.get().profiles(),
+                outagePolicy, pushLoopRef::get);
+        AgentControl agents = router.memberAgents();
+        // Both fleetd#201 Unit 5 (backend-error patterns + sink) and fleetd#241 (the worktree/branch
+        // lookup the fallback report names) land on this one call. The full constructor takes both,
+        // so neither feature is dropped; nowNanos must be passed explicitly to reach it.
+        //
+        // fleetd #248: every argument built specifically for this call (backendErrorPatterns and
+        // backendErrorSink above, and the worktree/branch lookup right here) now comes from a
+        // static factory tested on its own; FleetdCompletionResolverWiringTest source-asserts that
+        // THIS call actually passes them, which is the coverage that was missing before.
+        CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns,
+                exhaustionSink, backendErrorPatterns, backendErrorSink, System::nanoTime,
+                worktreeBranchLookup(sessions::roster));
         // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
         // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
         MemberPresence presence = sessions.asPresence();
@@ -378,13 +484,14 @@ public final class Fleetd {
                 sessions.onTurnFailed(target);
             }
         };
-        Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
+        Predicate<String> deliverable = deliverableTo(presence, leads);
+        Injector injector = new Injector(router, turnListener, deliverable,
                 presence::forget);
-        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
+        StatusPoller poller = new StatusPoller(router, injector, Injector.POLL_INTERVAL_MILLIS);
         poller.start();
 
         // CB-307: reply inbox. A broker: block selects the AMQP-backed durable adapter; absent (or
-        // unusable), bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
+        // unusable), fleetd stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
         // connection, so keep the reference to close it in the ordered shutdown hook.
         final ReplyInbox replyInbox = selectReplyInbox(cfg.broker(), System.getenv(), AmqpReplyInbox::open);
         // CB-637: this daemon's lead-to-lead mailbox on the SHARED coordination vhost — a separate
@@ -417,8 +524,11 @@ public final class Fleetd {
         // are counted at their single funnel rather than at each of the two caller-facing surfaces.
         // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
         Metrics metrics = FleetMetrics.create(sessions, replyInbox);
-        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
+        var pushLoop = new ReplyPushLoop(primaryRegistry, router.leadAgents(), replyInbox,
                 pushScheduler, maxReminders, backoffMs, metrics);
+        // fleetd #201 Unit 5: point the forwarding holder captured by the backendErrorSink lambda
+        // above at the real push loop, now that it exists.
+        pushLoopRef.set(pushLoop);
         // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
         // an upgraded daemon cannot silently start spending subscription on nudging an idle lead.
         // It has its own single-thread scheduler and holds its own scheduler shutdown via close().
@@ -427,7 +537,7 @@ public final class Fleetd {
                 Thread.ofVirtual().name("bridge-heartbeat-").unstarted(r));
         if (cfg.leadHeartbeat() != null) {
             var hb = cfg.leadHeartbeat();
-            heartbeat = new LeadHeartbeatLoop(primaryRegistry, agents, replyInbox, sessions::roster,
+            heartbeat = new LeadHeartbeatLoop(primaryRegistry, router.leadAgents(), replyInbox, sessions::roster,
                     pushLoop, heartbeatScheduler, System::nanoTime,
                     TimeUnit.SECONDS.toNanos(hb.idleAfterSeconds()), hb.backoffMs(), hb.quietNudgeCap(),
                     metrics);
@@ -436,7 +546,7 @@ public final class Fleetd {
             heartbeat = null;
             heartbeatScheduler.shutdownNow();
         }
-        MessageService messages = new MessageService(agents, injector, rendezvous, replyInbox,
+        MessageService messages = new MessageService(router, injector, rendezvous, replyInbox,
                 pushLoop, metrics);
 
         // Health is a slow whole-fleet observer. Keep it separate from the 250ms delivery poller.
@@ -447,7 +557,8 @@ public final class Fleetd {
             // CB-580: a member found GONE/NEVER_READY must fail whatever ticket is waiting on it,
             // through the same idempotent target-wide operation CB-516 already uses on release.
             healthMonitor = new FleetHealthMonitor(agents, sessions::roster, messages, healthScheduler,
-                    System::nanoTime, cfg.health().intervalOrDefault(), messages::abandon);
+                    System::nanoTime, cfg.health().intervalOrDefault(),
+                    cfg.health().workingSuspectAfterOrDefault(), messages::abandon);
             String coverage = FleetHealthMonitor.coverage(true,
                     cfg.health().notifications() != null && cfg.health().notifications().configured());
             if ("detection-only".equals(coverage)) {
@@ -480,15 +591,22 @@ public final class Fleetd {
             if (detail.agentSessionId() != null) {
                 reason += " agentSessionId=" + detail.agentSessionId();
             }
-            messages.abandon(detail.terminalId(), reason);
+            // fleetd #275: this is an explicit teardown (fleet_stop, or the idle reaper) — the
+            // worker's pane is being stopped right now, so an open fleet_ask has no turn left to
+            // resume into. Sweep it too, unlike FleetHealthMonitor's health-classification call
+            // (see MessageService.abandon's javadoc for why those two must differ).
+            messages.abandon(detail.terminalId(), reason, true);
             replyInbox.release(detail.terminalId());
             primaryRegistry.forgetDelegation(detail.terminalId()); // CB-532: don't leak the lead binding
         });
 
         // MCP server face (CB-105): fleet_send/fleet_reply/fleet_status, mounted at /mcp.
         // Caller identity is resolved from the connection (peer PID → herdr pane), not arguments.
+        // CB-185: a caller's pane can live on either daemon (a lead's on the lead daemon, a
+        // member's on the member daemon) — search both, lead first. Collapses to one scan when
+        // memberHerdrSocket is unset (herdr == memberHerdr).
         ConnectionIdentity identity = new ConnectionIdentity(
-                new PaneLocator(herdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
+                new PaneLocator(herdr, memberHerdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
 
         // CB-501: one resolver behind both entry paths. Worker identity still comes from the
         // connection and is never token-gated, so enabling token mode cannot lock the fleet out.
@@ -497,7 +615,7 @@ public final class Fleetd {
             String token = System.getenv(cfg.auth().tokenEnv());
             if (token == null || token.isBlank()) {
                 throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
-                        + " is unset or empty — export it before starting bridged");
+                        + " is unset or empty — export it before starting fleetd");
             }
             callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
             log.info("auth: token mode (bearer required for non-worker callers, env {})",
@@ -507,6 +625,19 @@ public final class Fleetd {
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 
+        // fleetd #297: named once and reused verbatim below for FleetApp's GET /profiles, rather than
+        // built a second time — two independently-constructed sources reading the SAME BackendQuarantine
+        // / BackendOutagePolicy would still be able to drift (e.g. a future edit to the credentialIdFor
+        // closure in only one of the two places), exactly the shape #284 was.
+        FleetMcp.QuarantineSource quarantineSource = new FleetMcp.QuarantineSource(profile -> {
+            var configured = config.get().profiles().get(profile);
+            return configured == null ? null : configured.effectiveCredentialId();
+        }, quarantine);
+        FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(profile -> {
+            var configured = config.get().profiles().get(profile);
+            return configured == null ? null : configured.effectiveCredentialId();
+        }, outagePolicy);
+
         FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
                 primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
                 profile -> {
@@ -518,11 +649,10 @@ public final class Fleetd {
                     return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
                             health != null && health.notifications() != null && health.notifications().configured());
                 }),
-                new FleetMcp.QuarantineSource(profile -> {
-                    var configured = config.get().profiles().get(profile);
-                    return configured == null ? null : configured.effectiveCredentialId();
-                }, quarantine),
-                leadMailbox);
+                quarantineSource,
+                leadMailbox,
+                outageSource,
+                new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), leaders, leads)));
 
         // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
         // coordinator (or an unreachable one) there is nothing to deliver, so no scheduler is
@@ -534,7 +664,7 @@ public final class Fleetd {
         if (leadMailbox != null) {
             var leadCoordScheduler = Executors.newSingleThreadScheduledExecutor(r ->
                     Thread.ofVirtual().name("bridge-leadcoord-").unstarted(r));
-            leadCoordLoop = new LeadCoordLoop(leadMailbox, agents, leads, leadCoordScheduler,
+            leadCoordLoop = new LeadCoordLoop(leadMailbox, router.leadAgents(), leads, leadCoordScheduler,
                     LEAD_COORD_INTERVAL_MS);
             leadCoordLoop.start();
             leadCoordSchedulerRef = leadCoordScheduler;
@@ -585,13 +715,21 @@ public final class Fleetd {
                     log.debug("lead mailbox close: {}", e.toString());
                 }
             }
-            herdr.close();
+            router.close();
         }));
 
-        Javalin app = new FleetApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
-                callers, metrics).build();
+        // CB-185: give FleetApp both daemons — /healthz must require both to answer and
+        // GET /sessions must merge across both, or a down/unpolled member daemon is invisible.
+        // fleetd #111: live (re-read-per-request) memberCredentials view for GET /member-credentials —
+        // same hot-reload shape as the memberCredentials supplier passed to ClaudeCodeLauncher above.
+        // fleetd #297: quarantineSource/outageSource are the SAME instances passed to FleetMcp above —
+        // GET /profiles must report the identical quarantine/cool-off facts as fleet_profiles.
+        Javalin app = new FleetApp(herdr, memberHerdr, workers, sessions, messages, presence, mcp.servlet(),
+                callers, metrics, deliverable,
+                () -> MemberCredentialPolicyView.of(config.get().memberCredentials()),
+                quarantineSource, outageSource).build();
         app.start(cfg.bind().host(), cfg.bind().port());
-        log.info("bridged listening on {}:{}, herdr socket {}",
+        log.info("fleetd listening on {}:{}, herdr socket {}",
                 cfg.bind().host(), cfg.bind().port(), socket);
     }
 
@@ -618,6 +756,198 @@ public final class Fleetd {
         return target -> presence.isPresent(target) || leads.get().containsKey(target);
     }
 
+    /**
+     * fleetd #248: package-private factory for the member worktree/branch lookup {@link
+     * CompletionResolver} uses to name a fallback report's worktree and branch (fleetd#241).
+     *
+     * <p>Before this ticket the lookup was an anonymous lambda built inline inside {@code main}'s
+     * {@code CompletionResolver} constructor call — provably untested wiring, the whole reason
+     * fleetd #248 exists: dropping that one argument (passing {@code _ -> null} instead) compiled
+     * clean and left every test green. Extracted here, {@code main} now calls this factory instead
+     * of building the lambda inline, and a source assertion on that call site
+     * ({@code FleetdCompletionResolverWiringTest}) proves the argument is still actually passed.
+     *
+     * <p>Takes the roster as a plain {@link Supplier} — not a {@link SessionManager} — so this is
+     * directly testable with a hand-built session list; no real {@code SessionManager} (launcher,
+     * worktrees, …) needs constructing. Follows the same {@code static} factory pattern as
+     * {@link #deliverableTo} above.
+     *
+     * @param roster the live member roster, normally {@code sessions::roster}
+     */
+    static Function<String, CompletionResolver.WorktreeBranch> worktreeBranchLookup(
+            Supplier<List<MemberSession>> roster) {
+        return target -> roster.get().stream()
+                .filter(session -> target.equals(session.terminalId()))
+                .findFirst()
+                .map(session -> new CompletionResolver.WorktreeBranch(session.worktree(), session.branch()))
+                .orElse(null);
+    }
+
+    /**
+     * fleetd #176: per-profile factory for {@link FleetMcp.LeadSeatSource} — how many seats a
+     * profile's own live LEAD session(s) hold on the same Claude subscription.
+     *
+     * <p>{@code maxLoad} counts only members; the lead itself is a live {@code claude} session that
+     * is never moved off-subscription ({@code LeadLauncher} strips {@code ANTHROPIC_BASE_URL}/
+     * {@code AUTH_TOKEN} from a lead's env whatever its profile says), so a {@code subscription:
+     * true} profile's real ceiling is lower than its configured {@code maxLoad} by exactly the
+     * number of lead seats sharing that same account.
+     *
+     * <p><b>The derivation, and why this route was chosen over a new config key.</b> The link is
+     * {@code fleet.leaders.<name>.profile} — the field the operator already sets to name which
+     * {@code profiles:} entry a lead runs on (CB-557; see {@code fleetd.example.yaml}) — matched
+     * against the profile passed in here via {@link FleetConfig.Profile#effectiveCredentialId()},
+     * the same grouping key {@link dev.ltms.fleet.placement.BackendQuarantine} already uses to say
+     * two profiles share one account. Nothing new is added to the config schema: this reuses a field
+     * that already exists and already means "the profile this lead's own session runs on". A lead
+     * entry that names no {@code profile:} (recognise-only, CB-558) says nothing about which account
+     * it shares, and there is no other reliable signal on the daemon's side to derive that from — so
+     * such a lead contributes no seats, exactly as before this ticket. Making that lead's seat count
+     * requires the operator to add one line (`profile: sonnet` under its {@code fleet.leaders} entry)
+     * — a config statement, not a code change, and the smallest one available given the field
+     * already exists for a closely related purpose.
+     *
+     * <p>Only counts leads {@code liveLeadTerminals} currently reports — CB-531's live tab scan (or
+     * the legacy {@code primary.terminal} pin) — never every configured lead: an entry whose
+     * {@code instances} nobody has actually started is not really competing for a seat, and must not
+     * shrink capacity for one that was never live.
+     *
+     * @param profiles          the live profile map, normally {@code () -> config.get().profiles()}
+     *                          in {@code main} — hot, like every other {@code maxLoad}/
+     *                          {@code credentialId} read {@link FleetMcp.CapacitySource} already does
+     * @param leaders           {@code fleet.leaders}, read once at startup like the rest of that
+     *                          block ({@code fleetd.example.yaml} notes it is not hot) — passed as a
+     *                          plain map, never re-read from {@code config.get()}
+     * @param liveLeadTerminals terminal_id → lead name for every CURRENTLY recognised lead, normally
+     *                          the same supplier {@link dev.ltms.fleet.auth.CallerResolver#leads()}
+     *                          and {@code LeadCoordLoop} already consult
+     */
+    static Function<String, Integer> leadSeatLookup(Supplier<Map<String, FleetConfig.Profile>> profiles,
+            Map<String, FleetConfig.Leader> leaders, Supplier<Map<String, String>> liveLeadTerminals) {
+        return profileName -> {
+            FleetConfig.Profile target = profiles.get().get(profileName);
+            if (target == null || !target.isSubscription()) {
+                return 0;
+            }
+            String targetCredential = target.effectiveCredentialId();
+            int seats = 0;
+            for (String leadName : liveLeadTerminals.get().values()) {
+                FleetConfig.Leader lead = leaders.get(leadName);
+                if (lead == null || lead.profile() == null || lead.profile().isBlank()) {
+                    continue;
+                }
+                FleetConfig.Profile leadProfile = profiles.get().get(lead.profile());
+                if (leadProfile != null && targetCredential.equals(leadProfile.effectiveCredentialId())) {
+                    seats++;
+                }
+            }
+            return seats;
+        };
+    }
+
+    /**
+     * fleetd #248 / fleetd#201 Unit 5: package-private factory for the per-target backend-error
+     * pattern lookup {@link CompletionResolver} classifies a pane scrape against. Closes over the
+     * live roster (to resolve a target to a profile) and {@code errorPatternsByProfile} (each
+     * profile's configured {@code errorPattern}, already compiled by the caller — the same map also
+     * feeds the coverage log next to where this is called) — nothing else, so it is directly
+     * testable. See {@link #worktreeBranchLookup} above for why this ticket exists and why the
+     * factory takes a roster {@link Supplier} rather than a {@link SessionManager}.
+     *
+     * @param roster                 the live member roster, normally {@code sessions::roster}
+     * @param errorPatternsByProfile every profile that has an {@code errorPattern} configured,
+     *                               keyed by profile name
+     */
+    static BackendErrorPatternLookup backendErrorPatternLookup(Supplier<List<MemberSession>> roster,
+            Map<String, Pattern> errorPatternsByProfile) {
+        return target -> roster.get().stream()
+                .filter(session -> target.equals(session.terminalId()))
+                .findFirst()
+                .map(session -> errorPatternsByProfile.get(session.profile()))
+                .orElse(null);
+    }
+
+    /**
+     * Count sessions that occupy a profile's spawn capacity. A {@code BACKEND_ERROR} or
+     * {@code FAILED} session stays in the roster so {@code fleet_list} can show its failure, but a
+     * member that cannot accept another delivery does not use a seat.
+     */
+    static int liveSessionCount(List<MemberSession> roster, String profileName) {
+        return (int) roster.stream()
+                .filter(session -> profileName.equals(session.profile()))
+                .filter(session -> session.state() != MemberSession.State.BACKEND_ERROR)
+                .filter(session -> session.state() != MemberSession.State.FAILED)
+                .count();
+    }
+
+    /**
+     * fleetd #248 / fleetd#201 Unit 5: factory for the production {@link BackendErrorSink} — the
+     * collaborator {@link CompletionResolver} notifies when a pane-scrape classification actually
+     * resolves a waiter as a backend error. Order: (1) mark the member BACKEND_ERROR; (2) resolve
+     * profile/credential through the roster — fail loud (never {@code Optional.ifPresent}, the
+     * fleetd #234 lesson applied to this sink) and notify the lead via {@code
+     * onBackendTargetUnmapped} when it cannot be resolved; (3) record the error in {@code
+     * outagePolicy}; (4) on a NEW incident (the {@code record()} call that actually crosses the
+     * threshold), tell the lead via {@code onBackendIncident}.
+     *
+     * <p>{@code public}, unlike {@link #worktreeBranchLookup} and {@link #backendErrorPatternLookup}
+     * above: {@code dev.ltms.fleet.inject.BackendOutageFlowTest} exercises this exact object as the
+     * real, wired production path, replacing what its own class doc used to call out as a
+     * hand-mirrored copy of this lambda ("mirrors {@code Fleetd.main}'s {@code backendErrorSink}
+     * lambda line-for-line") — that copy proved only itself, never that {@code main} still wires the
+     * real thing. That was precisely the gap fleetd #248 exists to close.
+     *
+     * @param sessions the session registry; both read (roster) and written (onBackendError)
+     * @param profiles the live profile map, normally {@code () -> config.get().profiles()} in
+     *                 {@code main}, or a fixed test map via {@code () -> profiles}
+     * @param pushLoop the lead-nudge loop, read lazily: {@code main} builds this sink before the
+     *                 real {@link ReplyPushLoop} exists (a genuine construction-order cycle, broken
+     *                 the same way {@code exhaustionSinkRef} is a few lines above it), so a
+     *                 {@link Supplier} reads whatever {@code main} has filled in by the time a real
+     *                 backend error fires
+     */
+    public static BackendErrorSink backendErrorSink(SessionManager sessions,
+            Supplier<Map<String, FleetConfig.Profile>> profiles, BackendOutagePolicy outagePolicy,
+            Supplier<ReplyPushLoop> pushLoop) {
+        return (target, matchedLine, reason) -> {
+            sessions.onBackendError(target, reason);
+
+            String profileName = sessions.roster().stream()
+                    .filter(session -> target.equals(session.terminalId()))
+                    .findFirst()
+                    .map(MemberSession::profile)
+                    .orElse(null);
+            FleetConfig.Profile profile = profileName == null ? null : profiles.get().get(profileName);
+            if (profile == null) {
+                log.error("backend error on target '{}' ({}) but no profile could be resolved — the "
+                                + "target is not (yet) in the roster — no cool-off applied (fleetd #201 Unit 5)",
+                        target, reason);
+                ReplyPushLoop loop = pushLoop.get();
+                if (loop != null) {
+                    loop.onBackendTargetUnmapped(target, reason);
+                }
+                return;
+            }
+            String credentialId = profile.effectiveCredentialId();
+            Optional<BackendOutagePolicy.Incident> incident = outagePolicy.record(credentialId, target, reason);
+            incident.ifPresent(inc -> {
+                List<String> affectedProfiles = profiles.get().values().stream()
+                        .filter(p -> credentialId.equals(p.effectiveCredentialId()))
+                        .map(FleetConfig.Profile::profile)
+                        .sorted()
+                        .toList();
+                log.warn("credential '{}' cooling off for {}s after backend errors on {} distinct "
+                                + "target(s) (profile '{}'): {}", credentialId,
+                        inc.remainingCoolOffSeconds(), inc.evidenceCount(), profile.profile(), reason);
+                ReplyPushLoop loop = pushLoop.get();
+                if (loop != null) {
+                    loop.onBackendIncident(inc.id(), inc.targets(), credentialId, affectedProfiles,
+                            (int) inc.remainingCoolOffSeconds());
+                }
+            });
+        };
+    }
+
     /** Injection seam for {@link #selectReplyInbox}: production binds {@link AmqpReplyInbox#open}. */
     @FunctionalInterface
     interface AmqpOpener {
@@ -665,7 +995,7 @@ public final class Fleetd {
             log.warn("coordinator.selfId is unset — lead coordination is OFF. A lead mailbox is the "
                     + "queue named after the coord-id that owns it, so with no id there is nothing to "
                     + "own and no sender identity to publish as. Set coordinator.selfId to a name that "
-                    + "is unique across every daemon sharing {} and restart bridged.",
+                    + "is unique across every daemon sharing {} and restart fleetd.",
                     stripCredentials(uri));
             return null;
         }
@@ -708,7 +1038,7 @@ public final class Fleetd {
             if (effectiveUri == null) {
                 log.warn("broker.uriEnv={} is unset or blank — durable AMQP reply inbox DISABLED. "
                                 + "Replies are soft-state and will not survive a restart. Set {} in the "
-                                + "daemon's environment (see scripts/redeploy-bridged.sh) and restart to "
+                                + "daemon's environment (see scripts/redeploy-fleetd.sh) and restart to "
                                 + "use the durable broker inbox.",
                         broker.uriEnv(), broker.uriEnv());
                 log.info("reply inbox: in-memory (soft-state)");
@@ -766,7 +1096,7 @@ public final class Fleetd {
 
