broker: uriEnv config + non-fatal unreachable broker on boot

#151: Broker gains uriEnv beside uri, taking the AMQP URI from an env var so the password stays out of fleetd.yaml (same pattern as auth.tokenEnv). uriEnv wins when set; isConfigured() treats a uriEnv naming an unset/blank variable as unconfigured. A configured uriEnv is added to the startup required-secrets report. Never logs the resolved URI (it carries the password). #152: AmqpReplyInbox.open throwing at boot no longer stops the daemon. The selection at the call site catches the failure and falls back to the in-memory inbox for the process lifetime, warning loudly that durable cross-restart delivery is off and logging the failed URI with credentials stripped.
Merge CB-633: constrain a member's environment with a derived allow-list
2026-08-23 13:49:26 +02:00 · 2026-08-23 08:22:06 +02:00 · 2026-08-23 08:17:52 +02:00 · 2026-08-23 07:43:38 +02:00 · 2026-08-23 07:04:44 +02:00 · 2026-08-23 07:00:30 +02:00
205 changed files with 4502 additions and 2126 deletions
@@ -13,7 +13,7 @@ A design task is worked by two architects. Design alone first, then exchange and
 say plainly where you disagree. Do not concede just to agree.

 Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `bridge_ask{question}` only when a decision belongs to
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
 the lead, such as an unclear requirement or two defensible fixes. Do not ask about
 something you can decide by reading more code.

@@ -10,7 +10,7 @@ git worktree and branch. Never check out, rebase onto, or push to `main`. Confir
 the worktree root and branch before you edit. Use only paths under that root.

 Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `bridge_ask{question}` only when a decision belongs to
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
 the lead, such as an unclear requirement or two defensible fixes. Do not ask about
 something you can decide by reading more code.

@@ -12,7 +12,7 @@ Read the whole assigned scope before judging it. Review only that scope. If you
 something outside it, note it in one line and do not investigate it further. Do not
 run the build. The owner makes changes and runs checks.

-Use `bridge_ask{question}` only when a decision belongs to the lead, such as an
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
 unclear requirement or two defensible fixes. Do not ask about something you can
 decide by reading more code.

@@ -5,7 +5,7 @@ description: Implementer-role procedure for a bridged worker — verify your wor

 # Implementer worker — procedure

-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge, never commit `.mcp.json` or `wiki/`) is in **`CLAUDE.md` → Bridge communication →
 Worker** and already applies. This skill is only the *implement-and-hand-off procedure*.

@@ -85,7 +85,7 @@ host (`GITEA_HOST`) into your env for exactly this — the token can create a PR
 merge**.

 ```bash
-API="${GITEA_HOST%/}/api/v1/repos/lms/claude-bridge/pulls"
+API="${GITEA_HOST%/}/api/v1/repos/fleet/fleetd/pulls"
 BRANCH="$(git branch --show-current)"
 curl -sS -X POST "$API" \
  -H "Authorization: token ${GITEA_TOKEN}" \
@@ -103,7 +103,7 @@ fix it if the cause is yours (e.g. branch not pushed yet), and report the failur
 inventing a URL. If `GITEA_TOKEN` is unset your profile was not granted PR-create: push the branch
 and report its name so the lead opens the PR.

-## 6. Hand off — what goes in `bridge_reply`
+## 6. Hand off — what goes in `fleet_reply`

 The reply is the entire handoff; the lead cannot see your terminal.

@@ -130,7 +130,7 @@ sequenceDiagram
    I->>G: git push -u origin HEAD
    I->>G: POST /pulls (GITEA_TOKEN) — open PR to main
    G-->>I: html_url
-    I->>L: bridge_reply(PR url, branch, files, tests)
+    I->>L: fleet_reply(PR url, branch, files, tests)
    Note over L,G: the lead reviews the PR and merges on green — you never merge
 ```

@@ -53,7 +53,7 @@ Map each entry from `.mcp.json`:
  "$schema": "https://opencode.ai/config.json",
  "instructions": ["CLAUDE.md"],
  "mcp": {
-    "bridged":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
+    "fleetd":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
    "context7": { "type": "remote", "url": "https://example.dev/mcp", "enabled": true,
                  "headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" } },
    "gitea":    { "type": "local", "command": ["gitea-mcp", "-t", "stdio"], "enabled": true,
@@ -5,7 +5,7 @@ description: Reviewer-role procedure for a bridged worker — how to work a revi

 # Reviewer worker — procedure

-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies. This
 skill is only the *review procedure*: how to work the scope, and the exact shape of what you
 send back.
@@ -24,13 +24,13 @@ wrong.
  covers what it was given.
 - Do **not** edit files or run the build. You review; the owner acts.

-## 3. Reach for `bridge_ask` only for a genuine fork
+## 3. Reach for `fleet_ask` only for a genuine fork

 Ambiguous requirement, a missing acceptance criterion, "intended or a bug?", or two defensible
 fixes with different consequences — those are the lead's call, and guessing produces a
 confident-but-wrong finding. Anything you could settle by reading more code is yours to settle.

-## 4. The finding — what goes in `bridge_reply`
+## 4. The finding — what goes in `fleet_reply`

 Report the **single most important** real issue in the scope, in these four lines, under
 ~90 words:
@@ -69,8 +69,6 @@ jobs:
        env:
          RABBITMQ_DEFAULT_USER: guest
          RABBITMQ_DEFAULT_PASS: guest
-        ports:
-          - 5672:5672
    env:
      # Service containers are reachable from the job by their network alias on their internal port.
      AMQP_URI: amqp://guest:guest@rabbitmq:5672
@@ -1,3 +1,3 @@
 [submodule "wiki"]
 	path = wiki
-	url = ssh://git@git.ltms.dev:2224/lms/claude-bridge.wiki.git
+	url = ssh://git@git.ltms.dev:2224/fleet/fleetd.wiki.git
@@ -13,7 +13,7 @@ A design task is worked by two architects. Design alone first, then exchange and
 say plainly where you disagree. Do not concede just to agree.

 Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `bridge_ask{question}` only when a decision belongs to
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
 the lead, such as an unclear requirement or two defensible fixes. Do not ask about
 something you can decide by reading more code.

@@ -10,7 +10,7 @@ git worktree and branch. Never check out, rebase onto, or push to `main`. Confir
 the worktree root and branch before you edit. Use only paths under that root.

 Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `bridge_ask{question}` only when a decision belongs to
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
 the lead, such as an unclear requirement or two defensible fixes. Do not ask about
 something you can decide by reading more code.

@@ -12,7 +12,7 @@ Read the whole assigned scope before judging it. Review only that scope. If you
 something outside it, note it in one line and do not investigate it further. Do not
 run the build. The owner makes changes and runs checks.

-Use `bridge_ask{question}` only when a decision belongs to the lead, such as an
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
 unclear requirement or two defensible fixes. Do not ask about something you can
 decide by reading more code.

@@ -4,35 +4,35 @@

 > **Canonical block.** Everything down to §Layering is the portable bridge charter, copied verbatim
 > into every project that mounts the bridge MCP. Keep it byte-identical with the template in the
-> wiki ([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable
+> wiki ([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable
 > CLAUDE.md block*); improvements go to the template first, then out to each project. Anything
 > specific to *this* repo lives under §Project addendum below, never inline above it.

-If no `bridge_*` MCP tools are mounted in this session, this section does not apply — skip it.
+If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.

 `bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
 **primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
-through its `bridge_*` tools. No session addresses a peer, a broker, or the network directly.
+through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.

 ### Which role am I? — settle this before acting

 **Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.

-**Call `bridge_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
+**Call `fleet_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
 your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
 carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
 was bound to. Don't infer what you can ask.

 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
-fires: the reply charter in your system prompt (*"You are an off-subscription worker in the
-claude-bridge fleet"*) ⇒ **spawned member**; bridge tools prefixed `mcp__bridge__*` ⇒ **spawned
+fires: the reply charter in your system prompt (*"You are a spawned member in the
+claude-bridge fleet"*) ⇒ **spawned member**; fleet tools prefixed `mcp__fleet__*` ⇒ **spawned
 member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
-`.mcp.json`, so it varies); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
+`.mcp.json`, so it varies — and a member spawned before CB-632 still says `mcp__bridge__*`); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
 on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
-only `bridge_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+only `fleet_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
 two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
-loud and self-correcting — while a member acting as the primary ends its turn with no `bridge_reply`,
+loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
 and the sender silently receives nothing. Fail toward the recoverable error.

 ### Invariants — both roles, no exceptions
@@ -41,7 +41,7 @@ and the sender silently receives nothing. Fail toward the recoverable error.
   stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
   never move a session across that boundary.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
-   side cannot see your screen. An answer that isn't in a `bridge_*` call is silently discarded.
+   side cannot see your screen. An answer that isn't in a `fleet_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
   cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
   reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
@@ -57,10 +57,10 @@ and the sender silently receives nothing. Fail toward the recoverable error.

 **Delegate by default — that is the job.** With the bridge mounted you are an orchestrator on a
 metered subscription, and workers are cheap, parallel, and disposable. The default answer to "who
-does this?" is **a worker**, not you. Reach for `bridge_send` before you reach for `Edit`. The steps
+does this?" is **a worker**, not you. Reach for `fleet_send` before you reach for `Edit`. The steps
 below are the procedure — run them in order, every task, not only the big ones.

-0. **Know your role** — `bridge_whoami`, once per session, before anything else.
+0. **Know your role** — `fleet_whoami`, once per session, before anything else.
 1. **Split.** Write the unit list. Every unit carries: scope · the files or PR in question ·
   acceptance criteria · exactly what to report back. A unit with no acceptance criteria is not
   ready to delegate — refine it or keep it.
@@ -70,17 +70,17 @@ below are the procedure — run them in order, every task, not only the big ones
   delegate. The keep-list is closed: the conversation with the user, decomposition and planning,
   the final judgment call, verification, merges, and anything that depends on context only you
   hold. Nothing else is yours by default.
-3. **Spawn every delegated unit first** — `bridge_spawn{profile, worktree:true, ticket}`, one per
+3. **Spawn every delegated unit first** — `fleet_spawn{profile, worktree:true, ticket}`, one per
   unit, *before* sending any. Pass `profile` explicitly: profiles differ in model and cost, not in
   tier, so the default is rarely what you want.
-4. **Then send them all** — `bridge_send{sessionId, content, wait:false}`. Line 1 of every brief is
+4. **Then send them all** — `fleet_send{sessionId, content, wait:false}`. Line 1 of every brief is
   `Load the <name> skill.` naming the worker's playbook; those skills are opt-in and that line is
   what makes them reliable. Where the project ships no such skill, spell the procedure out in the
   brief instead. The brief is self-contained — the worker sees your message and the repo, nothing
   of your context, your plan, or your screen.
-5. **Collect** — `bridge_poll{ticket}` → `bridge_ack{target, msgId}`. Answer a worker's `bridge_ask`
-   with `bridge_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
-   `bridge_status`, never by reading its terminal; it also reports an open question and the `turnId`
+5. **Collect** — `fleet_poll{ticket}` → `fleet_ack{target, msgId}`. Answer a worker's `fleet_ask`
+   with `fleet_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
+   `fleet_status`, never by reading its terminal; it also reports an open question and the `turnId`
   that answers it. **A worker's ask waits ~55 seconds, and no nudge makes that longer** — so never
   brief a worker to "ask me". Decide before you delegate, or give it an explicit default.
 6. **Verify yourself.** Re-run the build and the checks. A worker cannot run your IDE tooling, any
@@ -93,11 +93,11 @@ below are the procedure — run them in order, every task, not only the big ones
   read it yourself.
 8. **Adjudicate, merge, tear down — yours alone.** Read the diff yourself: fully if it is small,
   targeted at the reported findings and the risky paths if it is large. Reviewer findings direct
-   your attention; they never substitute for it. Then merge, then `bridge_stop{paneId}`.
+   your attention; they never substitute for it. Then merge, then `fleet_stop{paneId}`.

 **Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
 silently becomes serial, and it is the most common way this layer is wasted. For the same reason,
-prefer `wait:false` + `bridge_poll` for anything non-trivial: a blocking `bridge_send` is capped by
+prefer `wait:false` + `fleet_poll` for anything non-trivial: a blocking `fleet_send` is capped by
 *your own* MCP client call timeout (~60s), well below the task's real runtime.

 **Delegating does not delegate responsibility.** Workers open PRs; you are the gate. Never delegate
@@ -105,21 +105,21 @@ the merge — and merging on a reviewer's word is delegating it by proxy.

 | Intent | Tool |
 |---|---|
-| Confirm your own role | `bridge_whoami` |
-| See backends available | `bridge_profiles` |
-| Start a member | `bridge_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
-| See the fleet | `bridge_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `bridge_status{sessionId}` |
-| Delegate (blocking) | `bridge_send{sessionId, content}` |
-| Delegate (long task) | `bridge_send{sessionId, content, wait:false}` → ticket → `bridge_poll{ticket}` |
-| Answer a member's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
-| Message a **peer lead** | `bridge_send{sessionId: <their terminal>, content}` — `bridge_list` → `leads` reports it. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `bridge_reply{content}` — the one case a lead replies |
-| Collect a held reply | `bridge_poll{target}` · then `bridge_ack{target, msgId}` |
-| Tear down a member | `bridge_stop{paneId}` |
+| Confirm your own role | `fleet_whoami` |
+| See backends available | `fleet_profiles` |
+| Start a member | `fleet_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
+| See the fleet | `fleet_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `fleet_status{sessionId}` |
+| Delegate (blocking) | `fleet_send{sessionId, content}` |
+| Delegate (long task) | `fleet_send{sessionId, content, wait:false}` → ticket → `fleet_poll{ticket}` |
+| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
+| Message a **peer lead** | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
+| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
+| Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
+| Tear down a member | `fleet_stop{paneId}` |

 ### Lead ↔ lead — coordinate, never delegate

-`bridge_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
+`fleet_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
 is a peer — an orchestrator with its own context, its own members, and its own judgment. An empty
 `members` array means no members are spawned; it says nothing about peers.

@@ -140,7 +140,7 @@ The traffic between leads is coordination and nothing else:
   against the code, and re-run the build. A peer's correction gets the same treatment — right or
   wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.

-Being messaged by a peer does not make you its worker: answer with `bridge_reply`, and push back on
+Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
 the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
 you.

@@ -148,11 +148,11 @@ you.

 1. **Load the playbook skill the lead named** before doing anything else.
 2. **Do the assigned scope only.** Note anything you spot outside it in one line; don't go hunt it.
-3. **`bridge_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
+3. **`fleet_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
   defensible fixes, "bug or intended?"). It blocks and you resume the *same* turn with the answer.
   Don't ask what you could decide yourself.
-4. **End the turn with exactly one `bridge_reply{content}`**, carrying your complete answer. This is
-   the whole handoff. No `bridge_reply` ⇒ the sender gets nothing and the exchange stalls.
+4. **End the turn with exactly one `fleet_reply{content}`**, carrying your complete answer. This is
+   the whole handoff. No `fleet_reply` ⇒ the sender gets nothing and the exchange stalls.
   Do **not** lean on the completion fallback to carry your answer for you: when you end a turn
   without replying, the bridge scrapes your pane, and it can return only the last 4000 characters.
   A clipped scrape is marked as partial, but the missing text is gone — your report reaches the
@@ -171,7 +171,7 @@ you.

 | Layer | Scope | Reaches |
 |---|---|---|
-| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `bridge_reply`* | every spawned member, at launch, every peer kind — never a lead |
+| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `fleet_reply`* | every spawned member, at launch, every peer kind — never a lead |
 | **this section** | protocol + orchestration policy | primary **and** every member that reads the repo — tracked in git, so worktrees inherit it |
 | role agent definition files | role contract and per-job procedure | a member whose launcher binds its role to the matching file in its worktree |
 | role playbook skills | per-job procedure (commit/PR recipe, finding format) | a member told to load one |
@@ -185,7 +185,7 @@ must obey belongs in the charter, not here.
 ## Project addendum — claude-bridge (not part of the canonical block)

 - **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
-  and the code behind the rules above is `mcp/BridgeMcp` (tools), `auth/Authz` (the role table),
+  and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
  `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
 - **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
  `reviewer` (scoped review → one structured finding). Name one in every delegation.
@@ -193,7 +193,7 @@ must obey belongs in the charter, not here.
  `port-to-opencode` (make an OpenCode session a participant in this workspace).
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
  (a submodule with its own remote).
- **Flows and the error model** — rendezvous, `bridge_ask`, detached delivery, turn-done fallback —
+- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, turn-done fallback —
  are diagrammed in `docs/MCP-Contract.md` **§6 only**. The rest of that page is a pre-build design
  doc whose tool names, parameter names and REST paths never caught up with the code, so do not use
  it as the tool reference (CB-609). Section 6 is kept out of this file because this file loads into
@@ -231,13 +231,13 @@ if the script is unavailable or a step fails, this is what it was protecting you
   daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
   logs this at startup — the script's `--check` is the only thing that reports it, and it checks
   whether the name resolves without ever printing the value.
-2. **Drain live members first.** `bridge_list`, then `bridge_stop` each member, and collect anything
-   you still want with `bridge_poll` before you kill anything. A restart drops in-flight tickets and
+2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
+   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
   rendezvous, and a member's report is not recoverable once its ticket is gone.
 3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
   it. The startup log names which keys it accepted and which it deferred — read those lines rather
   than assuming.
-4. **Re-check identity afterwards.** Call `bridge_whoami` and confirm it still answers `primary`. The
+4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
   lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
   demoted to worker, which refuses every orchestration call.
 5. **Prove the new jar is the one running.** Confirm a *fresh* `bridged listening` line at the end of
@@ -268,10 +268,10 @@ Before you call any work done, check the row that matches what you touched:

 | You changed… | Re-read and update… |
 |---|---|
-| a `bridge_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
+| a `fleet_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
 | `Authz` / the role table | invariant 3, and the primary-only vs worker-only claims |
-| `ConnectionIdentity` / how a caller is resolved | the `bridge_whoami` paragraph and the fallback ladder |
-| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__bridge__*`), and the layering table's top row |
+| `ConnectionIdentity` / how a caller is resolved | the `fleet_whoami` paragraph and the fallback ladder |
+| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__fleet__*`), and the layering table's top row |
 | the injector / status gating | invariant 4 |
 | worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
 | `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
@@ -287,7 +287,7 @@ is a Roadmap line. A change that touches none of the three earns no entry, and t
 outcome rather than an omission.

 Then **propagate**: the block in this file and the template in the wiki
-([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
+([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
 block*) must stay byte-identical, and other projects carrying the block need the same edit. Verify
 rather than trust:

@@ -9,23 +9,23 @@ Sibling of [`crush-bridge`](https://git.ltms.dev/systems/vms) (which drives a he
 process*, so it inherits `CLAUDE.md`, hooks, skills, and MCP — just pointed at a
 cheaper/local model.

-## Leading approach — herdr-centric message server (`bridged`)
+## Leading approach — herdr-centric message server (`fleetd`)

-A small always-on message server, **`bridged`**, controls
+A small always-on message server, **`fleetd`**, controls
 [herdr](https://herdr.dev) (an agent multiplexer) over its Unix-socket API and exposes a
 clean 2-way messaging API as an **MCP server that both the primary and the workers mount** —
 one unified Claude setup and the **sole communication gateway** (REST/SSE stays for non-Claude
-clients; any broker is `bridged`-internal, below the gateway).
-herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `bridged` owns
+clients; any broker is `fleetd`-internal, below the gateway).
+herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `fleetd` owns
 policy (subscription boundary, session lifecycle, status-gated delivery) and the client
 contract. A Claude member launches with `ANTHROPIC_BASE_URL` pointed at the gateway,
 `https://llm.ltms.dev/anthropic`, plus a bearer token; the lead stays env-clean and calls
-`bridged`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.
+`fleetd`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.

 ```mermaid
 flowchart LR
    OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["bridged — standalone daemon (not a claude process)"]
+    subgraph BD["fleetd — standalone daemon (not a claude process)"]
        SRV["SERVER face<br/>MCP · REST/SSE · policy"]
        CLI["CLIENT face<br/>status-gated injector · herdr socket"]
        SRV --> CLI
@@ -34,8 +34,8 @@ flowchart LR
    W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
    M["llm.ltms.dev<br/>(the one gateway)"]

-    OPUS -->|"MCP bridge_send (blocks)"| SRV
-    W -.->|"MCP bridge_reply"| SRV
+    OPUS -->|"MCP fleet_send (blocks)"| SRV
+    W -.->|"MCP fleet_reply"| SRV
    CLI -->|"Unix socket<br/>send_text · events.subscribe"| HERDR
    HERDR -->|"drives PTY"| W
    W -->|"inference"| M
@@ -47,24 +47,27 @@ flowchart LR
 ```

 - **Subscription boundary:** the *primary* never sets `ANTHROPIC_BASE_URL` (stays on
-  Pro/Max). Only the *secondary* process is off-subscription — and `bridged` itself is a
+  Pro/Max). Only the *secondary* process is off-subscription — and `fleetd` itself is a
  plain daemon (no Anthropic quota), so it may poll/subscribe freely.
- **One gateway (unified MCP setup):** `bridged` is the **sole communication path** for every
+- **One gateway (unified MCP setup):** `fleetd` is the **sole communication path** for every
  Claude session. Primary and workers each mount it as an MCP server (one `claude mcp add`
-  line, same on both) and talk over MCP tools — `bridge_send` / `bridge_reply` /
-  `bridge_status` (with `bridge_ask` planned for the blocked-worker path). **No Claude session
-  ever addresses a broker, a peer, or the network
-  directly**; any queue is `bridged`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
-  mounting the bridge is subscription-safe by construction.
- **How the primary consumes a reply:** a single **blocking MCP call** (`bridge_send`);
-  `bridged` holds it open until the worker calls `bridge_reply` or its turn hits
+   line, same on both) and talk over MCP tools — `fleet_send` / `fleet_reply` /
+   `fleet_status` (with `fleet_ask` planned for the blocked-worker path). **No Claude session
+   ever addresses a broker, a peer, or the network
+   directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
+   mounting the bridge is subscription-safe by construction.
+   **Tool naming:** the tools were renamed from `bridge_*` to `fleet_*` (CB-622). The daemon
+   still answers the old `bridge_*` names for one release, but they are deprecated — use the
+   `fleet_*` names.
+- **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
+  `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
  `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so
  no quota burn. SSE is an optional side-channel for humans/dashboards watching status.
- **Worker → primary** rides `bridged`'s **MCP rendezvous** — the reply resolves the primary's
-  blocking call (or, for detached work, `bridged` **injects the primary's idle pane** when it's
+- **Worker → primary** rides `fleetd`'s **MCP rendezvous** — the reply resolves the primary's
+  blocking call (or, for detached work, `fleetd` **injects the primary's idle pane** when it's
  ready), so *no keystroke-into-primary and no broker are involved, even single-host*. The one
  exception: a split-host primary that isn't a herdr pane wakes via its own `Stop`-hook, which
-  polls **`bridged`** (never a broker). See the wiki for the two topologies.
+  polls **`fleetd`** (never a broker). See the wiki for the two topologies.
 - **Different model per process** sidesteps Claude Code's lack of per-subagent provider
  routing — the worker isn't a subagent, it's its own configured process.
 - **AgentAPI** ([`coder/agentapi`](https://github.com/coder/agentapi)) is retained only as a
@@ -73,11 +76,11 @@ flowchart LR

 ## Docs

-Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/lms/claude-bridge/wiki)**,
+Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/fleet/fleetd/wiki)**,
 vendored here as a submodule under [`wiki/`](./wiki):

 ```bash
-git clone --recurse-submodules ssh://git@git.ltms.dev:2224/lms/claude-bridge.git
+git clone --recurse-submodules ssh://git@git.ltms.dev:2224/fleet/fleetd.git
 # or, after a plain clone:
 git submodule update --init
 ```
@@ -87,7 +90,7 @@ Gitea wiki.

 ## Status

-🟢 **Implemented & dogfooded** — the herdr-centric **`bridged`** message server is built and in
+🟢 **Implemented & dogfooded** — the herdr-centric **`fleetd`** message server is built and in
 real use: an Opus primary delegates tasks to off-subscription workers that reply through the
 bridge (code reviews delegated this way have produced committed bug fixes). Selected as the
 primary approach 2026-07-11, superseding the AgentAPI plan (2026-07-08); AgentAPI retained as a
@@ -98,9 +101,9 @@ tests run separately via `mvn test -Pcontract`):

 - **Core gateway** — herdr socket client (contract-tested vs live 0.7.0); guard-checked worker
  spawn with `ANTHROPIC_BASE_URL` injected only into the worker's env; status-gated injector;
-  blocking `bridge_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
- **MCP tools** — `bridge_send` / `bridge_reply` / `bridge_status` (messaging) and `bridge_spawn`
-  / `bridge_list` / `bridge_stop` / `bridge_profiles` / `bridge_poll` (fleet). Caller identity is
+  blocking `fleet_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
+- **MCP tools** — `fleet_send` / `fleet_reply` / `fleet_status` (messaging) and `fleet_spawn`
+  / `fleet_list` / `fleet_stop` / `fleet_profiles` / `fleet_poll` (fleet). Caller identity is
  connection-based (loopback peer PID → herdr pane), so the same mount serves primary and workers.
 - **Delivery reliability** — completion fallback (a confirmed `working→idle` turn resolves a
  send); async fire-and-poll (beats the caller's MCP call timeout for long tasks); and failure
@@ -108,7 +111,7 @@ tests run separately via `mvn test -Pcontract`):
 - **Fleet** — multiple worker profiles, each with an independent base_url guard check; workers
  inherit the primary's working directory (never `$HOME`); a readiness gate holds delivery until
  a worker's Claude has connected the bridge MCP (no paste lost into its boot window).
- **Blocked-worker path** — `bridge_ask` reverse rendezvous: a worker pauses its delegated turn to
+- **Blocked-worker path** — `fleet_ask` reverse rendezvous: a worker pauses its delegated turn to
  ask the primary and resumes the *same* turn with the answer (CB-205).
 - **Session lifecycle** — session manager with spawn/reuse/recycle, `idle_ttl` reaper, `context_cap`,
  and graceful drain on shutdown (CB-301/CB-303); per-worker git worktrees on their own branch with
@@ -2,7 +2,9 @@
 target/
 dependency-reduced-pom.xml

-# Local runtime config (copy from bridged.example.yaml)
+# Local runtime config (copy from fleetd.example.yaml). Both names: the live file is still
+# bridged.yaml until the cutover, and Fleetd reads either one.
+fleetd.yaml
 bridged.yaml

 # CB-505 audit trail + daemon stdout/stderr — runtime records, never source
@@ -5,10 +5,10 @@

 ## Why this exists

-Stage 2 gave a worker→primary reply a **durable place to wait** when no `bridge_send` is
+Stage 2 gave a worker→primary reply a **durable place to wait** when no `fleet_send` is
 open: it lands in `agent.<target>.inbox` on the broker and survives a daemon bounce. But
 delivery is still **pull** — the primary only sees the reply if it happens to call
-`bridge_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
+`fleet_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
 the primary works on something else.