     /**
      * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
-     * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
+     * subscription} profile's explicitly configured {@code tokenEnv} (a subscription profile never reads one, see
      * {@link FleetConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
      * where set (opt-in), plus a configured {@code broker.uriEnv} (CB-151). Derived from the
      * config, not hard-coded, so a new profile is covered for free. A var required by more than one
@@ -783,7 +1113,9 @@ public final class Fleetd {
     static Map<String, List<String>> requiredSecretEnvVars(FleetConfig cfg) {
         Map<String, List<String>> requiredBy = new LinkedHashMap<>();
         cfg.profiles().forEach((name, profile) -> {
-            if (!profile.isSubscription()) {
+            // All kinds are checked when tokenEnv is explicit. OpenCode may use provider credentials,
+            // but an explicit tokenEnv still declares a required host secret for its configured provider.
+            if (!profile.isSubscription() && profile.hasTokenEnv()) {
                 requiredBy.computeIfAbsent(profile.tokenEnv(), _ -> new ArrayList<>())
                         .add("profile '" + name + "' tokenEnv");
             }
@@ -809,7 +1141,7 @@ public final class Fleetd {
      * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
      * what is wrong is strictly more useful than one that will not boot at all.
      */
-    private static void reportRequiredSecrets(FleetConfig cfg) {
+    static void reportRequiredSecrets(FleetConfig cfg) {
         Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
         if (requiredBy.isEmpty()) {
             log.info("startup secrets: no profile references a token env var — nothing to check");
@@ -823,13 +1155,31 @@ public final class Fleetd {
             } else {
                 log.warn("startup secret {}: MISSING ({}) — the daemon will start anyway, and this "
                                 + "failure stays invisible until a worker actually needs it. Fix "
-                                + "${SHARED_ENV}/tools/secrets.sh and restart bridged from a LOGIN "
-                                + "shell (see scripts/redeploy-bridged.sh).",
+                                + "${SHARED_ENV}/tools/secrets.sh and restart fleetd from a LOGIN "
+                                + "shell (see scripts/redeploy-fleetd.sh).",
                         varName, String.join(", ", sources));
             }
         });
     }
 
+    /**
+     * fleetd #184: state the member trust model at startup. Environment controls and worktrees do
+     * not make a sandbox when fleetd and its members use the same OS user. A separate herdr may
+     * provide that boundary, but fleetd cannot inspect the uid at the other end of its socket.
+     */
+    static void reportMemberTrustModel(FleetConfig cfg) {
+        if (cfg.memberHerdrSocket() != null && !cfg.memberHerdrSocket().isBlank()) {
+            log.info("member trust model: members are routed to a separate herdr through "
+                    + "memberHerdrSocket. fleetd cannot see that herdr's uid, so confirm it runs "
+                    + "as a different OS user before treating it as a boundary.");
+            return;
+        }
+        log.info("member trust model: members run as the same OS user as fleetd, not in a sandbox. "
+                + "A member can read any file this user can read, including SSH keys and credential "
+                + "stores, whatever memberCredentials says. To add a real boundary, route members to "
+                + "a second herdr under a different OS user with memberHerdrSocket.");
+    }
+
     /**
      * CB-596: {@code known:} empty (block absent entirely, or present but empty) means {@link
      * FleetConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
@@ -843,12 +1193,14 @@ public final class Fleetd {
      * #requiredSecretEnvVars} is exposed for {@link #reportRequiredSecrets}'s own test.
      */
     static void reportMemberCredentialsGap(FleetConfig cfg) {
-        FleetConfig.MemberCredentials creds = cfg.memberCredentials();
-        if (creds != null && !creds.known().isEmpty()) {
+        // fleetd #111: the counts below come from MemberCredentialPolicyView, the same class the
+        // live GET /member-credentials endpoint reads — one place computes them, not two.
+        MemberCredentialPolicyView view = MemberCredentialPolicyView.of(cfg.memberCredentials());
+        if (view.present()) {
             log.info("memberCredentials: policy={}, {} known name(s), {} allowed — blocking {} on "
                             + "every spawn{}",
-                    creds.policy(), creds.known().size(), creds.allow().size(), creds.blockedSet().size(),
-                    creds.isAllowList()
+                    view.policy(), view.knownCount(), view.allowedCount(), view.blockedCount(),
+                    cfg.memberCredentials().isAllowList()
                             ? " (allow-list: known/allow are reporting only — the control is the derived ZDOTDIR scrub)"
                             : "");
             return;
@@ -856,7 +1208,7 @@ public final class Fleetd {
         log.warn("memberCredentials: absent or empty — the daemon will start anyway, and every "
                 + "member pane inherits the operator's WHOLE secret store, unblocked (CB-592's "
                 + "protection is lost). Add a memberCredentials: block (policy/allow/known) to "
-                + "bridged.yaml — see fleetd.example.yaml — and restart.");
+                + "fleetd.yaml — see fleetd.example.yaml — and restart.");
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -236,7 +236,15 @@ public final class CallerResolver {
         // loopback-trust: same-host callers that are not workers are the primary. A non-loopback
         // caller is anonymous even here — and startup refuses that combination anyway
         // (FleetConfig.validateAuthExposure), so this is defence in depth, not the control.
-        return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
+        //
+        // fleetd #317: "not a worker" must not be conflated with "identity unresolved". The real
+        // primary is a real process — its pid resolves (c.resolved()), it just owns no herdr pane.
+        // A caller whose peer-PID lookup failed (LsofPeerPidLookup's -1 sentinel — on any failure,
+        // silently including "lsof found no match") has no such pid, and PaneLocator's own javadoc
+        // already names what happens if that case is handed the primary role: a worker→primary
+        // escalation. So an unresolved caller is refused (ANONYMOUS — the same clean, already-tested
+        // "authenticated as nothing" outcome used everywhere else in this method), never promoted.
+        return isLoopback(remoteAddr) && c.resolved() ? Principal.primary(c.pid()) : Principal.anonymous();
     }
 
     private boolean presentedTokenMatches(String authorizationHeader) {
@@ -262,11 +270,15 @@ public final class CallerResolver {
         return token.isEmpty() ? null : token;
     }
 
+    /**
+     * fleetd #305: delegates to {@link ConnectionIdentity#isLoopback}. This used to be a second,
+     * independent copy of the same rule, and the two drifted: this one accepted all of
+     * {@code 127.0.0.0/8}, {@code ConnectionIdentity}'s accepted only {@code 127.0.0.1}. A caller
+     * from {@code 127.0.0.2} therefore had its identity skipped (so it had no terminal) and was
+     * then read as loopback here — which under loopback-trust is the primary. Sharing the inputs
+     * would not have prevented that; only sharing the computation does.
+     */
     private static boolean isLoopback(String remoteAddr) {
-        if (remoteAddr == null) {
-            return false;
-        }
-        return remoteAddr.equals("127.0.0.1") || remoteAddr.equals("::1")
-                || remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.startsWith("127.");
+        return ConnectionIdentity.isLoopback(remoteAddr);
     }
 }

fleetd/src/main/java/dev/ltms/fleet/auth/MemberLifecycle.java

@@ -0,0 +1,74 @@
+package dev.ltms.fleet.auth;
+
+import dev.ltms.fleet.peer.MemberRole;
+
+/** Optional session lifecycle hook for live member-slot bindings. */
+public interface MemberLifecycle {
+
+    /** A slot held before a member process starts. */
+    record SlotReservation(String slot, String profile) { }
+
+    MemberLifecycle NONE = new MemberLifecycle() {
+        @Override
+        public MemberRole acquired(MemberRole role, String profile, String terminal) {
+            return role; // no registry configured — nothing to bind against, so the request stands
+        }
+
+        @Override
+        public void released(String terminal) {
+        }
+
+        @Override
+        public void requireSlotFor(MemberRole role, String profile) {
+            // no registry configured — nothing to validate against, so nothing is refused
+        }
+
+        @Override
+        public SlotReservation reserve(MemberRole role, String profile) {
+            return null;
+        }
+
+        @Override
+        public boolean bind(SlotReservation reservation, String terminal) {
+            return false;
+        }
+
+        @Override
+        public void release(SlotReservation reservation) {
+        }
+    };
+
+    /**
+     * Try to bind a newly spawned {@code terminal} into the role it was granted.
+     *
+     * @return the role this session actually holds: {@code role} unchanged for a role with no
+     *         live slot-binding semantics (dev, reviewer), or when the bind succeeded; a fallback
+     *         role — never {@code role} — when a slot-bound role (architect) could not be bound.
+     *         Callers must record THIS value on the session, never the requested {@code role}, so
+     *         a later roster read never reports a role the session does not hold (CB-619). In
+     *         normal operation this fallback should not happen once a reservation has been bound.
+     *         It remains the honest answer if a caller has no reservation, or if binding a
+     *         reservation unexpectedly fails.
+     */
+    MemberRole acquired(MemberRole role, String profile, String terminal);
+
+    void released(String terminal);
+
+    /**
+     * Refuse an acquire before anything spawns when {@code role} requires a live slot binding and
+     * no configured slot carries {@code profile} (CB-619 / fleetd #123). A no-op for a role with
+     * no slot-binding semantics.
+     *
+     * @throws IllegalArgumentException naming the role, the profile, and the pools that do carry it
+     */
+    void requireSlotFor(MemberRole role, String profile);
+
+    /** Reserve a matching slot before launch, or refuse before a charter can be delivered. */
+    SlotReservation reserve(MemberRole role, String profile);
+
+    /** Convert a reservation into a live terminal binding. */
+    boolean bind(SlotReservation reservation, String terminal);
+
+    /** Return an unbound reservation after a failed launch. */
+    void release(SlotReservation reservation);
+}

fleetd/src/main/java/dev/ltms/fleet/auth/MemberRegistry.java

@@ -8,6 +8,7 @@ import org.slf4j.LoggerFactory;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 
@@ -55,8 +56,10 @@ public final class MemberRegistry implements MemberLifecycle {
     }
 
     private final Map<String, Entry> slots;
-    /** Live {@code terminal_id → qualified slot key}; guarded by {@code this}. */
+    /** Live {@code terminal_id → qualified slot key}; guarded by {@code terminalToSlot}. */
     private final Map<String, String> terminalToSlot = new HashMap<>();
+    /** Slot keys held between reservation and the terminal binding. Guarded by terminalToSlot. */
+    private final java.util.Set<String> reservedSlots = new java.util.HashSet<>();
 
     /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
     public MemberRegistry(FleetConfig.Fleet fleet) {
@@ -166,7 +169,7 @@ public final class MemberRegistry implements MemberLifecycle {
             if (existingSlot != null) {
                 return slot.equals(existingSlot); // already this slot (idempotent) or a different one
             }
-            if (terminalToSlot.containsValue(slot)) {
+            if (terminalToSlot.containsValue(slot) || reservedSlots.contains(slot)) {
                 return false; // slot already hosts a terminal — no second one
             }
             terminalToSlot.put(terminal, slot);
@@ -206,19 +209,116 @@ public final class MemberRegistry implements MemberLifecycle {
      *
      * <p>The role check is lifecycle policy. {@link CallerResolver} repeats it when resolving a
      * binding, so a later lifecycle regression cannot turn a worker into an architect.
+     *
+     * <p>CB-619 / fleetd #123: the return value is the role this session actually holds, and the
+     * caller is required to record THAT — never the requested {@code role} — on the session. Before
+     * this fix the caller kept the requested role regardless of whether the bind below succeeded, so
+     * a demoted session's {@code GET /members} row still said {@code "architect"} while
+     * {@code fleet_whoami} (which reads the live binding, not the request) correctly said
+     * {@code "worker"} — three sources of truth that disagreed about one live member, silently.
      */
     @Override
-    public void acquired(MemberRole role, String profile, String terminal) {
+    public MemberRole acquired(MemberRole role, String profile, String terminal) {
         if (role != MemberRole.ARCHITECT || terminal == null || terminal.isBlank()) {
-            return;
+            return role;
         }
         // slotsFor preserves definition order, so duplicate-profile slots use the first free one.
         for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
             if (Objects.equals(profile, entry.profile()) && bind(entry.key(), terminal)) {
-                return;
+                return MemberRole.ARCHITECT;
+            }
+        }
+        // fleetd #123: at least WARN — a role downgrade that the roster must now also reflect is
+        // not routine bookkeeping. requireSlotFor already refuses the config-gap case (no slot at
+        // all carries this profile) before a process ever spawns; reaching here means the config DID
+        // carry a matching slot but every one of them was already bound to a different terminal — a
+        // race this pre-spawn check cannot close on its own (see requireSlotFor's javadoc).
+        log.warn("member slot: no free architect slot for profile={} terminal={}; holding the session "
+                + "as {} instead of the architect it asked for — every configured slot for this "
+                + "profile is already bound to a different terminal", profile, terminal,
+                MemberRole.DEV.wireName());
+        return MemberRole.DEV;
+    }
+
+    /**
+     * CB-619 / fleetd #123: refuse an architect acquire before anything spawns when no configured
+     * slot carries {@code profile} — the config-gap case from the original defect report (a spawn
+     * asked for {@code role=architect, profile=sonnet}, and {@code fleet.architects} carried only
+     * {@code opus} and {@code sol}). A dev/reviewer acquire is always a no-op: those pools are
+     * placement candidates only (see {@code CompositePeerLauncher}), never a live identity binding,
+     * so there is nothing here to refuse — an explicit profile outside the pool for those roles is a
+     * documented operator override, not a defect.
+     *
+     * <p>This closes the config-gap case, not the live-capacity case: a profile that DOES carry a
+     * slot can still lose the race to a concurrent spawn between this check and the actual
+     * {@link #bind}, which is why {@link #acquired} must still answer honestly even after this
+     * check has passed.
+     */
+    @Override
+    public void requireSlotFor(MemberRole role, String profile) {
+        if (role != MemberRole.ARCHITECT) {
+            return;
+        }
+        boolean hasSlot = slotsFor(MemberRole.ARCHITECT).values().stream()
+                .anyMatch(e -> Objects.equals(profile, e.profile()));
+        if (hasSlot) {
+            return;
+        }
+        List<String> pools = slotsFor(MemberRole.ARCHITECT).values().stream()
+                .map(Entry::profile)
+                .distinct()
+                .toList();
+        throw new IllegalArgumentException(
+                "no " + role.wireName() + " slot for profile '" + profile + "' — an architect's "
+                        + "identity IS the slot it is bound to, so there is nothing to bind this "
+                        + "session's identity to. fleet." + role.configKey() + " carries profiles: "
+                        + (pools.isEmpty() ? "(none configured)" : String.join(", ", pools))
+                        + "; add profile '" + profile + "' there, or spawn " + role.wireName()
+                        + " on one of those profiles instead");
+    }
+
+    @Override
+    public SlotReservation reserve(MemberRole role, String profile) {
+        if (role != MemberRole.ARCHITECT) {
+            return null;
+        }
+        synchronized (terminalToSlot) {
+            for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
+                if ((profile == null || profile.isBlank() || Objects.equals(profile, entry.profile()))
+                        && !terminalToSlot.containsValue(entry.key()) && reservedSlots.add(entry.key())) {
+                    return new SlotReservation(entry.key(), entry.profile());
+                }
+            }
+        }
+        throw new IllegalArgumentException("no free architect slot for profile '" + profile
+                + "' — every matching slot is already bound or reserved");
+    }
+
+    @Override
+    public boolean bind(SlotReservation reservation, String terminal) {
+        if (reservation == null || terminal == null || terminal.isBlank()) {
+            return false;
+        }
+        synchronized (terminalToSlot) {
+            if (!reservedSlots.remove(reservation.slot())) {
+                return false;
+            }
+            if (!isSlot(reservation.slot()) || terminalToSlot.containsKey(terminal)
+                    || terminalToSlot.containsValue(reservation.slot())) {
+                return false;
+            }
+            terminalToSlot.put(terminal, reservation.slot());
+            return true;
+        }
+    }
+
+    @Override
+    public void release(SlotReservation reservation) {
+        if (reservation != null) {
+            synchronized (terminalToSlot) {
+                reservedSlots.remove(reservation.slot());
             }
         }
-        log.info("member slot: no free architect slot for profile={}; session remains a worker", profile);
     }
 
     /** Unbind a released terminal using the compare-safe registry operation. */

fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -43,7 +43,9 @@ import java.util.function.Supplier;
  *       which is constructed once), <em>and an existing profile's launch settings</em> —
  *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
  *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
- *       pattern map at startup), and the rest. {@code credentialId} (CB-578 stage B) is NOT on
+ *       pattern map at startup), {@code errorPattern} (fleetd #201 Unit 5 — compiled once into
+ *       {@code Fleetd.main}'s backend-error pattern map at startup, the same way), and the rest.
+ *       {@code credentialId} (CB-578 stage B) is NOT on
  *       this list — it is read live off the config supplier at every quarantine check and
  *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
  *       {@code HerdrPeerLauncher} takes {@code Map.copyOf(profiles)} at construction and resolves
@@ -71,7 +73,7 @@ public final class ConfigRef implements Supplier<FleetConfig> {
 
     /** Keys that cannot change under a running daemon — see the class doc. */
     private static final Set<String> COLD_KEYS =
-            Set.of("bind", "herdrSocket", "broker", "auth");
+             Set.of("bind", "herdrSocket", "memberHerdrSocket", "broker", "auth");
 
     private final Path path;
     private final AtomicReference<FleetConfig> current;
@@ -128,7 +130,7 @@ public final class ConfigRef implements Supplier<FleetConfig> {
             }
             if (!applied) {
                 return "config reload refused — these keys cannot change under a running daemon: "
-                        + String.join(", ", coldKeys) + ". Restart bridged to apply them.";
+                        + String.join(", ", coldKeys) + ". Restart fleetd to apply them.";
             }
             if (!deferred.isEmpty()) {
                 return "config reloaded; these changes need a restart to take effect: "
@@ -190,6 +192,9 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         if (!Objects.equals(old.herdrSocket(), fresh.herdrSocket())) {
             changed.add("herdrSocket");
         }
+        if (!Objects.equals(old.memberHerdrSocket(), fresh.memberHerdrSocket())) {
+            changed.add("memberHerdrSocket");
+        }
         if (!Objects.equals(old.broker(), fresh.broker())) {
             changed.add("broker");
         }
@@ -289,6 +294,10 @@ public final class ConfigRef implements Supplier<FleetConfig> {
                 // CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map
                 // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
                 // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
-                && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern());
+                && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern())
+                // fleetd #201 Unit 5: errorPattern is compiled once into Fleetd.main's backend-error
+                // pattern map at startup (see BackendErrorPatternLookup wiring), the same way
+                // exhaustedPattern is — a reload never re-reads it either.
+                && Objects.equals(a.errorPattern(), b.errorPattern());
     }
 }

fleetd/src/main/java/dev/ltms/fleet/config/ConfigWatcher.java

@@ -11,7 +11,7 @@ import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
 /**
- * Polls {@code bridged.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
+ * Polls {@code fleetd.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
  * (CB-559). Opt-in through {@code configReload.enabled}.
  *
  * <p><strong>Why polling and not a filesystem watch.</strong> {@code WatchService} on macOS has no

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -1,6 +1,8 @@
 package dev.ltms.fleet.config;
 
+import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonToken;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -24,15 +26,18 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.regex.Pattern;
+import java.util.regex.PatternSyntaxException;
 
 /**
- * {@code bridged} configuration, loaded from a YAML file (see
+ * {@code fleetd} configuration, loaded from a YAML file (see
  * {@code fleetd.example.yaml}). Unknown keys are ignored so config can grow ahead
  * of the code — but an unknown <em>top-level</em> key is logged as a WARN at load (CB-530), because
  * silently dropping a whole block is indistinguishable from honouring it.
  *
  * @param bind          REST/MCP listen host:port
- * @param herdrSocket   path to herdr's Unix socket ({@code null} → client default)
+ * @param herdrSocket   path to the lead herdr Unix socket ({@code null} → client default)
+ * @param memberHerdrSocket optional member herdr Unix socket ({@code null}/blank → lead socket)
  * @param profiles      named backend profiles, keyed by profile name (multi-backend fleet). A
  *                      profile answers <em>which backend</em> — model, CLI adapter, credentials,
  *                      cost. It says nothing about what the member spawned on it is for; that is
@@ -75,11 +80,38 @@ import java.util.Set;
  *                      stay on {@code broker}'s vhost). {@code null} → no lead mailbox is opened.
  *                      Config parsing + accessors only — nothing here wires it into a live
  *                      {@code LeadMailbox}; that is a separate ticket. See {@link Coordinator}.
+ * @param worktreeGroup optional OS group name (fleetd #185 stage 3) that makes a provisioned
+ *                      worktree's repo group-shared, so a member running as a different OS user
+ *                      (see {@code memberHerdrSocket}) can write its own worktree, its per-worktree
+ *                      git metadata, and its own commit objects. {@code null}/blank/empty ⇒ off,
+ *                      today's behaviour unchanged (every file stays owned by fleetd's own uid).
+ *                      <strong>This isolates credentials, not the repository</strong>: a member in
+ *                      the group can still write the operator's git objects and refs in the shared
+ *                      repo. See {@link dev.ltms.fleet.session.Worktrees#shareWithGroup}.
+ * @param memberLoginShell fleetd #213: the login shell the member's OS user actually runs, ONLY
+ *                      meaningful (and only ever read) when {@code memberHerdrSocket} is
+ *                      configured — that mode spawns member panes under a different OS user than
+ *                      fleetd's own process, so fleetd's own {@code $SHELL} says nothing about what
+ *                      that pane runs. There is no channel to ask herdr for another user's shell, so
+ *                      this must be told, never guessed. {@code null}/blank (or a value not ending
+ *                      in {@code zsh}) is treated the same as "not zsh". fleetd #155: what that means
+ *                      now depends on {@code memberCredentials.policy}. Under {@code deny-by-default}
+ *                      it stays a degraded control, never a refusal to spawn — the pane-creation
+ *                      overlay is unaffected by shell type, so the spawn proceeds with a WARN naming
+ *                      the shell. Under {@code allow-list} the spawn is REFUSED instead: that policy's
+ *                      whole point is a control a sourced file cannot undo, so silently falling back
+ *                      to the weaker overlay would be the same "control silently does nothing" defect
+ *                      #155 exists to remove — configure this field (or move the account to zsh, or
+ *                      switch policy back to {@code deny-by-default}) to unblock the spawn.
+ *                      When {@code memberHerdrSocket} is NOT configured this field is never
+ *                      consulted at all; fleetd keeps reading its own {@code $SHELL}, exactly as
+ *                      before this field existed.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record FleetConfig(
         Bind bind,
         String herdrSocket,
+        String memberHerdrSocket,
         Map<String, Profile> profiles,
         Guard guard,
         String worktreeRoot,
@@ -96,7 +128,33 @@ public record FleetConfig(
         ConfigReload configReload,
         Integer quarantineCooldownSeconds,
         MemberCredentials memberCredentials,
-        Coordinator coordinator) {
+        Coordinator coordinator,
+        String worktreeGroup,
+        String memberLoginShell) {
+
+    /** Back-compat form before the {@code memberLoginShell} key was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup, null);
+    }
+
+    /** Back-compat form before the {@code worktreeGroup} key was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, null, null);
+    }
 
     /** Back-compat form before the {@code coordinator:} block was added. */
     public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
@@ -105,9 +163,9 @@ public record FleetConfig(
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
                          ConfigReload configReload, Integer quarantineCooldownSeconds,
                          MemberCredentials memberCredentials) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, memberCredentials, null);
+                configReload, quarantineCooldownSeconds, memberCredentials, null, null);
     }
 
     /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
@@ -116,9 +174,9 @@ public record FleetConfig(
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
                          ConfigReload configReload, Integer quarantineCooldownSeconds) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, null);
+                configReload, quarantineCooldownSeconds, null, null);
     }
 
     /** Default cooldown (CB-578 stage B) when {@code quarantineCooldownSeconds} is absent/non-positive. */
@@ -129,8 +187,8 @@ public record FleetConfig(
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, String placement, Auth auth) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
-                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, null, null);
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, null, null, null, null);
     }
 
     /** Back-compat form before the optional {@code health:} block was added. */
@@ -138,8 +196,8 @@ public record FleetConfig(
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, String placement, Auth auth, ConfigReload configReload) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
-                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, configReload, null);
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, configReload, null, null, null);
     }
 
     /** Back-compat form before the CB-578 stage B {@code quarantineCooldownSeconds} field was added. */
@@ -148,9 +206,9 @@ public record FleetConfig(
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
                          ConfigReload configReload) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, null);
+                configReload, null, null, null);
     }
 
     /**
@@ -192,13 +250,14 @@ public record FleetConfig(
      * @param configDir {@code CLAUDE_CONFIG_DIR} so the worker inherits the profile's
      *                  skills/MCP/hooks (may be {@code null})
      * @param tokenEnv  name of the host env var holding the worker's auth token; its value
-     *                  is injected as {@code ANTHROPIC_AUTH_TOKEN} (never stored in config)
+     *                  is injected as {@code ANTHROPIC_AUTH_TOKEN} (never stored in config).
+     *                  {@code null}/blank means this profile needs no token.
      * @param argv      launch command; defaults to {@code ["claude"]}
      * @param placement where a worker lands: {@code "tab"} (default — its own tab in the
      *                  worker space) or {@code "pane"} (legacy — split the focused tab)
-     * @param workspace label of the dedicated worker space; found-or-created on first
-     *                  spawn (default {@code "bridged-workers"}). A future per-session
-     *                  layout is just a distinct label here — the shared space is default.
+     * @param workspace label of the shared fleet space; found-or-created on first spawn
+     *                  (default {@code "fleet"}). The lead and every member share this one
+     *                  space so the operator sees a single "session" with many tabs.
      * @param tabLabel  template for a worker tab's label; {@code {profile}}/{@code {model}}
      *                  and {@code {n}} (per-worker number, to keep sibling tabs distinct)
      *                  are substituted (default {@code "worker: {profile} #{n}"})
@@ -208,7 +267,13 @@ public record FleetConfig(
      * @param cwd            fixed working directory for this profile's workers (CB-112 "told otherwise");
      *                       {@code null}/blank → inherit the primary's cwd, else the daemon's
      * @param parityOverlay  repo-relative paths copied primary→worktree for config parity; null/empty
-     *                       defaults to a sensible set of local config files.
+     *                       defaults to {@code [.env]} only (CB-148 point 2). {@code .env} is data — a
+     *                       copy of it can only carry values. {@code .envrc} is executable shell that
+     *                       {@code direnv} evaluates on every {@code cd}, so copying it moves behaviour
+     *                       into the worker, not just values, and that is a different risk from copying
+     *                       data. It is deliberately left out of the default for that reason. The knob
+     *                       still supports it: an operator who wants it copied writes
+     *                       {@code parityOverlay: [.env, .envrc]} explicitly and owns that choice.
      *                       <p><strong>Every overlay path must be gitignored or tracked-and-skipped.</strong>
      *                       CB-576 made {@code release()} preserve a worktree that {@code git status
      *                       --porcelain} reports as dirty, and it deliberately counts untracked files —
@@ -218,11 +283,10 @@ public record FleetConfig(
      *                       worktrees then accumulate with no error anywhere.
      *                       <p>Checked on 2026-08-15 (CB-581): inert as configured. Tracked overlay
      *                       files carry {@code --skip-worktree} so {@code --porcelain} cannot see them,
-     *                       {@code bridged.yaml} is gitignored, and the default pair {@code .env} /
-     *                       {@code .envrc} does not exist in this repo. Note the default applies to
-     *                       <em>every</em> profile, so creating either file at the repo root is enough
-     *                       to make it live. Add a new overlay path to {@code .gitignore} in the same
-     *                       change that adds it here.
+     *                       {@code fleetd.yaml} is gitignored, and {@code .env} does not exist in this
+     *                       repo. Note the default applies to <em>every</em> profile, so creating
+     *                       {@code .env} at the repo root is enough to make it live. Add a new overlay
+     *                       path to {@code .gitignore} in the same change that adds it here.
      *                       <p>CB-578 stage C raised the stakes: a preserved dirty worktree is now also
      *                       committed to {@code refs/wip/<branch>} via {@code git add -A}. The overlay
      *                       carries the primary's own environment files into the worktree, so a
@@ -258,8 +322,9 @@ public record FleetConfig(
      *                       statement that does not stop being true just because the profile was
      *                       named directly. A negative value has no sane meaning (there is no
      *                       "excluded" to degrade to below zero) and is refused at config load
-     *                       instead, naming the profile and the key. Live means any session the
-     *                       registry still owns (acquired and not yet released), in any state.
+     *                       instead, naming the profile and the key. Live means a session that can
+     *                       receive another delivery. The roster keeps terminal {@code BACKEND_ERROR}
+     *                       and {@code FAILED} sessions for diagnostics, but they do not use capacity.
      * @param kind           which peer launcher spawns this profile: {@code "claude-code"} (default —
      *                       the {@link dev.ltms.fleet.member.ClaudeCodeLauncher}) or {@code "opencode"}.
      *                       The {@code CompositePeerLauncher} routes {@code spawn}/reap by this value, so
@@ -307,6 +372,16 @@ public record FleetConfig(
      *                       {@code limit.context} instead, which bounds the window opencode compacts
      *                       <em>within</em>, and only when {@code model} resolves to a
      *                       {@code provider/model} pair.
+     * @param errorPattern   regex matched against a completion-fallback scrape (fleetd #201 Unit 5)
+     *                       to classify a turn that ended with no {@code fleet_reply} as a backend
+     *                       error (credential outage, provider 5xx) rather than a real answer or an
+     *                       exhausted usage limit. {@code null}/blank ⇒ this profile relies on
+     *                       {@link dev.ltms.fleet.inject.CompletionResolver}'s built-in
+     *                       {@code (?i)\bAPI Error\s*:} compatibility pattern instead — classification
+     *                       still happens, just without a profile-specific match (reported separately
+     *                       at startup as legacy-default coverage, never full coverage). Compiled once
+     *                       at startup ({@code Fleetd.main}), like {@code exhaustedPattern}, so a
+     *                       reload of this key is DEFERRED (see {@code ConfigRef}).
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
     public record Profile(String profile, String baseUrl, String model,
@@ -325,7 +400,8 @@ public record FleetConfig(
                          String ideMcpUrl,
                          String ideProjectDir,
                          String ideOpenCommand,
-                         Integer autoCompactWindow) {
+                         Integer autoCompactWindow,
+                         String errorPattern) {
 
         /** Peer kind spawned by {@link dev.ltms.fleet.member.ClaudeCodeLauncher} (the default). */
         public static final String KIND_CLAUDE_CODE = "claude-code";
@@ -341,9 +417,9 @@ public record FleetConfig(
                     ? (KIND_CLAUDE_CODE.equals(k) ? List.of("claude") : List.of(k))
                     : List.copyOf(argv);
             kind = k;
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_WORKER_TOKEN" : tokenEnv;
+            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? null : tokenEnv;
             placement = (placement == null || placement.isBlank()) ? "tab" : placement.toLowerCase();
-            workspace = (workspace == null || workspace.isBlank()) ? "bridged-workers" : workspace;
+            workspace = (workspace == null || workspace.isBlank()) ? "fleet" : workspace;
             // CB-557: no per-profile default any more. A label is generated from the member's ROLE
             // ("dev: sonnet #2"), which a profile cannot know, so the template lives on `fleet:` and
             // this field is only an override for a profile that wants its own. Blank ⇒ defer.
@@ -359,7 +435,7 @@ public record FleetConfig(
             // servers do not exist there to be enabled. This is defence in depth, not a live fix: the
             // worker stays isolated only because this separate mechanism already removes the servers.
             parityOverlay = (parityOverlay == null || parityOverlay.isEmpty())
-                    ? List.of(".env", ".envrc")
+                    ? List.of(".env")
                     : List.copyOf(parityOverlay);
             // gitTokenEnv stays null when unset (opt-in). gitHostEnv defaults so operators enabling
             // checkpoints need only set gitTokenEnv; it is injected only alongside a resolved token.
@@ -389,7 +465,7 @@ public record FleetConfig(
             // (pinned to its own worktree via the charter). Blank ⇒ off.
             ideMcpUrl = (ideMcpUrl == null || ideMcpUrl.isBlank()) ? null : ideMcpUrl;
             // CB-634 auto-open: both are only read when hasIdeMcp(). ideProjectDir is the repo-relative
-            // module dir IntelliJ must open (this repo's pom lives in `bridged/`, not at the root), and
+            // module dir IntelliJ must open (this repo's pom lives in `fleetd/`, not at the root), and
             // it is also the project_path the overlay pins. Blank ⇒ the worktree root (unchanged before
             // auto-open). ideOpenCommand is the host command that opens that dir in the IDE, with {dir}
             // substituted; blank ⇒ no auto-open (the operator opens the module by hand).
@@ -399,6 +475,32 @@ public record FleetConfig(
             // there is no blank-string form to normalize (it's an Integer), and the [100000, 1000000]
             // range is enforced eagerly at config load (rejectAutoCompactWindowOutOfRange), naming the
             // profile, rather than silently clamped here. A profile that never sets it keeps null.
+            // errorPattern stays null when unset/blank (opt-in) — same rule as exhaustedPattern: no
+            // defaulting, no vendor wording. A profile that never sets it relies on
+            // CompletionResolver's built-in compatibility pattern instead (never "off").
+            errorPattern = (errorPattern == null || errorPattern.isBlank()) ? null : errorPattern;
+        }
+
+        /**
+         * Backward-compatible constructor without the fleetd #201 {@code errorPattern} field — the
+         * profile relies on {@code CompletionResolver}'s built-in compatibility pattern instead
+         * (legacy-default coverage). This is the shape the canonical constructor had before the
+         * field was added; every pre-existing Java call site (and any YAML that omits the key) keeps
+         * compiling and behaving identically. Jackson binds the canonical (longest) constructor, so
+         * YAML omitting {@code errorPattern:} still lands here as {@code null} via that path too.
+         */
+        public Profile(String profile, String baseUrl, String model,
+                      String configDir, String tokenEnv, List<String> argv,
+                      String placement, String workspace, String tabLabel, String mcpUrl,
+                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
+                      String kind, Map<String, String> env, Float weight, Integer maxLoad,
+                      Boolean subscription, String exhaustedPattern, String credentialId,
+                      String ideMcpUrl, String ideProjectDir, String ideOpenCommand,
+                      Integer autoCompactWindow) {
+            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad,
+                    subscription, exhaustedPattern, credentialId, ideMcpUrl, ideProjectDir, ideOpenCommand,
+                    autoCompactWindow, null);
         }
 