 This layer makes delivery **active**: the bridge *pushes* a nudge to the primary the moment
@@ -26,11 +26,11 @@ pointed at the primary's pane instead.

 ```mermaid
 flowchart LR
-    W["worker"] -->|"bridge_reply (no open send)"| MS["MessageService.reply"]
+    W["worker"] -->|"fleet_reply (no open send)"| MS["MessageService.reply"]
    MS -->|"inbox.publish"| INBOX[("agent.&lt;target&gt;.inbox<br/>(durable, LavinMQ)")]
    MS -->|"notify"| LOOP["ReplyPushLoop"]
    LOOP -->|"status-gated inject"| PANE["primary's herdr pane"]
-    PANE -->|"primary drains"| DRAIN["bridge_poll(target)<br/>= peek + ack"]
+    PANE -->|"primary drains"| DRAIN["fleet_poll(target)<br/>= peek + ack"]
    DRAIN -->|"inbox now empty"| LOOP
    LOOP -.->|"still non-empty →<br/>re-inject on backoff"| PANE
    classDef store fill:#2c5282,stroke:#1a365d,color:#ffffff;
@@ -51,13 +51,13 @@ the caller runs in a herdr pane on this host. Today it's discarded for the prima
 (`presence.markPresent` is a no-op on it).

 **Plan:** a single-slot `PrimaryRegistry` (thread-safe) holding the primary's `terminal_id`.
-Populate it from the **orchestration-side** MCP tools — `bridge_send`, `bridge_spawn`,
-`bridge_poll`, `bridge_list`, `bridge_status`, `bridge_profiles` — capturing
+Populate it from the **orchestration-side** MCP tools — `fleet_send`, `fleet_spawn`,
+`fleet_poll`, `fleet_list`, `fleet_status`, `fleet_profiles` — capturing
 `callerTerminal(exchange)` when it is (a) non-null and (b) **not** a registered worker
 session in `SessionManager`. That caller is, by construction, the primary. Worker-side tools
-(`bridge_reply`, `bridge_ask`) never set it.
+(`fleet_reply`, `fleet_ask`) never set it.

- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `BridgedConfig`
+- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `FleetConfig`
  (nested record, same shape as `Broker`). Lets an operator pin it, or supply it when
  derivation can't (see degrade case).
 - **Degrade:** if the primary is off-host or in a non-herdr terminal, `terminalForPid`
@@ -71,13 +71,13 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
 (`MessageService.reply` → the `inbox.publish` branch, `MessageService.java:192`).

 - **Inject a nudge, not the payload.** The injected turn tells the primary *to drain*
-  (e.g. "Worker `<target>` returned a reply — run `bridge_poll(target=<target>)` to collect
+  (e.g. "Worker `<target>` returned a reply — run `fleet_poll(target=<target>)` to collect
  it"), it does **not** carry the reply text. Rationale: replies can be large/multiline and
  terminal injection would mangle them; the drain response is the clean transport. Keeps the
  push idempotent — re-nudging is harmless.
 - **Ack = drain.** The primary draining (`drainReplies` = peek + ack) is the acknowledgement.
  The loop's **stop condition is `inbox.peek(target).isEmpty()`** — the reply is gone from the
-  inbox because it was acked. No new `bridge_ack` tool needed for v1 (see Increment 3).
+  inbox because it was acked. No new `fleet_ack` tool needed for v1 (see Increment 3).
 - **Status-gated injection (mechanism (b), chosen).** A dedicated lightweight scheduled loop,
  **not** the worker `Injector`. It injects via `AgentControl.send(primaryTerminal, nudge)`
  (the same herdr `agent.send` = `pane send-text` + submit that delivers to workers) only when
@@ -93,10 +93,10 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
  the reply remains in the durable inbox and the next natural poll (or a later worker reply's
  nudge) still surfaces it. Bounded so the bridge never spams the primary.

-### Increment 3 — optional per-`msgId` `bridge_ack` tool (deferred)
+### Increment 3 — optional per-`msgId` `fleet_ack` tool (deferred)

 Drain-as-ack is coarse: it clears *all* pending replies for a target at once. If finer
-control is ever needed (ack one reply, leave others held), add a `bridge_ack(msgId)` tool
+control is ever needed (ack one reply, leave others held), add a `fleet_ack(msgId)` tool
 mapping to `inbox.ack(target, msgId)` — the port already supports per-`msgId` ack. Not built
 in v1; the stop-on-empty loop is sufficient.

@@ -106,7 +106,7 @@ in v1; the stop-on-empty loop is sufficient.
   resolved terminal is non-null **and not a registered worker session**, seen on an
   orchestration-side tool. This never mislabels a worker (workers are in `SessionManager`)
   and needs no new env var or argument (identity stays connection-derived, per the existing
-   `BridgeMcp` invariant).
+   `FleetMcp` invariant).

 2. **Readiness-gate mismatch → dedicated loop.** The existing `Injector` gates delivery on
   `ready.test(target)` = `WorkerPresence` (the *worker's* MCP connected). The primary is not
@@ -132,7 +132,7 @@ boundary**. The bridge is signalling the primary that it has mail — not drivin
  non-null terminal AND not a registered session" predicate; the loop's stop-on-empty and
  bounded-reminder logic with an injected clock + a fake injector (no real herdr).
 - **Live dogfood (primary-side):** with the daemon on the broker jar + a real worker,
-  delegate a task, let the worker reply after the `bridge_send` window closes, and observe the
+  delegate a task, let the worker reply after the `fleet_send` window closes, and observe the
  bridge inject a drain nudge into *this* primary pane; confirm draining stops the reminders;
  confirm an unreachable primary (registry empty) degrades to pull with no loss.

@@ -35,7 +35,7 @@ bind:
 # a caller whose connection maps to this pane resolves as the primary (no credential needed —
 # the pane mapping is as unforgeable as a worker's), and reply nudges are pushed to it.
 # REQUIRED when the primary runs inside a herdr pane — without it the pane match reads the
-# primary as a worker and refuses spawn/send/stop. Get the id from bridge_whoami; re-pin if
+# primary as a worker and refuses spawn/send/stop. Get the id from fleet_whoami; re-pin if
 # the primary moves panes.
 # primary:
 #   terminal: term_0123456789abcd
@@ -49,12 +49,12 @@ bind:
 #
 #   tab → the ONLY field identity depends on (CB-579); the exact label of the tab hosting the lead.
 #         Label the tab yourself, or let bridged label one it launches — see `fleet.leaders:` below.
-#   kind/model → descriptive; they document what runs in the pane and are echoed by bridge_whoami
+#   kind/model → descriptive; they document what runs in the pane and are echoed by fleet_whoami
 #
 # A lead's tab must already carry its label (or be launched by bridged, which labels it) — there is
 # no terminal id to paste in and nothing to re-pin when the session restarts: the tab survives, so
 # the same label resolves the same lead again on the next scan.
-# `bridge_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
+# `fleet_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
 # IS a primary for authorization, so nothing that keys on the role breaks.
 #
 # KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
@@ -69,7 +69,7 @@ bind:
 # never a capability: what a pane may do is decided by the role the daemon resolves for it.

 # CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
-# idle (no open bridge_send driving it) past the quiet period. The fleet is one lead + architects +
+# idle (no open fleet_send driving it) past the quiet period. The fleet is one lead + architects +
 # workers, so a lead that stalls is a single point of failure; the ReplyPushLoop only nudges when a
 # reply lands, and this timer catches the gap where nothing lands and the lead just sits idle.
 #
@@ -99,7 +99,7 @@ bind:
 #                      them changes nothing right now, and no minimum is enforced on either, because
 #                      nothing reads them to enforce one. They exist so a later build can start
 #                      honouring them without another config-shape change.
-#   notifications.mode → "webhook" flips what bridge_list REPORTS (healthCoverage: "full" instead
+#   notifications.mode → "webhook" flips what fleet_list REPORTS (healthCoverage: "full" instead
 #                      of "detection-only") — it does NOT make bridged send any webhook call; no
 #                      delivery mechanism is implemented yet. Any other value, or omitting the
 #                      block, reports "detection-only".
@@ -152,7 +152,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
 #                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
 #   exhaustedPattern → regex matched against a completion-fallback scrape (CB-578 stage A) to
-#                      classify a turn that ended with no bridge_reply as the backend having
+#                      classify a turn that ended with no fleet_reply as the backend having
 #                      refused on a subscription usage limit, rather than a real answer. Opt-in —
 #                      omit and this profile's completion fallback behaves exactly as before.
 #                      Every backend words its refusal differently, so this is config, never a
@@ -179,7 +179,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
 #                      only to override that or add more (JAVA_HOME, …). Since the default is the
 #                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
-#                      lines in deploy/dev.ltms.bridged.plist and deploy/bridged.service.
+#                      lines in deploy/dev.ltms.fleet.plist and deploy/bridged.service.
 #
 #                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
 #                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
@@ -200,12 +200,12 @@ profiles:
    # weight: relative selection weight for automatic placement (weighted, round-robin, and
    # fixed's fallback walk). Absent defaults to 1.0. An explicit 0 or negative value means
    # "never auto-select this profile" (CB-554) — it stays reachable via an explicit
-    # `bridge_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
+    # `fleet_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
    # selection skips it.
    weight: 0.5
    # maxLoad: max live workers on this profile. Omit for unlimited. An explicit 0 (CB-585) caps
    # the profile at zero live members — it is excluded from automatic placement and an explicit
-    # `bridge_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
+    # `fleet_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
    # is named directly. Negative is refused at config load — there is no sane meaning for it.
    maxLoad: 2
    # subscription: true
@@ -224,7 +224,7 @@ profiles:
    #   subscription path no guard would vet the URL, so allowing both would be a way around the
    #   guard rather than a configuration.
    #
-    #   GOTCHA 1 — it is invisible to the startup secret check. `Bridged.reportRequiredSecrets`
+    #   GOTCHA 1 — it is invisible to the startup secret check. `Fleetd.reportRequiredSecrets`
    #   skips subscription profiles on purpose (they need no token), so a boot log that reports
    #   every secret as fine says nothing about these profiles.
    #
@@ -259,8 +259,8 @@ profiles:
  # The bridge MCP + reply charter mount via a generated OPENCODE_CONFIG file, and the model is a
  # `provider/model` selector. Placement, tabs, cwd, and the readiness gate are shared with Claude.
  #
-  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → bridge_send →
-  # structured bridge_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
+  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → fleet_send →
+  # structured fleet_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
  # and need NO credentials — check `opencode models` for the current free list, since the names
  # change. That also makes the worker off-subscription by construction.
  #   opencode-free:
@@ -342,7 +342,7 @@ placement: weighted
 #               / credentialId. Those are hot because the placement policy (and, for credentialId,
 #               the CB-578 stage B quarantine check) reads them through a supplier — being config is
 #               not by itself enough to make a key hot.
-#               EXCEPT `fleet.leaders`: Bridged.main reads it once at startup to build the lead tab
+#               EXCEPT `fleet.leaders`: Fleetd.main reads it once at startup to build the lead tab
 #               scanner and launcher, and neither is rebuilt on reload. A changed/added/removed
 #               `fleet.leaders` entry is silently accepted — the reload reports "config reloaded"
 #               with nothing in the deferred list — but has NO effect until you restart. Treat it
@@ -447,7 +447,7 @@ fleet:
  #                                  # MUST NOT be a member workspace — those are excluded from the
  #                                  # scan, so a lead placed in one is never found again.
  #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
-  #     kind: claude                 # descriptive; reported by bridge_whoami
+  #     kind: claude                 # descriptive; reported by fleet_whoami
  #   gpt-sol-5.6:
  #     tab: "lead: gpt-sol-5.6"
  #     kind: opencode
@@ -505,20 +505,51 @@ guard:
 # through either: the daemon logs a WARN naming any credential-shaped env var it finds on neither
 # list (never its value), so a secret added to the store later does not go unnoticed forever.
 #
-#   policy → only "deny-by-default" exists today (an operator-authored deny-list was deliberately
-#            rejected — see above). An unrecognized value refuses to start, naming it.
-#   allow  → credential names a member legitimately needs. Left OUT of the pane's env overlay
-#            entirely, so the value the pane's own (login) shell exports passes through untouched.
-#   known  → every credential name the operator's store is known to export. Every name here NOT
-#            also in `allow` is overlaid with a non-secret sentinel value before the pane's login
-#            shell runs — real protection only for names the login shell does not itself re-export
-#            (see the ROUND-2 CORRECTION note above for the ones it does).
+#   policy → "deny-by-default" (the default; also accepted spelled "deny-list") overlays each
+#            known-but-not-allowed name BEFORE the pane's login shell runs — real protection only
+#            where that shell does not re-export the name (see ROUND-2 CORRECTION above). An
+#            unrecognized value refuses to start, naming it.
+#   policy → "allow-list" (CB-633) moves the control to a per-spawn ZDOTDIR directory the daemon
+#            generates and passes through tab.create's env map. Each generated startup file sources
+#            its ~/ counterpart FIRST and then runs the scrub, so the scrub happens after the
+#            operator's whole chain and no sourced file can undo it.
+#            The scrub is sourced from BOTH the generated .zshrc and the generated .zlogin, because
+#            herdr does not open the same kind of shell everywhere: macOS panes run a LOGIN zsh (so
+#            .zlogin runs), Linux panes run a plain interactive zsh (so .zlogin never runs at all).
+#            A scrub in .zlogin alone would be a control that silently does nothing on Linux.
+#            The allow-list is DERIVED, never typed:
+#            every profile's tokenEnv/gitTokenEnv/gitHostEnv values and env-map keys, plus an
+#            infrastructure set (PATH HOME SHELL TERM LANG LC_* TMPDIR USER LOGNAME PWD SHLVL EDITOR
+#            PAGER JAVA_HOME XDG_* ZDOTDIR), plus whatever keys this spawn's own env overlay carries.
+#            Adding a profile can therefore only widen the list, never break another spawn's scrub.
+#            Under this policy `known`/`allow` below become REPORTING ONLY — they feed the gap WARN,
+#            they are no longer a control. If the member's login shell is NOT zsh, the daemon logs a
+#            loud WARN saying protection is off and falls back to deny-by-default's overlay.
+#            Each pane writes a scrub-report.txt naming how many variables it kept of how many it
+#            saw; the daemon logs that "allowed N of M" line when the pane stops. If the report is
+#            MISSING the daemon logs a WARN instead — the scrub cannot then be confirmed to have
+#            run, and a silently-dead control is exactly what this policy exists to prevent.
+#   allow  → credential names a member legitimately needs. Under deny-by-default, left OUT of the
+#            pane's env overlay entirely, so the value the pane's own (login) shell exports passes
+#            through untouched. Under allow-list: reporting only.
+#   known  → every credential name the operator's store is known to export. Under deny-by-default,
+#            every name here NOT also in `allow` is overlaid with a non-secret sentinel value before
+#            the pane's login shell runs — real protection only for names that shell does not itself
+#            re-export (see the ROUND-2 CORRECTION note above). Under allow-list: reporting only.
+#   sshAuthSock → whether SSH_AUTH_SOCK may pass through under allow-list ("allow") or must be
+#            blanked like any other non-derived name ("block", the default). This is a decision you
+#            have to make explicitly: SSH_AUTH_SOCK is a handle to YOUR ssh-agent, and a member
+#            holding it can sign with your keys — it sits in no secret file and looks like no
+#            credential, which is why it slipped past three earlier tickets (gitea #110). Blocking
+#            it breaks git over SSH inside members (push/fetch authenticate as you); use HTTPS
+#            remotes or scoped deploy keys instead of allowing it lightly.
 #
 # HOT-RELOADABLE the same way `fleet:` is (CB-559): read fresh on every spawn, so editing this list
 # and reloading config (or restarting) changes what the NEXT spawn inherits; already-running members
 # are unaffected either way.
 # memberCredentials:
-#   policy: deny-by-default
+#   policy: deny-by-default        # or "deny-list", or "allow-list" (CB-633) — see above
+#   sshAuthSock: block             # allow-list only; see the sshAuthSock note above
 #   allow:
 #     - AI_GATEWAY_TOKEN     # named in a profile's tokenEnv (local/gx) — a member reaching the
 #                            # gateway is by design, not a leak
@@ -593,14 +624,19 @@ guard:
 # RabbitMQ speaks the same AMQP 0-9-1, so it is a URI-only swap.
 #   uri      → AMQP connection URI. No trailing slash ⇒ the default vhost "/"; an empty path ("/")
 #              is vhost "" and will NOT connect. Encode a named vhost as .../%2Fmyvhost.
+#   uriEnv   → CB-151: name of a host env var holding the AMQP URI, preferred over `uri` (wins
+#              whenever set). The URI carries `user:pass@` inline, so naming a variable keeps the
+#              password out of fleetd.yaml — same pattern as auth.tokenEnv/Profile.tokenEnv. A
+#              uriEnv that resolves to an unset or blank variable is treated as NOT configured and
+#              the daemon falls back to the in-memory inbox, warning loudly.
 #   prefetch → CB-527: consumer basicQos, capping how many unacked messages the inbox holds
 #              in-heap per owned target (the rest sits on the broker's durable queue instead of
 #              growing the JVM heap). Default 32 when omitted.
 # broker:
-#   uri: amqp://guest:guest@127.0.0.1:5672
+#   uriEnv: LAVINMQ_URI
 #   prefetch: 32

-# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open bridge_send,
+# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open fleet_send,
 # the ReplyPushLoop injects a *drain nudge* (never the payload) into the primary's own herdr
 # pane — status-gated (only when injectable, never mid-turn) and bounded. Ack = drain: the loop
 # stops as soon as the primary's inbox is empty.
@@ -615,7 +651,7 @@ guard:
 #                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
 #                    self-locking: the learned terminal is populated by the very orchestration
 #                    calls being refused, so only this pinned value can break the cycle. Read the
-#                    id off bridge_whoami (it reports the current terminal even while
+#                    id off fleet_whoami (it reports the current terminal even while
 #                    misclassified) and re-pin whenever the primary moves panes.
 #   pushReminders  → max nudges before giving up (default 5)
 #   pushBackoffMs  → delay between nudges in ms (default 15000)
@@ -5,17 +5,17 @@
    <modelVersion>4.0.0</modelVersion>

    <groupId>dev.ltms</groupId>
-    <artifactId>bridged</artifactId>
+    <artifactId>fleetd</artifactId>
    <version>1.0.0</version>
    <packaging>jar</packaging>

-    <name>bridged</name>
-    <description>claude-bridge message server: sole gateway between primary/worker Claude sessions and herdr</description>
+    <name>fleetd</name>
+    <description>fleet message server: sole gateway between a lead session, its members, and herdr</description>

    <properties>
        <maven.compiler.release>25</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <mainClass>dev.ltms.bridged.Bridged</mainClass>
+        <mainClass>dev.ltms.fleet.Fleetd</mainClass>

        <jackson.version>2.19.0</jackson.version>
        <javalin.version>6.7.0</javalin.version>
@@ -161,6 +161,9 @@
    </dependencies>

    <build>
+        <!-- CB-632: stays 'bridged' until the cutover renames the module dir and the launchd
+         plist together. The installed plist names bridged/target/bridged.jar and
+         KeepAlive is armed, so renaming the jar alone strands a restart. -->
        <finalName>bridged</finalName>
        <plugins>
            <plugin>
@@ -1,56 +1,57 @@
-package dev.ltms.bridged;
+package dev.ltms.fleet;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.config.ConfigRef;
-import dev.ltms.bridged.config.ConfigWatcher;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.LeadTabScanner;
-import dev.ltms.bridged.lead.LeadLauncher;
-import dev.ltms.bridged.herdr.PaneLocator;
-import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.ExhaustedPatternLookup;
-import dev.ltms.bridged.inject.ExhaustionSink;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.inject.StatusPoller;
-import dev.ltms.bridged.inject.TurnListener;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.auth.MemberRegistry;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.mcp.BridgeMcp;
-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.health.FleetHealthMonitor;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.mcp.LsofPeerPidLookup;
-import dev.ltms.bridged.mcp.LsofProcessCwdLookup;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.msg.LeadHeartbeatLoop;
-import dev.ltms.bridged.msg.ReplyPushLoop;
-import dev.ltms.bridged.rest.BridgedApp;
-import dev.ltms.bridged.session.GitWorktrees;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.session.SessionReaper;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.member.CompositePeerLauncher;
-import dev.ltms.bridged.member.HerdrPeerLauncher;
-import dev.ltms.bridged.member.OpenCodeLauncher;
-import dev.ltms.bridged.placement.BackendQuarantine;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.ConfigWatcher;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.lead.LeadLauncher;
+import dev.ltms.fleet.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.UnixSocketHerdrClient;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.CompletionResolver;
+import dev.ltms.fleet.inject.ExhaustedPatternLookup;
+import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.StatusPoller;
+import dev.ltms.fleet.inject.TurnListener;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.health.FleetHealthMonitor;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.mcp.LsofPeerPidLookup;
+import dev.ltms.fleet.mcp.LsofProcessCwdLookup;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.msg.LeadHeartbeatLoop;
+import dev.ltms.fleet.msg.ReplyPushLoop;
+import dev.ltms.fleet.rest.FleetApp;
+import dev.ltms.fleet.session.GitWorktrees;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.session.SessionReaper;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.member.HerdrPeerLauncher;
+import dev.ltms.fleet.member.OpenCodeLauncher;
+import dev.ltms.fleet.placement.BackendQuarantine;
 import io.javalin.Javalin;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -72,17 +73,33 @@ import java.util.stream.Collectors;
 * starts listening. Before anything else it asserts its own environment is clean —
 * {@code bridged} is not a Claude process and must never carry a base_url.
 */
-public final class Bridged {
+public final class Fleetd {

-    private static final Logger log = LoggerFactory.getLogger(Bridged.class);
+    private static final Logger log = LoggerFactory.getLogger(Fleetd.class);

    /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
    private static final long HERDR_WAIT_SECONDS = 30;
    private static final long HERDR_WAIT_POLL_MILLIS = 500;

+    /**
+     * CB-632: prefer {@code fleetd.yaml} in {@code dir}; fall back to {@code bridged.yaml} when
+     * the new name is not there. The operator's live file is still named {@code bridged.yaml},
+     * so the old name keeps working until that file moves.
+     */
+    static Path chooseDefaultConfigFile(Path dir) {
+        Path fleetd = dir.resolve("fleetd.yaml");
+        if (Files.exists(fleetd)) {
+            return fleetd;
+        }
+        return dir.resolve("bridged.yaml");
+    }
+
    static void main(String[] args) {
-        Path configPath = Path.of(args.length > 0 ? args[0] : "bridged.yaml");
-        BridgedConfig cfg = BridgedConfig.load(configPath);
+        Path configPath = args.length > 0 ? Path.of(args[0]) : chooseDefaultConfigFile(Path.of(""));
+        // CB-632: the config file is being renamed bridged.yaml -> fleetd.yaml. Name the file we
+        // actually loaded, whichever of the two names it carries.
+        log.info("Using configuration file {}", configPath);
+        FleetConfig cfg = FleetConfig.load(configPath);
        // CB-594: report which secret env vars the config actually needs, by name, before anything
        // else can fail on a silently-empty one. A daemon started without a login shell (launchd)
        // boots fine either way — this is the only thing that says so out loud.
@@ -127,8 +144,8 @@ public final class Bridged {
        // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
        // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
        // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
-        Map<String, BridgedConfig.Profile> claudeProfiles = new LinkedHashMap<>();
-        Map<String, BridgedConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> claudeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
        cfg.profiles().forEach((name, w) -> {
            if (w.isOpenCode()) {
                opencodeProfiles.put(name, w);
@@ -157,7 +174,7 @@ public final class Bridged {
        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
        // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
        // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
-        // The cooldown is deferred (see BridgedConfig#quarantineCooldownSeconds): it is read once
+        // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
        // here, at startup, and a config reload only changes it for a daemon restart.
        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
@@ -227,7 +244,7 @@ public final class Bridged {
        var leaders = cfg.fleet().leaders();
        if (!leaders.isEmpty()) {
            Set<String> memberSpaces = cfg.profiles().values().stream()
-                    .map(BridgedConfig.Profile::workspace)
+                    .map(FleetConfig.Profile::workspace)
                    .filter(Objects::nonNull)
                    .collect(Collectors.toSet());
            Map<String, String> tabToName = new LinkedHashMap<>();
@@ -332,7 +349,7 @@ public final class Bridged {
            }

            @Override
-            public void onDelivered(String target, dev.ltms.bridged.msg.TurnToken token) {
+            public void onDelivered(String target, dev.ltms.fleet.msg.TurnToken token) {
                completion.onDelivered(target, token);
                sessions.onDelivered(target, token);
            }
@@ -354,18 +371,10 @@ public final class Bridged {
        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
        poller.start();

-        // CB-307: reply inbox. A broker: block (with a uri) selects the AMQP-backed durable adapter;
-        // absent, bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
+        // CB-307: reply inbox. A broker: block selects the AMQP-backed durable adapter; absent (or
+        // unusable), bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
        // connection, so keep the reference to close it in the ordered shutdown hook.
-        final ReplyInbox replyInbox;
-        if (cfg.broker() != null && cfg.broker().isConfigured()) {
-            replyInbox = AmqpReplyInbox.open(cfg.broker().uri(), cfg.broker().prefetchOrDefault());
-            log.info("reply inbox: AMQP broker (durable) at {} (prefetch={})",
-                    cfg.broker().uri(), cfg.broker().prefetchOrDefault());
-        } else {
-            replyInbox = new InMemoryReplyInbox();
-            log.info("reply inbox: in-memory (soft-state)");
-        }
+        final ReplyInbox replyInbox = selectReplyInbox(cfg.broker(), System.getenv(), AmqpReplyInbox::open);
        // CB-307: learn the primary's terminal from orchestration tool calls (or pin from config).
        // The pin also feeds CallerResolver below: a primary running inside a herdr pane would
        // otherwise resolve as a worker and be refused every orchestration tool.
@@ -381,7 +390,7 @@ public final class Bridged {
                    + "has lost the delegation map. Its pushReminders/pushBackoffMs stay valid.");
        }
        // CB-307: active push-to-primary loop — nudge the primary when replies land without an
-        // open bridge_send. Uses its own lightweight scheduled executor, separate from the injector.
+        // open fleet_send. Uses its own lightweight scheduled executor, separate from the injector.
        int maxReminders = cfg.primary() != null ? cfg.primary().remindersOrDefault() : 5;
        long backoffMs = cfg.primary() != null ? cfg.primary().backoffMsOrDefault() : 15_000L;
        var pushScheduler = Executors.newSingleThreadScheduledExecutor(r ->
@@ -389,7 +398,7 @@ public final class Bridged {
        // CB-502: the registry is built before the service and the push loop so send/reply outcomes
        // are counted at their single funnel rather than at each of the two caller-facing surfaces.
        // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
-        Metrics metrics = BridgedMetrics.create(sessions, replyInbox);
+        Metrics metrics = FleetMetrics.create(sessions, replyInbox);
        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
                pushScheduler, maxReminders, backoffMs, metrics);
        // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
@@ -458,7 +467,7 @@ public final class Bridged {
            primaryRegistry.forgetDelegation(detail.terminalId()); // CB-532: don't leak the lead binding
        });

-        // MCP server face (CB-105): bridge_send/bridge_reply/bridge_status, mounted at /mcp.
+        // MCP server face (CB-105): fleet_send/fleet_reply/fleet_status, mounted at /mcp.
        // Caller identity is resolved from the connection (peer PID → herdr pane), not arguments.
        ConnectionIdentity identity = new ConnectionIdentity(
                new PaneLocator(herdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
@@ -480,18 +489,18 @@ public final class Bridged {
            log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
        }

-        BridgeMcp mcp = new BridgeMcp(messages, workers, sessions, identity, presence,
-                primaryRegistry, callers, metrics, new BridgeMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
+        FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
+                primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
                profile -> {
                    var configured = config.get().profiles().get(profile);
                    return configured == null ? null : configured.maxLoad();
                }, () -> config.get().profiles().keySet(), System::nanoTime),
-                new BridgeMcp.HealthCoverageSource(() -> {
+                new FleetMcp.HealthCoverageSource(() -> {
                    var health = config.get().health();
                    return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
                            health != null && health.notifications() != null && health.notifications().configured());
                }),
-                new BridgeMcp.QuarantineSource(profile -> {
+                new FleetMcp.QuarantineSource(profile -> {
                    var configured = config.get().profiles().get(profile);
                    return configured == null ? null : configured.effectiveCredentialId();
                }, quarantine));
@@ -530,7 +539,7 @@ public final class Bridged {
            herdr.close();
        }));

-        Javalin app = new BridgedApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
+        Javalin app = new FleetApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
                callers, metrics).build();
        app.start(cfg.bind().host(), cfg.bind().port());
        log.info("bridged listening on {}:{}, herdr socket {}",
@@ -546,7 +555,7 @@ public final class Bridged {
     * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
     * (or labelled its tab) only once it was up, so there is no boot window to guard.
     *
-     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code BridgeMcp} marks presence
+     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code FleetMcp} marks presence
     * for every spawned member (worker and architect), deliberately, since that map doubles as the
     * member roster's availability signal and a lead counted there would show up as an available
     * member. So without the second disjunct a lead is permanently un-deliverable: every
@@ -560,22 +569,109 @@ public final class Bridged {
        return target -> presence.isPresent(target) || leads.get().containsKey(target);
    }

+    /** Injection seam for {@link #selectReplyInbox}: production binds {@link AmqpReplyInbox#open}. */
+    @FunctionalInterface
+    interface AmqpOpener {
+        ReplyInbox open(String uri, int prefetch);
+    }
+
+    /**
+     * CB-151/152: pick the reply inbox. A usable broker — a literal {@code uri}, or a {@code
+     * uriEnv} whose variable resolves (both read from {@code env}) — selects the durable AMQP inbox.
+     * Everything else falls back to the in-memory inbox: no broker block, a blank {@code uri}, a
+     * {@code uriEnv} whose variable is unset or blank, or a broker unreachable at boot. The two
+     * lossy paths warn <em>loudly</em> — never silently — because what is lost is durable,