         /**
@@ -443,7 +545,8 @@ public record FleetConfig(
         public Profile withProfile(String p) {
             return new Profile(p, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
                     mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, subscription,
-                    exhaustedPattern, credentialId, ideMcpUrl, ideProjectDir, ideOpenCommand, autoCompactWindow);
+                    exhaustedPattern, credentialId, ideMcpUrl, ideProjectDir, ideOpenCommand, autoCompactWindow,
+                    errorPattern);
         }
 
         /**
@@ -541,14 +644,55 @@ public record FleetConfig(
         }
 
         /**
-         * The credential group this profile quarantines with (CB-578 stage B): the configured
-         * {@link #credentialId} when set, else this profile's own name — so an unconfigured profile
-         * quarantines alone, exactly as it did before this field existed. Two profiles that set the
-         * same non-blank {@code credentialId} share one quarantine: a {@code BACKEND_EXHAUSTED}
-         * classification on either one quarantines both.
+         * True when this profile configures its own fleetd #201 Unit 5 backend-error classification
+         * pattern. {@code false} means this profile relies on {@code CompletionResolver}'s built-in
+         * {@code (?i)\bAPI Error\s*:} compatibility pattern instead (legacy-default coverage).
+         */
+        public boolean hasErrorPattern() {
+            return errorPattern != null;
+        }
+
+        /**
+         * The shared credential id every {@code subscription: true} profile falls back to when it
+         * sets no explicit {@link #credentialId} (fleetd #176 stage 2, correcting an inert first cut
+         * of that ticket). A subscription profile has no credential of its own to fall back to its
+         * name for: it authenticates as the operator's own Claude login, and a host has exactly one
+         * of those, whatever names the operator gives the profiles running on it. Falling back to the
+         * profile's own name (the way an ordinary off-subscription profile does) would keep two
+         * subscription profiles on one login apart from each other, which is the opposite of what
+         * "one account" means.
+         *
+         * <p>Measured live and what it broke: a lead on profile {@code opus}, members on profile
+         * {@code sonnet}, same Claude login, neither setting {@code credentialId}. Before this
+         * sentinel, {@code opus.effectiveCredentialId()} was {@code "opus"} and {@code sonnet
+         * .effectiveCredentialId()} was {@code "sonnet"} — so fleetd #176's lead-seat matcher (and,
+         * this sentinel now also fixes, {@code CompositePeerLauncher}'s quarantine/cool-off spawn
+         * refusal and {@code BackendOutagePolicy}'s incident grouping) silently never linked them: the
+         * fix shipped, and stayed inert on the one host it was written for.
+         */
+        public static final String SUBSCRIPTION_CREDENTIAL_ID = "<subscription>";
+
+        /**
+         * The credential group this profile quarantines with (CB-578 stage B; extended fleetd #176
+         * stage 2 — see {@link #SUBSCRIPTION_CREDENTIAL_ID}): the configured {@link #credentialId}
+         * when set — that always wins, so an operator with two separate Claude logins on one host can
+         * still keep them apart. Otherwise, a {@code subscription: true} profile falls back to
+         * {@link #SUBSCRIPTION_CREDENTIAL_ID} rather than its own name; an ordinary off-subscription
+         * profile falls back to its own name, exactly as it did before this field existed, so an
+         * unconfigured off-subscription profile still quarantines alone.
+         *
+         * <p>A {@code BACKEND_EXHAUSTED} (or repeated backend-error) classification on any profile
+         * sharing the result quarantines/cools off every profile that shares it — including, now,
+         * every {@code subscription: true} profile with no explicit {@code credentialId}. That is
+         * intended, not incidental: one Claude subscription hitting a usage limit really does take out
+         * every profile running on it, the same way {@code credentialId: openai-shared} already lets
+         * two OpenAI-backed profiles share one quarantine.
          */
         public String effectiveCredentialId() {
-            return (credentialId == null || credentialId.isBlank()) ? profile : credentialId;
+            if (credentialId != null && !credentialId.isBlank()) {
+                return credentialId;
+            }
+            return isSubscription() ? SUBSCRIPTION_CREDENTIAL_ID : profile;
         }
 
         /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */
@@ -556,6 +700,11 @@ public record FleetConfig(
             return gitTokenEnv != null && !gitTokenEnv.isBlank();
         }
 
+        /** True when this profile explicitly names a host token environment variable. */
+        public boolean hasTokenEnv() {
+            return tokenEnv != null && !tokenEnv.isBlank();
+        }
+
         /**
          * True when this profile's {@code env:} block names a worker-side Anthropic binding variable.
          * Those two keys are the adapter's, never the operator's: on a claude-code worker
@@ -642,6 +791,9 @@ public record FleetConfig(
                          Integer paneProbeIntervalSeconds, Notifications notifications) {
         public boolean isEnabled() { return Boolean.TRUE.equals(enabled); }
         public int intervalOrDefault() { return Math.max(15, intervalSeconds == null ? 30 : intervalSeconds); }
+        public int workingSuspectAfterOrDefault() {
+            return Math.max(300, workingSuspectAfterSeconds == null ? 600 : workingSuspectAfterSeconds);
+        }
         public record Notifications(String mode) {
             public boolean configured() { return "webhook".equalsIgnoreCase(mode); }
         }
@@ -649,7 +801,7 @@ public record FleetConfig(
 
     /**
      * External AMQP broker for durable, cross-restart reply delivery (CB-307 Stage 2). Its mere
-     * presence swaps the in-memory {@code ReplyInbox} for the AMQP-backed adapter; absent, bridged
+     * presence swaps the in-memory {@code ReplyInbox} for the AMQP-backed adapter; absent, fleetd
      * stays soft-state. Production default is LavinMQ; a stock RabbitMQ speaks the same AMQP 0-9-1
      * and is a URI-only swap.
      *
@@ -835,7 +987,15 @@ public record FleetConfig(
      * survives restarts of the agent inside it — so identity is now the tab label alone.
      *
      * @param profile             the {@code profiles:} entry to launch this lead on when one must
-     *                            be created; {@code null} ⇒ recognise-only, never create
+     *                            be created; {@code null} ⇒ recognise-only, never create.
+     *                            <p>fleetd #176: also the field {@code Fleetd.leadSeatLookup} reads
+     *                            to learn which account this lead's own live session shares — set it
+     *                            (safely, even on an already-running recognise-only lead: naming a
+     *                            profile here never starts anything beyond {@code instances}) so a
+     *                            {@code subscription: true} worker profile sharing its
+     *                            {@code effectiveCredentialId()} has this lead's seat subtracted from
+     *                            {@code fleet_list}'s {@code free}. {@code null} here also means this
+     *                            lead's seat cannot be derived and is not counted.
      * @param tab                 the exact tab label hosting this lead, matched case-insensitively;
      *                            the only field identity depends on. Required — a lead with no
      *                            {@code tab} can never be discovered, launched or not
@@ -857,11 +1017,12 @@ public record FleetConfig(
                          String workspace, String cwd) {
 
         /**
-         * Where an auto-launched lead's tab is created (CB-558). It must NOT be a member workspace:
-         * {@code LeadTabScanner} excludes those wholesale, so a lead placed in one would never be
-         * discovered and the daemon would relaunch it on every boot.
+         * Where an auto-launched lead's tab is created (CB-558). It defaults to the SAME shared
+         * {@code "fleet"} space the members use, so the operator sees one "session" with many tabs.
+         * The scanner no longer excludes member spaces — it tells a lead from a member by the exact
+         * tab label, so a lead sharing the members' space is still discovered (see LeadLauncher).
          */
-        public static final String DEFAULT_WORKSPACE = "leads";
+        public static final String DEFAULT_WORKSPACE = "fleet";
 
         public Leader {
             instances = (instances == null || instances < 0) ? 1 : instances;
@@ -1060,7 +1221,7 @@ public record FleetConfig(
     }
 
     /**
-     * Watch {@code bridged.yaml} and re-read it when it changes (CB-559).
+     * Watch {@code fleetd.yaml} and re-read it when it changes (CB-559).
      *
      * <p>Opt-in, like every other block that acts on its own initiative. A daemon that reloads
      * whenever a file is saved would apply a half-finished edit the moment an editor writes it, and
@@ -1118,7 +1279,7 @@ public record FleetConfig(
      *                 a caller must present {@code Authorization: Bearer <token>} or it is
      *                 {@code ANONYMOUS} and authorized for nothing.
      * @param tokenEnv name of the host env var holding the bearer token; the literal value is
-     *                 never stored in config. Defaults to {@code BRIDGED_API_TOKEN}. Only read
+     *                 never stored in config. Defaults to {@code FLEETD_API_TOKEN}. Only read
      *                 when {@code mode} is {@code token}.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
@@ -1131,7 +1292,7 @@ public record FleetConfig(
 
         public Auth {
             mode = (mode == null || mode.isBlank()) ? MODE_LOOPBACK_TRUST : mode.toLowerCase();
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_API_TOKEN" : tokenEnv;
+            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "FLEETD_API_TOKEN" : tokenEnv;
         }
 
         /** True when a bearer token is required of every non-worker caller. */
@@ -1199,19 +1360,19 @@ public record FleetConfig(
      *               deny-list/deny-by-default every name here that is NOT also in {@link #allow} is
      *               overlaid with a non-secret sentinel value. Under allow-list this list is
      *               reporting only.
-     * @param sshAuthSock whether the member may inherit {@code SSH_AUTH_SOCK} under the allow-list
-     *               policy ({@code "allow"}) or must have it blanked ({@code "block"}, the default).
+     * @param sshAgentEnv whether the member may inherit {@code SSH_AUTH_SOCK} under the allow-list
+     *               policy ({@code "inherit"}) or must have it omitted ({@code "omit"}, the default).
      *               This is a DECISION, never a default: {@code SSH_AUTH_SOCK} is a handle to the
      *               operator's ssh-agent, and a member holding it can sign with the operator's own
      *               keys — but it appears in no secret file and is credential-shaped like nothing on
      *               any list, which is why three earlier tickets missed it (gitea #110 / CB-607).
-     *               Blocking it breaks git over SSH inside the member; allow it only when members do
+     *               Omitting it does not prevent git over SSH inside the member; inherit it only when members do
      *               not need to authenticate as the operator over SSH. Ignored under deny-list /
      *               deny-by-default, which never touch the name.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
     public record MemberCredentials(String policy, List<String> allow, List<String> known,
-                                    String sshAuthSock) {
+                                     String sshAgentEnv) {
 
         /** Default policy: block every {@code known} name not in {@code allow}, via the env overlay. */
         public static final String POLICY_DENY_BY_DEFAULT = "deny-by-default";
@@ -1228,11 +1389,25 @@ public record FleetConfig(
          */
         public static final String POLICY_ALLOW_LIST = "allow-list";
 
-        /** The pre-CB-633 three-field form — {@code sshAuthSock} defaults to blocked. */
+        /** The pre-CB-633 three-field form — {@code sshAgentEnv} defaults to omitted. */
         public MemberCredentials(String policy, List<String> allow, List<String> known) {
             this(policy, allow, known, null);
         }
 
+        /**
+         * Reads both the current {@code sshAgentEnv} key and the compatible {@code sshAuthSock} key.
+         * When both keys are present, {@code sshAgentEnv} wins, even if its value is unrecognised.
+         */
+        @JsonCreator
+        public static MemberCredentials fromYaml(@JsonProperty("policy") String policy,
+                                                @JsonProperty("allow") List<String> allow,
+                                                @JsonProperty("known") List<String> known,
+                                                @JsonProperty("sshAgentEnv") String sshAgentEnv,
+                                                @JsonProperty("sshAuthSock") String sshAuthSock) {
+            return new MemberCredentials(policy, allow, known,
+                    sshAgentEnv != null ? sshAgentEnv : sshAuthSock);
+        }
+
         public MemberCredentials {
             String normalizedPolicy = (policy == null || policy.isBlank())
                     ? POLICY_DENY_BY_DEFAULT : policy.toLowerCase(java.util.Locale.ROOT);
@@ -1241,8 +1416,9 @@ public record FleetConfig(
             policy = POLICY_DENY_LIST.equals(normalizedPolicy) ? POLICY_DENY_BY_DEFAULT : normalizedPolicy;
             allow = allow == null ? List.of() : List.copyOf(allow);
             known = known == null ? List.of() : List.copyOf(known);
-            sshAuthSock = (sshAuthSock != null && "allow".equalsIgnoreCase(sshAuthSock.trim()))
-                    ? "allow" : "block";
+            sshAgentEnv = (sshAgentEnv != null
+                    && ("inherit".equalsIgnoreCase(sshAgentEnv.trim())
+                    || "allow".equalsIgnoreCase(sshAgentEnv.trim()))) ? "inherit" : "omit";
         }
 
         /** True when this block selects the CB-633 derived-allow-list policy. */
@@ -1251,8 +1427,8 @@ public record FleetConfig(
         }
 
         /** True when {@code SSH_AUTH_SOCK} may pass through under the allow-list policy. Default: no. */
-        public boolean sshAuthSockAllowed() {
-            return "allow".equals(sshAuthSock);
+        public boolean sshAgentEnvInherited() {
+            return "inherit".equals(sshAgentEnv);
         }
 
         /** {@link #allow} as a set, for membership checks. */
@@ -1313,13 +1489,13 @@ public record FleetConfig(
      *
      * <p>Package-private (not {@code private}) so a test can assert every key here is documented in
      * {@code fleetd.example.yaml} — the only committed description of the config schema, since
-     * {@code bridged.yaml} itself is gitignored.
+     * {@code fleetd.yaml} itself is gitignored.
      */
     static final Set<String> KNOWN_TOP_LEVEL_KEYS = Set.of(
-            "bind", "herdrSocket", "profiles", "guard", "worktreeRoot",
+            "bind", "herdrSocket", "memberHerdrSocket", "profiles", "guard", "worktreeRoot",
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
             "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
-            "memberCredentials", "coordinator");
+            "memberCredentials", "coordinator", "worktreeGroup", "memberLoginShell");
 
     /** Load and validate config from {@code path}. */
     public static FleetConfig load(Path path) {
@@ -1331,6 +1507,7 @@ public record FleetConfig(
             rejectDuplicateMemberSlots(yaml);
             rejectNegativeMaxLoad(yaml);
             rejectAutoCompactWindowOutOfRange(yaml);
+            rejectMalformedProfilePatterns(yaml);
             rejectUnknownKind(yaml);
             rejectUnknownAuthMode(yaml);
             rejectUnknownPlacement(yaml);
@@ -1342,7 +1519,7 @@ public record FleetConfig(
             rejectUnknownPlacementPolicy(cfg.placement());
             return cfg.withDefaults();
         } catch (IOException e) {
-            throw new UncheckedIOException("cannot read bridged config at " + path, e);
+            throw new UncheckedIOException("cannot read fleetd config at " + path, e);
         }
     }
 
@@ -1679,6 +1856,59 @@ public record FleetConfig(
         }
     }
 
+    /**
+     * Reject a profile whose {@code errorPattern} (fleetd #201 Unit 5) or {@code exhaustedPattern}
+     * (CB-578 stage A) is not a valid Java regex, naming the profile, the key, and the parser's own
+     * message.
+     *
+     * <p>Unset/{@code null} means, for {@code errorPattern}, "use {@code CompletionResolver}'s
+     * built-in {@code (?i)\bAPI Error\s*:} compatibility pattern", and for {@code exhaustedPattern},
+     * "opt out of that classification" — either way it passes silently. A profile that DOES set
+     * either key gets it compiled once at daemon startup ({@code Fleetd.main}) — an uncaught
+     * {@link java.util.regex.PatternSyntaxException} there crashes startup without naming which
+     * profile or key is at fault (fleetd #273: this happened for {@code exhaustedPattern}, which had
+     * no validator here even though its sibling {@code errorPattern} did). Validate eagerly here
+     * instead, at config load, the same "fail loud at load, not lazily later" reasoning as
+     * {@link #rejectAutoCompactWindowOutOfRange}. Both keys are checked from a single load, and any
+     * failures from either are collected together into one message.
+     *
+     * @param yaml the raw config text
+     * @throws IllegalStateException when any profile's {@code errorPattern} or
+     *                                {@code exhaustedPattern} fails to compile
+     */
+    static void rejectMalformedProfilePatterns(String yaml) {
+        Map<?, ?> raw;
+        try {
+            raw = YAML.readValue(yaml, Map.class);
+        } catch (IOException | IllegalArgumentException e) {
+            return; // a malformed file is reported by the real parse, not here
+        }
+        if (raw == null || !(raw.get("profiles") instanceof Map<?, ?> profiles)) {
+            return;
+        }
+        List<String> bad = new ArrayList<>();
+        for (Map.Entry<?, ?> e : profiles.entrySet()) {
+            if (!(e.getValue() instanceof Map<?, ?> p)) {
+                continue;
+            }
+            for (String key : List.of("errorPattern", "exhaustedPattern")) {
+                if (!(p.get(key) instanceof String pattern) || pattern.isBlank()) {
+                    continue;
+                }
+                try {
+                    Pattern.compile(pattern);
+                } catch (PatternSyntaxException ex) {
+                    bad.add("profiles." + e.getKey() + "." + key + " (\"" + pattern + "\"): " + ex.getMessage());
+                }
+            }
+        }
+        bad.sort(String::compareTo);
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: malformed pattern — "
+                    + String.join("; ", bad));
+        }
+    }
+
     /** The peer kinds this build has an adapter for — {@link Profile#kind()}'s only valid values. */
     private static final Set<String> KNOWN_KINDS = Set.of(Profile.KIND_CLAUDE_CODE, Profile.KIND_OPENCODE);
 