+     * cross-restart reply delivery. Package-private and env-injected so the selection is testable
+     * without a real broker or a mutable process environment.
+     */
+    static ReplyInbox selectReplyInbox(FleetConfig.Broker broker, Map<String, String> env, AmqpOpener amqp) {
+        if (broker == null) {
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+        if (broker.hasUriEnv()) {
+            // uriEnv is authoritative whenever set (CB-151): the operator moved off clear text, so
+            // it must not quietly fall back onto a stale literal uri.
+            if (broker.uri() != null && !broker.uri().isBlank()) {
+                log.info("broker.uri is ignored because broker.uriEnv={} is set", broker.uriEnv());
+            }
+            String effectiveUri = broker.effectiveUri(env);
+            if (effectiveUri == null) {
+                log.warn("broker.uriEnv={} is unset or blank — durable AMQP reply inbox DISABLED. "
+                                + "Replies are soft-state and will not survive a restart. Set {} in the "
+                                + "daemon's environment (see scripts/redeploy-bridged.sh) and restart to "
+                                + "use the durable broker inbox.",
+                        broker.uriEnv(), broker.uriEnv());
+                log.info("reply inbox: in-memory (soft-state)");
+                return new InMemoryReplyInbox();
+            }
+            log.info("reply inbox: AMQP broker (durable) via env var {} (prefetch={})",
+                    broker.uriEnv(), broker.prefetchOrDefault());
+            return openAmqpOrFallback(effectiveUri, broker.prefetchOrDefault(), "uriEnv " + broker.uriEnv(), amqp);
+        }
+        // No uriEnv: the literal uri path (existing behaviour).
+        if (broker.effectiveUri(env) == null) {
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+        log.info("reply inbox: AMQP broker (durable) (prefetch={})", broker.prefetchOrDefault());
+        return openAmqpOrFallback(broker.uri(), broker.prefetchOrDefault(), "uri", amqp);
+    }
+
+    /**
+     * Open the AMQP inbox, falling back to the in-memory inbox for this process lifetime if the
+     * broker cannot be reached at boot (CB-152). Not silent: the warning says durable delivery is
+     * off, replies are soft-state and will not survive a restart, plus the source that failed and
+     * the URI <em>with credentials stripped</em>. Never retries in the background — a broker that
+     * drops <em>after</em> startup already self-heals via the connection factory's automatic
+     * recovery; only the boot path is changed here.
+     */
+    private static ReplyInbox openAmqpOrFallback(String effectiveUri, int prefetch, String source,
+                                                 AmqpOpener amqp) {
+        try {
+            return amqp.open(effectiveUri, prefetch);
+        } catch (IllegalStateException e) {
+            log.warn("cannot reach AMQP broker ({}, {}) — falling back to the in-memory reply inbox "
+                            + "for this process lifetime. Durable, cross-restart reply delivery is OFF; "
+                            + "replies are soft-state and will not survive a restart. Reason: {}",
+                    source, stripCredentials(effectiveUri), reasonOf(e));
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+    }
+
+    /** An AMQP URI carries {@code user:pass@} inline — show the host/port, never the credentials. */
+    static String stripCredentials(String uri) {
+        return uri == null ? null : uri.replaceAll("://[^@/]*@", "://");
+    }
+
+    /** The deepest cause's class and message — the outermost {@code IllegalStateException} echoes the URI (with password). */
+    private static String reasonOf(Throwable e) {
+        Throwable t = e;
+        while (t.getCause() != null && t.getCause() != t) {
+            t = t.getCause();
+        }
+        String msg = t.getMessage();
+        return t.getClass().getSimpleName() + (msg == null || msg.isBlank() ? "" : ": " + msg);
+    }
+
    /**
     * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
     * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
-     * {@link BridgedConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
-     * where set (opt-in). Derived from the config, not hard-coded, so a new profile is covered for
-     * free. A var required by more than one profile is one entry naming every profile that needs
-     * it. Deliberately excludes {@code auth.tokenEnv}: that one is already enforced loudly, by a
-     * startup throw in {@code main()} — about 370 lines <em>below</em> this method's call site
-     * ({@link #reportRequiredSecrets(BridgedConfig)}), not a few lines above it. That throw only
+     * {@link FleetConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
+     * where set (opt-in), plus a configured {@code broker.uriEnv} (CB-151). Derived from the
+     * config, not hard-coded, so a new profile is covered for free. A var required by more than one
+     * profile is one entry naming every profile that needs it. Deliberately excludes {@code
+     * auth.tokenEnv}: that one is already enforced loudly, by a startup throw in {@code main()} —
+     * about 370 lines <em>below</em> this method's call site
+     * ({@link #reportRequiredSecrets(FleetConfig)}), not a few lines above it. That throw only
     * fires when {@code auth.mode: token} is configured; under the default loopback-trust mode it
     * never runs, and {@code auth.tokenEnv} is simply not required.
     *
     * <p>Package-private and pure (no I/O, no logging) so the derivation is unit-testable without
-     * capturing log output; {@link #reportRequiredSecrets(BridgedConfig)} is the logging caller.
+     * capturing log output; {@link #reportRequiredSecrets(FleetConfig)} is the logging caller.
     */
-    static Map<String, List<String>> requiredSecretEnvVars(BridgedConfig cfg) {
+    static Map<String, List<String>> requiredSecretEnvVars(FleetConfig cfg) {
        Map<String, List<String>> requiredBy = new LinkedHashMap<>();
        cfg.profiles().forEach((name, profile) -> {
            if (!profile.isSubscription()) {
@@ -587,6 +683,11 @@ public final class Bridged {
                        .add("profile '" + name + "' gitTokenEnv");
            }
        });
+        FleetConfig.Broker broker = cfg.broker();
+        if (broker != null && broker.hasUriEnv()) {
+            requiredBy.computeIfAbsent(broker.uriEnv(), _ -> new ArrayList<>())
+                    .add("broker uriEnv");
+        }
        return requiredBy;
    }

@@ -599,7 +700,7 @@ public final class Bridged {
     * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
     * what is wrong is strictly more useful than one that will not boot at all.
     */
-    private static void reportRequiredSecrets(BridgedConfig cfg) {
+    private static void reportRequiredSecrets(FleetConfig cfg) {
        Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
        if (requiredBy.isEmpty()) {
            log.info("startup secrets: no profile references a token env var — nothing to check");
@@ -622,7 +723,7 @@ public final class Bridged {

    /**
     * CB-596: {@code known:} empty (block absent entirely, or present but empty) means {@link
-     * BridgedConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
+     * FleetConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
     * operator's whole secret store, unblocked, exactly the defect this ticket fixes. Unlike a
     * missing token ({@link #reportRequiredSecrets}), there is no name to point at: the point is
     * that the block itself is missing. Warn once at startup and say what to add; never refuse to
@@ -632,17 +733,21 @@ public final class Bridged {
     * <p>Package-private so the test can capture the log directly, the same way {@link
     * #requiredSecretEnvVars} is exposed for {@link #reportRequiredSecrets}'s own test.
     */
-    static void reportMemberCredentialsGap(BridgedConfig cfg) {
-        BridgedConfig.MemberCredentials creds = cfg.memberCredentials();
+    static void reportMemberCredentialsGap(FleetConfig cfg) {
+        FleetConfig.MemberCredentials creds = cfg.memberCredentials();
        if (creds != null && !creds.known().isEmpty()) {
-            log.info("memberCredentials: {} known name(s), {} allowed — blocking {} on every spawn",
-                    creds.known().size(), creds.allow().size(), creds.blockedSet().size());
+            log.info("memberCredentials: policy={}, {} known name(s), {} allowed — blocking {} on "
+                            + "every spawn{}",
+                    creds.policy(), creds.known().size(), creds.allow().size(), creds.blockedSet().size(),
+                    creds.isAllowList()
+                            ? " (allow-list: known/allow are reporting only — the control is the derived ZDOTDIR scrub)"
+                            : "");
            return;
        }
        log.warn("memberCredentials: absent or empty — the daemon will start anyway, and every "
                + "member pane inherits the operator's WHOLE secret store, unblocked (CB-592's "
                + "protection is lost). Add a memberCredentials: block (policy/allow/known) to "
-                + "bridged.yaml — see bridged.example.yaml — and restart.");
+                + "bridged.yaml — see fleetd.example.yaml — and restart.");
    }

    /**
@@ -678,6 +783,6 @@ public final class Bridged {
        }
    }

-    private Bridged() {
+    private Fleetd() {
    }
 }
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,9 +1,9 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

 /**
 * The authorization table (CB-505), stated once and enforced on both entry paths.
 *
- * <p>Most of these rules are already true de facto — {@code BridgeMcp} derives a worker's identity
+ * <p>Most of these rules are already true de facto — {@code FleetMcp} derives a worker's identity
 * from the connection rather than reading it from an argument, so a worker has never been able to
 * reply <em>as</em> another worker over MCP. What was missing is that the REST surface trusted the
 * session id in the URL path, and neither surface checked role at all. This class makes the
@@ -1,7 +1,7 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.peer.MemberRole;

 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -12,7 +12,7 @@ import java.util.function.Supplier;
 /**
 * Resolves every caller to a {@link Principal}, for both entry paths into the core (CB-501).
 *
- * <p>There are two of them and they are not layered the way the docs suggest: {@code BridgeMcp}
+ * <p>There are two of them and they are not layered the way the docs suggest: {@code FleetMcp}
 * calls the service layer directly and is mounted as a raw servlet (so it never passes through a
 * Javalin filter), while the REST routes historically resolved no identity at all. Both now
 * delegate here, so the authorization rules are stated once instead of drifting apart.
@@ -59,7 +59,7 @@ public final class CallerResolver {
     * <p>Like {@link #leadTerminals}, a supplier rather than a fixed map, so a binding injected
     * after startup — when the later spawn lifecycle establishes a live architect session, or an
     * operator pins one — takes effect without a restart. Consulted per resolve; today's wiring
-     * in {@code Bridged} reads a constant from config, which is the degenerate live case.
+     * in {@code Fleetd} reads a constant from config, which is the degenerate live case.
     */
    private final Supplier<Map<String, String>> architectTerminals;
    private final Function<String, MemberRole> memberSlotRoles;
@@ -235,7 +235,7 @@ public final class CallerResolver {

        // loopback-trust: same-host callers that are not workers are the primary. A non-loopback
        // caller is anonymous even here — and startup refuses that combination anyway
-        // (BridgedConfig.validateAuthExposure), so this is defence in depth, not the control.
+        // (FleetConfig.validateAuthExposure), so this is defence in depth, not the control.
        return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
    }

@@ -1,6 +1,6 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.peer.MemberRole;

 /** Optional session lifecycle hook for live member-slot bindings. */
 public interface MemberLifecycle {
@@ -1,7 +1,7 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.peer.MemberRole;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -59,7 +59,7 @@ public final class MemberRegistry implements MemberLifecycle {
    private final Map<String, String> terminalToSlot = new HashMap<>();

    /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
-    public MemberRegistry(BridgedConfig.Fleet fleet) {
+    public MemberRegistry(FleetConfig.Fleet fleet) {
        Map<String, Entry> flat = new LinkedHashMap<>();
        if (fleet != null) {
            for (MemberRole role : MemberRole.values()) {
@@ -94,7 +94,7 @@ public final class MemberRegistry implements MemberLifecycle {
     * An immutable copy of the live {@code terminal_id → slot name} bindings.
     *
     * <p>Passed to {@link CallerResolver} as the source of architect identity, and what
-     * {@code bridge_whoami}/the roster will read to say which slot a pane hosts. Empty until the
+     * {@code fleet_whoami}/the roster will read to say which slot a pane hosts. Empty until the
     * spawn lifecycle binds a slot.
     */
    public Map<String, String> snapshot() {
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

 /**
 * A resolved caller: its {@link Role}, and — for a worker — the herdr {@code terminal_id} that
@@ -39,14 +39,14 @@ public record Principal(Role role, String terminal, long pid, String name) {
     *
     * <p>Carries {@link Role#PRIMARY}: a lead <em>is</em> a primary as far as authorization goes,
     * so every existing {@code isPrimary()} gate keeps working unchanged and the role table needed
-     * no new entry. The name is reporting only — it lets {@code bridge_whoami} say <em>which</em>
+     * no new entry. The name is reporting only — it lets {@code fleet_whoami} say <em>which</em>
     * lead is asking once more than one is configured.
     *
     * <p><strong>CB-532: a lead now carries the terminal it was matched by.</strong> Under CB-530 it
     * deliberately did not, because {@code terminal} meant "which worker pane" everywhere and a
     * non-null one would have enrolled the lead in the worker presence map. That reading was what
     * made a lead unaddressable: {@link #ownsSession} could never be true for it, so
-     * {@code bridge_reply} was refused and one lead could send to another but never be answered.
+     * {@code fleet_reply} was refused and one lead could send to another but never be answered.
     * The terminal now means "which pane is this caller", the presence map keys on
     * {@link #isSpawnedMember()} instead, and a lead is a peer that can both send and receive.
     */
@@ -63,7 +63,7 @@ public record Principal(Role role, String terminal, long pid, String name) {
     * An architect (CB-548), identified by the slot it occupies and the pane bound to it.
     *
     * <p>Carries {@link Role#ARCHITECT}. {@code slotName} is reporting only — it lets
-     * {@code bridge_whoami} say <em>which</em> architect slot is asking, and it is the key the
+     * {@code fleet_whoami} say <em>which</em> architect slot is asking, and it is the key the
     * (future) spawn lifecycle reads a profile back from. Identity is the {@code terminal}: like a
     * worker's it comes from the connection and the live terminal→slot binding, so
     * {@code ownsSession} works exactly as it does for a worker — an architect acts as its own
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

 /**
 * What a caller is allowed to be on the bus (CB-501).
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -16,7 +16,7 @@ import java.util.function.Supplier;
 /**
 * The daemon's live configuration, re-readable without a restart (CB-559).
 *
- * <p>Consumers hold this, not a {@link BridgedConfig}, and read through {@link #get()} at the point
+ * <p>Consumers hold this, not a {@link FleetConfig}, and read through {@link #get()} at the point
 * of use. A component that captures {@code ref.get()} into a field at construction has opted out of
 * reload — which is sometimes right (see <em>deferred</em> below), but it must then be a deliberate
 * choice rather than an accident of where the field was initialised.
@@ -31,7 +31,7 @@ import java.util.function.Supplier;
 *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those
 *       three are read through a supplier on {@code CompositePeerLauncher}, which is what makes
 *       them hot — not the fact that they are config. <strong>This does NOT include
- *       {@code fleet.leaders}</strong>: {@code Bridged.main} reads {@code cfg.fleet().leaders()}
+ *       {@code fleet.leaders}</strong>: {@code Fleetd.main} reads {@code cfg.fleet().leaders()}
 *       once at startup to build the {@code LeadTabScanner} and the {@code LeadLauncher}, and
 *       neither is reconstructed on reload — so a lead added, removed, or re-{@code tab}'d under
 *       {@code fleet.leaders} needs a restart, the same as any deferred key below.</li>
@@ -42,7 +42,7 @@ import java.util.function.Supplier;
 *       {@code guard:}, {@code worktreeRoot:}, adding or removing a profile (a new backend needs its own launcher,
 *       which is constructed once), <em>and an existing profile's launch settings</em> —
 *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
- *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Bridged.main}'s
+ *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
 *       pattern map at startup), and the rest. {@code credentialId} (CB-578 stage B) is NOT on
 *       this list — it is read live off the config supplier at every quarantine check and
 *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
@@ -65,7 +65,7 @@ import java.util.function.Supplier;
 * running. A config file being edited is normally read once mid-save; degrading a working daemon
 * because it caught a half-written file would be a bad trade.
 */
-public final class ConfigRef implements Supplier<BridgedConfig> {
+public final class ConfigRef implements Supplier<FleetConfig> {

    private static final Logger log = LoggerFactory.getLogger(ConfigRef.class);

@@ -74,21 +74,21 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
            Set.of("bind", "herdrSocket", "broker", "auth");

    private final Path path;
-    private final AtomicReference<BridgedConfig> current;
+    private final AtomicReference<FleetConfig> current;

-    public ConfigRef(Path path, BridgedConfig initial) {
+    public ConfigRef(Path path, FleetConfig initial) {
        this.path = path;
        this.current = new AtomicReference<>(Objects.requireNonNull(initial, "initial config"));
    }

    /** A fixed reference that never reloads — for tests and for wiring built from a config in code. */
-    public static ConfigRef fixed(BridgedConfig cfg) {
+    public static ConfigRef fixed(FleetConfig cfg) {
        return new ConfigRef(null, cfg);
    }

    /** The live configuration. Read this per use; do not cache it in a field. */
    @Override
-    public BridgedConfig get() {
+    public FleetConfig get() {
        return current.get();
    }

@@ -149,10 +149,10 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
        if (path == null) {
            return Outcome.failed("this config was built in code and has no file to reload from");
        }
-        BridgedConfig old = current.get();
-        BridgedConfig fresh;
+        FleetConfig old = current.get();
+        FleetConfig fresh;
        try {
-            fresh = BridgedConfig.load(path);
+            fresh = FleetConfig.load(path);
            // The same gate startup runs. A config that would have refused to boot must not be able
            // to slip in through a reload — that is how a daemon ends up in a state it could never
            // have started in, which is the hardest kind to debug.
@@ -182,7 +182,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
    }

    /** Cold keys whose value differs between the running config and the candidate. */
-    private static List<String> changedColdKeys(BridgedConfig old, BridgedConfig fresh) {
+    private static List<String> changedColdKeys(FleetConfig old, FleetConfig fresh) {
        List<String> changed = new ArrayList<>();
        if (!Objects.equals(old.bind(), fresh.bind())) {
            changed.add("bind");
@@ -202,7 +202,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
    }

    /** Changed keys that were accepted but whose effect waits for a restart. */
-    private static List<String> changedDeferredKeys(BridgedConfig old, BridgedConfig fresh) {
+    private static List<String> changedDeferredKeys(FleetConfig old, FleetConfig fresh) {
        List<String> changed = new ArrayList<>();
        if (!Objects.equals(old.lifecycle(), fresh.lifecycle())) {
            changed.add("lifecycle");
@@ -226,9 +226,9 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
        if (!Objects.equals(old.quarantineCooldownSeconds(), fresh.quarantineCooldownSeconds())) {
            changed.add("quarantineCooldownSeconds");
        }
-        Map<String, BridgedConfig.Profile> before =
+        Map<String, FleetConfig.Profile> before =
                old.profiles() == null ? Map.of() : old.profiles();
-        Map<String, BridgedConfig.Profile> after =
+        Map<String, FleetConfig.Profile> after =
                fresh.profiles() == null ? Map.of() : fresh.profiles();
        // Adding or removing a profile is deferred: a new backend needs its own launcher, and
        // launchers are built once at startup.
@@ -247,7 +247,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
        // a reload can produce, because the operator has no reason to doubt it.
        List<String> relaunch = new ArrayList<>();
        before.forEach((name, was) -> {
-            BridgedConfig.Profile now = after.get(name);
+            FleetConfig.Profile now = after.get(name);
            if (now != null && !sameLaunchSettings(was, now)) {
                relaunch.add(name);
            }
@@ -266,7 +266,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
     * {@code CompositePeerLauncher}/the CB-578 stage B exhaustion sink) and really do take effect on
     * the next spawn.
     */
-    private static boolean sameLaunchSettings(BridgedConfig.Profile a, BridgedConfig.Profile b) {
+    private static boolean sameLaunchSettings(FleetConfig.Profile a, FleetConfig.Profile b) {
        return Objects.equals(a.baseUrl(), b.baseUrl())
                && Objects.equals(a.model(), b.model())
                && Objects.equals(a.configDir(), b.configDir())
@@ -283,7 +283,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
                && Objects.equals(a.kind(), b.kind())
                && Objects.equals(a.env(), b.env())
                && Objects.equals(a.subscription(), b.subscription())
-                // CB-578 stage B: exhaustedPattern is compiled once into Bridged.main's pattern map
+                // CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map
                // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
                // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
                && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern());
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,13 +1,13 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;

 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonToken;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.placement.PlacementPolicies;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.placement.PlacementPolicies;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -26,7 +26,7 @@ import java.util.Set;

 /**
 * {@code bridged} configuration, loaded from a YAML file (see
- * {@code bridged.example.yaml}). Unknown keys are ignored so config can grow ahead
+ * {@code fleetd.example.yaml}). Unknown keys are ignored so config can grow ahead
 * of the code — but an unknown <em>top-level</em> key is logged as a WARN at load (CB-530), because
 * silently dropping a whole block is indistinguishable from honouring it.
 *
@@ -71,7 +71,7 @@ import java.util.Set;
 *                      omitted) blocks nothing — see {@link MemberCredentials}.
 */
@JsonIgnoreProperties(ignoreUnknown = true)
-public record BridgedConfig(
+public record FleetConfig(
        Bind bind,
        String herdrSocket,
        Map<String, Profile> profiles,
@@ -92,7 +92,7 @@ public record BridgedConfig(
        MemberCredentials memberCredentials) {

    /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
@@ -106,7 +106,7 @@ public record BridgedConfig(
    public static final int DEFAULT_QUARANTINE_COOLDOWN_SECONDS = 1800;

    /** Back-compat 14-arg form — no {@code configReload:} block, so file watching stays off. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                         LeadHeartbeat leadHeartbeat, String placement, Auth auth) {
@@ -115,7 +115,7 @@ public record BridgedConfig(
    }

    /** Back-compat form before the optional {@code health:} block was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                         LeadHeartbeat leadHeartbeat, String placement, Auth auth, ConfigReload configReload) {
@@ -124,7 +124,7 @@ public record BridgedConfig(
    }

    /** Back-compat form before the CB-578 stage B {@code quarantineCooldownSeconds} field was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
@@ -147,7 +147,7 @@ public record BridgedConfig(
     * {@code WeightedRoundRobinPolicy}), so losing it makes equal-weight placement
     * non-reproducible across restarts. Unmodifiable-wrap instead of copy-and-scramble.
     */
-    public BridgedConfig {
+    public FleetConfig {
        if (profiles != null && !profiles.isEmpty()) {
            Map<String, Profile> normalized = new LinkedHashMap<>();
            profiles.forEach((name, p) -> normalized.put(name,
@@ -184,7 +184,7 @@ public record BridgedConfig(
     *                  and {@code {n}} (per-worker number, to keep sibling tabs distinct)
     *                  are substituted (default {@code "worker: {profile} #{n}"})
     * @param mcpUrl         bridge MCP URL to provision into the worker's {@code configDir} so it
-     *                       can call {@code bridge_reply} ({@code null}/blank → no provisioning; the
+     *                       can call {@code fleet_reply} ({@code null}/blank → no provisioning; the
     *                       worker won't reply, only the fallback/timeout resolves the send)
     * @param cwd            fixed working directory for this profile's workers (CB-112 "told otherwise");
     *                       {@code null}/blank → inherit the primary's cwd, else the daemon's
@@ -224,7 +224,7 @@ public record BridgedConfig(
     *                       auto-select this profile": it is excluded from every automatic policy's
     *                       pool the same way a quarantined candidate is (see
     *                       {@code PlacementPolicyUtil}). This does not make the profile
-     *                       unreachable — an explicit {@code bridge_spawn{profile:"..."}} bypasses
+     *                       unreachable — an explicit {@code fleet_spawn{profile:"..."}} bypasses
     *                       placement entirely and still resolves it. Weights among the remaining
     *                       (non-excluded) candidates need not sum to 1.0; only their ratios matter.
     * @param maxLoad         max live workers allowed on this profile at one time. Absent
@@ -234,7 +234,7 @@ public record BridgedConfig(
     *                       the same way a {@code weight <= 0} profile is (see
     *                       {@code PlacementPolicyUtil.available()}, which already treats "at cap"
     *                       and "excluded" alike), and an explicit
-     *                       {@code bridge_spawn{profile:"..."}} against it is refused too (see
+     *                       {@code fleet_spawn{profile:"..."}} against it is refused too (see
     *                       {@code CompositePeerLauncher.enforceMaxLoad}) — a cap is a capacity
     *                       statement that does not stop being true just because the profile was
     *                       named directly. A negative value has no sane meaning (there is no
@@ -242,7 +242,7 @@ public record BridgedConfig(
     *                       instead, naming the profile and the key. Live means any session the
     *                       registry still owns (acquired and not yet released), in any state.
     * @param kind           which peer launcher spawns this profile: {@code "claude-code"} (default —
-     *                       the {@link dev.ltms.bridged.member.ClaudeCodeLauncher}) or {@code "opencode"}.
+     *                       the {@link dev.ltms.fleet.member.ClaudeCodeLauncher}) or {@code "opencode"}.
     *                       The {@code CompositePeerLauncher} routes {@code spawn}/reap by this value, so
     *                       each adapter drives only its own kind. Normalised to lower-case; blank ⇒ the
     *                       default. It selects the adapter, not the transport — placement, tabs, cwd, and
@@ -259,7 +259,7 @@ public record BridgedConfig(
     *                       {@code ANTHROPIC_BASE_URL} or {@code ANTHROPIC_AUTH_TOKEN} is refused at
     *                       config load (CB-542): on the subscription path no guard would vet it.
     * @param exhaustedPattern  regex matched against a completion-fallback scrape (CB-578 stage A) to
-     *                       classify a turn that ended with no {@code bridge_reply} as the backend
+     *                       classify a turn that ended with no {@code fleet_reply} as the backend
     *                       having refused on a subscription usage limit, rather than a real answer.
     *                       {@code null}/blank ⇒ the classification never fires for this profile and
     *                       today's completion-fallback behaviour is unchanged. Every backend words
@@ -291,7 +291,7 @@ public record BridgedConfig(
                         String exhaustedPattern,
                         String credentialId) {

-        /** Peer kind spawned by {@link dev.ltms.bridged.member.ClaudeCodeLauncher} (the default). */
+        /** Peer kind spawned by {@link dev.ltms.fleet.member.ClaudeCodeLauncher} (the default). */
        public static final String KIND_CLAUDE_CODE = "claude-code";
        /** Peer kind spawned by the opencode adapter (CB-402). */
        public static final String KIND_OPENCODE = "opencode";
@@ -472,7 +472,7 @@ public record BridgedConfig(
         * {@code ANTHROPIC_AUTH_TOKEN} is injected from {@code tokenEnv}. An {@code env:} entry for
         * either is a bypass vector — it is what the subscription path would otherwise let survive
         * unguarded — so it is rejected at config load (see
-         * {@link BridgedConfig#validateSubscriptionProfiles()}).
+         * {@link FleetConfig#validateSubscriptionProfiles()}).
         */
        public boolean envCarriesAnthropicBinding() {
            return env != null
@@ -551,16 +551,52 @@ public record BridgedConfig(
     *
     * @param uri      AMQP connection URI, e.g. {@code amqp://guest:guest@127.0.0.1:5672/}. Blank/
     *                 {@code null} ⇒ the broker block is treated as absent (in-memory adapter).
+     *                 Ignored when {@code uriEnv} is set.
+     * @param uriEnv   name of a host env var holding the AMQP URI (CB-151). The URI carries its
+     *                 credentials inline, so giving the variable <em>name</em> keeps the password
+     *                 out of the config file, same as {@code auth.tokenEnv}/{@code Profile.tokenEnv}.
+     *                 Wins over {@code uri} whenever set. Blank/{@code null} ⇒ ignored.
     * @param prefetch CB-527: the consumer's {@code basicQos} prefetch count, bounding how many
     *                 unacked messages the AMQP inbox holds in-heap per owned target. {@code null}/
     *                 non-positive ⇒ {@link AmqpReplyInbox#DEFAULT_PREFETCH}.
     */
    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Broker(String uri, Integer prefetch) {
+    public record Broker(String uri, String uriEnv, Integer prefetch) {

-        /** True when a usable broker URI is configured (an empty block does not enable AMQP). */
+        /** True when a {@code uriEnv} is configured by name, whether or not its variable resolves. */
+        public boolean hasUriEnv() {
+            return uriEnv != null && !uriEnv.isBlank();
+        }
+
+        /**
+         * True when a usable broker URI is configured (an empty block does not enable AMQP).
+         * Honors {@code uriEnv} first: if it names a variable that is unset or blank, the broker is
+         * <em>not</em> configured (the daemon falls back to the in-memory inbox) — a bare {@code uri}
+         * is only consulted when no {@code uriEnv} is set. Env lookup makes this process-dependent;
+         * callers already reading {@link System#getenv} are the right ones to invoke it.
+         */
        public boolean isConfigured() {
-            return uri != null && !uri.isBlank();
+            return effectiveUri() != null;
+        }
+
+        /**
+         * The effective AMQP URI to connect with. {@code uriEnv} wins when set (both over {@code uri}
+         * and alone). When {@code uriEnv} names a variable that is unset or blank, returns {@code
+         * null} rather than falling back to {@code uri} — an operator who moved to the secret store
+         * must not silently drop back onto a stale clear-text URI. Returns the literal {@code uri}
+         * when no {@code uriEnv} is configured.
+         */
+        public String effectiveUri() {
+            return effectiveUri(System.getenv());
+        }
+
+        /** As {@link #effectiveUri()}, reading the variable value from {@code env} (the injection seam). */
+        public String effectiveUri(Map<String, String> env) {
+            if (hasUriEnv()) {
+                String value = env.get(uriEnv);
+                return (value != null && !value.isBlank()) ? value : null;
+            }
+            return (uri != null && !uri.isBlank()) ? uri : null;
        }

        /** The prefetch to use, defaulting to {@link AmqpReplyInbox#DEFAULT_PREFETCH} when unset. */
@@ -605,7 +641,7 @@ public record BridgedConfig(
     * work as peers — the second is silently demoted and refused every orchestration call.
     *
     * <p>{@code kind} and {@code model} are descriptive only: they document what runs in the pane
-     * and are reported back by {@code bridge_whoami}.
+     * and are reported back by {@code fleet_whoami}.
     *
     * <p><b>A lead is now also creatable (CB-557).</b> Before, nothing spawned one — a lead
     * pre-existed, which is why it had to be recognised by configuration rather than created. With
@@ -811,7 +847,7 @@ public record BridgedConfig(

    /**
     * Opt-in idle-lead heartbeat (CB-551): when the single lead has been continuously idle past
-     * {@code idleAfterSeconds} with no open {@code bridge_send} driving it, nudge it back to work.
+     * {@code idleAfterSeconds} with no open {@code fleet_send} driving it, nudge it back to work.
     *
     * <p>Deliberately opt-in ({@code null} ⇒ off, exactly like {@code leadScan:}). The heartbeat
     * spends the operator's model subscription on its own initiative — it prompts the lead to start
@@ -893,7 +929,7 @@ public record BridgedConfig(
     *
     * <p>Member identity never depends on this block: a loopback peer PID that maps to a herdr
     * pane is unforgeable and is always honoured (see
-     * {@link dev.ltms.bridged.mcp.ConnectionIdentity}). This only decides what happens for
+     * {@link dev.ltms.fleet.mcp.ConnectionIdentity}). This only decides what happens for
     * <em>everyone else</em>.
     *
     * @param mode     {@code "loopback-trust"} (default) — any loopback caller that is not a known
@@ -957,27 +993,86 @@ public record BridgedConfig(
     * UNLESS it is also in {@link #allow}. A name that shows up in neither list is not silently
     * allowed — see {@code HerdrPeerLauncher}'s gap detector, which logs it.
     *
-     * @param policy how the block is computed. Only {@link #POLICY_DENY_BY_DEFAULT} is understood
-     *               today; {@code null}/blank defaults to it. An operator's own deny-list is
-     *               deliberately not supported — see above.
+     * <p><b>CB-633: allow-list.</b> Deny-by-default's overlay is applied BEFORE the pane's login
+     * shell runs, so any file that chain sources can re-export over it — and did. The allow-list
+     * policy moves the control to a generated ZDOTDIR whose startup files run the scrub LAST, after
+     * the whole operator chain, and blank every exported variable not on an allow-list DERIVED from
+     * what the launcher itself injects (profiles' tokenEnv/gitTokenEnv/gitHostEnv/env keys plus an
+     * infrastructure set) — never hand-typed, so adding a profile cannot break a spawn. Under this
+     * policy {@link #allow} and {@link #known} stop being a control and become reporting only.
+     *
+     * @param policy how the block is computed. {@link #POLICY_DENY_BY_DEFAULT} (the default; also
+     *               accepted as {@link #POLICY_DENY_LIST}) shadows each {@code known}-but-not-allowed
+     *               name in the pane-creation env overlay — which a login shell that re-exports the
+     *               name defeats (see CB-596's round-2 correction). {@link #POLICY_ALLOW_LIST}
+     *               (CB-633) replaces the overlay with a per-spawn ZDOTDIR scrub that runs AFTER the
+     *               pane's login shell has finished sourcing everything, blanking every variable not
+     *               on the DERIVED allow-list (derived from what the launcher itself injects — never
+     *               hand-typed). Under {@code allow-list}, {@link #allow} and {@link #known} are
+     *               REPORTING ONLY: they feed the gap WARN, they are no longer a control.
     * @param allow  credential names a member legitimately needs (e.g. the gateway token it reaches
-     *               the LLM through, the repo-scoped forge token it opens its own PR with). Every
-     *               name here is left unmentioned in the pane's env overlay, so the value the pane's
-     *               own (login) shell exports passes through untouched.
-     * @param known  every credential name the operator's store is known to export. Every name here
-     *               that is NOT also in {@link #allow} is overlaid with a non-secret sentinel value,
-     *               shadowing whatever the pane's login shell would otherwise export for it.
+     *               the LLM through, the repo-scoped forge token it opens its own PR with). Under
+     *               deny-list/deny-by-default every name here is left unmentioned in the pane's env
+     *               overlay; under allow-list this list is reporting only — the control is derived,
+     *               not configured.
+     * @param known  every credential name the operator's store is known to export. Under
+     *               deny-list/deny-by-default every name here that is NOT also in {@link #allow} is
+     *               overlaid with a non-secret sentinel value. Under allow-list this list is
+     *               reporting only.
+     * @param sshAuthSock whether the member may inherit {@code SSH_AUTH_SOCK} under the allow-list
+     *               policy ({@code "allow"}) or must have it blanked ({@code "block"}, the default).
+     *               This is a DECISION, never a default: {@code SSH_AUTH_SOCK} is a handle to the
+     *               operator's ssh-agent, and a member holding it can sign with the operator's own
+     *               keys — but it appears in no secret file and is credential-shaped like nothing on
+     *               any list, which is why three earlier tickets missed it (gitea #110 / CB-607).
+     *               Blocking it breaks git over SSH inside the member; allow it only when members do
+     *               not need to authenticate as the operator over SSH. Ignored under deny-list /
+     *               deny-by-default, which never touch the name.
     */
    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record MemberCredentials(String policy, List<String> allow, List<String> known) {
+    public record MemberCredentials(String policy, List<String> allow, List<String> known,
+                                    String sshAuthSock) {

-        /** The only policy this build understands: block every {@code known} name not in {@code allow}. */
+        /** Default policy: block every {@code known} name not in {@code allow}, via the env overlay. */
        public static final String POLICY_DENY_BY_DEFAULT = "deny-by-default";

+        /** Alias of {@link #POLICY_DENY_BY_DEFAULT}, spelled the way CB-633 names the two policies. */
+        public static final String POLICY_DENY_LIST = "deny-list";
+
+        /**
+         * CB-633: derive the kept-name set from what the launcher itself injects, generate a
+         * per-spawn ZDOTDIR whose startup files blank every exported variable not on it AFTER the
+         * pane's shell has finished sourcing the operator's chain. The scrub is sourced from both
+         * the generated {@code .zshrc} and {@code .zlogin}, because herdr opens a LOGIN zsh on macOS
+         * and a plain interactive one on Linux — see {@code EnvAllowListScrub}.
+         */
+        public static final String POLICY_ALLOW_LIST = "allow-list";
+
+        /** The pre-CB-633 three-field form — {@code sshAuthSock} defaults to blocked. */
+        public MemberCredentials(String policy, List<String> allow, List<String> known) {
+            this(policy, allow, known, null);
+        }
+
        public MemberCredentials {
-            policy = (policy == null || policy.isBlank()) ? POLICY_DENY_BY_DEFAULT : policy.toLowerCase();
+            String normalizedPolicy = (policy == null || policy.isBlank())
+                    ? POLICY_DENY_BY_DEFAULT : policy.toLowerCase(java.util.Locale.ROOT);
+            // deny-list is an alias of deny-by-default, not a third behaviour — normalize to one
+            // spelling so every isDenyList()-style check has one value to compare against.
+            policy = POLICY_DENY_LIST.equals(normalizedPolicy) ? POLICY_DENY_BY_DEFAULT : normalizedPolicy;
            allow = allow == null ? List.of() : List.copyOf(allow);
            known = known == null ? List.of() : List.copyOf(known);
+            sshAuthSock = (sshAuthSock != null && "allow".equalsIgnoreCase(sshAuthSock.trim()))
+                    ? "allow" : "block";
+        }
+
+        /** True when this block selects the CB-633 derived-allow-list policy. */
+        public boolean isAllowList() {
+            return POLICY_ALLOW_LIST.equals(policy);
+        }
+
+        /** True when {@code SSH_AUTH_SOCK} may pass through under the allow-list policy. Default: no. */
+        public boolean sshAuthSockAllowed() {
+            return "allow".equals(sshAuthSock);
        }

        /** {@link #allow} as a set, for membership checks. */
@@ -1028,7 +1123,7 @@ public record BridgedConfig(
        return defaultProfileFor(MemberRole.DEV);
    }

-    private static final Logger log = LoggerFactory.getLogger(BridgedConfig.class);
+    private static final Logger log = LoggerFactory.getLogger(FleetConfig.class);

    private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());

@@ -1037,7 +1132,7 @@ public record BridgedConfig(
     * {@link #warnUnknownTopLevelKeys}. Keep in step with the record components.
     *
     * <p>Package-private (not {@code private}) so a test can assert every key here is documented in
-     * {@code bridged.example.yaml} — the only committed description of the config schema, since
+     * {@code fleetd.example.yaml} — the only committed description of the config schema, since
     * {@code bridged.yaml} itself is gitignored.
     */
    static final Set<String> KNOWN_TOP_LEVEL_KEYS = Set.of(
@@ -1047,7 +1142,7 @@ public record BridgedConfig(
            "memberCredentials");

    /** Load and validate config from {@code path}. */
-    public static BridgedConfig load(Path path) {
+    public static FleetConfig load(Path path) {
        try {
            String yaml = Files.readString(path);
            rejectRenamedTopLevelKeys(yaml);
@@ -1059,7 +1154,7 @@ public record BridgedConfig(
            rejectUnknownAuthMode(yaml);
            rejectUnknownPlacement(yaml);
            rejectUnknownMemberCredentialsPolicy(yaml);
-            BridgedConfig cfg = YAML.readValue(yaml, BridgedConfig.class);
+            FleetConfig cfg = YAML.readValue(yaml, FleetConfig.class);
            // CB-606: validated here, eagerly, using PlacementPolicies.fromName as the single source
            // of truth — not lazily at first spawn (see CompositePeerLauncher's placementPolicy
            // Supplier), where a bad name would still start a daemon that looks healthy.
@@ -1366,7 +1461,7 @@ public record BridgedConfig(
     *
     * <p>{@link Profile}'s compact constructor only lower-cases {@code kind} and compares it against
     * {@code KIND_OPENCODE} — anything else, including a typo like {@code opencod}, silently falls
-     * into the claude-code bucket ({@link dev.ltms.bridged.member.CompositePeerLauncher} routes by
+     * into the claude-code bucket ({@link dev.ltms.fleet.member.CompositePeerLauncher} routes by
     * exact adapter claim, not by membership in a known set). With {@code argv:} also unset, the argv
     * default special-cases only the exact string {@code "claude-code"}, so the launch command falls
     * back to {@code List.of(kind)} — the daemon then tries to run a program literally named after the
@@ -1487,9 +1582,15 @@ public record BridgedConfig(
        }
    }

-    /** The member-credential policies this build understands — {@link MemberCredentials#policy()}'s only valid value. */
+    /**
+     * The member-credential policies this build understands — {@link MemberCredentials#policy()}'s
+     * only valid values. Checked against the RAW yaml text (before {@link MemberCredentials}'s
+     * compact constructor normalizes {@code deny-list} onto {@code deny-by-default}), so the alias
+     * is listed explicitly.
+     */
    private static final Set<String> KNOWN_MEMBER_CREDENTIALS_POLICIES =
-            Set.of(MemberCredentials.POLICY_DENY_BY_DEFAULT);
+            Set.of(MemberCredentials.POLICY_DENY_BY_DEFAULT, MemberCredentials.POLICY_DENY_LIST,
+                    MemberCredentials.POLICY_ALLOW_LIST);

    /**
     * Reject a {@code memberCredentials.policy} that is not {@link #KNOWN_MEMBER_CREDENTIALS_POLICIES}
@@ -1570,7 +1671,7 @@ public record BridgedConfig(
    }

    /** Fill in nested defaults so callers never see nulls for structural fields. */
-    public BridgedConfig withDefaults() {
+    public FleetConfig withDefaults() {
        Bind b = bind != null ? bind : new Bind(null, 0);
        Guard g = guard != null ? guard : new Guard(List.of());
        Lifecycle l = lifecycle != null ? lifecycle : new Lifecycle(null, null, null, false);
@@ -1601,10 +1702,13 @@ public record BridgedConfig(
        // guard/lifecycle, an absent block is not a safe "feature off" default here, it is a gap. It
        // is deliberately not pre-populated with a Java-side name list (that would just reintroduce
        // the hardcoded-list defect this record replaces); the block must be configured in
-        // bridged.yaml to protect anything. See bridged.example.yaml's memberCredentials: comment.
+        // bridged.yaml to protect anything. See fleetd.example.yaml's memberCredentials: comment.
+        // CB-633: policy stays deny-by-default here — the allow-list scrub is opt-in, because it is
+        // stricter than today's behaviour (it blanks every non-derived name, not just known ones)
+        // and an upgrade must not change what a running deployment's members inherit.
        MemberCredentials mc = memberCredentials != null ? memberCredentials
                : new MemberCredentials(null, List.of(), List.of());
-        return new BridgedConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
+        return new FleetConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
                quarantineCooldown, mc);
    }
@@ -1639,8 +1743,8 @@ public record BridgedConfig(
     * <p>The scan reads a tab label and concludes "a lead lives here". bridged also <em>writes</em>
     * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
     * a member template matches and the daemon starts labelling its own members as leads, promoting
-     * the entire fleet to {@link dev.ltms.bridged.auth.Role#PRIMARY} with no message and no diff.
-     * The member-space exclusion in {@link dev.ltms.bridged.herdr.LeadTabScanner} already blocks the
+     * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
+     * The member-space exclusion in {@link dev.ltms.fleet.herdr.LeadTabScanner} already blocks the
     * realistic path, but defence that depends on one workspace label holding is not defence enough
     * for a privilege boundary.
     *
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;

 /** Thrown when the subscription boundary would be violated. Never swallow this. */
 public class GuardException extends RuntimeException {
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;

 import java.net.URI;
 import java.net.URISyntaxException;
@@ -1,7 +1,7 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;

 /**
 * Pure classifier. Collection and repair are deliberately outside this package.
@@ -1,10 +1,10 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.session.MemberSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -44,7 +44,7 @@ public final class FleetHealthMonitor {
     *                   invoked once when a member transitions into a terminal health state. Required —
     *                   there is deliberately no defaulting overload; a caller that does not want the
     *                   fail-tickets-on-terminal-health behavior must pass an explicit inert value (see
-     *                   {@code TestTurnTokens.inert} / {@code BridgeMcp.CapacitySource.none()} for the pattern).
+     *                   {@code TestTurnTokens.inert} / {@code FleetMcp.CapacitySource.none()} for the pattern).
     */
    public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
                              ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

 /** Classification plus the private fact that the next pure decision needs. */
 public record HealthDecision(HealthState state, HealthPrior prior) { }
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

 /** Private cross-tick observation. It is deliberately not a reported health value. */
 public record HealthPrior(boolean busyButDone) {
@@ -1,7 +1,7 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;

 /** Read-only facts from one fleet collection tick. */
 public record HealthSnapshot(MemberSession.State sessionState, AgentStatus liveStatus,
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

 /** Health classifications reported for a member. */
 public enum HealthState {
@@ -1,12 +1,12 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

-import dev.ltms.bridged.msg.Rendezvous;
+import dev.ltms.fleet.msg.Rendezvous;

 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;

 /**
- * Counts turns that ended via the completion fallback instead of {@code bridge_reply}.
+ * Counts turns that ended via the completion fallback instead of {@code fleet_reply}.
 * MUTE is an observation by target and profile, not a classifier state and never suppresses faults.
 */
 public final class MuteCounter {
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

 import java.util.ArrayList;
 import java.util.HashMap;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 /**
 * A herdr agent's lifecycle state, as reported by {@code agent_status}. Drives the
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 /**
 * Raised when a herdr call fails: transport error, or an {@code error} envelope
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
@@ -14,7 +14,7 @@ import java.util.function.Supplier;

 /**
 * Discovers which panes host a lead by scanning herdr for tabs the operator labelled by convention
- * (CB-531), and hands {@link dev.ltms.bridged.auth.CallerResolver} the resulting
+ * (CB-531), and hands {@link dev.ltms.fleet.auth.CallerResolver} the resulting
 * {@code terminal_id → lead name} map.
 *
 * <p><strong>Why scan at all.</strong> A lead is never spawned — a human opens a tab and starts an
@@ -49,7 +49,7 @@ import java.util.function.Supplier;
 * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
 * that bridged never renames a lead tab, so the label was always the human's own writing and there
 * was no round-trip from the daemon's rename back into its next decision.
- * {@code dev.ltms.bridged.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
+ * {@code dev.ltms.fleet.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
 * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
 * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
 * real: a label left behind by a session that has since died would read as a live lead forever.
@@ -58,7 +58,7 @@ import java.util.function.Supplier;
 * ever make a decision that <em>removes</em> something based on this map, add the same check.
 * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
 * happens to start with the same prefix would promote the whole fleet — and that is refused at
- * startup by {@code BridgedConfig.validateLeadTabPrefixes} rather than documented here.
+ * startup by {@code FleetConfig.validateLeadTabPrefixes} rather than documented here.
 *
 * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
 * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -16,14 +16,14 @@ import java.util.regex.Pattern;

 /**
 * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
- * {@link Rendezvous} so a blocking {@code bridge_send} resolves even when the worker finishes its
- * task without ever calling {@code bridge_reply} — the common case for a real delegated coding task.
+ * {@link Rendezvous} so a blocking {@code fleet_send} resolves even when the worker finishes its
+ * task without ever calling {@code fleet_reply} — the common case for a real delegated coding task.
 *
 * <p>On a confirmed {@code working → idle} boundary it scrapes the worker's recent transcript and
 * resolves the awaiting send with that tail (a {@link Rendezvous.Kind#COMPLETION} resolution, so the
 * caller can tell a scrape from a structured reply). It scrapes only when a send is actually waiting
 * — a fleet worker's own turns, or a send that already timed out, cost no herdr traffic. An explicit
- * {@code bridge_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
+ * {@code fleet_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
 *
 * <p>It also handles the CB-109 stall signal ({@link #onTurnFailed}): a worker that ran a turn then
 * wedged in an {@code unknown} state resolves the send as a failure (with the error screen as
@@ -38,7 +38,7 @@ import java.util.regex.Pattern;
 * <p><strong>Waiter-specific resolution (CB-116).</strong> On delivery we also capture the exact
 * {@link Rendezvous} waiter this turn belongs to, and the completion/failure fallbacks resolve
 * <em>that</em> waiter — never "whatever send is waiting now". A completion fallback runs on a virtual
- * thread and can land after the worker's {@code bridge_reply} already resolved the turn and the
+ * thread and can land after the worker's {@code fleet_reply} already resolved the turn and the
 * <em>next</em> send opened its own waiter on the same session; resolving the current waiter would
 * then deliver turn N's stale scrape as turn N+1's answer. Targeting the captured waiter makes a late
 * completion a harmless no-op (its waiter is already done) instead of a cross-turn stale reply.
@@ -62,7 +62,7 @@ public final class CompletionResolver implements TurnListener {
    static final int MAX_SCRAPE_CHARS = 4000;

    private static final String CLIPPED_PANE_TAIL_MARKER =
-            "[Pane tail clipped: member did not call bridge_reply.]";
+            "[Pane tail clipped: member did not call fleet_reply.]";

    private final AgentControl agents;
    private final Rendezvous rendezvous;
@@ -171,7 +171,7 @@ public final class CompletionResolver implements TurnListener {
    void resolve(String target, InFlight turn) {
        CompletableFuture<Rendezvous.Resolution> waiter = turn == null ? null : turn.waiter();
        if (waiter == null || waiter.isDone()) {
-            // Nobody is blocked on THIS turn (it had no send, or its bridge_reply already won). Skip
+            // Nobody is blocked on THIS turn (it had no send, or its fleet_reply already won). Skip
            // the scrape; resolving the current waiter here would be the CB-116 cross-turn stale reply.
            inFlight.remove(target, turn);
            return;
@@ -197,7 +197,7 @@ public final class CompletionResolver implements TurnListener {
        // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
        // delivery, this turn produced no new output — the boundary belongs to the previous turn's
        // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
-        // a stale answer; the real bridge_reply (or a later genuine completion) resolves it instead.
+        // a stale answer; the real fleet_reply (or a later genuine completion) resolves it instead.
        // A scrape that failed to read is exempt — an empty tail there is "couldn't see", not "no change".
        String baseline = turn.baseline();
        if (!scrapeFailed && baseline != null && baseline.equals(tail)) {
@@ -205,7 +205,7 @@ public final class CompletionResolver implements TurnListener {
                    target);
            return; // keep the in-flight record: a later genuine completion still needs it
        }
-        // CB-578 stage A: a turn that ended with no bridge_reply AND whose scrape matches the
+        // CB-578 stage A: a turn that ended with no fleet_reply AND whose scrape matches the
        // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
        // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
        if (!scrapeFailed) {
@@ -215,7 +215,7 @@ public final class CompletionResolver implements TurnListener {
                String reason = "backend exhausted (usage limit): " + matchedLine;
                if (rendezvous.resolveExhausted(waiter, reason)) {
                    inFlight.remove(target, turn);
-                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no bridge_reply; scrape "
+                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no fleet_reply; scrape "
                            + "matched the profile's exhausted pattern): {}", target, reason);
                    // CB-578 stage B: only on the resolution that actually won the race — a late
                    // duplicate must never quarantine a credential twice for one refusal.
@@ -229,7 +229,7 @@ public final class CompletionResolver implements TurnListener {
            inFlight.remove(target, turn);
            if (clipped) {
                log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
-                                + "member did not call bridge_reply, so the pane tail is partial",
+                                + "member did not call fleet_reply, so the pane tail is partial",
                        target, originalLength, MAX_SCRAPE_CHARS);
            }
            log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
@@ -289,7 +289,7 @@ public final class CompletionResolver implements TurnListener {

    /**
     * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
-     * the way {@link dev.ltms.bridged.health.FleetHealthMonitor#coverage} is — so an operator can
+     * the way {@link dev.ltms.fleet.health.FleetHealthMonitor#coverage} is — so an operator can
     * see whether the classification is on, and for which profiles, without reading every
     * profile's config by hand.
     *
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

 import java.util.regex.Pattern;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

 /**
 * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
@@ -8,7 +8,7 @@ package dev.ltms.bridged.inject;
 *
 * <p>{@link CompletionResolver} knows only {@code target} (a herdr terminal id); it has no notion of
 * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
- * the sink's job — see {@code Bridged.main}'s wiring, which resolves target → session → profile →
+ * the sink's job — see {@code Fleetd.main}'s wiring, which resolves target → session → profile →
 * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
 */
@FunctionalInterface
@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -81,7 +81,7 @@ public final class Injector {

    /**
     * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
-     * {@link #onStatus} at. {@code Bridged} passes this to every {@link StatusPoller} it constructs,
+     * {@link #onStatus} at. {@code Fleetd} passes this to every {@link StatusPoller} it constructs,
     * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
     * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
     * that claims a grace duration.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

 import java.util.concurrent.ConcurrentHashMap;
 import java.util.Set;
@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -1,12 +1,12 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.msg.TurnToken;

 /**
 * Notified when a worker's delegated turn is observed to complete — a confirmed
 * {@code WORKING → IDLE} transition after a delivery. This is the CB-106 completion signal the
 * {@code CompletionResolver} uses to resolve a blocked send whose worker never called
- * {@code bridge_reply}. Kept as a seam so the {@link Injector} needs no dependency on the message
+ * {@code fleet_reply}. Kept as a seam so the {@link Injector} needs no dependency on the message
 * layer and stays unit-testable with a capturing fake.
 */
@FunctionalInterface
@@ -1,12 +1,12 @@
-package dev.ltms.bridged.lead;
+package dev.ltms.fleet.lead;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.Tab;
+import dev.ltms.fleet.herdr.Workspace;
+import dev.ltms.fleet.herdr.WorkspaceControl;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -17,6 +17,7 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
 import java.util.stream.Collectors;
+import dev.ltms.fleet.peer.PeerLauncher;

 /**
 * Starts the leads {@code fleet.leaders:} declares, when none is already running (CB-558).
@@ -26,7 +27,7 @@ import java.util.stream.Collectors;
 * must never receive:
 * <ol>
 *   <li>it appends the <em>reply charter</em> — "you are an off-subscription worker … end every turn
- *       with {@code bridge_reply}". A lead is the orchestrator; telling it that it is a worker is
+ *       with {@code fleet_reply}". A lead is the orchestrator; telling it that it is a worker is
 *       exactly backwards.</li>
 *   <li>it registers the session with {@code SessionManager}, which subjects it to the idle reaper,
 *       the context cap and the shutdown drain. An idle lead is the normal state of a lead, so the
@@ -54,14 +55,14 @@ public final class LeadLauncher {

    private final AgentControl agents;
    private final WorkspaceControl spaces;
-    private final BridgedConfig cfg;
+    private final FleetConfig cfg;

    /**
     * @param agents herdr agent control (start, list)
     * @param spaces workspace / tab control (ensure, create, label, list)
     * @param cfg    the loaded config — {@code fleet.leaders}, {@code profiles} and each lead's tab
     */
-    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, BridgedConfig cfg) {
+    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, FleetConfig cfg) {
        this.agents = agents;
        this.spaces = spaces;
        this.cfg = cfg;
@@ -75,7 +76,7 @@ public final class LeadLauncher {
     * the remaining leads are still attempted.
     */
    public int ensureLeads() {
-        Map<String, BridgedConfig.Leader> leaders = cfg.fleet().leaders();
+        Map<String, FleetConfig.Leader> leaders = cfg.fleet().leaders();
        if (leaders.isEmpty()) {
            return 0;
        }
@@ -91,9 +92,9 @@ public final class LeadLauncher {
        }

        int started = 0;
-        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
+        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
            String name = e.getKey();
-            BridgedConfig.Leader lead = e.getValue();
+            FleetConfig.Leader lead = e.getValue();
            int running = live.getOrDefault(name, 0);
            int wanted = lead.instances();

@@ -110,7 +111,7 @@ public final class LeadLauncher {
                continue;
            }

-            BridgedConfig.Profile profile = cfg.profiles().get(lead.profile());
+            FleetConfig.Profile profile = cfg.profiles().get(lead.profile());
            if (profile == null) {
                log.warn("lead '{}' names profile '{}', which is not configured — not launching",
                        name, lead.profile());
@@ -138,9 +139,9 @@ public final class LeadLauncher {
     * already carries {@link Agent#tabId()} directly, so a hand-opened lead is found the same way an
     * auto-launched one is — by labelling its tab to match.
     */
-    private Map<String, Integer> liveLeads(Map<String, BridgedConfig.Leader> leaders) {
+    private Map<String, Integer> liveLeads(Map<String, FleetConfig.Leader> leaders) {
        Set<String> memberSpaces = cfg.profiles().values().stream()
-                .map(BridgedConfig.Profile::workspace)
+                .map(FleetConfig.Profile::workspace)
                .filter(w -> w != null && !w.isBlank())
                .collect(Collectors.toSet());

@@ -174,12 +175,12 @@ public final class LeadLauncher {
     * <p>Matched exactly (case-insensitively) against each lead's configured {@code tab}, so an
     * operator's {@code "lead: something-else"} tab is not mistaken for a configured lead.
     */
-    private String leadNameOf(String label, Map<String, BridgedConfig.Leader> leaders) {
+    private String leadNameOf(String label, Map<String, FleetConfig.Leader> leaders) {
        if (label == null) {
            return null;
        }
        String l = label.strip();
-        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
+        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
            String tab = e.getValue().tabLabel();
            if (tab != null && l.equalsIgnoreCase(tab.strip())) {
                return e.getKey();
@@ -189,7 +190,7 @@ public final class LeadLauncher {
    }

    /** Start one lead. Returns false (having logged) rather than throwing on any failure. */
-    private boolean launch(String name, BridgedConfig.Leader lead, BridgedConfig.Profile profile) {
+    private boolean launch(String name, FleetConfig.Leader lead, FleetConfig.Profile profile) {
        String label = lead.tabLabel();
        String cwd = (lead.cwd() == null || lead.cwd().isBlank())
                ? System.getProperty("user.dir") : lead.cwd();
@@ -236,7 +237,7 @@ public final class LeadLauncher {
     * The herdr agent kind for this profile — the same value the matching member adapter passes, so
     * herdr resolves the same executable for a lead as it does for a member on that backend.
     */
-    private static String herdrKind(BridgedConfig.Profile profile) {
+    private static String herdrKind(FleetConfig.Profile profile) {
        return profile.isOpenCode() ? "opencode" : "claude";
    }

@@ -248,11 +249,12 @@ public final class LeadLauncher {
     * any other primary. This is the single most important difference from the member launchers;
     * do not "unify" it back.
     */
-    private List<String> leadArgv(BridgedConfig.Profile profile) {
+    private List<String> leadArgv(FleetConfig.Profile profile) {
        List<String> argv = new ArrayList<>(profile.argv());
        if (profile.hasMcp()) {
            argv.add("--mcp-config");
-            argv.add("{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
+            argv.add("{\"mcpServers\":{\"" + PeerLauncher.MCP_MOUNT_NAME
+                    + "\":{\"type\":\"http\",\"url\":\""
                    + profile.mcpUrl() + "\"}}}");
        }
        // Appended last, for the same reason the member launcher does it (CB-533): the argv is
@@ -274,7 +276,7 @@ public final class LeadLauncher {
     * definition, so there is no configuration under which pointing it elsewhere is correct, and a
     * profile that carries them (a member profile reused as a lead's backend) must not leak them in.
     */
-    private Map<String, String> leadEnv(BridgedConfig.Profile profile) {
+    private Map<String, String> leadEnv(FleetConfig.Profile profile) {
        Map<String, String> out = new LinkedHashMap<>();
        if (profile.env() != null) {
            out.putAll(profile.env());
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.logging;
+package dev.ltms.fleet.logging;

 import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.Logger;
@@ -1,6 +1,6 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

-import dev.ltms.bridged.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.PaneLocator;

 /**
 * Resolves <em>who is calling</em> an MCP tool from the connection alone — the anti-spoofing
@@ -1,26 +1,26 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

-import dev.ltms.bridged.auth.AuditLog;
-import dev.ltms.bridged.auth.Authz;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.Principal;
-import dev.ltms.bridged.auth.Role;