@@ -1929,7 +2159,7 @@ public record FleetConfig(
         // guard/lifecycle, an absent block is not a safe "feature off" default here, it is a gap. It
         // is deliberately not pre-populated with a Java-side name list (that would just reintroduce
         // the hardcoded-list defect this record replaces); the block must be configured in
-        // bridged.yaml to protect anything. See fleetd.example.yaml's memberCredentials: comment.
+        // fleetd.yaml to protect anything. See fleetd.example.yaml's memberCredentials: comment.
         // CB-633: policy stays deny-by-default here — the allow-list scrub is opt-in, because it is
         // stricter than today's behaviour (it blanks every non-derived name, not just known ones)
         // and an upgrade must not change what a running deployment's members inherit.
@@ -1937,9 +2167,14 @@ public record FleetConfig(
                 : new MemberCredentials(null, List.of(), List.of());
         // coordinator is left as-is, like broker/primary above: null keeps no LeadMailbox opened,
         // and this ticket's Coordinator is config-only anyway (nothing yet reads it at startup).
-        return new FleetConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
+        // worktreeGroup is left as-is (fleetd #185 stage 3): null/blank is "off", and there is no
+        // sane non-null default — an OS group name is operator-specific.
+        // memberLoginShell is left as-is (fleetd #213), like worktreeGroup: null/blank is "not
+        // configured", and there is no sane non-null default — a member's login shell is
+        // operator-specific and only meaningful when memberHerdrSocket is also set.
+        return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
-                quarantineCooldown, mc, coordinator);
+                quarantineCooldown, mc, coordinator, worktreeGroup, memberLoginShell);
     }
 
     /**
@@ -1969,7 +2204,7 @@ public record FleetConfig(
     /**
      * Reject a lead-scan convention that a worker tab would also satisfy (CB-531).
      *
-     * <p>The scan reads a tab label and concludes "a lead lives here". bridged also <em>writes</em>
+     * <p>The scan reads a tab label and concludes "a lead lives here". fleetd also <em>writes</em>
      * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
      * a member template matches and the daemon starts labelling its own members as leads, promoting
      * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.

fleetd/src/main/java/dev/ltms/fleet/guard/SubscriptionGuard.java

@@ -16,7 +16,7 @@ import java.util.Set;
  *       means its traffic would leave the subscription. That is a hard stop.</li>
  * </ul>
  *
- * Both checks throw {@link GuardException} on violation. {@code bridged} calls
+ * Both checks throw {@link GuardException} on violation. {@code fleetd} calls
  * {@link #assertWorker} before spawning a worker and {@link #assertPrimaryClean}
  * against its own environment at startup.
  */

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -0,0 +1,270 @@
+package dev.ltms.fleet.health;
+
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.session.MemberSession;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.function.BiConsumer;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/** Slow whole-fleet evidence collection. It is deliberately separate from the delivery poller. */
+public final class FleetHealthMonitor {
+    private static final Logger log = LoggerFactory.getLogger(FleetHealthMonitor.class);
+
+    /** Bounded attempts to run {@link #failTarget} for one transition. Never retried tick-to-tick (CB-580). */
+    static final int MAX_FAIL_TARGET_ATTEMPTS = 3;
+    // CB-641: Match the injector's 60s readiness gate so health allows a full first boot.
+    static final long READINESS_GRACE_NANOS = TimeUnit.SECONDS.toNanos(60);
+    /**
+     * fleetd #280: how long after a terminal transition to wait before the one bounded re-check
+     * fires. Must exceed the worst-case reverse-rendezvous {@code fleet_ask} window (55-115s, see
+     * {@code FleetMcp.ASK_DEFAULT_TIMEOUT_MS} / {@code FleetApp.MAX_ASK_TIMEOUT_MS}) so that, if the
+     * target was genuinely {@code ASKING} when {@code state} was first observed, its own ask has had
+     * time to lapse (clearing {@code Task#question} back to {@code null}) before this fires.
+     */
+    static final long ASK_LAPSE_RECHECK_DELAY_SECONDS = 120;
+
+    private final AgentControl agents;
+    private final Supplier<List<MemberSession>> roster;
+    private final MessageService messages;
+    private final ScheduledExecutorService scheduler;
+    private final LongSupplier clock;
+    private final long intervalSeconds;
+    private final long workingSuspectAfterNanos;
+    private final BiConsumer<String, String> failTarget;
+    private final Map<String, HealthPrior> priors = new HashMap<>();
+    /**
+     * The live classification per member, and the only one of this class's three maps that more
+     * than one scheduler task touches. {@code tick} writes it (and prunes it to the roster);
+     * fleetd #280's delayed {@link #recheckTerminalTarget} reads it from its own separate scheduled
+     * task. Both run on the single-threaded scheduler {@code Fleetd} passes in today, so they are
+     * serialised — but nothing in this class enforces that, and an unsynchronised {@link HashMap}
+     * read racing a resize can spin a CPU forever rather than fail visibly. {@code priors} and
+     * {@code orphanStreaks} stay plain maps because {@code tick} is still their only toucher.
+     */
+    private final Map<String, HealthState> states = new ConcurrentHashMap<>();
+    /**
+     * CB-643: consecutive ticks on which a target looked like an orphaned delegation. The fact
+     * {@link MessageService#hasOrphanedDelegation} reports is a true snapshot, but it can read true
+     * for one tick during an ordinary race — an async ticket exists before its virtual thread has
+     * reached {@code rendezvous.open()}, so for that instant nothing is accepted or queued behind
+     * it. {@code decide} maps the field straight to {@code DELEGATION_ORPHANED} with no cross-tick
+     * smoothing of its own, so a single racy read would log a fault that clears on the next tick.
+     * Requiring two consecutive observations costs one interval of latency on a real orphan and
+     * removes that false positive entirely.
+     */
+    private final Map<String, Integer> orphanStreaks = new HashMap<>();
+
+    /** How many consecutive ticks a target must look orphaned before health reports it (CB-643). */
+    static final int ORPHAN_CONFIRM_TICKS = 2;
+
+    // CB-643: every HealthSnapshot field now carries real evidence. The NOT_YET_OBSERVED placeholder
+    // that stood in for 7 of the 12 is gone, and with it the reason 8 of the 9 fault states were
+    // unreachable — GONE and NEVER_READY included, which is what kept CB-580's failTarget from ever
+    // firing. Do not reintroduce a constant here: a field with no publisher is a dead state, and the
+    // tests pass either way, so nothing else will tell you.
+
+    /**
+     * @param failTarget CB-568's idempotent target-wide failure operation (e.g. {@code messages::abandon}),
+     *                   invoked once when a member transitions into a terminal health state. Required —
+     *                   there is deliberately no defaulting overload; a caller that does not want the
+     *                   fail-tickets-on-terminal-health behavior must pass an explicit inert value (see
+     *                   {@code TestTurnTokens.inert} / {@code FleetMcp.CapacitySource.none()} for the pattern).
+     */
+    public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
+                              ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
+                              long workingSuspectAfterSeconds, BiConsumer<String, String> failTarget) {
+        this.agents = agents;
+        this.roster = roster;
+        this.messages = messages;
+        this.scheduler = scheduler;
+        this.clock = clock;
+        this.intervalSeconds = intervalSeconds;
+        this.workingSuspectAfterNanos = TimeUnit.SECONDS.toNanos(workingSuspectAfterSeconds);
+        this.failTarget = Objects.requireNonNull(failTarget, "failTarget");
+    }
+
+    /** Pure per-member decision seam. */
+    static HealthDecision decide(HealthSnapshot snapshot, HealthPrior prior, long nowNanos) {
+        return FleetHealth.decide(snapshot, prior, nowNanos);
+    }
+
+    public void start() { scheduler.schedule(this::tick, intervalSeconds, TimeUnit.SECONDS); }
+    public void stop() { scheduler.shutdownNow(); }
+
+    // Package-private so tests can run one tick without waiting.
+    void tick() {
+        try {
+            List<MemberSession> rosterNow = roster.get(); // One in-memory roster snapshot for this tick.
+            List<Agent> agentsNow;
+            boolean controlLinkDown = false;
+            try {
+                agentsNow = agents.list(); // Exactly one list call for this complete observation.
+            } catch (HerdrException error) {
+                agentsNow = List.of();
+                controlLinkDown = true;
+                log.warn("fleet health control link unavailable; classifying roster", error);
+            }
+            Map<String, Agent> live = new HashMap<>();
+            for (Agent agent : agentsNow) live.put(agent.terminalId(), agent);
+            HashSet<String> current = new HashSet<>();
+            long nowNanos = clock.getAsLong();
+            for (MemberSession session : rosterNow) {
+                current.add(session.terminalId());
+                Agent agent = live.get(session.terminalId());
+                AgentStatus status = agent == null ? AgentStatus.UNKNOWN : agent.status();
+                boolean accepted = messages.hasAcceptedDelivery(session.terminalId());
+                boolean present = agent != null;
+                boolean targetNotFound = !controlLinkDown && !present
+                        && session.state() != MemberSession.State.SPAWNING;
+                boolean readinessGraceElapsed = nowNanos - session.spawnedAtNanos() >= READINESS_GRACE_NANOS;
+                boolean stalled = session.state() == MemberSession.State.BUSY
+                        && nowNanos - session.lastActivityAtNanos() >= workingSuspectAfterNanos;
+                // CB-643: the three message-layer facts CB-640 published. Read them here rather than
+                // leaving them false — that constant is what made 8 of the 9 fault states dead.
+                boolean queuedDelivery = messages.hasQueuedDelivery(session.terminalId());
+                boolean replyStranded = messages.hasStrandedReply(session.terminalId());
+                boolean orphanedDelegation = confirmOrphan(session.terminalId(),
+                        messages.hasOrphanedDelegation(session.terminalId()));
+                HealthSnapshot snapshot = new HealthSnapshot(session.state(), status, accepted, queuedDelivery,
+                        messages.hasInboxMessage(session.terminalId()), present, targetNotFound, controlLinkDown,
+                        readinessGraceElapsed, orphanedDelegation, replyStranded, stalled);
+                HealthDecision decision = decide(snapshot, priors.getOrDefault(session.terminalId(), HealthPrior.NONE),
+                        nowNanos);
+                priors.put(session.terminalId(), decision.prior());
+                reportTransition(session.terminalId(), decision.state());
+            }
+            priors.keySet().retainAll(current);
+            states.keySet().retainAll(current);
+            orphanStreaks.keySet().retainAll(current);
+        } catch (Throwable error) {
+            // Any unclassified collection failure must never kill the monitor's only scheduler task.
+            log.warn("fleet health collection failed; will retry next tick", error);
+        } finally {
+            if (!scheduler.isShutdown()) {
+                scheduler.schedule(this::tick, intervalSeconds, TimeUnit.SECONDS);
+            }
+        }
+    }
+
+    /**
+     * Debounce {@link MessageService#hasOrphanedDelegation} across ticks (CB-643). Returns true only
+     * once {@code observed} has held for {@link #ORPHAN_CONFIRM_TICKS} consecutive ticks; a single
+     * false reading resets the streak, so a transient race never reaches the classifier.
+     */
+    private boolean confirmOrphan(String target, boolean observed) {
+        if (!observed) {
+            orphanStreaks.remove(target);
+            return false;
+        }
+        int streak = orphanStreaks.merge(target, 1, Integer::sum);
+        return streak >= ORPHAN_CONFIRM_TICKS;
+    }
+
+    void reportTransition(String target, HealthState next) {
+        HealthState previous = states.put(target, next);
+        if (previous == next) return;
+        if (fault(next)) {
+            log.warn("fleet health member={} state={} previous={}", target, next, previous);
+        } else if (previous != null && fault(previous)) {
+            log.info("fleet health member={} recovered state={} previous={}", target, next, previous);
+        }
+        // CB-580: a member entering GONE/NEVER_READY must not leave its waiting tickets pending
+        // forever. Fire exactly once per transition — never on a tick where the state is unchanged,
+        // which is what made the rejected commit call abandon() once per tick for as long as a
+        // member stayed terminal.
+        if (terminal(next)) {
+            failTerminalTarget(target, next);
+            scheduleTerminalRecheck(target, next);
+        }
+    }
+
+    private void failTerminalTarget(String target, HealthState state) {
+        String reason = "fleet health: member reached terminal state " + state.name();
+        RuntimeException last = null;
+        for (int attempt = 1; attempt <= MAX_FAIL_TARGET_ATTEMPTS; attempt++) {
+            try {
+                failTarget.accept(target, reason);
+                return;
+            } catch (RuntimeException error) {
+                last = error;
+                log.warn("fleet health: failTarget attempt {}/{} failed for member={} state={}",
+                        attempt, MAX_FAIL_TARGET_ATTEMPTS, target, state, error);
+            }
+        }
+        log.warn("fleet health: giving up on failTarget for member={} state={} after {} attempts",
+                target, state, MAX_FAIL_TARGET_ATTEMPTS, last);
+    }
+
+    /**
+     * fleetd #280: schedule the one bounded, delayed follow-up for a terminal transition — never a
+     * per-tick retry (CB-580 rejected that shape; {@link #reportTransition} still fires
+     * {@link #failTerminalTarget} exactly once per transition, unconditionally on the tick loop).
+     * This is a single one-shot task, scheduled once per transition into GONE/NEVER_READY, so a
+     * member stuck terminal for the rest of its life gets exactly one extra attempt, not one per
+     * tick. See {@link #recheckTerminalTarget} for why the extra attempt is safe.
+     */
+    private void scheduleTerminalRecheck(String target, HealthState state) {
+        if (scheduler.isShutdown()) return;
+        try {
+            scheduler.schedule(() -> recheckTerminalTarget(target, state),
+                    ASK_LAPSE_RECHECK_DELAY_SECONDS, TimeUnit.SECONDS);
+        } catch (RuntimeException e) {
+            log.warn("fleet health: could not schedule terminal re-check for member={} state={}",
+                    target, state, e);
+        }
+    }
+
+    /**
+     * fleetd #280: the delayed re-check {@link #scheduleTerminalRecheck} scheduled for one terminal
+     * transition. By now, a {@code fleet_ask} that was still open when {@code state} was first
+     * observed has had time to lapse on its own (see {@link #ASK_LAPSE_RECHECK_DELAY_SECONDS}),
+     * clearing {@code Task#question} back to {@code null} — which is exactly what
+     * {@link MessageService#abandon(String, String, boolean)}'s {@code sweepAsking=false} filter
+     * needs to finally match it. Calling {@link #failTerminalTarget} again is safe only because
+     * {@code sweepAsking} stays {@code false}: a task genuinely still {@code ASKING} is skipped
+     * exactly as it was on the very first attempt — this never fails a ticket whose ask has not yet
+     * lapsed.
+     *
+     * <p><strong>Guarded on "target is still classified {@code state}."</strong> Without this guard,
+     * a member that recovered (or was released and dropped from the roster) between the transition
+     * and this re-check would still take a blind {@code failTarget} call — reaching into whatever
+     * brand-new, unrelated turn it has since picked up and failing it too. {@link #states} already
+     * carries the live classification (updated every tick, pruned to the current roster on release),
+     * so a stale or recovered target simply reads as a mismatch here and this is a no-op.
+     */
+    void recheckTerminalTarget(String target, HealthState state) {
+        if (states.get(target) != state) return;
+        failTerminalTarget(target, state);
+    }
+
+    private static boolean terminal(HealthState state) {
+        return state == HealthState.GONE || state == HealthState.NEVER_READY;
+    }
+
+    private static boolean fault(HealthState state) {
+        return switch (state) {
+            case NEVER_READY, GONE, TURN_BOUNDARY_LOST, ERROR_ON_SCREEN, STALL_SUSPECTED,
+                    MUTE, REPLY_STRANDED, DELEGATION_ORPHANED, CONTROL_LINK_DOWN -> true;
+            default -> false;
+        };
+    }
+
+    public static String coverage(boolean enabled, boolean notificationConfigured) {
+        return !enabled ? "off" : notificationConfigured ? "full" : "detection-only";
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/AgentControl.java

@@ -38,6 +38,11 @@ public final class AgentControl {
         this.herdr = herdr;
     }
 
+    /** The herdr daemon this control object sends its agent calls to. */
+    public HerdrClient herdr() {
+        return herdr;
+    }
+
     /** One agent-targeted call, translating a terminal id to its pane id (retrying once fresh). */
     private JsonNode agentCall(String method, String target, Map<String, Object> extra) {
         String resolved = resolveTarget(target);

fleetd/src/main/java/dev/ltms/fleet/herdr/AgentStatus.java

@@ -32,7 +32,7 @@ public enum AgentStatus {
         };
     }
 
-    /** Whether {@code bridged} may inject a message now without stepping on a live turn. */
+    /** Whether {@code fleetd} may inject a message now without stepping on a live turn. */
     public boolean injectable() {
         return this == IDLE || this == BLOCKED || this == DONE;
     }

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrClient.java

@@ -5,13 +5,13 @@ import com.fasterxml.jackson.databind.JsonNode;
 /**
  * Client face onto the herdr daemon (protocol 14, herdr 0.7.0).
  *
- * <p>This is the ONLY thing in {@code bridged} that speaks to herdr. Every method
+ * <p>This is the ONLY thing in {@code fleetd} that speaks to herdr. Every method
  * maps to a herdr JSON-RPC call over its Unix domain socket. Requests are
  * newline-delimited JSON with a <em>string</em> id; responses carry either a
  * {@code result} object (whose {@code type} field discriminates the payload) or an
  * {@code error} object.
  *
- * <p>Higher layers ({@code bridged}'s policy brain, REST endpoints, MCP adapters)
+ * <p>Higher layers ({@code fleetd}'s policy brain, REST endpoints, MCP adapters)
  * depend on this interface, not on the socket. Tests substitute a fake; the
  * {@code contract}-tagged suite exercises the real implementation against a running
  * herdr to catch protocol drift.