-import dev.ltms.bridged.guard.GuardException;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.placement.BackendQuarantine;
-import dev.ltms.bridged.placement.PlacementException;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.fleet.auth.AuditLog;
+import dev.ltms.fleet.auth.Authz;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.auth.Role;
+import dev.ltms.fleet.guard.GuardException;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementException;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.WorktreeRequest;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerLauncher;
 import io.modelcontextprotocol.common.McpTransportContext;
 import io.modelcontextprotocol.json.McpJsonMapper;
 import io.modelcontextprotocol.json.jackson3.JacksonMcpJsonMapperSupplier;
@@ -37,35 +37,50 @@ import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.BiFunction;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;

+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 /**
 * The MCP SERVER face (CB-105): a Streamable-HTTP MCP server whose tools are <em>thin adapters</em>
 * over the same {@link MessageService}/{@link Rendezvous} the REST routes use — so the two are
- * validated by parity, not by re-implementing behaviour. The primary Opus calls {@code bridge_send}
- * / {@code bridge_status}; the worker calls {@code bridge_reply}.
+ * validated by parity, not by re-implementing behaviour. The primary Opus calls {@code fleet_send}
+ * / {@code fleet_status}; the worker calls {@code fleet_reply}.
 *
- * <p>Beyond delegation the primary also manages the fleet here (CB-108): {@code bridge_spawn} /
- * {@code bridge_list} / {@code bridge_stop} drive the {@link PeerLauncher} SPI so a worker's whole
+ * <p>Beyond delegation the primary also manages the fleet here (CB-108): {@code fleet_spawn} /
+ * {@code fleet_list} / {@code fleet_stop} drive the {@link PeerLauncher} SPI so a worker's whole
 * lifecycle is managed through MCP, with each adapter's subscription boundary enforced inside it.
 *
 * <p>The tool <em>logic</em> lives in package-private static methods returning a
 * {@link McpSchema.CallToolResult}, so it is unit-testable without standing up the HTTP transport;
 * the SDK owns the wire protocol. Mount {@link #servlet()} at {@code /mcp} on the daemon's Jetty.
 */
-public final class BridgeMcp {
+public final class FleetMcp {
+
+    private static final Logger log = LoggerFactory.getLogger(FleetMcp.class);

    private static final long DEFAULT_TIMEOUT_MS = 25_000;
    private static final long MAX_TIMEOUT_MS = 120_000;
-    // bridge_ask blocks the WORKER's own MCP call, which its client caps near 60s — default under
+    // fleet_ask blocks the WORKER's own MCP call, which its client caps near 60s — default under
    // that so the bridge returns a clean timeout before the client severs the call (CB-205).
    private static final long ASK_DEFAULT_TIMEOUT_MS = 55_000;
    private static final long ASK_MAX_TIMEOUT_MS = 115_000;
    private static final ObjectMapper MAPPER = new ObjectMapper(); // worker-view JSON projections

+    /**
+     * CB-622: the product is renaming {@code bridge_*} tools to {@code fleet_*}. Both names reach
+     * the same handler (registered below); this set makes the "old name used" WARN fire once per
+     * old name for the life of the process, not once per call — a per-name flag, not a numeric
+     * sentinel, so it survives concurrent callers cleanly and reads unambiguously in a log.
+     */
+    private static final Set<String> WARNED_DEPRECATED_NAMES = ConcurrentHashMap.newKeySet();
+
    /** Transport-context key under which the extractor stashes the resolved caller identity. */
    static final String CALLER_TERMINAL = "callerTerminal";
    /** Transport-context key under which the extractor stashes the caller's PID (for cwd inherit). */
@@ -83,7 +98,7 @@ public final class BridgeMcp {
    private final HealthCoverageSource healthCoverage;
    private final QuarantineSource quarantine;

-    /** Capacity facts used by {@code bridge_list}; production must supply the placement live count. */
+    /** Capacity facts used by {@code fleet_list}; production must supply the placement live count. */
    public record CapacitySource(Function<String, Integer> liveCount, Function<String, Integer> maxLoad,
                                 Supplier<Set<String>> configuredProfiles, LongSupplier clock) {
        /** Inert test-only source. It omits capacity rather than inventing zero live counts. */
@@ -95,7 +110,7 @@ public final class BridgeMcp {
    public record HealthCoverageSource(Supplier<String> value) { }

    /**
-     * CB-578 stage B quarantine facts used by {@code bridge_profiles}: a profile → credential id
+     * CB-578 stage B quarantine facts used by {@code fleet_profiles}: a profile → credential id
     * lookup, plus the shared {@link BackendQuarantine} to read remaining cooldowns off.
     */
    public record QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine) {
@@ -109,10 +124,10 @@ public final class BridgeMcp {
     *                Jetty's context handler and never passes through Javalin's {@code before}
     *                filter, so the REST guard does not cover it.
     * @param metrics registry for auth-failure counting; may be {@code null}
-     * @param quarantine CB-578 stage B facts for {@code bridge_profiles}; required — pass
+     * @param quarantine CB-578 stage B facts for {@code fleet_profiles}; required — pass
     *                   {@link QuarantineSource#none()} for a caller that does not want the feature
     */
-    public BridgeMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
+    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                      QuarantineSource quarantine) {
@@ -124,7 +139,7 @@ public final class BridgeMcp {
                .jsonMapper(json)
                .mcpEndpoint("/mcp")
                // Resolve the caller from the connection (peer PID → herdr pane) in one lookup: the
-                // worker terminal for bridge_reply (no spoofable arg), and the PID so bridge_spawn can
+                // worker terminal for fleet_reply (no spoofable arg), and the PID so fleet_spawn can
                // inherit the primary's cwd (CB-112). Any contact from a worker marks it available
                // (CB-113) — its MCP initialize is the reliable "the agent is up" signal.
                .contextExtractor(req -> {
@@ -145,10 +160,10 @@ public final class BridgeMcp {
                            CALLER_NAME, orEmpty(p.name())));
                })
                .build();
-        this.server = McpServer.sync(transport)
-                .serverInfo("bridge", "0.1.0")
-                .capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
-                .toolCall(sendTool(), (exchange, req) -> {
+        // CB-622: each handler is built once and reused for BOTH its fleet_* tool and its
+        // deprecated bridge_* twin (registered below), so the two names can never drift apart.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> sendHandler =
+                (exchange, req) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SEND,
                            str(req.arguments(), "sessionId"));
                    if (denied != null) return denied;
@@ -163,7 +178,7 @@ public final class BridgeMcp {
                    String content = str(a, "content");
                    String turnId = str(a, "turnId");
                    if (turnId != null && !turnId.isBlank()) {
-                        // Answering a worker's bridge_ask (CB-205): resolve its blocked question and
+                        // Answering a worker's fleet_ask (CB-205): resolve its blocked question and
                        // block for the worker's reply as it resumes the same turn. This is the same
                        // delegation, so ownership is left untouched (CB-548) — never re-recorded.
                        return answer(messages, turnId, content, timeoutMs(a));
@@ -178,43 +193,49 @@ public final class BridgeMcp {
                    return Boolean.FALSE.equals(a.get("wait"))
                            ? sendAsync(messages, target, content, onAccepted, workers.profiles())
                            : send(messages, target, content, timeoutMs(a), onAccepted, workers.profiles());
-                })
-                // bridge_reply's identity is the CONNECTION, never an argument — so the authz check
-                // is "is this caller a worker at all", and it can only ever reply as itself.
-                .toolCall(replyTool(), (exchange, req) -> {
+                };
+        // fleet_reply's identity is the CONNECTION, never an argument — so the authz check
+        // is "is this caller a worker at all", and it can only ever reply as itself.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> replyHandler =
+                (exchange, req) -> {
                    String self = callerTerminal(exchange);
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.REPLY, self);
                    if (denied != null) return denied;
                    return reply(messages, self, str(req.arguments(), "content"));
-                })
-                // bridge_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
-                .toolCall(askTool(), (exchange, req) -> {
+                };
+        // fleet_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> askHandler =
+                (exchange, req) -> {
                    String self = callerTerminal(exchange);
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.ASK, self);
                    if (denied != null) return denied;
                    return ask(messages, self, str(req.arguments(), "question"), timeoutMs(req.arguments()));
-                })
-                .toolCall(statusTool(), (exchange, req) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> statusHandler =
+                (exchange, req) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                    if (denied != null) return denied;
                    return status(messages, str(req.arguments(), "sessionId"));
-                })
-                .toolCall(pollTool(), (exchange, req) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> pollHandler =
+                (exchange, req) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                    if (denied != null) return denied;
                    Map<String, Object> a = req.arguments();
                    return poll(messages, str(a, "ticket"), str(a, "target"));
-                })
-                // CB-307 Increment 3: per-msgId ack (not needed in v1 but supported by the inbox).
-                // Acking removes a reply from the inbox, so it is a drain, not a read.
-                .toolCall(ackTool(), (exchange, req) -> {
+                };
+        // CB-307 Increment 3: per-msgId ack (not needed in v1 but supported by the inbox).
+        // Acking removes a reply from the inbox, so it is a drain, not a read.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> ackHandler =
+                (exchange, req) -> {
                    Map<String, Object> a = req.arguments();
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.DRAIN, str(a, "target"));
                    if (denied != null) return denied;
                    return ack(messages, str(a, "target"), str(a, "msgId"));
-                })
-                // Fleet management (CB-108): spawn/list/stop over ClaudeCodeLauncher.
-                .toolCall(spawnTool(), (exchange, req) -> {
+                };
+        // Fleet management (CB-108): spawn/list/stop over ClaudeCodeLauncher.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> spawnHandler =
+                (exchange, req) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SPAWN, null);
                    if (denied != null) return denied;
                    String caller = callerTerminal(exchange);
@@ -229,30 +250,72 @@ public final class BridgeMcp {
                    return spawn(sessions, str(a, "profile"), str(a, "role"), str(a, "cwd"), callerCwd,
                            callerTerminal(exchange), worktreeRequest(a),
                            str(a, "sessionName"), str(a, "resumeSessionId"));
-                })
-                .toolCall(listTool(), (exchange, _) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> listHandler =
+                (exchange, _) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                    if (denied != null) return denied;
                    return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine,
                            callers == null ? Map.of() : callers.leads(),
                            callerTerminal(exchange));
-                })
-                .toolCall(stopTool(), (exchange, req) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> stopHandler =
+                (exchange, req) -> {
                    String paneId = str(req.arguments(), "paneId");
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.STOP, paneId);
                    if (denied != null) return denied;
                    return stop(sessions, paneId);
-                })
-                .toolCall(profilesTool(), (exchange, _) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> profilesHandler =
+                (exchange, _) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                    if (denied != null) return denied;
                    return profiles(workers, quarantine);
-                })
-                .toolCall(whoamiTool(), (exchange, _) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> whoamiHandler =
+                (exchange, _) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                    if (denied != null) return denied;
                    return whoami(principal(exchange), sessions);
-                })
+                };
+
+        McpSchema.Tool fleetSend = sendTool();
+        McpSchema.Tool fleetReply = replyTool();
+        McpSchema.Tool fleetAsk = askTool();
+        McpSchema.Tool fleetStatus = statusTool();
+        McpSchema.Tool fleetPoll = pollTool();
+        McpSchema.Tool fleetAck = ackTool();
+        McpSchema.Tool fleetSpawn = spawnTool();
+        McpSchema.Tool fleetList = listTool();
+        McpSchema.Tool fleetStop = stopTool();
+        McpSchema.Tool fleetProfiles = profilesTool();
+        McpSchema.Tool fleetWhoami = whoamiTool();
+
+        this.server = McpServer.sync(transport)
+                .serverInfo("bridge", "0.1.0")
+                .capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
+                .toolCall(fleetSend, sendHandler)
+                .toolCall(deprecatedTwin(fleetSend, "bridge_send"), deprecatedHandler(fleetSend, "bridge_send", sendHandler))
+                .toolCall(fleetReply, replyHandler)
+                .toolCall(deprecatedTwin(fleetReply, "bridge_reply"), deprecatedHandler(fleetReply, "bridge_reply", replyHandler))
+                .toolCall(fleetAsk, askHandler)
+                .toolCall(deprecatedTwin(fleetAsk, "bridge_ask"), deprecatedHandler(fleetAsk, "bridge_ask", askHandler))
+                .toolCall(fleetStatus, statusHandler)
+                .toolCall(deprecatedTwin(fleetStatus, "bridge_status"), deprecatedHandler(fleetStatus, "bridge_status", statusHandler))
+                .toolCall(fleetPoll, pollHandler)
+                .toolCall(deprecatedTwin(fleetPoll, "bridge_poll"), deprecatedHandler(fleetPoll, "bridge_poll", pollHandler))
+                .toolCall(fleetAck, ackHandler)
+                .toolCall(deprecatedTwin(fleetAck, "bridge_ack"), deprecatedHandler(fleetAck, "bridge_ack", ackHandler))
+                .toolCall(fleetSpawn, spawnHandler)
+                .toolCall(deprecatedTwin(fleetSpawn, "bridge_spawn"), deprecatedHandler(fleetSpawn, "bridge_spawn", spawnHandler))
+                .toolCall(fleetList, listHandler)
+                .toolCall(deprecatedTwin(fleetList, "bridge_list"), deprecatedHandler(fleetList, "bridge_list", listHandler))
+                .toolCall(fleetStop, stopHandler)
+                .toolCall(deprecatedTwin(fleetStop, "bridge_stop"), deprecatedHandler(fleetStop, "bridge_stop", stopHandler))
+                .toolCall(fleetProfiles, profilesHandler)
+                .toolCall(deprecatedTwin(fleetProfiles, "bridge_profiles"), deprecatedHandler(fleetProfiles, "bridge_profiles", profilesHandler))
+                .toolCall(fleetWhoami, whoamiHandler)
+                .toolCall(deprecatedTwin(fleetWhoami, "bridge_whoami"), deprecatedHandler(fleetWhoami, "bridge_whoami", whoamiHandler))
                .build();
        this.authz = callers;
        this.metrics = metrics;
@@ -314,7 +377,7 @@ public final class BridgeMcp {
     * without fabricating an SDK {@code McpSyncServerExchange}.
     *
     * <p>This surface exists because the enforcement was previously unreachable from a test: no
-     * test constructs a {@code BridgeMcp}, so the whole MCP-side gate ran zero times in the suite
+     * test constructs a {@code FleetMcp}, so the whole MCP-side gate ran zero times in the suite
     * while the REST-side equivalent had ten tests. A security control nothing exercises is a
     * claim, not a control.
     *
@@ -335,7 +398,7 @@ public final class BridgeMcp {
        String reason = Authz.isUnauthenticated(caller) ? "unauthenticated" : "forbidden";
        AuditLog.denied(caller, action, target, reason);
        if (metrics != null) {
-            metrics.inc(BridgedMetrics.AUTH_FAILURES, "reason", reason);
+            metrics.inc(FleetMetrics.AUTH_FAILURES, "reason", reason);
        }
        return error(reason + ": " + caller.describe() + " may not " + action);
    }
@@ -406,7 +469,7 @@ public final class BridgeMcp {
    // --- tool logic (thin adapters over the services; unit-testable) ---------------------------

    /**
-     * {@code bridge_send}: delegate {@code content} to a worker session and block for its reply.
+     * {@code fleet_send}: delegate {@code content} to a worker session and block for its reply.
     * The configured profiles are required so a profile name can never bypass target validation.
     *
     * (CB-548): {@code onAccepted} records delegator ownership the instant the send is accepted, so
@@ -430,8 +493,8 @@ public final class BridgeMcp {
    }

    /**
-     * {@code bridge_send} carrying a {@code turnId}: the primary's answer to a worker's
-     * {@code bridge_ask} (CB-205). Resolves the worker's blocked question and blocks for its reply as
+     * {@code fleet_send} carrying a {@code turnId}: the primary's answer to a worker's
+     * {@code fleet_ask} (CB-205). Resolves the worker's blocked question and blocks for its reply as
     * it resumes the same turn — surfaced to the primary identically to a normal send.
     */
    static McpSchema.CallToolResult answer(MessageService messages, String turnId, String content, Long timeoutMs) {
@@ -443,13 +506,13 @@ public final class BridgeMcp {
    }

    /**
-     * {@code bridge_ask} (CB-205): a worker pauses its delegated turn to ask the primary, blocking
+     * {@code fleet_ask} (CB-205): a worker pauses its delegated turn to ask the primary, blocking
     * until the primary answers. The worker is identified by its connection ({@code callerTerminal}),
     * never an argument — a {@code null} means the caller is not a known worker.
     */
    static McpSchema.CallToolResult ask(MessageService messages, String callerTerminal, String question, Long timeoutMs) {
        if (callerTerminal == null) {
-            return error("bridge_ask is for workers only — could not identify the calling worker "
+            return error("fleet_ask is for workers only — could not identify the calling worker "
                    + "from the connection");
        }
        if (isBlank(question)) {
@@ -459,10 +522,10 @@ public final class BridgeMcp {
        MessageService.AskResult r = messages.ask(callerTerminal, question, timeout);
        return switch (r.outcome()) {
            case ANSWERED -> text(r.answer());
-            case NO_WAITER -> error("no primary is awaiting this turn — bridge_ask only works while a "
-                    + "bridge_send delegation is open to answer it");
+            case NO_WAITER -> error("no primary is awaiting this turn — fleet_ask only works while a "
+                    + "fleet_send delegation is open to answer it");
            case TIMED_OUT -> text("[no answer within " + timeout + "ms — the primary did not respond; "
-                    + "proceed on your best judgement, then call bridge_reply to end the turn]");
+                    + "proceed on your best judgement, then call fleet_reply to end the turn]");
        };
    }

@@ -470,10 +533,10 @@ public final class BridgeMcp {
    private static McpSchema.CallToolResult formatReply(MessageService.Reply r, long timeout) {
        return switch (r.outcome()) {
            case REPLIED -> text(r.text());
-            // The worker's turn finished but it never called bridge_reply — hand back the scraped
+            // The worker's turn finished but it never called fleet_reply — hand back the scraped
            // transcript tail, flagged so the primary knows it isn't a structured reply.
            case COMPLETED_UNREPLIED -> text(
-                    "[worker finished without a structured bridge_reply — transcript tail follows]\n" + r.text());
+                    "[worker finished without a structured fleet_reply — transcript tail follows]\n" + r.text());
            // The worker ran the turn then wedged (CB-109) — surface the error context.
            case WORKER_FAILED -> text("[worker failed — turn ended in an unrecoverable state]\n" + r.text());
            // The backend refused on a subscription usage limit (CB-578 stage A) — the worker's
@@ -483,7 +546,7 @@ public final class BridgeMcp {
                    + "usage limit]\n" + r.text());
            // The worker paused mid-turn to ask (CB-205) — tell the primary how to answer in-turn.
            case QUESTION -> text("[question] the worker paused to ask before it can finish:\n" + r.text()
-                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + r.turnId()
+                    + "\n\nAnswer it by calling fleet_send again with turnId=\"" + r.turnId()
                    + "\" and content set to your answer; the worker resumes the same turn.");
            case STALE_TURN -> error("that question is no longer open — it timed out or was already "
                    + "answered (turnId stale)");
@@ -493,7 +556,7 @@ public final class BridgeMcp {
    }

    /**
-     * {@code bridge_send} with {@code wait:false}: delegate {@code content} and return a ticket
+     * {@code fleet_send} with {@code wait:false}: delegate {@code content} and return a ticket
     * immediately (fire-and-poll), so a long task isn't cut off by the caller's MCP call timeout.
     * The configured profiles are required so a profile name can never bypass target validation.
     *
@@ -510,19 +573,19 @@ public final class BridgeMcp {
            return targetError;
        }
        String ticket = messages.sendAsync(sessionId, content, onAccepted);
-        return text("accepted — task delegated. Poll bridge_poll with ticket=" + ticket);
+        return text("accepted — task delegated. Poll fleet_poll with ticket=" + ticket);
    }

    /** A configured profile is never a send target; other unknown values may be herdr-owned panes. */
    private static McpSchema.CallToolResult profileTargetError(String sessionId, Set<String> profiles) {
        if (profiles.contains(sessionId)) {
            return error("unknown send target \"" + sessionId + "\": it is a configured profile name, not a "
-                    + "session id. Call bridge_list to find a member or lead sessionId.");
+                    + "session id. Call fleet_list to find a member or lead sessionId.");
        }
        return null;
    }

-    /** {@code bridge_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
+    /** {@code fleet_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
    static McpSchema.CallToolResult poll(MessageService messages, String ticket, String target) {
        if (!isBlank(target)) {
            var replies = messages.drainReplies(target);
@@ -540,25 +603,25 @@ public final class BridgeMcp {
        }
        return switch (v.phase()) {
            case DONE -> text(v.replySource() != null && v.replySource().equals("transcript")
-                    ? "[done — worker finished without a structured bridge_reply; transcript tail follows]\n" + v.reply()
+                    ? "[done — worker finished without a structured fleet_reply; transcript tail follows]\n" + v.reply()
                    : v.reply());
            case PENDING -> text("[pending — " + v.detail() + "]");
            case ASKING -> text("[question — worker is waiting for your answer]\n" + v.reply()
-                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + v.turnId()
+                    + "\n\nAnswer it by calling fleet_send again with turnId=\"" + v.turnId()
                    + "\" and content set to your answer; the worker resumes the same turn.");
            case FAILED -> text("[failed — " + v.detail() + "]");
        };
    }

    /**
-     * {@code bridge_reply}: the worker returns its structured answer, resolving the awaiting send
+     * {@code fleet_reply}: the worker returns its structured answer, resolving the awaiting send
     * or — when no send is open — queueing the reply in the inbox for later drain (CB-307).
     * {@code callerTerminal} is resolved from the connection (never an argument); a {@code null}
     * means the caller is not a known worker (e.g. the primary called it by mistake).
     */
    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, String content) {
        if (callerTerminal == null) {
-            return error("bridge_reply is for workers only — could not identify the calling worker "
+            return error("fleet_reply is for workers only — could not identify the calling worker "
                    + "from the connection");
        }
        if (content == null) {
@@ -568,7 +631,7 @@ public final class BridgeMcp {
        return text("delivered");
    }

-    /** {@code bridge_ack}: acknowledge (remove) a specific reply from the inbox. */
+    /** {@code fleet_ack}: acknowledge (remove) a specific reply from the inbox. */
    static McpSchema.CallToolResult ack(MessageService messages, String target, String msgId) {
        if (isBlank(target) || isBlank(msgId)) {
            return error("target and msgId are required");
@@ -578,8 +641,8 @@ public final class BridgeMcp {
    }

    /**
-     * {@code bridge_status}: the live lifecycle status of a worker session, plus — when the worker
-     * is paused mid-turn in an async {@code bridge_ask} (CB-582) — the open question and how to
+     * {@code fleet_status}: the live lifecycle status of a worker session, plus — when the worker
+     * is paused mid-turn in an async {@code fleet_ask} (CB-582) — the open question and how to
     * answer it, so a lead on its normal poll cadence does not need the ticket to notice.
     */
    static McpSchema.CallToolResult status(MessageService messages, String sessionId) {
@@ -593,7 +656,7 @@ public final class BridgeMcp {
                return text(base);
            }
            return text(base + "\n\n[question — worker is waiting for your answer]\n" + ask.question()
-                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + ask.turnId()
+                    + "\n\nAnswer it by calling fleet_send again with turnId=\"" + ask.turnId()
                    + "\" and content set to your answer; the worker resumes the same turn."
                    + " (ticket " + ask.ticket() + ")");
        } catch (HerdrException e) {
@@ -602,7 +665,7 @@ public final class BridgeMcp {
    }

    /**
-     * {@code bridge_whoami}: the caller's own identity, as the daemon already resolved it.
+     * {@code fleet_whoami}: the caller's own identity, as the daemon already resolved it.
     *
     * <p>Every other tool <em>consumes</em> this identity — the authorization gate, the reply
     * rendezvous, the cwd inherit — but none reported it, so an agent had to infer its own role
@@ -610,7 +673,7 @@ public final class BridgeMcp {
     * name its MCP mount happens to carry, or {@code ANTHROPIC_BASE_URL} (which Claude-model
     * workers do not set). The failure mode of guessing is asymmetric and silent: a primary that
     * mistakes itself for a worker is refused by {@link Authz} and learns immediately, while a
-     * worker that mistakes itself for the primary ends its turn without {@code bridge_reply} and
+     * worker that mistakes itself for the primary ends its turn without {@code fleet_reply} and
     * the sender simply receives nothing. This tool removes the guess.
     *
     * <p>For a worker the session registry adds what it knows about that session. A worker the
@@ -668,13 +731,13 @@ public final class BridgeMcp {

    // --- fleet management logic (CB-108 / CB-301) --------------------------------------------

-    /** {@code bridge_spawn} without cwd/caller context (default resolution). */
+    /** {@code fleet_spawn} without cwd/caller context (default resolution). */
    static McpSchema.CallToolResult spawn(SessionManager sessions, String profile) {
        return spawn(sessions, profile, null, null, null, null, null, null, null);
    }

    /**
-     * {@code bridge_spawn}: launch a guard-checked member for {@code profile} (blank → the default
+     * {@code fleet_spawn}: launch a guard-checked member for {@code profile} (blank → the default
     * profile) under {@code role} (blank → {@code dev}), and return its session id + pane id. The
     * member's cwd is {@code requestedCwd} if given, else the profile's config, else
     * {@code callerCwd} (the primary's directory), else the daemon's.
@@ -682,7 +745,7 @@ public final class BridgeMcp {
     * CB-301-ext: {@code worktreeRequest} non-null provisions an isolated git worktree.
     * CB-584: {@code sessionName}/{@code resumeSessionId} request agent session identity — a resumed
     * conversation requires an explicit {@code profile} whose adapter declares
-     * {@link dev.ltms.bridged.peer.Capability#SESSION_RESUME}, or the spawn is refused rather than
+     * {@link dev.ltms.fleet.peer.Capability#SESSION_RESUME}, or the spawn is refused rather than
     * silently starting a cold session.
     *
     * <p>{@code role} and {@code profile} are independent: the role picks the contract, the profile
@@ -718,7 +781,7 @@ public final class BridgeMcp {
        }
    }

-    /** Build a {@link WorktreeRequest} from {@code bridge_spawn}'s optional {@code worktree}/{@code ticket} args. */
+    /** Build a {@link WorktreeRequest} from {@code fleet_spawn}'s optional {@code worktree}/{@code ticket} args. */
    private static WorktreeRequest worktreeRequest(Map<String, Object> a) {
        Object w = a.get("worktree");
        if (w == null || Boolean.FALSE.equals(w)) {
@@ -747,7 +810,7 @@ public final class BridgeMcp {
    }

    /**
-     * {@code bridge_profiles}: the configured worker profiles, the default, and — CB-578 stage B —
+     * {@code fleet_profiles}: the configured worker profiles, the default, and — CB-578 stage B —
     * which of them are currently quarantined (backend exhausted) and for how much longer. The
     * {@code quarantined} key is present only when at least one profile is, so a fleet where nothing
     * has ever been quarantined gets exactly the pre-stage-B shape.
@@ -776,7 +839,7 @@ public final class BridgeMcp {
    }

    /**
-     * {@code bridge_list}: the whole fleet — {@code leads} and {@code workers} — each merged with
+     * {@code fleet_list}: the whole fleet — {@code leads} and {@code workers} — each merged with
     * live herdr status. CB-519 decoupled the registry key (a host-unique id) from the herdr pane
     * coordinate, so the join is on the terminal id, which both the session and the live agent carry.
     *
@@ -789,10 +852,10 @@ public final class BridgeMcp {
     * <p>Leads are drawn from the resolver rather than from a second registry, so an address listed
     * here is one that would actually resolve as a lead — see {@link CallerResolver#leads()}. The
     * caller's own row is flagged {@code "self": true}: a peer needs to tell its own pane apart from
-     * a peer's, and the alternative is every lead calling {@code bridge_whoami} to subtract itself.
+     * a peer's, and the alternative is every lead calling {@code fleet_whoami} to subtract itself.
     *
     * <p>CB-583: the {@code capacity} rows reuse {@code quarantine} (the same {@link QuarantineSource}
-     * {@code bridge_profiles} reads) so the two surfaces cannot disagree about which profile is
+     * {@code fleet_profiles} reads) so the two surfaces cannot disagree about which profile is
     * quarantined — see {@link #capacityView}.
     *
     * @param leads    terminal_id → lead name, live from the resolver
@@ -856,7 +919,7 @@ public final class BridgeMcp {
     * CB-583: {@code free} alone cannot tell a lead "busy, will free up" from "refusing, and
     * nothing changes for N seconds" — those need different decisions. So a quarantined profile
     * forces {@code free} to 0, whatever its {@code maxLoad}/{@code live} say, and the row carries
-     * the same {@code credentialId}/{@code quarantinedForSeconds} facts {@code bridge_profiles}
+     * the same {@code credentialId}/{@code quarantinedForSeconds} facts {@code fleet_profiles}
     * reports, reusing {@link QuarantineSource} rather than a second lookup. Both new keys are
     * added only when the profile is actually quarantined, so an ordinary fleet's rows are
     * byte-identical to before this change.
@@ -889,7 +952,7 @@ public final class BridgeMcp {
     *
     * <p>{@code status} is herdr's live view, and {@code unknown} when herdr is not tracking that
     * pane as an agent — the honest answer, and the one that matters: a lead whose pane herdr cannot
-     * see is a lead a {@code bridge_send} cannot be typed into. It is reported rather than hidden,
+     * see is a lead a {@code fleet_send} cannot be typed into. It is reported rather than hidden,
     * because a peer that has gone unreachable is exactly what the sender needs to know.
     */
    private static Map<String, Object> leadView(String terminal, String name, Agent live,
@@ -905,7 +968,7 @@ public final class BridgeMcp {
        return m;
    }

-    /** {@code bridge_stop}: tear a worker down by its pane id. */
+    /** {@code fleet_stop}: tear a worker down by its pane id. */
    static McpSchema.CallToolResult stop(SessionManager sessions, String paneId) {
        if (isBlank(paneId)) {
            return error("paneId is required");
@@ -948,25 +1011,25 @@ public final class BridgeMcp {
    // --- tool schemas --------------------------------------------------------------------------

    private static McpSchema.Tool sendTool() {
-        return tool("bridge_send",
+        return tool("fleet_send",
                "Delegate a task to a worker session. By default blocks until the worker replies and "
                        + "returns its reply (or a 'still working / queued' note on timeout). Pass wait:false "
-                        + "for a long task to return a ticket immediately, then poll it with bridge_poll. To "
-                        + "answer a worker's bridge_ask, pass its turnId (with content) instead of sessionId.",
+                        + "for a long task to return a ticket immediately, then poll it with fleet_poll. To "
+                        + "answer a worker's fleet_ask, pass its turnId (with content) instead of sessionId.",
                objectSchema(Map.of(
                        "sessionId", stringProp("The worker session id (herdr terminal_id) to delegate to"),
                        "content", stringProp("The task/message to send to the worker (or your answer, with turnId)"),
                        "timeoutMs", Map.of("type", "integer", "description", "Max ms to wait for a reply (blocking mode)"),
                        "wait", Map.of("type", "boolean",
                                "description", "Block for the reply (default true); false returns a ticket to poll"),
-                        "turnId", stringProp("When answering a worker's bridge_ask, its question turnId — "
+                        "turnId", stringProp("When answering a worker's fleet_ask, its question turnId — "
                                + "routes your answer back into the same turn (omit for a normal delegation)")),
                        List.of("content")));
    }

    private static McpSchema.Tool askTool() {
        // No target/session arg — the worker's identity is resolved from the connection.
-        return tool("bridge_ask",
+        return tool("fleet_ask",
                "Pause your current delegated turn to ask the primary a question, blocking until it "
                        + "answers — then resume the same turn with the answer. Use this when only the "
                        + "primary has a decision or detail you need to continue. You do not address the "
@@ -979,19 +1042,19 @@ public final class BridgeMcp {
    }

    private static McpSchema.Tool pollTool() {
-        return tool("bridge_poll",
-                "Check an async delegation (a bridge_send with wait:false) by its ticket: "
+        return tool("fleet_poll",
+                "Check an async delegation (a fleet_send with wait:false) by its ticket: "
                        + "pending, done (with the worker's reply), or failed. When target (a worker "
                        + "session id) is present instead of ticket, drain that worker's inbox of "
                        + "replies delivered when no send was open.",
                objectSchema(Map.of(
-                        "ticket", stringProp("The ticket returned by bridge_send wait:false"),
+                        "ticket", stringProp("The ticket returned by fleet_send wait:false"),
                        "target", stringProp("Worker session id to drain pending replies from (optional)")),
                        List.of()));
    }

    private static McpSchema.Tool ackTool() {
-        return tool("bridge_ack",
+        return tool("fleet_ack",
                "Acknowledge (remove) a specific reply from a worker's inbox. Use when the primary "
                        + "has processed a reply and wants to confirm it, leaving other pending replies "
                        + "in the inbox for later drain.",
@@ -1002,22 +1065,22 @@ public final class BridgeMcp {
    }

    private static McpSchema.Tool spawnTool() {
-        return tool("bridge_spawn",
+        return tool("fleet_spawn",
                "Spawn a new off-subscription member session. A member has two independent attributes: "
                        + "role (what it is for) and profile (which backend it runs on). Pass role to pick "
                        + "the contract — 'dev' implements a unit and opens its own PR, 'reviewer' reviews a "
                        + "diff it did not write, 'architect' refines a ticket before anyone builds it; omit "
-                        + "it for 'dev'. Pass profile (from bridge_profiles) to pick the backend, or omit it "
+                        + "it for 'dev'. Pass profile (from fleet_profiles) to pick the backend, or omit it "
                        + "for the default. The two are independent: a reviewer may run on the same profile "
                        + "as the dev it reviews. The member opens your current directory by default; pass "
                        + "cwd to pin a different one. Pass worktree:true (with ticket) or "
                        + "worktree:<ticket-slug> to provision an isolated git worktree. Pass resumeSessionId "
                        + "to relaunch onto a prior conversation instead of starting cold — this requires an "
-                        + "explicit profile whose backend supports it (bridge_list shows agentSessionId for "
+                        + "explicit profile whose backend supports it (fleet_list shows agentSessionId for "
                        + "resumable members), and is refused otherwise rather than silently starting fresh. "
                        + "sessionName gives the member a display name in its own UI when the backend supports "
-                        + "one. Returns the member's sessionId (use with bridge_send) and paneId (use with "
-                        + "bridge_stop).",
+                        + "one. Returns the member's sessionId (use with fleet_send) and paneId (use with "
+                        + "fleet_stop).",
                objectSchema(Map.of(
                        "role", stringProp("What the member is for: architect, dev or reviewer (default dev)"),
                        "profile", stringProp("Which backend to run it on (omit for the default profile)"),
@@ -1025,33 +1088,33 @@ public final class BridgeMcp {
                        "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
                        "ticket", stringProp("Ticket slug when worktree:true"),
                        "sessionName", stringProp("Logical display name for the member's own session, when its backend supports one"),
-                        "resumeSessionId", stringProp("A prior member's agentSessionId (from bridge_list) to resume — requires an explicit profile that supports it")),
+                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it")),
                        List.of()));
    }

    private static McpSchema.Tool profilesTool() {
-        return tool("bridge_profiles",
-                "List the configured worker profiles (backends) and which one bridge_spawn uses by "
+        return tool("fleet_profiles",
+                "List the configured worker profiles (backends) and which one fleet_spawn uses by "
                        + "default. A 'quarantined' map is present when a backend-exhausted refusal put "
-                        + "a profile's credential on cooldown — bridge_spawn onto it is refused until "
+                        + "a profile's credential on cooldown — fleet_spawn onto it is refused until "
                        + "quarantinedForSeconds elapses; a profile sharing that credential is listed too.",
                objectSchema(Map.of(), List.of()));
    }

    private static McpSchema.Tool listTool() {
-        return tool("bridge_list",
+        return tool("fleet_list",
                "List the whole fleet the bridge tracks, in two parts. 'leads' are your PEERS — other "
-                        + "orchestrators, each with its sessionId (the address to bridge_send to), "
+                        + "orchestrators, each with its sessionId (the address to fleet_send to), "
                        + "name, live status, and 'self': true on your own row; this is how you "
                        + "discover a peer lead without being told its address. 'members' are the "
                        + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
                        + "reviewer), profile (the backend it runs on), state, optional "
-                        + "worktree/branch/owner/agentSessionId (the id to pass as bridge_spawn's "
+                        + "worktree/branch/owner/agentSessionId (the id to pass as fleet_spawn's "
                        + "resumeSessionId to relaunch onto that same conversation, when the backend "
                        + "supports it), and live herdr status. An empty 'members' "
                        + "means no members are spawned; it says nothing about peers. When capacity "
                        + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
-                        + "a quarantined profile's credential (see bridge_profiles), whatever its "
+                        + "a quarantined profile's credential (see fleet_profiles), whatever its "
                        + "maxLoad/live — with credentialId and quarantinedForSeconds naming the "
                        + "quarantine, so 'free: 0, busy' can be told apart from 'free: 0, refusing "
                        + "for N seconds'.",
@@ -1059,8 +1122,8 @@ public final class BridgeMcp {
    }

    private static McpSchema.Tool stopTool() {
-        return tool("bridge_stop",
-                "Tear down a worker session by its paneId (from bridge_spawn or bridge_list).",
+        return tool("fleet_stop",
+                "Tear down a worker session by its paneId (from fleet_spawn or fleet_list).",
                objectSchema(Map.of(
                        "paneId", stringProp("The worker's paneId to stop")),
                        List.of("paneId")));
@@ -1068,9 +1131,9 @@ public final class BridgeMcp {

    private static McpSchema.Tool replyTool() {
        // No session/target arg — the caller's identity is resolved from the connection.
-        return tool("bridge_reply",
+        return tool("fleet_reply",
                "Return your structured answer for a message you were sent, resolving the sender's "
-                        + "blocked bridge_send. A worker MUST end every delegated turn with exactly "
+                        + "blocked fleet_send. A worker MUST end every delegated turn with exactly "
                        + "one of these. A lead uses it only to answer another lead that messaged "
                        + "it — never to answer a worker, whose turn it is not.",
                objectSchema(Map.of(
@@ -1079,7 +1142,7 @@ public final class BridgeMcp {
    }

    private static McpSchema.Tool statusTool() {
-        return tool("bridge_status",
+        return tool("fleet_status",
                "Get the live lifecycle status (idle/working/blocked/unknown) of a worker session.",
                objectSchema(Map.of(
                        "sessionId", stringProp("The worker session id to query")),
@@ -1087,20 +1150,58 @@ public final class BridgeMcp {
    }

    private static McpSchema.Tool whoamiTool() {
-        return tool("bridge_whoami",
+        return tool("fleet_whoami",
                "Report who YOU are on the bridge — your role is resolved from your connection "
                        + "(unforgeable), never from anything you claim. Returns role 'primary' (you "
                        + "orchestrate: spawn/send/stop; reply ONLY to answer a peer lead that "
                        + "messaged you, never to answer a worker), 'architect' (you delegate turns "
                        + "and reply/ask as your own pane, but cannot spawn/stop/drain), or 'worker' "
                        + "(you were delegated to: you must end every turn with exactly one "
-                        + "bridge_reply, and cannot spawn or send), plus 'leader'/'architect' naming "
+                        + "fleet_reply, and cannot spawn or send), plus 'leader'/'architect' naming "
                        + "which one you are, your own sessionId, and profile/worktree/branch when "
                        + "you are a worker. Call this first when following role-conditional "
                        + "instructions rather than guessing.",
                objectSchema(Map.of(), List.of()));
    }

+    // --- CB-622: bridge_* -> fleet_* rename, kept working under both names -------------------
+
+    /**
+     * The deprecated {@code bridge_*} twin of {@code fleetTool}: same name-minus-prefix schema,
+     * with a description that leads with the deprecation notice so a client listing tools sees it
+     * immediately. Reuses {@code fleetTool}'s input schema rather than restating it, so the two
+     * can never drift on parameters.
+     */
+    static McpSchema.Tool deprecatedTwin(McpSchema.Tool fleetTool, String oldName) {
+        return tool(oldName, "DEPRECATED: use " + fleetTool.name() + " instead. " + fleetTool.description(),
+                fleetTool.inputSchema());
+    }
+
+    /**
+     * Wrap {@code handler} so a call under the deprecated {@code oldName} logs one WARN naming
+     * the old and new name, then runs the exact SAME handler {@code fleetTool}'s name uses — no
+     * logic is duplicated between the two registrations.
+     */
+    static BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> deprecatedHandler(
+            McpSchema.Tool fleetTool, String oldName,
+            BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> handler) {
+        return (exchange, req) -> {
+            warnDeprecatedOnce(oldName, fleetTool.name());
+            return handler.apply(exchange, req);
+        };
+    }
+
+    /**
+     * Log one WARN naming {@code oldName} and {@code newName} — once per {@code oldName} for the
+     * life of the process, not once per call. {@link #WARNED_DEPRECATED_NAMES} is a per-name flag
+     * (a {@link Set}), not a call counter, so this never conflates "warned" with any numeric state.
+     */
+    static void warnDeprecatedOnce(String oldName, String newName) {
+        if (WARNED_DEPRECATED_NAMES.add(oldName)) {
+            log.warn("{} is deprecated; use {} instead", oldName, newName);
+        }
+    }
+
    // --- small helpers -------------------------------------------------------------------------

    // The SDK 2.0.0 deprecates its own Tool builders without a stable replacement — isolate it here.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 /**
 * Resolves the OS PID that owns a loopback TCP source port — the OS half of connection-based MCP
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -11,7 +11,7 @@ import java.util.concurrent.atomic.AtomicReference;
 * Single-slot, thread-safe registry for the primary's herdr {@code terminal_id}.
 *
 * <p>Populated from the caller terminal of orchestration-side MCP tools
- * ({@code bridge_send}, {@code bridge_spawn}) — tools that only the primary calls.
+ * ({@code fleet_send}, {@code fleet_spawn}) — tools that only the primary calls.
 * A pinned terminal (from config) seeds the registry at construction and makes
 * subsequent {@link #record(String)} calls no-ops.
 *
@@ -29,7 +29,7 @@ public final class PrimaryRegistry {
    /**
     * CB-532: worker terminal → the lead that delegated to it. The single slot above answers "who is
     * THE primary", a question with no correct answer once two leads orchestrate the same fleet:
-     * whichever called {@code bridge_send} first captured every nudge, including nudges for the
+     * whichever called {@code fleet_send} first captured every nudge, including nudges for the
     * other lead's delegations. This map answers the question that actually matters — "who is
     * waiting on THIS worker" — and is what lets {@code primary.terminal} be retired.
     */
@@ -71,7 +71,7 @@ public final class PrimaryRegistry {
     *
     * <p>Called from the {@code MessageService} accepted-delivery hook — only after a send has won
     * the session's send lock and queued delivery — where both halves are known (CB-548). It is
-     * deliberately <em>not</em> called at {@code bridge_send} request time: a concurrent sender that
+     * deliberately <em>not</em> called at {@code fleet_send} request time: a concurrent sender that
     * times out {@code BUSY} must not steal a live delegation's reply routing without ever owning
     * the turn. Last writer wins — if a second lead's later send is accepted, replies follow the
     * lead that most recently delegated to it, which is the one waiting.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 /**
 * Resolves a process's current working directory from its PID — the OS half of CB-112's
@@ -1,11 +1,12 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.PeerLauncher;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -53,7 +54,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * existing deployments and tests keep the legacy non-blocking spawn semantics.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env) {
        this(agents, spaces, guard, profiles, defaultProfile, env, 0,
                System::currentTimeMillis, () -> sleepUninterruptibly(300));
@@ -64,7 +65,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs, long spawnReadyPollMs) {
        this(agents, spaces, guard, profiles, defaultProfile, env,
@@ -77,10 +78,10 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<BridgedConfig.Fleet> fleet) {
+                              Supplier<FleetConfig.Fleet> fleet) {
        this(agents, spaces, guard, profiles, defaultProfile, env,
                spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
@@ -91,11 +92,11 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        this(agents, spaces, guard, profiles, defaultProfile, env,
                spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
@@ -120,7 +121,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     *                             (poll ms) is accepted for API symmetry but otherwise unused here
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper) {
@@ -134,11 +135,11 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * @param fleet live fleet config, read once for each spawn
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet) {
+                              Supplier<FleetConfig.Fleet> fleet) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
        this.guard = guard;
@@ -148,12 +149,12 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
        this.guard = guard;
@@ -165,12 +166,12 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * default (the real {@code System.getenv()} key set) via the constructor above.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials,
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials,
                              Supplier<Set<String>> hostEnvNames) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, hostEnvNames);
@@ -187,7 +188,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * applied here — see {@link #applySessionIdentity}.
     */
    @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
@@ -232,9 +233,9 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
        // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
        // id via -r and passes no --session-id (the two conflict). Both are injected before the
        // model flag so --model keeps outranking the operator's own argv.
-        // mutableArgv: argvWithBridge may hand back the profile's own (immutable) List.of when it
+        // mutableArgv: argvWithFleet may hand back the profile's own (immutable) List.of when it
        // has neither MCP nor a charter — session flags must be added into a list we own.
-        List<String> argv = mutableArgv(argvWithBridge(cfg, spec));
+        List<String> argv = mutableArgv(argvWithFleet(cfg, spec));
        String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
        return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
    }
@@ -289,7 +290,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * is present it keeps its proven inline {@code --append-system-prompt} delivery, which is also
     * the only form that reaches a member with no repo checkout.
     */
-    private List<String> argvWithBridge(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    private List<String> argvWithFleet(FleetConfig.Profile cfg, LaunchSpec spec) {
        String roleCharter = nonBlank(spec.roleCharter());
        String replyCharter = nonBlank(spec.replyCharter());
        Path agentFile = agentDefinitionFile(spec.cwd(), spec.role(), ".claude", "agents");
@@ -298,7 +299,8 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
        }
        List<String> argv = mutableArgv(cfg.argv());
        if (cfg.hasMcp()) {
-            String mcpJson = "{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
+            String mcpJson = "{\"mcpServers\":{\"" + PeerLauncher.MCP_MOUNT_NAME
+                    + "\":{\"type\":\"http\",\"url\":\""
                    + cfg.mcpUrl() + "\"}}}";
            argv.add("--mcp-config");
            argv.add(mcpJson);
@@ -358,7 +360,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
     */
-    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+    private static List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
        if (cfg.model() == null || cfg.model().isBlank()) {
            return argv;
        }
@@ -411,7 +413,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {

    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
    }

    // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------
@@ -1,19 +1,19 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
-import dev.ltms.bridged.placement.BackendQuarantine;
-import dev.ltms.bridged.placement.PlacementCandidate;
-import dev.ltms.bridged.placement.PlacementContext;
-import dev.ltms.bridged.placement.PlacementException;
-import dev.ltms.bridged.placement.PlacementPolicies;
-import dev.ltms.bridged.placement.PlacementPolicy;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementCandidate;
+import dev.ltms.fleet.placement.PlacementContext;
+import dev.ltms.fleet.placement.PlacementException;
+import dev.ltms.fleet.placement.PlacementPolicies;
+import dev.ltms.fleet.placement.PlacementPolicy;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -78,7 +78,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * this way is the set of adapters ({@link #byProfile}), because a new backend needs a launcher
     * and launchers are built once; {@code ConfigRef} classifies that as deferred and says so.
     */
-    private final Supplier<Map<String, BridgedConfig.Profile>> profileConfigs;
+    private final Supplier<Map<String, FleetConfig.Profile>> profileConfigs;
    private final Supplier<PlacementPolicy> placementPolicy;

    /** CB-578 stage B: credential cooldown, checked before an explicit spawn and filtered into placement. */
@@ -89,7 +89,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * {@code null}, and an empty pool for a role, both fall back to every configured profile — the
     * pre-CB-557 behaviour.
     */
-    private final Supplier<BridgedConfig.Fleet> fleet;
+    private final Supplier<FleetConfig.Fleet> fleet;

    /**
     * Backward-compatible constructor: fixed placement, no live-counting. Use this for tests and
@@ -119,7 +119,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                 PlacementPolicy placementPolicy,
                                 Function<String, Integer> liveCount) {
        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, null, BackendQuarantine.none());
@@ -136,27 +136,27 @@ public final class CompositePeerLauncher implements PeerLauncher {
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                 PlacementPolicy placementPolicy,
                                 Function<String, Integer> liveCount,
-                                 BridgedConfig.Fleet fleet) {
+                                 FleetConfig.Fleet fleet) {
        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, fleet, BackendQuarantine.none());
    }

    /**
     * Production constructor with role pools and quarantine (CB-578 stage B). The full-featured
     * non-reloading form; {@link #CompositePeerLauncher(List, String, Supplier, Function, BackendQuarantine)}
-     * is what {@code Bridged.main} actually wires up.
+     * is what {@code Fleetd.main} actually wires up.
     *
     * @param quarantine required — pass {@link BackendQuarantine#none()} for a caller that does not
     *                   want the feature, never a defaulting overload (CB-578 stage B's own rule).
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                 PlacementPolicy placementPolicy,
                                 Function<String, Integer> liveCount,
-                                 BridgedConfig.Fleet fleet,
+                                 FleetConfig.Fleet fleet,
                                 BackendQuarantine quarantine) {
        // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
        // policy breaks exact-weight ties on it, so a salted iteration order would make placement
@@ -175,7 +175,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Supplier<BridgedConfig> config,
+                                 Supplier<FleetConfig> config,
                                 Function<String, Integer> liveCount,
                                 BackendQuarantine quarantine) {
        this(delegates, defaultProfile,
@@ -189,10 +189,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
    /** The all-suppliers form every other constructor funnels into. */
    private CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                  String defaultProfile,
-                                  Supplier<Map<String, BridgedConfig.Profile>> profileConfigs,
+                                  Supplier<Map<String, FleetConfig.Profile>> profileConfigs,
                                  Supplier<PlacementPolicy> placementPolicy,
                                  Function<String, Integer> liveCount,
-                                  Supplier<BridgedConfig.Fleet> fleet,
+                                  Supplier<FleetConfig.Fleet> fleet,
                                  BackendQuarantine quarantine) {
        this.fleet = fleet;
        this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
@@ -214,7 +214,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
                }
            }
        }
-        // Order-preserving for the same reason, and because profiles() is user-visible (bridge_profiles).
+        // Order-preserving for the same reason, and because profiles() is user-visible (fleet_profiles).
        this.byProfile = Collections.unmodifiableMap(index);
    }

@@ -229,8 +229,8 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * <p>Read fresh on every call so a reload is visible; a caller that needs two consistent reads
     * takes one local, as {@link #poolFor} does.
     */
-    private Map<String, BridgedConfig.Profile> profiles0() {
-        Map<String, BridgedConfig.Profile> m = profileConfigs.get();
+    private Map<String, FleetConfig.Profile> profiles0() {
+        Map<String, FleetConfig.Profile> m = profileConfigs.get();
        return m == null ? Map.of() : m;
    }

@@ -254,7 +254,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
        String requestedProfile = req.profileName();
        if (requestedProfile != null && !requestedProfile.isBlank()) {
            // An explicit profile bypasses the placement policy, but not the capacity cap: maxLoad
-            // is documented as an unconditional limit on this profile (BridgedConfig.Profile), and
+            // is documented as an unconditional limit on this profile (FleetConfig.Profile), and
            // the charter makes explicit-profile spawns the normal path — so skipping the check
            // here would leave the cap dead config in real operation.
            HerdrPeerLauncher d = route(requestedProfile);
@@ -267,7 +267,7 @@ public final class CompositePeerLauncher implements PeerLauncher {

        // CB-557: an unqualified spawn is placed inside the pool of the role it asked for, not across
        // the whole profile list. An EXPLICIT profile (above) is left alone on purpose — it is the
-        // operator overriding, and refusing it would break `bridge_spawn{profile:"opus"}`, which
+        // operator overriding, and refusing it would break `fleet_spawn{profile:"opus"}`, which
        // carries no role and so would be judged against the dev pool it was never meant for.
        List<PlacementCandidate> candidates = candidates(req.role());
        String roleDefault = defaultProfileFor(req.role());
@@ -317,7 +317,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
    /**
     * Refuse an explicit-profile spawn when the profile is at its {@code maxLoad} cap.
     *
-     * <p>maxLoad is a documented, unconditional capacity limit (see {@code BridgedConfig.Profile#maxLoad}),
+     * <p>maxLoad is a documented, unconditional capacity limit (see {@code FleetConfig.Profile#maxLoad}),
     * and the charter makes explicit-profile spawns the normal path — so enforcing it only in placement
     * ({@code PlacementPolicyUtil}, package-private, hence not linked) would leave the cap dead config
     * on every call that names a profile. Same rule as placement: {@code live >= cap} is at capacity.
@@ -359,7 +359,7 @@ public final class CompositePeerLauncher implements PeerLauncher {

    /** {@code profile}'s credential group (CB-578 stage B), or the profile's own name if unconfigured. */
    private String credentialIdFor(String profile) {
-        BridgedConfig.Profile cfg = profiles0().get(profile);
+        FleetConfig.Profile cfg = profiles0().get(profile);
        return cfg == null ? profile : cfg.effectiveCredentialId();
    }

@@ -377,7 +377,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
        // until CB-585: an explicit `maxLoad: 0` now survives as 0 and is a real cap of zero, so the
        // check below refuses every spawn on that profile, and a negative value is refused at config
        // load rather than normalized away.
-        BridgedConfig.Profile cfg = profiles0().get(profile);
+        FleetConfig.Profile cfg = profiles0().get(profile);
        Integer cap = (cfg == null) ? null : cfg.maxLoad();
        if (cap == null) {
            return;
@@ -398,8 +398,8 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * a pool entry with no profile, so a survivor is a profile this particular composite does not own.
     */
    private List<String> poolFor(MemberRole role) {
-        Map<String, BridgedConfig.Profile> configured = profiles0();
-        BridgedConfig.Fleet f = fleet.get();
+        Map<String, FleetConfig.Profile> configured = profiles0();
+        FleetConfig.Fleet f = fleet.get();
        List<String> pool = (f == null) ? List.of() : f.profilesFor(role);
        List<String> known = pool.stream().filter(configured::containsKey).toList();
        return known.isEmpty() ? List.copyOf(configured.keySet()) : known;
@@ -415,7 +415,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
    private List<PlacementCandidate> candidates(MemberRole role) {
        List<PlacementCandidate> out = new ArrayList<>();
        for (String name : poolFor(role)) {
-            BridgedConfig.Profile w = profiles0().get(name);
+            FleetConfig.Profile w = profiles0().get(name);
            if (w != null) {
                out.add(new PlacementCandidate(name, null, w.weight(), w.maxLoad()));
            }
@@ -0,0 +1,276 @@
+package dev.ltms.fleet.member;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Stream;
+
+/**
+ * CB-633: generates the per-spawn {@code ZDOTDIR} directory whose startup files enforce
+ * {@code memberCredentials.policy: allow-list}.
+ *
+ * <p>The seam: zsh reads its startup files from {@code $ZDOTDIR}, and the daemon puts that variable
+ * in the pane-creation env map. The operator's whole chain ({@code ~/.zshrc} → secret store) runs
+ * inside those files, so a scrub appended to the LAST one runs after everything the operator
+ * sourced, and nothing later can re-export over it. This is the property CB-596's env-overlay
+ * control lacked: herdr applies that overlay BEFORE the shell starts, so any sourced file can undo
+ * it — and did.
+ *
+ * <p><b>Which file is last depends on the platform, so the scrub runs from two of them.</b> zsh
+ * reads {@code .zshenv} always, {@code .zprofile} and {@code .zlogin} only for a LOGIN shell, and
+ * {@code .zshrc} only for an INTERACTIVE one. herdr does not open the same kind of shell
+ * everywhere — measured on herdr 0.8.0: macOS panes run {@code -zsh} (login, so {@code .zlogin}
+ * runs), Linux panes run a plain {@code /usr/bin/zsh} (interactive but NOT login, so
+ * {@code .zlogin} never runs at all). A scrub in {@code .zlogin} alone is therefore a control that
+ * silently does nothing on Linux — the exact failure this class exists to remove, one platform
+ * over.
+ *
+ * <p>So both {@code .zshrc} and {@code .zlogin} source the same generated {@code scrub.zsh} after
+ * sourcing their {@code $HOME} counterpart. On Linux only the first fires; on macOS both do, and
+ * the second pass is deliberate rather than merely harmless — it re-scrubs anything the operator's
+ * own {@code ~/.zlogin} exported after {@code .zshrc} had finished. Re-running is idempotent: a
+ * name already blank is blanked again, and the report is rewritten with the same counts.
+ *
+ * <p>Each generated file sources its {@code $HOME} counterpart FIRST, so {@code PATH} and every
+ * toolchain binary still resolve exactly as the operator configured them; only afterwards does
+ * {@code .zlogin} run the scrub: every EXPORTED variable not on the derived allow-list is re-exported
+ * blank. Blank, not credential-shaped-pattern-filtered: a pattern list ({@code *TOKEN*}, …) is an
+ * enumeration and misses what it did not think of — a username is the other half of a credential and
+ * is shaped like none. Credential-SHAPED names among the blanked set go to the WARN log only,
+ * never to the control.
+ *
+ * <p>The scrub also writes {@code scrub-report.txt} into its own directory: one {@code allowed N of
+ * M} line (N = exports left untouched, M = exports present when the scrub ran), then the blanked
+ * NAMES — never values. The launcher reads this back at teardown and logs it, because a blocked
+ * count next to an unknown denominator is not a finding.
+ */
+public final class EnvAllowListScrub {
+
+    private static final Logger log = LoggerFactory.getLogger(EnvAllowListScrub.class);
+
+    /** Name of the report file written into the generated directory by the scrub itself. */
+    static final String REPORT_FILE = "scrub-report.txt";
+
+    /** The scrub body, generated once and sourced from both {@code .zshrc} and {@code .zlogin}. */
+    static final String SCRUB_FILE = "scrub.zsh";
+
+    /** Prefix of every generated directory — also what {@link #reapOrphans} matches on. */
+    static final String DIR_PREFIX = "bridged-zdotdir-";
+
+    /**
+     * How old an orphan must be before {@link #reapOrphans} removes it. Comfortably longer than any