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrRouter.java

@@ -0,0 +1,40 @@
+package dev.ltms.fleet.herdr;
+
+import java.util.Objects;
+import java.util.function.Predicate;
+
+/** Routes lead operations and member operations to their owning herdr daemon. */
+public final class HerdrRouter implements AutoCloseable {
+    private final HerdrClient lead;
+    private final HerdrClient member;
+    private final AgentControl leadAgents;
+    private final AgentControl memberAgents;
+    private final WorkspaceControl leadSpaces;
+    private final WorkspaceControl memberSpaces;
+    private final Predicate<String> isLead;
+
+    public HerdrRouter(HerdrClient lead, HerdrClient member, Predicate<String> isLead) {
+        this.lead = Objects.requireNonNull(lead, "lead");
+        this.member = member != null ? member : lead;
+        this.isLead = Objects.requireNonNull(isLead, "isLead");
+        leadAgents = new AgentControl(this.lead);
+        memberAgents = this.member == this.lead ? leadAgents : new AgentControl(this.member);
+        leadSpaces = new WorkspaceControl(this.lead);
+        memberSpaces = this.member == this.lead ? leadSpaces : new WorkspaceControl(this.member);
+    }
+
+    public AgentControl leadAgents() { return leadAgents; }
+    public WorkspaceControl leadSpaces() { return leadSpaces; }
+    public AgentControl memberAgents() { return memberAgents; }
+    public WorkspaceControl memberSpaces() { return memberSpaces; }
+    public AgentControl agentsFor(String targetId) { return isLead.test(targetId) ? leadAgents : memberAgents; }
+
+    HerdrClient leadClient() { return lead; }
+    HerdrClient memberClient() { return member; }
+
+    @Override
+    public void close() {
+        lead.close();
+        if (member != lead) member.close();
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -39,18 +39,18 @@ import java.util.function.Supplier;
  *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
  *       become a lead by being placed — as a split, say — inside a matching tab.</li>
  *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
- *       {@link WorkspaceControl}, which no {@code bridge_*} tool exposes. The label is writable by
+ *       {@link WorkspaceControl}, which no {@code fleet_*} tool exposes. The label is writable by
  *       the human at the terminal and by nobody the bridge is defending against.</li>
  *   <li>The label is a <em>name</em>, not a capability. What a pane may do is decided by
  *       {@code Authz} against the role {@code CallerResolver} returns; a tab that calls itself a
  *       lead still cannot act as one unless the daemon's own registry agrees.</li>
  * </ol>
  *
- * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
- * that bridged never renames a lead tab, so the label was always the human's own writing and there
+ * <p><strong>CB-558 — fleetd now writes lead labels too.</strong> This class used to be able to say
+ * that fleetd never renames a lead tab, so the label was always the human's own writing and there
  * was no round-trip from the daemon's rename back into its next decision.
  * {@code dev.ltms.fleet.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
- * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
+ * daemon and found again by this scan. The trust direction above is unaffected — fleetd writing a
  * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
  * real: a label left behind by a session that has since died would read as a live lead forever.
  * This scanner does not solve that (its job is naming, and a stale name costs nothing here); the

fleetd/src/main/java/dev/ltms/fleet/herdr/PaneLocator.java

@@ -0,0 +1,147 @@
+package dev.ltms.fleet.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.OptionalLong;
+import java.util.Set;
+
+/**
+ * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
+ * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
+ * the agent pane whose process tree contains it, so {@code fleetd} can tell <em>which worker</em>
+ * is calling without the worker sending anything spoofable.
+ *
+ * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
+ * and foreground process PIDs. A pid that is neither of those directly — e.g. a grandchild a
+ * worker spawned, such as a {@code python3} or {@code curl} helper that opens its own MCP
+ * connection — is resolved by walking its ancestry (via {@link ParentResolver}) up to the root and
+ * matching any ancestor against a pane's {@code shell_pid} or foreground pids (CB-161). Without
+ * this walk such a pid matches no pane, and the caller falls through to loopback-trust and is
+ * resolved as the primary — a worker→primary privilege escalation.
+ *
+ * <p>This scans agent panes; a spawn-time {@code pid→terminal} cache is the obvious optimization
+ * once wired into {@code ClaudeCodeLauncher}.
+ *
+ * <p>CB-185 split the fleet across two herdr daemons — lead operations on one, members on the
+ * other ({@code memberHerdrSocket}). A caller's pane can live on <em>either</em> daemon (a lead's
+ * MCP connection resolves against the lead daemon; a member's against the member daemon), so this
+ * must be able to search more than one client. {@link #PaneLocator(HerdrClient, HerdrClient)}
+ * searches the lead client first, then the member client, and collapses to a single scan when the
+ * two are the same object (the historical single-daemon deployment). The caller's ancestor set is
+ * computed once per {@link #terminalForPid} call and reused across every client searched — it
+ * does not depend on which daemon a pane happens to live on.
+ */
+public final class PaneLocator {
+
+    /**
+     * Bound on how many ancestor generations {@link #ancestorsOf} walks. This runs on every MCP
+     * call, so a cycle or a pathologically deep process tree must not hang identity resolution;
+     * 32 generations is far more than any real worker→helper process tree needs.
+     */
+    private static final int MAX_ANCESTRY_DEPTH = 32;
+
+    private final List<HerdrClient> herdrs;
+    private final ParentResolver parentResolver;
+
+    /** Search only this client — the single-daemon deployment. */
+    public PaneLocator(HerdrClient herdr) {
+        this(herdr, ParentResolver.PROCESS_HANDLE);
+    }
+
+    /** Search only this client, resolving ancestry through {@code parentResolver} — for tests. */
+    public PaneLocator(HerdrClient herdr, ParentResolver parentResolver) {
+        this.herdrs = List.of(herdr);
+        this.parentResolver = parentResolver;
+    }
+
+    /**
+     * Search {@code lead} first, then {@code member} — the two-daemon deployment (CB-185). When
+     * the caller passes the same client for both (no {@code memberHerdrSocket} configured), this
+     * collapses to one client and one scan, exactly {@link #PaneLocator(HerdrClient)}'s behaviour.
+     */
+    public PaneLocator(HerdrClient lead, HerdrClient member) {
+        this(lead, member, ParentResolver.PROCESS_HANDLE);
+    }
+
+    /** Two-daemon deployment, resolving ancestry through {@code parentResolver} — for tests. */
+    public PaneLocator(HerdrClient lead, HerdrClient member, ParentResolver parentResolver) {
+        this.herdrs = lead == member ? List.of(lead) : List.of(lead, member);
+        this.parentResolver = parentResolver;
+    }
+
+    /**
+     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
+     * {@code null} if no agent pane on any searched daemon owns it (e.g. the caller is the
+     * primary, or off-host).
+     */
+    public String terminalForPid(long pid) {
+        if (pid <= 0) {
+            return null;
+        }
+        Set<Long> ancestry = ancestorsOf(pid);
+        for (HerdrClient herdr : herdrs) {
+            String terminal = terminalForPid(herdr, ancestry);
+            if (terminal != null) {
+                return terminal;
+            }
+        }
+        return null;
+    }
+
+    /**
+     * {@code pid} itself plus its ancestor chain, walked through {@link #parentResolver} up to
+     * {@link #MAX_ANCESTRY_DEPTH} generations or pid 1, whichever comes first. A vanished ancestor
+     * ({@link ParentResolver#parentOf} returning empty) ends the walk without error — it just means
+     * the chain is shorter than the bound. A cycle in a fake resolver is caught by the "already
+     * seen" check and also ends the walk, so this can never loop.
+     */
+    private Set<Long> ancestorsOf(long pid) {
+        Set<Long> ancestry = new LinkedHashSet<>();
+        long current = pid;
+        for (int depth = 0; depth < MAX_ANCESTRY_DEPTH; depth++) {
+            if (current <= 0 || !ancestry.add(current)) {
+                break; // vanished/invalid pid, or a cycle back to a pid already recorded
+            }
+            if (current == 1) {
+                break; // reached the root of the process tree
+            }
+            OptionalLong parent = parentResolver.parentOf(current);
+            if (parent.isEmpty()) {
+                break; // vanished ancestor — not an error, just the end of the chain
+            }
+            current = parent.getAsLong();
+        }
+        return ancestry;
+    }
+
+    private static String terminalForPid(HerdrClient herdr, Set<Long> ancestry) {
+        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
+            String paneId = pane.path("pane_id").asText(null);
+            if (paneId != null && paneOwnsAnyOf(herdr, paneId, ancestry)) {
+                return pane.path("terminal_id").asText(null);
+            }
+        }
+        return null;
+    }
+
+    private static boolean paneOwnsAnyOf(HerdrClient herdr, String paneId, Set<Long> ancestry) {
+        JsonNode info;
+        try {
+            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
+        } catch (HerdrException e) {
+            return false; // pane vanished mid-scan — just skip it
+        }
+        if (ancestry.contains(info.path("shell_pid").asLong(-1))) {
+            return true;
+        }
+        for (JsonNode p : info.path("foreground_processes")) {
+            if (ancestry.contains(p.path("pid").asLong(-1))) {
+                return true;
+            }
+        }
+        return false;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/ParentResolver.java

@@ -0,0 +1,21 @@
+package dev.ltms.fleet.herdr;
+
+import java.util.OptionalLong;
+
+/**
+ * Resolves a pid's parent pid — the seam {@link PaneLocator} walks a process's ancestry through,
+ * so its tests can drive the walk from a fake pid→parent map instead of spawning real processes.
+ *
+ * <p>{@link #PROCESS_HANDLE} is the production implementation, backed by {@link ProcessHandle}.
+ */
+public interface ParentResolver {
+
+    /** The parent pid of {@code pid}, or empty if {@code pid} is gone or has no known parent. */
+    OptionalLong parentOf(long pid);
+
+    /** Production resolver: asks the JVM's {@link ProcessHandle} view of the OS process tree. */
+    ParentResolver PROCESS_HANDLE = pid -> ProcessHandle.of(pid)
+            .flatMap(ProcessHandle::parent)
+            .map(parent -> OptionalLong.of(parent.pid()))
+            .orElse(OptionalLong.empty());
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/Workspace.java

@@ -7,7 +7,7 @@ import com.fasterxml.jackson.databind.JsonNode;
  * dedicated worker space so they never split or clutter the user's real work spaces.
  *
  * @param workspaceId herdr's stable id (e.g. {@code "w4"})
- * @param label       display label shown in herdr's UI (e.g. {@code "bridged-workers"})
+ * @param label       display label shown in herdr's UI (e.g. {@code "fleetd-workers"})
  * @param activeTabId the workspace's currently-focused tab, or {@code null}
  */
 public record Workspace(String workspaceId, String label, String activeTabId) {

fleetd/src/main/java/dev/ltms/fleet/inject/BackendErrorPatternLookup.java

@@ -0,0 +1,35 @@
+package dev.ltms.fleet.inject;
+
+import java.util.regex.Pattern;
+
+/**
+ * Per-target lookup for a profile's configured backend-error pattern (fleetd#201 / #227): how
+ * {@link CompletionResolver} recognizes a backend that failed a turn outright (a credential
+ * outage, a provider 5xx) from whatever ends up on the member's pane, apart from a genuine
+ * completion.
+ *
+ * <p>The pattern is always profile config, never a vendor string in Java source: every backend
+ * words its failure differently, so a hardcoded sentence would only ever match one of them. A
+ * target with no configured pattern is not "off" the way {@link ExhaustedPatternLookup#none()}
+ * is — {@link CompletionResolver} falls back to its narrow {@code (?i)\bAPI Error\s*:}
+ * compatibility pattern instead, so classification still happens, just without a profile-specific
+ * match. {@link #legacy()} is the explicit stand-in existing (pre-fleetd#201) callers pass to get
+ * exactly that fallback-only behavior until a caller wires a real, profile-driven lookup
+ * (fleetd#201 Unit 5).
+ */
+@FunctionalInterface
+public interface BackendErrorPatternLookup {
+
+    /** The compiled pattern configured for {@code target}'s profile, or {@code null} if none. */
+    Pattern patternFor(String target);
+
+    /**
+     * Legacy lookup — no profile has a configured pattern, so {@link CompletionResolver} classifies
+     * every target using only its built-in {@code (?i)\bAPI Error\s*:} compatibility pattern. The
+     * explicit stand-in existing constructors pass so their behavior is unchanged until a caller
+     * wires a real, profile-driven lookup.
+     */
+    static BackendErrorPatternLookup legacy() {
+        return target -> null;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/inject/BackendErrorSink.java