+     * spawn takes, so a directory belonging to a pane that is still starting is never removed.
+     */
+    private static final Duration ORPHAN_AGE = Duration.ofHours(24);
+
+    /** Appended to the two startup files that must run the scrub, after their {@code $HOME} source. */
+    private static final String SOURCE_SCRUB =
+            "source \"$ZDOTDIR/" + SCRUB_FILE + "\"\n";
+
+    private EnvAllowListScrub() {
+    }
+
+    /**
+     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran,
+     * how many were left untouched (allowed), and the NAMES that were blanked. Values never appear.
+     */
+    record ScrubReport(int allowed, int total, List<String> blanked) {
+    }
+
+    /**
+     * Create a fresh ZDOTDIR directory under {@code parentDir} holding the four zsh startup files.
+     * Every file (and the directory) registers {@code deleteOnExit}, next to the existing per-spawn
+     * charter/config temp cleanup; the launcher additionally deletes eagerly at pane release.
+     *
+     * @param allowedNames the DERIVED allow-list — exact variable names that must survive the scrub
+     * @return the directory path (to be passed as the pane's {@code ZDOTDIR})
+     * @throws UncheckedIOException when the directory or any file cannot be written — a spawn whose
+     *                              protection cannot even be materialized must fail loudly rather
+     *                              than start unprotected
+     */
+    public static Path generate(Path parentDir, Set<String> allowedNames) {
+        try {
+            reapOrphans(parentDir);
+            Path dir = Files.createTempDirectory(parentDir, DIR_PREFIX);
+            dir.toFile().deleteOnExit();
+            // The report is written by zsh, after these hooks are registered, so register its path
+            // too — otherwise the directory is non-empty at JVM exit and cannot be removed at all.
+            dir.resolve(REPORT_FILE).toFile().deleteOnExit();
+            write(dir, SCRUB_FILE, scrubScript(allowedNames));
+            write(dir, ".zshenv", homeSourcingFile(".zshenv"));
+            write(dir, ".zprofile", homeSourcingFile(".zprofile"));
+            write(dir, ".zshrc", homeSourcingFile(".zshrc") + SOURCE_SCRUB);
+            write(dir, ".zlogin", homeSourcingFile(".zlogin") + SOURCE_SCRUB);
+            return dir;
+        } catch (IOException e) {
+            throw new UncheckedIOException("cannot generate ZDOTDIR scrub files under " + parentDir, e);
+        }
+    }
+
+    /** One operator-sourcing startup file: source the {@code $HOME} counterpart, change nothing else. */
+    private static String homeSourcingFile(String name) {
+        return """
+                # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
+                # Source the operator's own %s first, so PATH and the agent binaries resolve as usual.
+                [ -r "$HOME/%s" ] && source "$HOME/%s"
+                """.formatted(name, name, name);
+    }
+
+    /**
+     * The generated {@code scrub.zsh} — the scrub body on its own, so the two startup files that
+     * must run it ({@code .zshrc} and {@code .zlogin}) hold one copy between them rather than two
+     * that can drift. Package-private so tests can assert on the exact script handed to zsh — the
+     * artefact here IS a shell file, and a test that checks only the Java string assembly proves
+     * nothing about whether zsh accepts it.
+     */
+    static String scrubScript(Set<String> allowedNames) {
+        StringBuilder names = new StringBuilder();
+        for (String n : allowedNames.stream().sorted().toList()) {
+            if (names.length() > 0) {
+                names.append(' ');
+            }
+            // Names are validated against [A-Za-z_][A-Za-z0-9_]* before they get here; single quotes
+            // keep even a non-conforming name inert rather than executable.
+            names.append('\'').append(n.replace("'", "")).append('\'');
+        }
+        return """
+                # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
+                # Sourced from .zshrc and again from .zlogin, each time AFTER that file has sourced
+                # its $HOME counterpart — so this runs after everything the operator sourced, on a
+                # login shell (macOS panes) and on a plain interactive one (Linux panes) alike.
+                # Running twice is idempotent and deliberate: the second pass catches anything
+                # ~/.zlogin exported after ~/.zshrc had finished.
+
+                typeset -A _cb633_allowed
+                for _cb633_n in %s; do _cb633_allowed[$_cb633_n]=1; done
+
+                # Enumerate EXPORTED variable NAMES from `env` itself. Deliberately NOT the special
+                # `parameters` assoc: its subscript is evaluated arithmetically on this host's zsh
+                # and blows up on some names ("bad math expression"). Names not matching the
+                # identifier pattern (junk from multi-line values) are skipped, never scrubbed.
+                typeset -a _cb633_names
+                _cb633_names=("${(@f)$(command env | command cut -d= -f1)}")
+                typeset -a _cb633_blank
+                _cb633_blank=()
+                integer _cb633_total=0
+                for _cb633_n in "${_cb633_names[@]}"; do
+                  [[ "$_cb633_n" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+                  (( _cb633_total += 1 ))
+                  [[ -n "${_cb633_allowed[$_cb633_n]-}" ]] && continue
+                  case "$_cb633_n" in %s) continue ;; esac
+                  _cb633_blank+=("$_cb633_n")
+                done
+
+                { for _cb633_n in "${_cb633_blank[@]}"; do export "$_cb633_n="; done; } 2>/dev/null
+
+                integer _cb633_kept=$(( _cb633_total - ${#_cb633_blank} ))
+                {
+                  print -r -- "allowed $_cb633_kept of $_cb633_total"
+                  for _cb633_n in "${_cb633_blank[@]}"; do print -r -- "$_cb633_n"; done
+                } > "$ZDOTDIR/%s" 2>/dev/null
+
+                unset _cb633_allowed _cb633_names _cb633_blank _cb633_n _cb633_total _cb633_kept
+                """.formatted(names, MemberEnvAllowList.zshCasePattern(), REPORT_FILE);
+    }
+
+    private static void write(Path dir, String fileName, String content) throws IOException {
+        Path file = dir.resolve(fileName);
+        Files.writeString(file, content);
+        file.toFile().deleteOnExit();
+    }
+
+    /**
+     * Read and parse {@link #REPORT_FILE} out of a generated ZDOTDIR directory. Returns {@code null}
+     * when absent or unreadable (the pane may have been torn down before its login shell ever got to
+     * the scrub) — callers treat that as "no measurement available", never as success.
+     */
+    static ScrubReport readReport(Path zdotdir) {
+        Path report = zdotdir.resolve(REPORT_FILE);
+        if (!Files.isRegularFile(report)) {
+            return null;
+        }
+        try {
+            List<String> lines = Files.readAllLines(report);
+            if (lines.isEmpty() || !lines.getFirst().startsWith("allowed ")) {
+                return null;
+            }
+            String[] parts = lines.getFirst().substring("allowed ".length()).trim().split("\\s+");
+            if (parts.length != 3 || !"of".equals(parts[1])) {
+                return null;
+            }
+            List<String> blanked = new ArrayList<>();
+            for (int i = 1; i < lines.size(); i++) {
+                if (!lines.get(i).isBlank()) {
+                    blanked.add(lines.get(i));
+                }
+            }
+            return new ScrubReport(Integer.parseInt(parts[0]), Integer.parseInt(parts[2]),
+                    List.copyOf(blanked));
+        } catch (IOException | NumberFormatException e) {
+            return null;
+        }
+    }
+
+    /** Best-effort recursive delete; failures are swallowed — JVM-exit cleanup is the backstop. */
+    /**
+     * Remove generated directories left behind by an earlier daemon process.
+     *
+     * <p>{@link #generate} registers each directory for deletion at JVM exit, which covers a clean
+     * shutdown and covers nothing else. A {@code kill -9}, a crash, or a host reboot leaves the
+     * directory in the temp dir for good, and the daemon is restarted often enough that these
+     * accumulate. They hold no secrets — the generated files contain variable NAMES and a report of
+     * names, never a value — but an unbounded pile of them in {@code /tmp} is still our mess to
+     * clear.
+     *
+     * <p>Called from {@link #generate}, so it runs on the path that creates them and needs no
+     * separate wiring or scheduler. Only directories older than {@link #ORPHAN_AGE} are touched,
+     * which keeps it clear of any pane that is merely still starting, including one belonging to a
+     * different daemon instance running right now. Best-effort: every failure is ignored, because
+     * tidying temp files must never be the reason a spawn fails.
+     */
+    static void reapOrphans(Path parentDir) {
+        Instant cutoff = Instant.now().minus(ORPHAN_AGE);
+        try (Stream<Path> entries = Files.list(parentDir)) {
+            entries.filter(d -> d.getFileName().toString().startsWith(DIR_PREFIX))
+                    .filter(Files::isDirectory)
+                    .filter(d -> olderThan(d, cutoff))
+                    .forEach(EnvAllowListScrub::deleteRecursively);
+        } catch (IOException | RuntimeException e) {
+            log.debug("could not scan {} for orphaned ZDOTDIRs: {}", parentDir, e.toString());
+        }
+    }
+
+    private static boolean olderThan(Path dir, Instant cutoff) {
+        try {
+            return Files.getLastModifiedTime(dir).toInstant().isBefore(cutoff);
+        } catch (IOException e) {
+            return false; // unreadable timestamp ⇒ leave it alone
+        }
+    }
+
+    static void deleteRecursively(Path dir) {
+        if (dir == null || !Files.exists(dir)) {
+            return;
+        }
+        try (Stream<Path> walk = Files.walk(dir)) {
+            walk.sorted(java.util.Comparator.reverseOrder()).forEach(p -> {
+                try {
+                    Files.deleteIfExists(p);
+                } catch (IOException ignored) {
+                    // best effort — deleteOnExit retries at JVM shutdown
+                }
+            });
+        } catch (IOException ignored) {
+            // same
+        }
+    }
+}
@@ -1,19 +1,19 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.Tab;
+import dev.ltms.fleet.herdr.Workspace;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.CharterReceipt;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.peer.SpawnRequest;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -49,7 +49,7 @@ import java.util.regex.Pattern;
 *   <li>{@code namePrefix} (constructor arg) — the label prefix ({@code claude}, {@code opencode})
 *       that drives both unique naming and the orphan-reap pattern, so each adapter reaps only its
 *       own kind of pane and never another's.</li>
- *   <li>{@link #buildLaunch(BridgedConfig.Profile, LaunchSpec)} — the peer-specific env map + argv, including any
+ *   <li>{@link #buildLaunch(FleetConfig.Profile, LaunchSpec)} — the peer-specific env map + argv, including any
 *       subscription/guard check, MCP mount, and instruction injection. The base never sees how the
 *       peer is configured; it only places and starts the returned {@link Launch}.</li>
 * </ul>
@@ -76,7 +76,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    private final String namePrefix;                       // label prefix: naming + reap scheme
    private final AgentControl agents;
    private final WorkspaceControl spaces;
-    private final Map<String, BridgedConfig.Profile> profiles; // profile name → spawn settings
+    private final Map<String, FleetConfig.Profile> profiles; // profile name → spawn settings
    private final String defaultProfile;                      // profile a no-arg spawn uses (nullable)

    /** Host env lookup (injectable for tests); adapters read it in {@link #buildLaunch}. */
@@ -91,14 +91,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * <p>CB-559: a supplier rather than a snapshot, so a config reload affects the next launch
     * without a restart. Existing tabs keep the label they were given.
     */
-    private final Supplier<BridgedConfig.Fleet> fleet;
+    private final Supplier<FleetConfig.Fleet> fleet;

    /**
     * CB-596: the live {@code memberCredentials:} policy, read once per spawn (same hot-reload shape
     * as {@link #fleet}). {@code null} — either the supplier itself, or what it returns — means no
     * policy is configured and {@link #applyMemberCredentialPolicy} shadows nothing.
     */
-    private final Supplier<BridgedConfig.MemberCredentials> memberCredentials;
+    private final Supplier<FleetConfig.MemberCredentials> memberCredentials;

    /**
     * Enumerates the daemon's own process environment variable NAMES ONLY, never values — the CB-596
@@ -117,14 +117,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    /** The final instruction always requires a bridge reply when the bridge MCP is mounted. */
    protected static final String REPLY_CHARTER =
            "You are a spawned member in the claude-bridge fleet. Every message you receive arrives "
-            + "through the bridge, and the ONLY channel back to the sender is the bridge_reply MCP tool. "
+            + "through the bridge, and the ONLY channel back to the sender is the fleet_reply MCP tool. "
            + "Text you write in your terminal is NOT sent anywhere — the sender cannot see your screen, "
            + "so an in-terminal answer is silently discarded. Therefore you MUST end EVERY turn by calling "
-            + "bridge_reply with `content` set to your complete response. This holds for every message without "
+            + "fleet_reply with `content` set to your complete response. This holds for every message without "
            + "exception — tasks, questions, clarifications, acknowledgements, and ordinary back-and-forth "
-            + "conversation. Call bridge_reply exactly once, as the final action of your turn, with your full "
+            + "conversation. Call fleet_reply exactly once, as the final action of your turn, with your full "
            + "answer in `content`; never wait for confirmation first. If you end a turn without calling "
-            + "bridge_reply, the sender receives nothing and the exchange stalls.";
+            + "fleet_reply, the sender receives nothing and the exchange stalls.";

    /**
     * Tab numbers, counted per {@code role/profile} pair (CB-557).
@@ -156,6 +156,20 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    private final ConcurrentMap<String, String> paneByAgentId = new ConcurrentHashMap<>();
    private final AtomicBoolean resetUnsupportedLogged = new AtomicBoolean();

+    /**
+     * CB-633: the per-spawn ZDOTDIR directory generated for a pane under
+     * {@code memberCredentials.policy: allow-list}, keyed by herdr pane id so every teardown exit
+     * ({@link #stop} is reached from explicit DELETE, orphan reap, and the spawn-readiness gate
+     * timeout alike) can read the scrub's own report and then remove the directory. A pane that
+     * never reaches {@code stop} (spawn failure) leaks its directory only until JVM exit, where the
+     * generator's {@code deleteOnExit} hooks are the backstop — the same cleanup shape the existing
+     * charter/config temp files use.
+     */
+    private final ConcurrentMap<String, Path> zdotdirByPane = new ConcurrentHashMap<>();
+
+    /** Guards {@link #warnNonZsh} to one WARN per launcher instance, not one per spawn. */
+    private final AtomicBoolean nonZshShellWarned = new AtomicBoolean();
+
    /**
     * @param namePrefix          label prefix for this peer kind (drives naming and reap)
     * @param agents              herdr agent control (start, status, close)
@@ -169,7 +183,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *                            interval is baked into this hook, so the base needs no poll field
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper) {
@@ -185,11 +199,11 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *              above, so every existing call site keeps the default without an edit.
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet) {
+                                Supplier<FleetConfig.Fleet> fleet) {
        this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                nowMillis, sleeper, fleet, null);
    }
@@ -203,12 +217,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *                          existing call site keeps the pre-CB-596 default without an edit.
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet,
-                                Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                                Supplier<FleetConfig.Fleet> fleet,
+                                Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                nowMillis, sleeper, fleet, memberCredentials, null);
    }
@@ -218,12 +232,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * seam only — every production call site leaves this {@code null} and gets the real host env.
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet,
-                                Supplier<BridgedConfig.MemberCredentials> memberCredentials,
+                                Supplier<FleetConfig.Fleet> fleet,
+                                Supplier<FleetConfig.MemberCredentials> memberCredentials,
                                Supplier<Set<String>> hostEnvNames) {
        this.fleet = fleet;
        this.namePrefix = namePrefix;
@@ -246,7 +260,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * Any subscription/guard check, MCP mount, and instruction injection happen here. The env map
     * and argv are adapter-private; the base only places and starts what is returned.
     */
-    protected abstract Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec);
+    protected abstract Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec);

    /** Direct transport access for peer-specific, non-turn control operations. */
    protected final AgentControl agents() {
@@ -327,7 +341,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        if (name == null || name.isBlank()) {
            return List.of();
        }
-        BridgedConfig.Profile cfg = profiles.get(name);
+        FleetConfig.Profile cfg = profiles.get(name);
        return cfg == null ? List.of() : cfg.parityOverlay();
    }

@@ -351,18 +365,18 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    }

    /** The configured profiles, for adapter capability decisions (e.g. any git-token grant). */
-    protected Collection<BridgedConfig.Profile> profileConfigs() {
+    protected Collection<FleetConfig.Profile> profileConfigs() {
        return profiles.values();
    }

    /** Resolve {@code profileName} (null/blank → default) to its config, or throw with the options. */
-    protected BridgedConfig.Profile requireProfile(String profileName) {
+    protected FleetConfig.Profile requireProfile(String profileName) {
        String name = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
        if (name == null || name.isBlank()) {
            throw new IllegalArgumentException("no default worker profile is configured — "
                    + "pass a profile; configured: " + profiles.keySet());
        }
-        BridgedConfig.Profile cfg = profiles.get(name);
+        FleetConfig.Profile cfg = profiles.get(name);
        if (cfg == null) {
            throw new IllegalArgumentException("unknown worker profile '" + name
                    + "' — configured: " + profiles.keySet());
@@ -399,30 +413,48 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {

    /**
     * Spawn a peer with session identity (CB-547a). The session values, role, and charter are
-     * threaded from the {@link SpawnRequest} into {@link #buildLaunch(BridgedConfig.Profile,
+     * threaded from the {@link SpawnRequest} into {@link #buildLaunch(FleetConfig.Profile,
     * LaunchSpec)}, and the launch's resolved agent-session id is returned alongside the agent so
     * the caller can put it on the {@link PeerHandle}.
     */
    protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
                                    String sessionName, String resumeSessionId, MemberRole role) {
-        BridgedConfig.Profile cfg = requireProfile(profileName);
-        BridgedConfig.Fleet liveFleet = fleet == null ? null : fleet.get();
+        FleetConfig.Profile cfg = requireProfile(profileName);
+        FleetConfig.Fleet liveFleet = fleet == null ? null : fleet.get();
        String roleCharter = liveFleet == null ? null : liveFleet.charterFor(role);
        String replyCharter = cfg.hasMcp() ? REPLY_CHARTER : null;
        String charter = roleCharter == null ? replyCharter
                : replyCharter == null ? roleCharter : roleCharter + "\n\n" + replyCharter;
        // CB-571: fingerprint the exact composed charter bytes once, here in the base, before the
        // string leaves for an adapter — so Claude and OpenCode derive the same digest. A failed
-        // start has no bridge_spawn result and no roster row, so the failure log below is the only
+        // start has no fleet_spawn result and no roster row, so the failure log below is the only
        // surface the byte count can appear on. The charter text itself is never logged.
        CharterReceipt receipt = CharterReceipt.compose(role, cfg.profile(), roleCharter, charter);
        String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
        try {
            Launch launch = buildLaunch(cfg, new LaunchSpec(sessionName, resumeSessionId, role, charter,
                    roleCharter, replyCharter, cwd));
-            Agent agent = cfg.tabPlacement()
-                    ? spawnInTab(cfg, launch.env(), launch.argv(), cwd, role, liveFleet)
-                    : spawnAsPane(cfg, launch.env(), launch.argv(), cwd, charter);
+            // CB-633: applied AFTER buildLaunch so the generated scrub's allow-list can also cover
+            // the exact env-map keys this launch injects (ANTHROPIC_*, OPENCODE_CONFIG, GITEA_TOKEN, …)
+            // — anything the daemon deliberately sets must survive its own control.
+            Path zdotdir = applyEnvironmentAllowListPolicy(cfg, launch);
+            Agent agent;
+            try {
+                agent = cfg.tabPlacement()
+                        ? spawnInTab(cfg, launch.env(), launch.argv(), cwd, role, liveFleet)
+                        : spawnAsPane(cfg, launch.env(), launch.argv(), cwd, charter);
+            } catch (RuntimeException e) {
+                // A failed spawn has no pane id, so nothing would ever key this directory for
+                // teardown and it would sit in the temp dir until the JVM exits cleanly — which,
+                // for a daemon, may be never. Remove it on the way out.
+                if (zdotdir != null) {
+                    EnvAllowListScrub.deleteRecursively(zdotdir);
+                }
+                throw e;
+            }
+            if (zdotdir != null) {
+                zdotdirByPane.put(agent.paneId(), zdotdir);
+            }
            logCharterReceipt(receipt, true);
            return new Spawned(agent, launch.agentSessionId(), receipt);
        } catch (RuntimeException e) {
@@ -507,7 +539,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * guaranteed last resort so a pathological environment with an unset {@code user.dir} still
     * honours the "never assume {@code $HOME}" contract rather than letting herdr default the pane.
     */
-    private static String resolveCwd(String requestedCwd, BridgedConfig.Profile cfg, String callerCwd) {
+    private static String resolveCwd(String requestedCwd, FleetConfig.Profile cfg, String callerCwd) {
        return firstNonBlank(requestedCwd, cfg.cwd(), callerCwd, System.getProperty("user.dir"), ".");
    }

@@ -519,8 +551,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    }

    /** Dedicated worker space → own tab (carrying cwd+env) → start the peer into the seed pane. */
-    private Agent spawnInTab(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
-                             List<String> argv, String cwd, MemberRole role, BridgedConfig.Fleet liveFleet) {
+    private Agent spawnInTab(FleetConfig.Profile cfg, Map<String, String> workerEnv,
+                             List<String> argv, String cwd, MemberRole role, FleetConfig.Fleet liveFleet) {
        Workspace space = spaces.ensureWorkspace(cfg.workspace());
        Tab.Created tab = spaces.createTab(space.workspaceId(), cwd, workerEnv);
        log.info("spawning {} profile={} space={} tab={} cwd={}",
@@ -578,7 +610,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * composed charter, if any; its argv element is replaced by its digest so the log still shows
     * which args were passed without exposing the charter prose.
     */
-    private Agent spawnAsPane(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
+    private Agent spawnAsPane(FleetConfig.Profile cfg, Map<String, String> workerEnv,
                              List<String> argv, String cwd, String charter) {
        log.info("spawning {} (pane placement) profile={} cwd={} argv={}",
                namePrefix, cfg.profile(), cwd, redactCharter(argv, charter));
@@ -620,7 +652,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * backstop for the astronomically unlikely nonce+seq clash; the name is a label only — herdr
     * detects kind and status from terminal output, not from it.
     */
-    private Started startUniquelyNamed(BridgedConfig.Profile cfg, List<String> argv, String paneId) {
+    private Started startUniquelyNamed(FleetConfig.Profile cfg, List<String> argv, String paneId) {
        // Protocol 19 resolves the executable from the agent kind (== namePrefix here), so
        // argv[0] — the configured executable — is dropped and only the extra args are passed.
        List<String> args = argv.isEmpty() ? argv : argv.subList(1, argv.size());
@@ -774,11 +806,19 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
            log.debug("not closing tab {} — it holds {} panes (not a dedicated peer tab)",
                    loc.tabId(), loc.tabPaneCount());
        }
+        // CB-633: log this pane's allowed-N-of-M scrub report, then remove the generated ZDOTDIR.
+        // Last in, best-effort — a failure here must not mask a real teardown failure above.
+        try {
+            releaseZdotdir(paneId);
+        } catch (RuntimeException e) {
+            log.warn("memberCredentials allow-list: releasing ZDOTDIR for pane {} failed: {}",
+                    paneId, e.getMessage());
+        }
    }

    /** Whether any configured profile places peers in their own tab (so tabs may need cleanup). */
    private boolean usesTabPlacement() {
-        return profiles.values().stream().anyMatch(BridgedConfig.Profile::tabPlacement);
+        return profiles.values().stream().anyMatch(FleetConfig.Profile::tabPlacement);
    }

    /** True when a herdr error means the target is already gone (safe to treat as done). */
@@ -844,7 +884,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * {@code GITEA_HOST}. Push over SSH is unaffected; the only incremental grant is PR-create.
     * Peer-neutral, so every herdr adapter reuses it unchanged.
     */
-    protected void applyGitToken(Map<String, String> workerEnv, BridgedConfig.Profile cfg) {
+    protected void applyGitToken(Map<String, String> workerEnv, FleetConfig.Profile cfg) {
        if (!cfg.hasGitToken()) {
            return;
        }
@@ -860,7 +900,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * herdr's own login-shell process environment (gitea issue #82, superseding CB-592's single
     * hardcoded {@code GITEA_ACCESS_TOKEN} name — see {@link #applyMemberCredentialPolicy}). herdr
     * spawns a pane from its <em>own</em> process environment and layers our map on top —
-     * {@link dev.ltms.bridged.herdr.WorkspaceControl#createTab} and {@code #splitPane} send only
+     * {@link dev.ltms.fleet.herdr.WorkspaceControl#createTab} and {@code #splitPane} send only
     * the keys we put in that map, so any key we never mention passes straight through from
     * herdr's own shell, admin credentials included.
     *
@@ -922,7 +962,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * <p>Adapter-specific variables are layered on top of this by {@code buildLaunch} and therefore
     * win. That ordering is deliberate and load-bearing: it stops a profile's {@code env:} from
     * overriding {@code ANTHROPIC_BASE_URL} and slipping past {@link
-     * dev.ltms.bridged.guard.SubscriptionGuard}, which is checked against the profile's
+     * dev.ltms.fleet.guard.SubscriptionGuard}, which is checked against the profile's
     * {@code baseUrl} and nothing else.
     *
     * <p>The CB-596 credential shadow and the CB-592 marker are put in <em>last</em>, after the
@@ -931,7 +971,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * place both are applied: every {@code buildLaunch} in every adapter calls this first, so a new
     * profile, and a peer kind not yet written, gets them for free.
     */
-    protected Map<String, String> baseEnv(BridgedConfig.Profile cfg) {
+    protected Map<String, String> baseEnv(FleetConfig.Profile cfg) {
        Map<String, String> workerEnv = new LinkedHashMap<>();
        String path = env.apply("PATH");
        if (path != null && !path.isBlank()) {
@@ -955,18 +995,136 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *
     * <p>No {@code memberCredentials} configured — the supplier is {@code null}, or it resolves to
     * one whose {@code known} list is empty — shadows nothing. This is a real, config-driven gap
-     * (see {@link BridgedConfig.MemberCredentials}'s javadoc), not a safe default: deny-by-default
+     * (see {@link FleetConfig.MemberCredentials}'s javadoc), not a safe default: deny-by-default
     * only defends names the operator has actually enumerated in {@code known}.
+     *
+     * <p>CB-633: under {@code policy: allow-list} this overlay is NOT the control anymore — it is
+     * applied before the login shell runs and a sourced file can (and did) undo it. The control is
+     * the ZDOTDIR scrub ({@link #applyEnvironmentAllowListPolicy}); {@code known}/{@code allow}
+     * remain as reporting only via {@link #logCredentialGap}.
     */
    private void applyMemberCredentialPolicy(Map<String, String> workerEnv) {
-        BridgedConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
+        FleetConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
        if (creds == null) {
            return;
        }
+        if (!creds.isAllowList()) {
+            overlayBlockedCredentials(workerEnv, creds);
+        }
+        logCredentialGap(creds);
+    }
+
+    /** Put {@link #BLOCKED_CREDENTIAL_SENTINEL} over every blocked name in the pane-creation env map. */
+    private static void overlayBlockedCredentials(Map<String, String> workerEnv,
+                                                  FleetConfig.MemberCredentials creds) {
        for (String name : creds.blockedSet()) {
            workerEnv.put(name, BLOCKED_CREDENTIAL_SENTINEL);
        }
-        logCredentialGap(creds);
+    }
+
+    /**
+     * CB-633: under {@code memberCredentials.policy: allow-list}, generate the per-spawn ZDOTDIR
+     * directory whose startup files blank every exported variable not on the DERIVED allow-list —
+     * running AFTER the pane's shell has finished sourcing the operator's chain, which is what no
+     * pre-shell env overlay can achieve. {@code EnvAllowListScrub} sources the scrub from both the
+     * generated {@code .zshrc} and {@code .zlogin}, since a herdr pane is a login shell on macOS
+     * and a plain interactive one on Linux. Mutates {@code launch.env()} to carry
+     * {@code ZDOTDIR=<dir>}, so both placement paths ({@link #spawnInTab}, {@link #spawnAsPane})
+     * pass it through {@code tab.create}/{@code pane.split}. Returns the directory for teardown
+     * registration, or {@code null} when the policy does not apply.
+     *
+     * <p>The allow-list handed to the generator is the derived profile set ({@link
+     * MemberEnvAllowList#derive}) UNIONed with the exact keys of THIS launch's env map — names the
+     * daemon itself injects must survive its own control. {@code SSH_AUTH_SOCK} is added ONLY when
+     * the config explicitly allows it; by default it is absent, so the scrub blanks it like any
+     * other non-derived name.
+     */
+    private Path applyEnvironmentAllowListPolicy(FleetConfig.Profile cfg, Launch launch) {
+        FleetConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
+        if (creds == null || !creds.isAllowList()) {
+            return null;
+        }
+        String loginShell = resolveEnv("SHELL");
+        boolean zsh = loginShell != null && (loginShell.endsWith("/zsh") || loginShell.equals("zsh"));
+        if (!zsh) {
+            // A non-zsh login shell ignores ZDOTDIR entirely: NO scrub would run, so pretending
+            // otherwise would be worse than saying so. Warn loudly and fall back to the CB-596
+            // sentinel overlay over the enumerated known: names — weaker (a sourced file can undo
+            // it), but strictly better than nothing.
+            warnNonZsh(loginShell);
+            overlayBlockedCredentials(launch.env(), creds);
+            logCredentialGap(creds);
+            return null;
+        }
+        Set<String> allowed = new java.util.TreeSet<>(MemberEnvAllowList.derive(profiles.values()));
+        if (creds.sshAuthSockAllowed()) {
+            allowed.add(SSH_AUTH_SOCK);
+        } // blocked by default: absent from the set ⇒ blanked by the scrub like any other name
+        allowed.addAll(launch.env().keySet());
+        Path dir = EnvAllowListScrub.generate(Path.of(System.getProperty("java.io.tmpdir")), allowed);
+        launch.env().put("ZDOTDIR", dir.toAbsolutePath().toString());
+        log.info("memberCredentials policy=allow-list: profile={} generated ZDOTDIR {} — derived "
+                        + "allow-list holds {} name(s); the pane reports allowed N of M at release",
+                cfg.profile(), dir.getFileName(), allowed.size());
+        return dir;
+    }
+
+    /** The operator ssh-agent handle — kept ONLY by explicit config decision, never by default. */
+    private static final String SSH_AUTH_SOCK = "SSH_AUTH_SOCK";
+
+    /**
+     * CB-633: a non-zsh login shell means the allow-list control CANNOT run — say so once per
+     * launcher instance, naming the shell, instead of failing silently.
+     */
+    private void warnNonZsh(String shell) {
+        if (nonZshShellWarned.compareAndSet(false, true)) {