@@ -0,0 +1,35 @@
+package dev.ltms.fleet.inject;
+
+/**
+ * Notified when {@link CompletionResolver} actually delivers a typed backend-error classification
+ * to a waiting send (fleetd#201 / #227) — never on a race that lost. {@link CompletionResolver}
+ * calls this only after {@code Rendezvous.resolveFailure} returns {@code true} for that exact
+ * waiter, mirroring the win-only race rule {@link ExhaustionSink} already uses.
+ *
+ * <p>The public send result is unchanged by this classification — it is still a failed send
+ * ({@code Rendezvous.Kind#FAILED}); this sink is the internal seam a later stage (fleetd#201 Unit
+ * 5, the policy that cools a credential off after two such failures in 60 seconds and tells the
+ * lead) consumes. {@link CompletionResolver} knows only {@code target} (a herdr terminal id); it
+ * has no notion of profiles or credentials, so mapping {@code target} to whatever should be
+ * quarantined is entirely the sink's job — exactly like {@link ExhaustionSink}.
+ */
+@FunctionalInterface
+public interface BackendErrorSink {
+
+    /**
+     * @param target      the herdr terminal id whose turn was classified as a backend error
+     * @param matchedLine the single pane line that matched the backend-error pattern
+     * @param reason      the full failure reason carried by the classification (the matched line
+     *                    plus whatever pane context the classifying path attaches)
+     */
+    void onBackendError(String target, String matchedLine, String reason);
+
+    /**
+     * Inert sink — nothing happens on a backend-error classification. The explicit stand-in a
+     * caller (or a test not exercising this feature) passes instead of a defaulting overload,
+     * exactly like {@link ExhaustionSink#none()}.
+     */
+    static BackendErrorSink none() {
+        return (target, matchedLine, reason) -> { };
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -0,0 +1,696 @@
+package dev.ltms.fleet.inject;
+
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.time.Duration;
+import java.util.List;
+import java.util.Objects;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.LongSupplier;
+import java.util.function.Function;
+import java.util.regex.Pattern;
+
+/**
+ * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
+ * {@link Rendezvous} so a blocking {@code fleet_send} resolves even when the worker finishes its
+ * task without ever calling {@code fleet_reply} — the common case for a real delegated coding task.
+ *
+ * <p>On a confirmed {@code working → idle} boundary it scrapes the worker's recent transcript and
+ * resolves the awaiting send with that tail (a {@link Rendezvous.Kind#COMPLETION} resolution, so the
+ * caller can tell a scrape from a structured reply). It scrapes only when a send is actually waiting
+ * — a fleet worker's own turns, or a send that already timed out, cost no herdr traffic. An explicit
+ * {@code fleet_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
+ *
+ * <p>It also handles the CB-109 stall signal ({@link #onTurnFailed}): a worker that ran a turn then
+ * wedged in an {@code unknown} state resolves the send as a failure (with the error screen as
+ * context) rather than leaving it to time out.
+ *
+ * <p>The scrape is cleaned to the last {@code ⏺} assistant block (stripping TUI chrome) and guarded
+ * against misattribution (CB-115): the pane content is baselined on delivery ({@link #onDelivered}),
+ * and a completion whose scrape is unchanged from that baseline — the previous turn's wind-down
+ * sampled as this turn's boundary on a rapid back-to-back send — is suppressed rather than resolving
+ * the send with a stale answer.
+ *
+ * <p><strong>Waiter-specific resolution (CB-116).</strong> On delivery we also capture the exact
+ * {@link Rendezvous} waiter this turn belongs to, and the completion/failure fallbacks resolve
+ * <em>that</em> waiter — never "whatever send is waiting now". A completion fallback runs on a virtual
+ * thread and can land after the worker's {@code fleet_reply} already resolved the turn and the
+ * <em>next</em> send opened its own waiter on the same session; resolving the current waiter would
+ * then deliver turn N's stale scrape as turn N+1's answer. Targeting the captured waiter makes a late
+ * completion a harmless no-op (its waiter is already done) instead of a cross-turn stale reply.
+ *
+ * <p>Wired as the {@link Injector}'s {@link TurnListener}; the handlers hand off to a virtual thread
+ * so the scrape's herdr round-trip never stalls the status poller. The captured waiter is read on the
+ * poller thread (before any next-turn delivery can overwrite it) and passed into the virtual thread.
+ */
+public final class CompletionResolver implements TurnListener {
+
+    private static final Logger log = LoggerFactory.getLogger(CompletionResolver.class);
+
+    /**
+     * herdr {@code agent.read} source for the completion scrape. {@code recent} returns the tail of
+     * the transcript (the worker's last output), which is what a delegator wants when the worker
+     * didn't structure a reply.
+     */
+    static final String SCRAPE_SOURCE = "recent";
+
+    /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
+    static final int MAX_SCRAPE_CHARS = 4000;
+
+    /**
+     * fleetd#164: the floor below which a {@code BUSY -> DONE} transition cannot be real work. A
+     * backend that rejects a turn outright (e.g. an HTTP 400 from the model, before the worker read
+     * a single file or produced a token) drives the exact same confirmed {@code working -> idle}
+     * transition a genuine completion does — just in about a second instead of the many seconds a
+     * real turn costs. {@link #onTurnComplete} cannot tell those two cases apart from the transition
+     * alone, so a turn that settles inside this floor is treated as a crash signature and resolved
+     * as a failure, never as a (possibly empty) success.
+     */
+    public static final long MIN_TURN_NANOS = Duration.ofSeconds(2).toNanos();
+
+    /**
+     * fleetd#164 (part 2): one stable, explicit backend-failure marker seen on a Claude Code pane
+     * when the backend itself rejected the turn (e.g. {@code "API Error: 400 invalid request body"}).
+     * Kept deliberately narrow — a growing list of ad-hoc error strings rots as backends change their
+     * wording; broader backend-error surfacing is out of scope here (fleetd#164 point 3).
+     */
+    private static final Pattern BACKEND_ERROR = Pattern.compile("(?i)\\bAPI Error\\s*:");
+
+    private static final String CLIPPED_PANE_TAIL_MARKER =
+            "[Pane tail clipped: member did not call fleet_reply.]";
+
+    /** A pane echo must be this large before it can replace a completion report. */
+    static final int ECHO_MIN_CHARS = 400;
+
+    /** Normalised TUI chrome may add this many characters to an otherwise echoed brief. */
+    static final int MAX_ECHO_EXCESS_CHARS = 160;
+
+    /** The explicit result returned instead of a lead's echoed injected brief. */
+    public static final String NO_REPORT_PREFIX = "[no report — the member ended its turn without fleet_reply, "
+            + "and the pane still shows the injected brief. Nothing was produced on the pane. Check the "
+            + "member's worktree and branch for committed work before re-delegating.";
+
+    private final AgentControl agents;
+    private final Rendezvous rendezvous;
+    private final ExhaustedPatternLookup exhaustedPatterns;
+    private final ExhaustionSink exhaustionSink;
+    private final BackendErrorPatternLookup backendErrorPatterns;
+    private final BackendErrorSink backendErrorSink;
+    private final LongSupplier nowNanos;
+    private final Function<String, WorktreeBranch> worktreeBranches;
+
+    /** Known member location, used only to guide a lead after an echoed brief. */
+    public record WorktreeBranch(String worktree, String branch) {
+    }
+
+    /**
+     * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
+     * delivering send opened, plus the assistant block present when it was delivered.
+     *
+     * <p>The {@code waiter} is what makes a late fallback safe (CB-116): we resolve it, not "whoever
+     * is waiting now", so a completion that fires after the next send has opened its own waiter is a
+     * no-op rather than a cross-turn stale reply. The {@code baseline} is the CB-115 staleness
+     * reference: a completion scrape equal to it means the worker produced no new output (the previous
+     * turn's wind-down sampled as this boundary), so it is suppressed. Overwritten on each delivery;
+     * cleared when the turn resolves. Package-private so tests can capture and replay a specific turn.
+     *
+     * <p>{@code deliveredAtNanos} (fleetd#164) is the {@link #nowNanos} reading taken at delivery —
+     * the other half of the {@link #MIN_TURN_NANOS} floor check, compared against a fresh reading at
+     * resolution time.
+     */
+    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline, long deliveredAtNanos,
+                    String injectedText) {
+
+        /**
+         * Convenience for tests exercising scrape/suppression logic that don't care about turn
+         * timing: back-dates the delivery far enough that {@link #MIN_TURN_NANOS} can never fire.
+         * Not used by production code — {@link #captureBaseline} always records a real reading.
+         */
+        InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
+            this(waiter, baseline, Long.MIN_VALUE / 2, null);
+        }
+
+        InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline, long deliveredAtNanos) {
+            this(waiter, baseline, deliveredAtNanos, null);
+        }
+    }
+
+    private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();
+
+    /**
+     * @param exhaustedPatterns CB-578 stage A: per-target lookup for a profile's configured
+     *                          usage-limit refusal pattern. Required — there is deliberately no
+     *                          defaulting overload; a caller that does not want the classification
+     *                          must pass an explicit inert value ({@link ExhaustedPatternLookup#none()}).
+     * @param exhaustionSink    CB-578 stage B: notified when a {@code BACKEND_EXHAUSTED}
+     *                          classification actually resolves a waiter. Required for the same
+     *                          reason as {@code exhaustedPatterns} — pass {@link ExhaustionSink#none()}
+     *                          to opt out.
+     *
+     * <p>Transition constructor (fleetd#201 Unit 1): delegates to the full constructor below with
+     * {@link BackendErrorPatternLookup#legacy()} and {@link BackendErrorSink#none()}, so every
+     * existing caller keeps today's behavior — the narrow built-in {@code API Error:} match, no
+     * sink notified — until a caller wires a real, profile-driven backend-error lookup and sink
+     * (fleetd#201 Unit 5).
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                               ExhaustionSink exhaustionSink) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink,
+                BackendErrorPatternLookup.legacy(), BackendErrorSink.none(), System::nanoTime);
+    }
+
+    /** Production constructor with a lookup for the member worktree and branch. */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                              ExhaustionSink exhaustionSink, Function<String, WorktreeBranch> worktreeBranches) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink,
+                BackendErrorPatternLookup.legacy(), BackendErrorSink.none(), System::nanoTime, worktreeBranches);
+    }
+
+    /**
+     * Transition constructor (fleetd#201 Unit 1): same legacy backend-error defaults as the 4-arg
+     * constructor above, but with the injectable clock. Kept so existing fleetd#164 timing tests
+     * (and any other caller that wants a controllable clock but not the backend-error feature)
+     * keep compiling unchanged.
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                       ExhaustionSink exhaustionSink, LongSupplier nowNanos) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink,
+                BackendErrorPatternLookup.legacy(), BackendErrorSink.none(), nowNanos);
+    }
+
+    /**
+     * Production constructor (fleetd#201 Unit 1): adds the target-keyed backend-error pattern
+     * lookup and sink alongside the existing exhaustion pair. Required, like {@code exhaustedPatterns}
+     * and {@code exhaustionSink} — pass {@link BackendErrorPatternLookup#legacy()} and
+     * {@link BackendErrorSink#none()} to opt out.
+     *
+     * @param backendErrorPatterns fleetd#201: per-target lookup for a profile's configured
+     *                             backend-error pattern; a target with none configured is matched
+     *                             against the built-in compatibility pattern instead (never "off").
+     * @param backendErrorSink     fleetd#201: notified when a backend-error classification actually
+     *                             resolves a waiter — never on a race that lost.
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                       ExhaustionSink exhaustionSink, BackendErrorPatternLookup backendErrorPatterns,
+                       BackendErrorSink backendErrorSink) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink, backendErrorPatterns, backendErrorSink,
+                System::nanoTime, _ -> null);
+    }
+
+    /**
+     * Test constructor with an injectable clock (fleetd#164), matching the {@code LongSupplier}
+     * pattern {@link dev.ltms.fleet.session.SessionManager} and {@link dev.ltms.fleet.msg.MessageService}
+     * already use: lets a test place a turn's delivery and its resolution at an exact, controllable
+     * distance apart around the {@link #MIN_TURN_NANOS} floor, without a real sleep. Public (rather
+     * than package-private like those two) because callers that wire a full {@code MessageService}
+     * fixture — e.g. {@code MessageServiceTest} — construct this resolver directly from another
+     * package.
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                        ExhaustionSink exhaustionSink, BackendErrorPatternLookup backendErrorPatterns,
+                        BackendErrorSink backendErrorSink, LongSupplier nowNanos) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink, backendErrorPatterns, backendErrorSink,
+                nowNanos, _ -> null);
+    }
+
+    /** Full constructor with injectable clock and member location lookup. */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                        ExhaustionSink exhaustionSink, BackendErrorPatternLookup backendErrorPatterns,
+                        BackendErrorSink backendErrorSink, LongSupplier nowNanos,
+                        Function<String, WorktreeBranch> worktreeBranches) {
+        this.agents = agents;
+        this.rendezvous = rendezvous;
+        this.exhaustedPatterns = Objects.requireNonNull(exhaustedPatterns, "exhaustedPatterns");
+        this.exhaustionSink = Objects.requireNonNull(exhaustionSink, "exhaustionSink");
+        this.backendErrorPatterns = Objects.requireNonNull(backendErrorPatterns, "backendErrorPatterns");
+        this.backendErrorSink = Objects.requireNonNull(backendErrorSink, "backendErrorSink");
+        this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
+        this.worktreeBranches = Objects.requireNonNull(worktreeBranches, "worktreeBranches");
+    }
+
+    @Override
+    public void onDelivered(String target, TurnToken token) {
+        // Capture the exact waiter this turn belongs to (CB-116) and snapshot the pane's pre-turn
+        // content — what it shows *before* the just-delivered turn produces output — as the staleness
+        // reference (CB-115). Done synchronously (like the delivering send itself) so both are in
+        // place before this turn's completion can fire.
+        captureBaseline(target, token);
+    }
+
+    /** Capture the in-flight turn: its waiter and pre-turn baseline (the testable core of {@link #onDelivered}). */
+    void captureBaseline(String target, TurnToken token) {
+        CompletableFuture<Rendezvous.Resolution> waiter = token.waiter();
+        if (waiter == null) {
+            inFlight.remove(target); // no send is waiting on this delivery — nothing to resolve later
+            return;
+        }
+        String baseline;
+        try {
+            // Clip to the same cap resolve() applies to the tail (line ~134): the CB-115 misattribution
+            // guard compares baseline.equals(tail), so both sides must be the same capped representation.
+            // An unclipped baseline vs a clipped tail would never match for a >MAX_SCRAPE_CHARS block,
+            // defeating the guard and letting a stale completion resolve the send.
+            baseline = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
+        } catch (RuntimeException e) {
+            baseline = null; // fail open: no baseline ⇒ no suppression
+            log.debug("delivery baseline for {} failed: {}", target, e.getMessage());
+        }
+        inFlight.put(target, new InFlight(waiter, baseline, nowNanos.getAsLong(), token.injectedText()));
+    }
+
+    /** The turn currently baselined for {@code target}, or {@code null} — a test hook for the captureBaseline path. */
+    InFlight inFlight(String target) {
+        return inFlight.get(target);
+    }
+
+    @Override
+    public void onTurnComplete(String target) {
+        // Read the in-flight turn on the poller thread — before any next-turn delivery can overwrite
+        // it — then off-load the scrape (a herdr round-trip we must not block polling on) to a vthread.
+        InFlight turn = inFlight.get(target);
+        Thread.ofVirtual().name("completion-" + target).start(() -> resolve(target, turn));
+    }
+
+    /**
+     * Resolve the completed turn before adapter housekeeping can erase its rendered output. This is
+     * intentionally synchronous and used only when a post-turn context reset is enabled; the normal
+     * path remains off-loaded so polling is not blocked by a scrape.
+     */
+    public void resolveBeforePostAction(String target) {
+        resolve(target, inFlight.get(target));
+    }
+
+    @Override
+    public void onTurnFailed(String target) {
+        InFlight turn = inFlight.get(target);
+        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn, null));
+    }
+
+    @Override
+    public void onTurnFailed(String target, String reason) {
+        InFlight turn = inFlight.get(target);
+        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn, reason));
+    }
+
+    /** Synchronous resolve (the unit-testable core of {@link #onTurnComplete}). */
+    void resolve(String target, InFlight turn) {
+        CompletableFuture<Rendezvous.Resolution> waiter = turn == null ? null : turn.waiter();
+        if (waiter == null || waiter.isDone()) {
+            // Nobody is blocked on THIS turn (it had no send, or its fleet_reply already won). Skip
+            // the scrape; resolving the current waiter here would be the CB-116 cross-turn stale reply.
+            inFlight.remove(target, turn);
+            return;
+        }
+        // fleetd#164: a BUSY -> DONE transition inside the floor cannot be real work — it's a crash
+        // signature (e.g. a backend HTTP 400 before the worker did anything), not a fast answer. Fail
+        // it before spending a scrape on the ordinary path; the reason still carries whatever is on
+        // screen, since that is usually the backend's own error.
+        long elapsedNanos = nowNanos.getAsLong() - turn.deliveredAtNanos();
+        if (elapsedNanos < MIN_TURN_NANOS) {
+            failTooFast(target, turn, waiter, elapsedNanos);
+            return;
+        }
+        String tail;
+        String assistantBlock = null;
+        String rawScrape = null;
+        int originalLength = 0;
+        boolean clipped = false;
+        boolean scrapeFailed = false;
+        try {
+            rawScrape = agents.read(target, SCRAPE_SOURCE);
+            assistantBlock = lastAssistantBlock(rawScrape);
+            originalLength = assistantBlock.strip().length();
+            clipped = originalLength > MAX_SCRAPE_CHARS;
+            tail = clip(assistantBlock);
+        } catch (RuntimeException e) {
+            log.warn("completion scrape for {} failed: {}", target, e.getMessage());
+            tail = "";
+            scrapeFailed = true;
+        }
+        // fleetd#164: a scrape nobody could read, and a scrape that read cleanly but produced nothing,
+        // both used to resolve the send as a SUCCESS carrying "" — indistinguishable from a worker that
+        // genuinely finished with nothing to say. That is the defect: fail loudly instead, naming the
+        // member, so a caller (including a lead deciding whether to delegate again) can tell a lost
+        // turn from a real empty answer.
+        if (scrapeFailed || tail.isEmpty()) {
+            // fleetd#211: lastAssistantBlock() found nothing usable — most often a pane with no ⏺
+            // marker at all, whose boundary scan then starts at the top of the raw screen and breaks
+            // immediately on the first line of TUI chrome (╭, │, ❯, …). Before giving up as a lost
+            // turn, run the same exhaustion/backend-error classification against the RAW scrape as a
+            // fallback, ONLY here. A pane that already yielded a usable block never reaches this
+            // branch, so the narrow (trimmed) match on the normal path below is completely unchanged
+            // — zero new false positives there. Every pane this fallback examines was already headed
+            // for the empty-scrape failure, so a wrong label here is strictly less bad than silently
+            // losing an exhaustion signal: the alternative outcome is already a failure, just one that
+            // never quarantines the credential. lastAssistantBlock stays the source of the reply
+            // TEXT everywhere else; only classification ever consults the raw scrape, and only here.
+            if (rawScrape != null && classifyRawScrapeFallback(target, turn, waiter, rawScrape)) {
+                return;
+            }
+            fail(target, turn, emptyScrapeReason(target, scrapeFailed));
+            return;
+        }
+        // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
+        // delivery, this turn produced no new output — the boundary belongs to the previous turn's
+        // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
+        // a stale answer; the real fleet_reply (or a later genuine completion) resolves it instead.
+        String baseline = turn.baseline();
+        if (baseline != null && baseline.equals(tail)) {
+            log.debug("suppressing misattributed completion for {} (no output change since delivery)",
+                    target);
+            return; // keep the in-flight record: a later genuine completion still needs it
+        }
+        // CB-578 stage A: a turn that ended with no fleet_reply AND whose scrape matches the
+        // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
+        // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
+        Pattern exhausted = exhaustedPatterns.patternFor(target);
+        String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
+        if (matchedLine != null) {
+            String reason = "backend exhausted (usage limit): " + matchedLine;
+            if (rendezvous.resolveExhausted(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("completion for {} classified BACKEND_EXHAUSTED (no fleet_reply; scrape "
+                        + "matched the profile's exhausted pattern): {}", target, reason);
+                // CB-578 stage B: only on the resolution that actually won the race — a late
+                // duplicate must never quarantine a credential twice for one refusal.
+                exhaustionSink.onExhausted(target, reason);
+            }
+            return;
+        }
+        // fleetd#164 (part 2) / fleetd#201: a scrape that read cleanly and produced content still
+        // isn't a real reply when that content is the backend's own rejection (e.g. an HTTP 400
+        // before the worker did any work). Classify it as a failure naming the member, rather than
+        // handing the caller a scrape that reads like a completed answer, and — only on the
+        // resolution that actually wins the race, mirroring the exhaustion sink above — notify the
+        // typed backend-error sink so a later stage can act on repeated failures.
+        String backendError = firstMatchingLine(assistantBlock, backendErrorPatternOrFallback(target));
+        if (backendError != null) {
+            // Carry the whole scrape, not just the matched line. The pattern is a heuristic: a member
+            // that forgot fleet_reply while reporting *about* a backend error matches it too. Failing
+            // is still right — the caller must not read a scrape as an answer — but dropping the rest
+            // of the pane would destroy the report, which is the same defect fleetd#164 is about.
+            String reason = "member " + target + " ended on a backend error: " + backendError
+                    + "\n--- pane tail ---\n" + tail;
+            if (rendezvous.resolveFailure(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
+                // fleetd#201 Unit 1: only on the resolution that actually won the race — a late
+                // duplicate must never double-count one backend failure.
+                backendErrorSink.onBackendError(target, backendError, reason);
+            }
+            return;
+        }
+        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
+        if (echoesInjectedBrief(tail, turn.injectedText())) {
+            completion = noReportMessage(target) + (clipped ? "\n" + CLIPPED_PANE_TAIL_MARKER : "");
+        }
+        if (rendezvous.resolveCompletion(waiter, completion)) {
+            inFlight.remove(target, turn);
+            if (clipped) {
+                log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
+                                + "member did not call fleet_reply, so the pane tail is partial",
+                        target, originalLength, MAX_SCRAPE_CHARS);
+            }
+            log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
+                    target, tail.length());
+        }
+    }
+
+    /**
+     * A full echoed brief is at least 400 normalised characters. A scrape that contains the brief may
+     * add no more than 160 normalised characters of TUI chrome. This accepts harmless status text, but
+     * preserves a real report that restates the full brief before adding substantive content.
+     */
+    static boolean echoesInjectedBrief(String scrape, String injectedText) {
+        String normalScrape = normalize(scrape);
+        String normalInjected = normalize(injectedText);
+        if (normalScrape.length() < ECHO_MIN_CHARS || normalInjected.length() < ECHO_MIN_CHARS) {
+            return false;
+        }
+        if (normalInjected.contains(normalScrape)) {
+            return true;
+        }
+        return normalScrape.contains(normalInjected)
+                && normalScrape.length() - normalInjected.length() <= MAX_ECHO_EXCESS_CHARS;
+    }
+
+    private static String normalize(String text) {
+        return text == null ? "" : text.toLowerCase().replaceAll("[^a-z0-9]+", "");
+    }
+
+    private String noReportMessage(String target) {
+        WorktreeBranch location = worktreeBranches.apply(target);
+        if (location == null || (location.worktree() == null && location.branch() == null)) {
+            return NO_REPORT_PREFIX + "]";
+        }
+        String locationText = location.worktree() == null ? "" : " worktree=" + location.worktree();
+        if (location.branch() != null) {
+            locationText += " branch=" + location.branch();
+        }
+        return NO_REPORT_PREFIX + locationText + "]";
+    }
+
+    /**
+     * fleetd#211: the raw-scrape fallback classification, run only when {@link #lastAssistantBlock}
+     * found nothing usable (see the call site in {@link #resolve}). Mirrors the two classifications
+     * the normal path already applies to the trimmed assistant block — exhaustion first, then the
+     * narrow {@link #BACKEND_ERROR} pattern — against {@code raw} instead, and reports whether one of
+     * them handled the turn (resolved the waiter or failed it) so the caller skips the empty-scrape
+     * failure. Never runs on the normal (non-empty-block) path, and never touches the reply text.
+     */
+    private boolean classifyRawScrapeFallback(String target, InFlight turn,
+                                               CompletableFuture<Rendezvous.Resolution> waiter, String raw) {
+        Pattern exhausted = exhaustedPatterns.patternFor(target);
+        String matchedLine = exhausted == null ? null : firstMatchingLine(raw, exhausted);
+        if (matchedLine != null) {
+            String reason = "backend exhausted (usage limit): " + matchedLine;
+            if (rendezvous.resolveExhausted(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("completion for {} classified BACKEND_EXHAUSTED from the raw scrape (no "
+                        + "usable assistant block; no fleet_reply): {}", target, reason);
+                // CB-578 stage B: only on the resolution that actually won the race — a late
+                // duplicate must never quarantine a credential twice for one refusal.
+                exhaustionSink.onExhausted(target, reason);
+            }
+            return true;
+        }
+        String backendError = firstMatchingLine(raw, backendErrorPatternOrFallback(target));
+        if (backendError != null) {
+            // Carry the pane, not just the matched line — the same fleetd#164 rule the normal path
+            // above applies. Here it matters more, not less: the trimmed block was empty, so the raw
+            // scrape is the ONLY copy of whatever the member managed to say. Clipped to the same cap
+            // the normal path uses, since a raw screen has no boundary trimming to bound it.
+            String reason = "member " + target + " ended on a backend error: " + backendError
+                    + "\n--- pane tail ---\n" + clip(raw);
+            if (rendezvous.resolveFailure(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("failing send to {} via turn-stall fallback from the raw scrape: {}", target, reason);
+                // fleetd#201 Unit 1: only on the resolution that actually won the race.
+                backendErrorSink.onBackendError(target, backendError, reason);
+            }
+            return true;
+        }
+        return false;
+    }
+
+    /** Synchronous fail (the unit-testable core of {@link #onTurnFailed}). */
+    void fail(String target, InFlight turn) {
+        fail(target, turn, null);
+    }
+
+    /** Synchronous fail with an optional reason supplied by a dropped worker queue. */
+    void fail(String target, InFlight turn, String explicitReason) {
+        // A never-delivered readiness failure has no in-flight record but still has a blocked send;
+        // fall back to the currently-registered waiter (unambiguous — that send never completed, so
+        // no next turn exists to confuse it with).
+        CompletableFuture<Rendezvous.Resolution> waiter =
+                turn != null ? turn.waiter() : rendezvous.currentWaiter(target);
+        if (waiter == null || waiter.isDone()) {
+            inFlight.remove(target, turn); // nobody blocked on this worker — nothing to fail
+            return;
+        }
+        String reason = explicitReason;
+        if (reason == null || reason.isBlank()) {
+            try {
+                reason = clip(agents.read(target, SCRAPE_SOURCE));
+            } catch (RuntimeException e) {
+                reason = "";
+            }
+            if (reason.isBlank()) {
+                // No screen to scrape — either the worker is stuck (CB-109) or gone (CB-110).
+                reason = "worker did not reply; its turn ended in an unrecoverable state "
+                        + "(worker unreachable or stuck)";
+            }
+        }
+        if (rendezvous.resolveFailure(waiter, reason)) {
+            inFlight.remove(target, turn);
+            log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
+        }
+    }
+
+    /**
+     * fleetd#164 (floor) / fleetd#201 (classification): fail a turn that settled inside
+     * {@link #MIN_TURN_NANOS} — a crash signature (e.g. a backend HTTP 400 before the worker did
+     * anything) that a bare {@code BUSY -> DONE} transition cannot be told apart from a genuinely
+     * fast completion. Runs the same backend-error classification the normal and raw-scrape paths
+     * apply, against whatever is on screen right now: a match is a typed failure that notifies
+     * {@link #backendErrorSink} (only on the resolution that wins the race); a non-match stays the
+     * original generic too-fast failure, naming the member and both timings, with whatever the pane
+     * shows appended so the caller sees the cause, not just "it failed".
+     */
+    private void failTooFast(String target, InFlight turn, CompletableFuture<Rendezvous.Resolution> waiter,
+                              long elapsedNanos) {
+        String scrape;
+        try {
+            scrape = agents.read(target, SCRAPE_SOURCE);
+        } catch (RuntimeException e) {
+            scrape = "";
+        }
+        String clippedScrape = clip(scrape);
+        String baseReason = String.format(
+                "member %s went BUSY -> DONE in %dms (floor %dms) — too fast to be real work, most "
+                        + "likely a backend error before any work started",
+                target, elapsedNanos / 1_000_000, MIN_TURN_NANOS / 1_000_000);
+        String backendError = firstMatchingLine(scrape, backendErrorPatternOrFallback(target));
+        if (backendError != null) {
+            String reason = baseReason + ": " + clippedScrape;
+            if (rendezvous.resolveFailure(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
+                // fleetd#201 Unit 1: only on the resolution that actually won the race.
+                backendErrorSink.onBackendError(target, backendError, reason);
+            }
+            return;
+        }
+        fail(target, turn, clippedScrape.isBlank() ? baseReason : baseReason + ": " + clippedScrape);
+    }
+
+    /**
+     * fleetd#201: the pattern to classify a backend error against for {@code target} — its
+     * profile's configured {@link BackendErrorPatternLookup} entry when there is one, else the
+     * built-in {@link #BACKEND_ERROR} compatibility pattern. A target with no configured pattern is
+     * never "off": it always falls back to this narrow default, exactly like the classification
+     * behaved before fleetd#201 (Unit 5 reports a target relying on this fallback separately, as
+     * legacy-default coverage rather than full per-profile coverage).
+     */
+    private Pattern backendErrorPatternOrFallback(String target) {
+        Pattern configured = backendErrorPatterns.patternFor(target);
+        return configured != null ? configured : BACKEND_ERROR;
+    }
+
+    /**
+     * fleetd#164: the failure reason for a scrape that produced zero characters — names the member
+     * and says plainly that the turn produced nothing, so a caller (a lead deciding whether to
+     * delegate again included) never mistakes a lost turn for a genuinely empty reply.
+     */
+    private static String emptyScrapeReason(String target, boolean scrapeFailed) {
+        return "member " + target + " turn completed with an empty scrape (0 chars) — "
+                + (scrapeFailed ? "its pane could not be read; " : "")
+                + "treating as a lost turn, not a real answer";
+    }
+
+    /**
+     * The first line of {@code text} matching {@code pattern}, stripped — the CB-578 stage A
+     * evidence carried in a {@code BACKEND_EXHAUSTED} reason so the operator sees the real refusal
+     * text, never a generic label. {@code null} if no line matches.
+     */
+    static String firstMatchingLine(String text, Pattern pattern) {
+        if (text == null || text.isEmpty()) return null;
+        for (String line : text.split("\n", -1)) {
+            if (pattern.matcher(line).find()) {
+                return line.strip();
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
+     * the way {@link dev.ltms.fleet.health.FleetHealthMonitor#coverage} is — so an operator can
+     * see whether the classification is on, and for which profiles, without reading every
+     * profile's config by hand.
+     *
+     * @param allProfiles        every configured profile name
+     * @param configuredProfiles the subset of {@code allProfiles} that carry an exhausted pattern
+     */
+    public static String coverage(String patternKey, Set<String> allProfiles, Set<String> configuredProfiles) {
+        if (configuredProfiles.isEmpty()) {
+            return "off (no profile has an " + patternKey + " configured; profiles: " + sorted(allProfiles) + ")";
+        }
+        Set<String> unconfigured = new TreeSet<>(allProfiles);
+        unconfigured.removeAll(configuredProfiles);
+        return unconfigured.isEmpty()
+                ? "full (all profiles configured: " + sorted(allProfiles) + ")"
+                : "partial (configured: " + sorted(configuredProfiles) + "; not configured: " + sorted(unconfigured) + ")";
+    }
+
+    private static List<String> sorted(Set<String> names) {
+        return names.stream().sorted().toList();
+    }
+
+    private static String clip(String s) {
+        if (s == null) return "";
+        String trimmed = s.strip();
+        return trimmed.length() <= MAX_SCRAPE_CHARS
+                ? trimmed
+                : trimmed.substring(trimmed.length() - MAX_SCRAPE_CHARS);
+    }
+
+    /**
+     * Extract the last assistant message from a raw Claude Code pane scrape (CB-115). Claude Code
+     * prefixes each assistant turn with {@code ⏺}; the delegator wants that answer, not the TUI
+     * chrome around it. Take everything from the final {@code ⏺} onward and stop at the <em>first</em>
+     * hard interface boundary below it — the spinner/status line, input box, {@code ❯} prompt (which
+     * may echo the <em>next</em> turn's text), footer, or tips/warnings. Stopping at the first
+     * boundary (rather than trimming only trailing chrome) is what keeps a following turn's echoed
+     * prompt out of this reply. Blank lines are not boundaries, so a multi-paragraph answer survives;
+     * trailing blanks are trimmed at the end. With no {@code ⏺} marker (an unusual render) the whole
+     * text is scanned the same way, so we never lose the reply.
+     *
+     * <p>Package-private and pure so it is unit-testable without herdr.
+     */
+    static String lastAssistantBlock(String raw) {
+        if (raw == null || raw.isBlank()) return "";
+        int marker = raw.lastIndexOf('⏺');
+        String block = marker >= 0 ? raw.substring(marker + 1) : raw;
+        StringBuilder out = new StringBuilder();
+        int kept = 0;
+        for (String line : block.split("\n", -1)) {
+            if (isBoundary(line)) break; // first TUI boundary ends the assistant message
+            if (kept++ > 0) out.append('\n');
+            out.append(line);
+        }
+        return out.toString().strip();
+    }
+
+    /**
+     * A hard TUI boundary line that marks the end of an assistant message and the start of interface
+     * chrome (input box, prompt, spinner, footer, tips/warnings). Blank lines are <em>not</em>
+     * boundaries — an answer may contain them — so they are kept and trimmed only if trailing.
+     */
+    private static boolean isBoundary(String line) {
+        String t = line.strip();
+        if (t.isEmpty()) return false;
+        // A horizontal rule / all box-drawing separators (e.g. "──────").
+        if (t.chars().allMatch(c -> c == '─' || c == '—' || c == '━' || c == '═' || c == '-')) {
+            return true;
+        }
+        String lower = t.toLowerCase();
+        return t.startsWith("╭") || t.startsWith("│") || t.startsWith("╰") || t.startsWith("┌")
+                || t.startsWith("└") || t.startsWith("❯") || t.startsWith("⏵")
+                || t.startsWith("⎿") || t.startsWith("⚠")
+                // Status/spinner lines Claude Code renders below a settled or in-flight turn,
+                // e.g. "✻ Baked for 21s", "✶ Forming…".
+                || t.startsWith("✻") || t.startsWith("✳") || t.startsWith("✽") || t.startsWith("·")
+                || t.startsWith("●") || t.startsWith("◐") || t.startsWith("✢") || t.startsWith("✶")
+                || lower.contains("auto mode") || lower.contains("for shortcuts")
+                || lower.contains("esc to interrupt") || lower.contains("bypass permissions");
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/inject/ExhaustionSink.java

@@ -0,0 +1,92 @@
+package dev.ltms.fleet.inject;
+
+import java.util.function.Supplier;
+
+/**
+ * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
+ * classification to a waiting send (CB-578 stage B) — never on a race that lost (see
+ * {@link CompletionResolver#resolve}, which only calls this after
+ * {@code Rendezvous.resolveExhausted} returns {@code true}).
+ *
+ * <p>{@link CompletionResolver} knows only {@code target} (a herdr terminal id); it has no notion of
+ * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
+ * the sink's job — see {@code Fleetd.main}'s wiring, which resolves target → session → profile →
+ * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
+ *
+ * <p><strong>The 3-arg overload is the single abstract method — fleetd #234, round 4.</strong> Two
+ * earlier rounds each shipped a caller that silently dropped the profile hint (see {@link
+ * #onExhausted(String, String, String)}): a lambda written against this interface can only ever
+ * implement whichever overload is abstract, and while the 2-arg form held that position, EVERY
+ * lambda site — a call-site forwarder in {@code Fleetd.java}, a hand-built test double — bound to
+ * it and silently inherited the profile-dropping default, whether or not its author remembered the
+ * hazard. Making the 3-arg form abstract instead removes the shape entirely: a lambda declared
+ * against this interface today is <em>forced</em> by the compiler to take {@code (target, reason,
+ * profile)}, so there is no overload left for it to bind to that can drop the hint. This is a type
+ * change, not a test — it holds even for a caller that has never heard of fleetd #234.
+ */
+@FunctionalInterface
+public interface ExhaustionSink {
+
+    /**
+     * @param target  the herdr terminal id whose turn was classified {@code BACKEND_EXHAUSTED}
+     * @param reason  the matched-line reason carried by the classification
+     * @param profile the profile the caller already knows should be quarantined, or {@code null}
+     *                when the caller has no better answer than {@code target} alone (fleetd #234):
+     *                a caller whose {@code target} is not yet resolvable through whatever roster
+     *                the sink's implementation consults — {@link
+     *                dev.ltms.fleet.member.OpenCodeLauncher}'s model-mismatch check fires from
+     *                {@code SessionAwareHandle.agentSessionId()}, which runs during {@code
+     *                SessionManager.acquire()} <em>before</em> that session is registered, so a
+     *                target -> session -> profile lookup finds nothing at that point. That launcher
+     *                already has its own {@code FleetConfig.Profile} in hand and does not need the
+     *                roster to know which profile to quarantine, so it supplies this directly
+     *                instead of leaving the sink to guess.
+     */
+    void onExhausted(String target, String reason, String profile);
+
+    /**
+     * Convenience for a caller with no profile to offer — every existing call site that predates
+     * the hint (fleetd #234): {@link dev.ltms.fleet.inject.CompletionResolver}'s two call sites
+     * always call with a {@code target} that IS live in the roster at the time of the call, so they
+     * need no hint and keep working exactly as before, unchanged by this default.
+     *
+     * @param target as {@link #onExhausted(String, String, String)}
+     * @param reason as {@link #onExhausted(String, String, String)}
+     */
+    default void onExhausted(String target, String reason) {
+        onExhausted(target, reason, null);
+    }
+
+    /**
+     * Inert sink — nothing happens on exhaustion. The explicit stand-in a caller (or a test not
+     * exercising this feature) passes instead of a defaulting overload, exactly like
+     * {@link ExhaustedPatternLookup#none()}. Safe as a lambda: the 3-arg form is now the interface's
+     * single abstract method, so a lambda here has no other overload to silently bind to instead —
+     * it simply does nothing with all three arguments.
+     */
+    static ExhaustionSink none() {
+        return (target, reason, profile) -> { };
+    }
+
+    /**
+     * A sink that forwards to whatever {@code target} currently supplies (fleetd #234). Exists to
+     * break a genuine construction-order cycle: {@code Fleetd.main} builds its adapters (including
+     * {@link dev.ltms.fleet.member.OpenCodeLauncher}) before {@code sessions} exists, so it cannot
+     * hand them the real sink yet — it hands them a forwarder pointed at an {@code
+     * AtomicReference<ExhaustionSink>} that starts at {@link #none()} and gets {@code .set()} to the
+     * real sink once {@code sessions} is built. {@code target} is evaluated on every call, never
+     * cached, so the forwarder keeps working after the reference is repointed.
+     *
+     * <p>Now safe as a one-line lambda (round 4): forwarding the single 3-arg abstract method
+     * forwards everything a caller can supply — there is no separate 2-arg overload left for a
+     * forwarder to bind to instead and silently lose the hint. Kept as a named factory rather than
+     * written inline at each call site anyway, so a test can call the exact object {@code
+     * Fleetd.java} builds instead of asserting a rebuilt copy of its shape (round 3's lesson).
+     *
+     * @param target supplies the sink to forward to, evaluated fresh on every call
+     * @return a sink whose call delegates to {@code target.get()}
+     */
+    static ExhaustionSink forwardingTo(Supplier<ExhaustionSink> target) {
+        return (t, r, p) -> target.get().onExhausted(t, r, p);
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/inject/Injector.java

@@ -2,6 +2,7 @@ package dev.ltms.fleet.inject;
 
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrRouter;
 import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -89,6 +90,7 @@ public final class Injector {
     public static final long POLL_INTERVAL_MILLIS = 250;
 
     private final AgentControl agents;
+    private final HerdrRouter router;
     private final TurnListener turnListener;
     private final Predicate<String> ready; // CB-113: a target is deliverable only when available
     private final Consumer<String> forget; // CB-114: clear a gone worker's readiness/presence
@@ -124,11 +126,25 @@ public final class Injector {
     public Injector(AgentControl agents, TurnListener turnListener, Predicate<String> ready,
                     Consumer<String> forget) {
         this.agents = agents;
+        this.router = null;
         this.turnListener = turnListener;
         this.ready = ready;
         this.forget = forget;
     }
 
+    public Injector(HerdrRouter router, TurnListener turnListener, Predicate<String> ready,
+                    Consumer<String> forget) {
+        this.agents = null;
+        this.router = router;
+        this.turnListener = turnListener;
+        this.ready = ready;
+        this.forget = forget;
+    }
+
+    private AgentControl agentsFor(String target) {
+        return router != null ? router.agentsFor(target) : agents;
+    }
+
     /** A pending message and the future that completes when it has been delivered. */
     private record Pending(String text, TurnToken token, CompletableFuture<Void> delivered) {
     }
@@ -141,6 +157,7 @@ public final class Injector {
         boolean awaitingCompletion; // a delivered message's turn is not yet known-complete
         boolean turnObserved;      // saw a real `working` sample since that delivery (turn ran)
         int unknownSinceTurn;      // consecutive `unknown` samples while a delegation is outstanding (CB-109)
+        int unknownSincePostTurn;  // the same, for the post-turn housekeeping phase (fleetd #306)
         int notReadySincePoll;     // consecutive injectable samples a queued message waited on the readiness gate (CB-114)
         boolean postTurnPending;   // completion observed; adapter housekeeping has not started yet
         boolean awaitingPostTurnPickup;
@@ -201,10 +218,12 @@ public final class Injector {
                 t.awaitingPickup = false;
                 t.injectableSincePickup = 0;
                 t.unknownSinceTurn = 0;
+                t.unknownSincePostTurn = 0;
                 t.notReadySincePoll = 0;
                 if (t.awaitingCompletion) t.turnObserved = true;
             } else if (status.injectable()) { // IDLE or BLOCKED
                 t.unknownSinceTurn = 0;
+                t.unknownSincePostTurn = 0;
                 if (t.awaitingPostTurnPickup) {
                     if (++t.injectableSincePostTurnPickup >= PICKUP_GRACE_POLLS) {
                         t.awaitingPostTurnPickup = false;
@@ -253,7 +272,7 @@ public final class Injector {
                         if (p != null && ready.test(target)) {
                             t.notReadySincePoll = 0;
                             try {
-                                agents.send(target, p.text());
+                                agentsFor(target).send(target, p.text());
                                 t.queue.poll();
                                 t.awaitingPickup = true;
                                 t.awaitingCompletion = true;
@@ -299,6 +318,24 @@ public final class Injector {
                     t.unknownSinceTurn = 0;
                     turnFailed = true;
                 }
+                // fleetd #306: the same escape for the post-turn housekeeping phase. Four latches
+                // gate delivery (awaitingCompletion, postTurnPending, awaitingPostTurnPickup,
+                // postTurnObserved) and only the first had a way out of a sustained unknown streak —
+                // a gate that closed one direction only. The other two below are released here as
+                // well; postTurnPending needs no escape because it is cleared unconditionally on the
+                // line after the listener call that sets it.
+                //
+                // This does NOT set turnFailed. The delegated turn already completed and its waiter
+                // already resolved — what is outstanding is adapter housekeeping (the `/clear`).
+                // Reporting a turn failure here would drive SessionManager.onFailed on a session
+                // that genuinely finished its work, which is a worse lie than the wedge.
+                if ((t.awaitingPostTurnPickup || t.postTurnObserved)
+                        && ++t.unknownSincePostTurn >= TURN_STALL_GRACE_POLLS) {
+                    t.awaitingPostTurnPickup = false;
+                    t.postTurnObserved = false;
+                    t.injectableSincePostTurnPickup = 0;
+                    t.unknownSincePostTurn = 0;
+                }
             }
 
             // Reclaim the entry once the worker is fully quiescent (nothing queued, no pickup or
@@ -313,7 +350,7 @@ public final class Injector {
         // thread while it holds the target lock.
         if (resubmit) {
             try {
-                agents.submit(target); // nudge a raced Enter so the pending paste submits
+                agentsFor(target).submit(target); // nudge a raced Enter so the pending paste submits
             } catch (RuntimeException e) {
                 log.debug("resubmit to {} failed (will retry next poll): {}", target, e.getMessage());
             }