+            log.warn("memberCredentials policy=allow-list: member login shell '{}' is NOT zsh — "
+                            + "ZDOTDIR scrubbing cannot run, so members' inherited environment is "
+                            + "UNPROTECTED beyond the enumerated known: fallback. Move herdr onto a "
+                            + "zsh account or switch policy back to deny-by-default.",
+                    shell == null ? "<unset>" : shell);
+        }
+    }
+
+    /**
+     * CB-633 teardown half: read the pane's scrub report (the denominator report the generated
+     * scrub wrote) and delete the directory. Called from {@link #stop}, which is the one funnel
+     * every teardown exit already goes through.
+     *
+     * <p><b>A missing report is a WARN, not a debug line.</b> The report is the only evidence that
+     * the scrub ran at all in that pane. Its absence has an innocent reading — the pane died before
+     * its shell finished starting — and a serious one: the shell was not zsh, or it read its
+     * startup files from somewhere other than the directory we generated, in which case the member
+     * ran for its whole life with the operator's full secret store in its environment and nothing
+     * said so. We cannot tell those two apart from here, so the line says what is and is not known
+     * rather than picking one. Logging this at debug is how a control that silently stopped working
+     * stays unnoticed — the failure mode this whole class exists to remove.
+     */
+    private void releaseZdotdir(String paneId) {
+        Path dir = zdotdirByPane.remove(paneId);
+        if (dir == null) {
+            return;
+        }
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(dir);
+        if (report == null) {
+            log.warn("memberCredentials allow-list: pane {} left no scrub report in {} — the "
+                    + "environment scrub cannot be confirmed to have run. Either the pane ended "
+                    + "before its shell finished starting, or its shell never read our generated "
+                    + "startup files, in which case that member saw the full host environment.",
+                    paneId, dir);
+        } else {
+            log.info("memberCredentials allow-list: pane {} allowed {} of {} environment variables",
+                    paneId, report.allowed(), report.total());
+            List<String> shaped = report.blanked().stream()
+                    .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
+                    .toList();
+            if (!shaped.isEmpty()) {
+                log.warn("memberCredentials allow-list: pane {} blanked credential-shaped variable(s) "
+                        + "{} — confirm none of them was something a member legitimately needed",
+                        paneId, shaped);
+            }
+        }
+        EnvAllowListScrub.deleteRecursively(dir);
    }

    /** Credential-shaped env var name heuristic for {@link #logCredentialGap} — case-insensitive. */
@@ -984,7 +1142,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * every such NAME, at WARN, at most once per launcher instance — never a value, a prefix of a
     * value, or a hash of a value, so the log itself cannot leak anything.
     */
-    private void logCredentialGap(BridgedConfig.MemberCredentials creds) {
+    private void logCredentialGap(FleetConfig.MemberCredentials creds) {
        Set<String> covered = new HashSet<>(creds.known());
        covered.addAll(creds.allow());
        List<String> gap = hostEnvNames.get().stream()
@@ -0,0 +1,112 @@
+package dev.ltms.fleet.member;
+
+import dev.ltms.fleet.config.FleetConfig;
+
+import java.util.Collection;
+import java.util.Set;
+import java.util.TreeSet;
+
+/**
+ * CB-633: the set of environment variable NAMES a spawned member is allowed to keep under
+ * {@code memberCredentials.policy: allow-list} — DERIVED from what the launcher itself injects,
+ * never hand-typed.
+ *
+ * <p>A hand-typed allow-list is the defect this class exists to prevent: a name an operator forgets
+ * to type is a credential that passes through to every member, and a profile added to config later
+ * would silently break spawns whose scrub did not know its names. Derivation closes both ends. The
+ * kept-name set is the union of:
+ *
+ * <ul>
+ *   <li>every configured {@link FleetConfig.Profile profile}'s {@code gitTokenEnv},
+ *       {@code gitHostEnv}, and {@code tokenEnv} values — these are variable <em>names</em> held in
+ *       config, and the launcher reads their values out of exactly these variables;</li>
+ *   <li>every key of every profile's {@code env:} map — anything the operator routes into a pane on
+ *       purpose;</li>
+ *   <li>{@link #INFRASTRUCTURE_PASSTHROUGH} — names that are not credentials at all but that a shell
+ *       or the agent binary genuinely needs to function.</li>
+ * </ul>
+ *
+ * <p>Because the union spans EVERY profile (not just the one spawning), adding a new profile can
+ * only ever widen the list — it cannot break another spawn's scrub. And because the launcher also
+ * unions in the exact keys of each spawn's own env map at generation time (see {@code
+ * HerdrPeerLauncher}), anything the daemon deliberately injects for THIS spawn survives its own
+ * control.
+ *
+ * <p>{@code SSH_AUTH_SOCK} is deliberately NOT here. It is a handle to the operator's ssh-agent — a
+ * member holding it can sign with the operator's keys — so keeping it is a config decision
+ * ({@code memberCredentials.sshAuthSock: allow}), not a derivation default.
+ */
+public final class MemberEnvAllowList {
+
+    /**
+     * Names that are not credentials and that a login shell or agent binary genuinely needs.
+     *
+     * <p>Every name here is a location or a shell setting, never a credential. That rule is load
+     * bearing, and CB-633's first cut broke it: it also listed {@code ANTHROPIC_AUTH_TOKEN},
+     * {@code GITEA_TOKEN}, {@code GITEA_HOST}, {@code ANTHROPIC_BASE_URL}, {@code ANTHROPIC_MODEL},
+     * {@code CLAUDE_CONFIG_DIR}, {@code OPENCODE_CONFIG} and {@code BRIDGED_MEMBER} "because the
+     * launcher injects them". The launcher does — but only on the spawns where it actually sets
+     * them, and {@code HerdrPeerLauncher} already unions THIS spawn's env-map keys into the
+     * allow-list. So a static entry adds nothing on a spawn that injects the name, and on a spawn
+     * that does not it lets the operator's own value through under exactly the name a member reads.
+     * {@code ANTHROPIC_BASE_URL} is the sharpest case: an inherited one silently moves a member off
+     * the endpoint the profile chose.
+     *
+     * <p>{@code ZDOTDIR} stays because it is this control's own handle — lose it and every later
+     * sub-shell loses the scrub. {@code JAVA_HOME} and the {@code XDG_*} roots are toolchain
+     * locations. Everything else a member needs must arrive via a profile's {@code env:} or the
+     * launcher's own injection, both of which land on the derived set automatically.
+     */
+    public static final Set<String> INFRASTRUCTURE_PASSTHROUGH = Set.of(
+            "PATH", "HOME", "SHELL", "TERM", "LANG", "TMPDIR",
+            "USER", "LOGNAME", "PWD", "SHLVL", "EDITOR", "PAGER",
+            "_",
+            "ZDOTDIR",
+            "JAVA_HOME",
+            "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "XDG_STATE_HOME");
+
+    /** Locale-category prefix kept as infrastructure ({@code LC_ALL}, {@code LC_CTYPE}, …). */
+    private static final String INFRASTRUCTURE_NAME_PREFIX = "LC_";
+
+    private MemberEnvAllowList() {
+    }
+
+    /**
+     * Derive the allowed NAME set from the given profiles plus {@link #INFRASTRUCTURE_PASSTHROUGH}.
+     * Deterministic (sorted) so generated scrub files are diffable run-to-run.
+     */
+    public static Set<String> derive(Collection<FleetConfig.Profile> profiles) {
+        Set<String> derived = new TreeSet<>(INFRASTRUCTURE_PASSTHROUGH);
+        if (profiles != null) {
+            for (FleetConfig.Profile p : profiles) {
+                addIfPresent(derived, p.gitTokenEnv());
+                addIfPresent(derived, p.gitHostEnv());
+                addIfPresent(derived, p.tokenEnv());
+                if (p.env() != null) {
+                    derived.addAll(p.env().keySet());
+                }
+            }
+        }
+        return Set.copyOf(derived);
+    }
+
+    /**
+     * Whether {@code name} survives the scrub when {@code allowedNames} is the derived set: an exact
+     * match, or an infrastructure-prefixed name ({@code LC_*}). Prefix rules live ONLY here and in
+     * the generated script's {@code case} pattern, which is written from this constant's value.
+     */
+    public static boolean keeps(Set<String> allowedNames, String name) {
+        return allowedNames.contains(name) || name.startsWith(INFRASTRUCTURE_NAME_PREFIX);
+    }
+
+    /** The prefix rule as a zsh {@code case} pattern, so the script and Java cannot drift apart. */
+    public static String zshCasePattern() {
+        return INFRASTRUCTURE_NAME_PREFIX + "*";
+    }
+
+    private static void addIfPresent(Set<String> into, String name) {
+        if (name != null && !name.isBlank()) {
+            into.add(name);
+        }
+    }
+}
@@ -1,15 +1,16 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.SpawnRequest;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.CharterReceipt;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.SpawnRequest;

 import java.io.IOException;
 import java.io.UncheckedIOException;
@@ -33,7 +34,7 @@ import java.util.function.Supplier;
 * <p>The divergences from {@link ClaudeCodeLauncher}, all confined to {@link #buildLaunch}:
 * <ul>
 *   <li><strong>No subscription boundary.</strong> opencode carries no {@code ANTHROPIC_BASE_URL}
- *       and there is no {@link dev.ltms.bridged.guard.SubscriptionGuard} — the guard is a
+ *       and there is no {@link dev.ltms.fleet.guard.SubscriptionGuard} — the guard is a
 *       Claude-private concern, not part of the SPI. opencode reads the operator's own provider
 *       credentials from its global {@code auth.json}; the bridge injects none.</li>
 *   <li><strong>File-based MCP mount + instructions.</strong> opencode has no inline
@@ -70,7 +71,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env) {
        this(agents, spaces, profiles, defaultProfile, env, 0,
                System::currentTimeMillis, () -> sleepUninterruptibly(300),
@@ -82,7 +83,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs, long spawnReadyPollMs) {
        this(agents, spaces, profiles, defaultProfile, env,
@@ -95,10 +96,10 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                            Supplier<BridgedConfig.Fleet> fleet) {
+                            Supplier<FleetConfig.Fleet> fleet) {
        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
                defaultConfigRoot(), defaultDiscoveryRoot(), fleet);
@@ -108,11 +109,11 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                            Supplier<BridgedConfig.Fleet> fleet,
-                            Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials);
@@ -138,7 +139,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     *                            {@link OpenCodeSessionDiscovery})
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
@@ -153,12 +154,12 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * @param fleet live fleet config, read once for each spawn
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
                            Path configRoot, Path discoveryRoot,
-                            Supplier<BridgedConfig.Fleet> fleet) {
+                            Supplier<FleetConfig.Fleet> fleet) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
        this.configRoot = configRoot;
@@ -169,13 +170,13 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
                            Path configRoot, Path discoveryRoot,
-                            Supplier<BridgedConfig.Fleet> fleet,
-                            Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
        this.configRoot = configRoot;
@@ -201,7 +202,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * grant; and select the model with {@code -m}.
     */
    @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
        Map<String, String> workerEnv = baseEnv(cfg);
        // A config file is needed for the bridge MCP mount, a member charter, or a pinned endpoint (CB-508).
        if (cfg.hasMcp() || spec.charter() != null || hasCustomProvider(cfg)) {
@@ -238,7 +239,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * primary's Anthropic subscription, and an opencode process has no Anthropic credential path
     * at all. Pointing it at a local vLLM cannot leak the subscription.
     */
-    private static boolean hasCustomProvider(BridgedConfig.Profile cfg) {
+    private static boolean hasCustomProvider(FleetConfig.Profile cfg) {
        return cfg.baseUrl() != null && !cfg.baseUrl().isBlank();
    }

@@ -247,12 +248,12 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * permissions opencode does not explicitly deny. It is unconditional, not a preference: a
     * spawned peer has no human at its pane — the bridge spawned it — so one that stops at an
     * approval prompt is a wedged agent, indistinguishable from a legitimate mid-turn wait and
-     * unable to end its turn with {@code bridge_reply}. opencode's own help calls this
+     * unable to end its turn with {@code fleet_reply}. opencode's own help calls this
     * "dangerous!", but the blast radius here is already bounded by design: a worker runs in its
     * own git worktree on its own branch, is off-subscription, and cannot merge — the lead is the
     * gate.
     */
-    private List<String> argvWithAuto(BridgedConfig.Profile cfg) {
+    private List<String> argvWithAuto(FleetConfig.Profile cfg) {
        List<String> argv = mutableArgv(cfg.argv());
        argv.add("--auto");
        return argv;
@@ -275,7 +276,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    }

    /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
-    private List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+    private List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
        if (cfg.model() != null && !cfg.model().isBlank()) {
            argv.add("-m");
            argv.add(cfg.model());
@@ -289,7 +290,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * {@code OPENCODE_CONFIG}. The dir is unique per spawn so concurrent workers never race on it;
     * it is best-effort cleaned on JVM exit (worker config is disposable — regenerated every spawn).
     */
-    private Path writeConfig(BridgedConfig.Profile cfg, String charterText) {
+    private Path writeConfig(FleetConfig.Profile cfg, String charterText) {
        try {
            Path dir = Files.createTempDirectory(configRoot, "bridged-opencode-");
            dir.toFile().deleteOnExit();
@@ -321,10 +322,10 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            }

            if (cfg.hasMcp()) {
-                ObjectNode bridge = root.putObject("mcp").putObject("bridge");
-                bridge.put("type", "remote");
-                bridge.put("url", cfg.mcpUrl());
-                bridge.put("enabled", true);
+                ObjectNode mount = root.putObject("mcp").putObject(PeerLauncher.MCP_MOUNT_NAME);
+                mount.put("type", "remote");
+                mount.put("url", cfg.mcpUrl());
+                mount.put("enabled", true);
            }
            if (hasCustomProvider(cfg)) {
                addCustomProvider(root, cfg);
@@ -349,7 +350,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * <p>The provider id comes from the {@code provider/model} selector in {@code model:}, so one
     * field drives both the declaration and the {@code -m} flag and they cannot drift apart.
     */
-    private void addCustomProvider(ObjectNode root, BridgedConfig.Profile cfg) {
+    private void addCustomProvider(ObjectNode root, FleetConfig.Profile cfg) {
        String[] parts = splitModelSelector(cfg);
        String providerId = parts[0];
        String modelId = parts[1];
@@ -362,7 +363,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
        options.put("baseURL", openAiBaseUrl(cfg.baseUrl()));
        // vLLM and friends usually ignore the key, but the AI SDK still requires a non-empty one.
        String token = resolveEnv(cfg.tokenEnv());
-        options.put("apiKey", (token == null || token.isBlank()) ? "bridged-local-noauth" : token);
+        options.put("apiKey", (token == null || token.isBlank()) ? "fleetd-local-noauth" : token);

        provider.putObject("models").putObject(modelId).put("name", modelId);
    }
@@ -372,7 +373,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * needs both, so a bare model name is rejected loudly rather than silently falling back to the
     * default gateway — a worker quietly talking to the wrong endpoint is the failure this avoids.
     */
-    private static String[] splitModelSelector(BridgedConfig.Profile cfg) {
+    private static String[] splitModelSelector(FleetConfig.Profile cfg) {
        String model = cfg.model();
        int slash = model == null ? -1 : model.indexOf('/');
        if (model == null || model.isBlank() || slash <= 0 || slash == model.length() - 1) {
@@ -496,7 +497,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {

    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
    }

    // --- CB-117 reap predicate (opencode prefix), kept for direct unit testing -----------------
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -1,8 +1,8 @@
-package dev.ltms.bridged.metrics;
+package dev.ltms.fleet.metrics;

-import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.MemberSession;

 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -13,33 +13,33 @@ import java.util.Map;
 *
 * <p>The set is deliberately small: each series maps to a failure mode this project has actually
 * hit, not to whatever was easy to count. The two worth watching in practice are
- * {@code bridged_sends_total{outcome="completion_fallback"}} — a rising share means turn detection
+ * {@code fleet_sends_total{outcome="completion_fallback"}} — a rising share means turn detection
 * is degrading, the CB-115/116/118 failure family — and
- * {@code bridged_push_nudges_total{outcome="exhausted"}}, which means the primary stopped draining
+ * {@code fleet_push_nudges_total{outcome="exhausted"}}, which means the primary stopped draining
 * its inbox and CB-307's active push gave up.
 */
-public final class BridgedMetrics {
+public final class FleetMetrics {

    /** Counter: delegated sends by terminal outcome. */
-    public static final String SENDS = "bridged_sends_total";
+    public static final String SENDS = "fleet_sends_total";
    /** Counter: worker replies by the path that carried them (rendezvous vs stranded-to-inbox). */
-    public static final String REPLIES = "bridged_replies_total";
+    public static final String REPLIES = "fleet_replies_total";
    /** Counter: push-loop nudges to the primary, by outcome. */
-    public static final String PUSH_NUDGES = "bridged_push_nudges_total";
+    public static final String PUSH_NUDGES = "fleet_push_nudges_total";
    /** Counter: idle-lead heartbeat nudges to the lead, by outcome (CB-551). */
-    public static final String HEARTBEAT_NUDGES = "bridged_lead_heartbeat_nudges_total";
+    public static final String HEARTBEAT_NUDGES = "fleet_lead_heartbeat_nudges_total";
    /** Counter: spawn attempts by peer kind and outcome. */
-    public static final String SPAWNS = "bridged_spawns_total";
+    public static final String SPAWNS = "fleet_spawns_total";
    /** Counter: herdr socket calls by method and outcome. */
-    public static final String HERDR_CALLS = "bridged_herdr_calls_total";
+    public static final String HERDR_CALLS = "fleet_herdr_calls_total";
    /** Counter: rejected requests by reason (CB-501). */
-    public static final String AUTH_FAILURES = "bridged_auth_failures_total";
+    public static final String AUTH_FAILURES = "fleet_auth_failures_total";
    /** Gauge: session census by lifecycle state. */
-    public static final String SESSIONS = "bridged_sessions";
+    public static final String SESSIONS = "fleet_sessions";
    /** Gauge: undrained replies held per target. */
-    public static final String INBOX_DEPTH = "bridged_inbox_depth";
+    public static final String INBOX_DEPTH = "fleet_inbox_depth";

-    private BridgedMetrics() {
+    private FleetMetrics() {
    }

    /**
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.metrics;
+package dev.ltms.fleet.metrics;

 import java.util.Map;
 import java.util.NavigableMap;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import com.rabbitmq.client.AMQP;
 import com.rabbitmq.client.Channel;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import java.util.LinkedHashMap;
 import java.util.List;
@@ -1,11 +1,11 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.session.MemberSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -18,7 +18,7 @@ import java.util.function.Supplier;

 /**
 * CB-551: an opt-in heartbeat that nudges the single idle lead back to work once it has been
- * continuously idle past a quiet period with no open {@code bridge_send} driving it.
+ * continuously idle past a quiet period with no open {@code fleet_send} driving it.
 *
 * <p>Why this exists: the fleet is ONE lead + architects + workers, so an idle, stalled lead is a
 * single point of failure for the fleet's progress. {@link ReplyPushLoop} nudges the lead only when
@@ -99,7 +99,7 @@ public final class LeadHeartbeatLoop {
    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
    private void countNudge(String outcome) {
        if (metrics != null) {
-            metrics.inc(BridgedMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
+            metrics.inc(FleetMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
        }
    }

@@ -290,7 +290,7 @@ public final class LeadHeartbeatLoop {
        /** The nudge body, phrased for the two cases the heartbeat distinguishes. */
        String nudgeText() {
            StringBuilder sb = new StringBuilder(
-                    "Heartbeat: you are idle and no bridge_send is waiting on you.");
+                    "Heartbeat: you are idle and no fleet_send is waiting on you.");
            if (hasPending()) {
                sb.append(" The fleet has state to collect: ").append(pendingDetail());
            } else {
@@ -309,10 +309,10 @@ public final class LeadHeartbeatLoop {
                    .append(" pending collection");
            if (!replyTargets.isEmpty()) {
                // Render each as the exact command so the lead can act without parsing: the nearest
-                // analogue to ReplyPushLoop's bridge_poll(target=...) nudge.
+                // analogue to ReplyPushLoop's fleet_poll(target=...) nudge.
                sb.append(" (")
                        .append(String.join(", ",
-                                replyTargets.stream().map(t -> "bridge_poll(target=" + t + ")").toList()))
+                                replyTargets.stream().map(t -> "fleet_poll(target=" + t + ")").toList()))
                        .append(")");
            }
            sb.append(", ").append(doneSessions).append(" DONE session").append(doneSessions == 1 ? "" : "s")
@@ -1,10 +1,10 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -24,7 +24,7 @@ import java.util.function.LongSupplier;

 /**
 * The blocking delegation feature (CB-104): deliver {@code content} into a worker and block until
- * the worker returns a <em>structured reply</em> via {@code bridge_reply} (the {@link Rendezvous}),
+ * the worker returns a <em>structured reply</em> via {@code fleet_reply} (the {@link Rendezvous}),
 * then hand that reply back. Delivery is the {@link Injector}'s job (the background poller sends it
 * when the worker is injectable); this service never drives the injector or scrapes the terminal —
 * completion is the worker's explicit reply, not a guess about {@code agent_status}.
@@ -62,10 +62,10 @@ public final class MessageService {

    /** Outcome of a blocking send. */
    public enum Outcome {
-        /** The worker called {@code bridge_reply}; {@code text} holds the structured answer. */
+        /** The worker called {@code fleet_reply}; {@code text} holds the structured answer. */
        REPLIED,
        /**
-         * The worker's delegated turn finished without a {@code bridge_reply} (CB-106 fallback);
+         * The worker's delegated turn finished without a {@code fleet_reply} (CB-106 fallback);
         * {@code text} is the scraped transcript tail rather than a structured answer.
         */
        COMPLETED_UNREPLIED,
@@ -75,7 +75,7 @@ public final class MessageService {
         */
        WORKER_FAILED,
        /**
-         * The turn finished without a {@code bridge_reply} and the scrape matched the backend's
+         * The turn finished without a {@code fleet_reply} and the scrape matched the backend's
         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
         * carrying the matched line. The worker's pane is healthy — only its account is refusing —
         * so this is never reported as a completed reply, and is kept distinct from
@@ -96,14 +96,14 @@ public final class MessageService {
        BUSY,
        /**
         * An answer ({@link #answer(String, String, long)}) referenced a {@code turnId} that is no
-         * longer open — the worker's {@code bridge_ask} already timed out or was answered.
+         * longer open — the worker's {@code fleet_ask} already timed out or was answered.
         */
        STALE_TURN
    }

    /**
     * @param outcome how the send ended (or paused)
-     * @param text    the worker's answer when {@link #completed()} (a structured {@code bridge_reply}
+     * @param text    the worker's answer when {@link #completed()} (a structured {@code fleet_reply}
     *                for {@link Outcome#REPLIED}, a scraped transcript tail for
     *                {@link Outcome#COMPLETED_UNREPLIED}), or the question for {@link Outcome#QUESTION},
     *                else {@code null}
@@ -122,7 +122,7 @@ public final class MessageService {
        }
    }

-    /** How a worker's {@code bridge_ask} (CB-205) resolved. */
+    /** How a worker's {@code fleet_ask} (CB-205) resolved. */
    public enum AskOutcome {
        /** The primary answered; {@link AskResult#answer} carries it. */
        ANSWERED,
@@ -132,7 +132,7 @@ public final class MessageService {
        TIMED_OUT
    }

-    /** The outcome of a worker's {@code bridge_ask}: how it resolved and (if answered) the answer. */
+    /** The outcome of a worker's {@code fleet_ask}: how it resolved and (if answered) the answer. */
    public record AskResult(AskOutcome outcome, String answer) {
    }

@@ -140,7 +140,7 @@ public final class MessageService {
    public enum Phase {
        /** Delegated and in flight — queued for the worker or being worked. */
        PENDING,
-        /** The worker is paused in {@code bridge_ask}; {@link TaskView#reply} and {@link TaskView#turnId} identify it. */
+        /** The worker is paused in {@code fleet_ask}; {@link TaskView#reply} and {@link TaskView#turnId} identify it. */
        ASKING,
        /** The worker's turn finished; {@link TaskView#reply} holds the answer. */
        DONE,
@@ -153,7 +153,7 @@ public final class MessageService {
     *
     * @param reply       the answer when {@link #phase} is {@link Phase#DONE}, or the question when
     *                    {@link #phase} is {@link Phase#ASKING}; otherwise {@code null}
-     * @param replySource {@code "reply"} (structured {@code bridge_reply}) or {@code "transcript"}
+     * @param replySource {@code "reply"} (structured {@code fleet_reply}) or {@code "transcript"}
     *                    (completion scrape) when {@link Phase#DONE}, else {@code null}
     * @param detail      a human note (live worker status while pending, ask state, or failure reason)
     * @param turnId      correlation id for an {@link Phase#ASKING} ticket, else {@code null}
@@ -179,11 +179,11 @@ public final class MessageService {
    }

    /**
-     * A worker session's currently-open {@code bridge_ask} question, surfaced so {@code bridge_status}
+     * A worker session's currently-open {@code fleet_ask} question, surfaced so {@code fleet_status}
     * can show it without the caller needing the ticket first (CB-582). Only covers async
     * (fire-and-poll) delegations, which track the question on their {@link Task}; a blocking
     * ({@code wait:true}) send already hands the question straight back to its own caller, so there is
-     * nothing hidden left for {@code bridge_status} to surface in that case.
+     * nothing hidden left for {@code fleet_status} to surface in that case.
     */
    public record PendingAsk(String ticket, String question, String turnId) {
    }
@@ -202,7 +202,7 @@ public final class MessageService {
    /** Async task that owns each exact forward rendezvous waiter. */
    private final ConcurrentHashMap<CompletableFuture<Rendezvous.Resolution>, Task> asyncTasksByWaiter =
            new ConcurrentHashMap<>();
-    /** Async tickets paused on a specific {@code bridge_ask} turn. */
+    /** Async tickets paused on a specific {@code fleet_ask} turn. */
    private final ConcurrentHashMap<String, Task> asyncTasksByTurn = new ConcurrentHashMap<>();
    private final AtomicLong ticketSeq = new AtomicLong();
    private final ExecutorService asyncExecutor = Executors.newThreadPerTaskExecutor(
@@ -216,7 +216,7 @@ public final class MessageService {
     *                 (CB-588) whenever an async ticket started by {@link #sendAsync} reaches a
     *                 terminal phase, whenever {@link #poll} hands a terminal ticket to its caller,
     *                 and (CB-582) whenever an async ticket's worker pauses mid-turn in
-     *                 {@code bridge_ask} or that pause ends (answered or lapsed)
+     *                 {@code fleet_ask} or that pause ends (answered or lapsed)
     */
    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
                          ReplyInbox inbox, ReplyPushLoop pushLoop) {
@@ -272,11 +272,11 @@ public final class MessageService {
    }

    /**
-     * Route a worker's explicit {@code bridge_reply}: resolve an open send, or queue it in the
+     * Route a worker's explicit {@code fleet_reply}: resolve an open send, or queue it in the
     * inbox if no send is currently open. Unlike the bare {@link Rendezvous#resolve}, a no-waiter
     * result is <em>not</em> a failure — the reply is held for later drain.
     *
-     * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code bridge_ask} /
+     * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code fleet_ask} /
     * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
     * are interactive and must never be queued.
     *
@@ -284,13 +284,13 @@ public final class MessageService {
     */
    public boolean reply(String session, String content) {
        if (rendezvous.resolve(session, content)) {
-            count(BridgedMetrics.REPLIES, "path", "rendezvous");
+            count(FleetMetrics.REPLIES, "path", "rendezvous");
            return true;                       // a live send took it — unchanged fast path
        }
        inbox.publish(session, UUID.randomUUID().toString(), content);
        // A rising inbox share is the signal CB-307 exists to make visible: the worker finished but
        // nobody was waiting, so delivery now depends on the push loop and a drain.
-        count(BridgedMetrics.REPLIES, "path", "inbox");
+        count(FleetMetrics.REPLIES, "path", "inbox");
        if (pushLoop != null) {
            pushLoop.onReplyQueued(session);
        }
@@ -308,7 +308,7 @@ public final class MessageService {
    private Reply recorded(Reply r) {
        String label = sendOutcomeLabel(r.outcome());
        if (label != null) {
-            count(BridgedMetrics.SENDS, "outcome", label);
+            count(FleetMetrics.SENDS, "outcome", label);
        }
        return r;
    }
@@ -329,7 +329,7 @@ public final class MessageService {
     * Abandon any send still waiting on {@code target} because its session has gone away (CB-516).
     *
     * <p>Without this, tearing a worker down left its rendezvous waiter open: a blocking
-     * {@code bridge_send} kept blocking, and an async one kept reporting {@code PENDING} until
+     * {@code fleet_send} kept blocking, and an async one kept reporting {@code PENDING} until
     * {@link #ASYNC_TIMEOUT_MS} — thirty minutes — even though the worker provably no longer
     * existed and the delegation could never complete. Worse, {@code poll} already had the evidence
     * (it calls {@code liveStatus} to build its detail string and gets back {@code "unknown"}) and
@@ -484,7 +484,7 @@ public final class MessageService {

    /**
     * A worker's mid-turn question (CB-205 reverse rendezvous): surface {@code question} to the
-     * primary by resolving its open blocking {@code bridge_send}, then block this (worker) call until
+     * primary by resolving its open blocking {@code fleet_send}, then block this (worker) call until
     * the primary answers via {@link #answer} or {@code timeoutMillis} elapses. Identity is the
     * worker's own session — it does not address the primary.
     *
@@ -509,10 +509,10 @@ public final class MessageService {
                rendezvous.closeAsk(ticket.turnId());
                return new AskResult(AskOutcome.NO_WAITER, null); // no primary is blocked on this worker
            }
-            // CB-582: the question just became visible via bridge_poll (Phase.ASKING) for an async
+            // CB-582: the question just became visible via fleet_poll (Phase.ASKING) for an async
            // (wait:false) delegation — nudge the lead's own pane the same way a terminal ticket does
            // (CB-588), since the lead's normal poll cadence is minutes away and the reverse-rendezvous
-            // window (~55s, see BridgeMcp/BridgedApp) is far shorter. A blocking (wait:true) send has
+            // window (~55s, see FleetMcp/FleetApp) is far shorter. A blocking (wait:true) send has
            // no Task and gets the question directly in its own reply, so task == null there — nothing
            // to nudge.
            if (task != null && pushLoop != null) {
@@ -523,7 +523,7 @@ public final class MessageService {
            String answer = ticket.answer().get(timeoutMillis, TimeUnit.MILLISECONDS);
            return new AskResult(AskOutcome.ANSWERED, answer);
        } catch (TimeoutException e) {
-            log.debug("bridge_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
+            log.debug("fleet_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
            clearAsyncQuestion(ticket.turnId(), true);
            return new AskResult(AskOutcome.TIMED_OUT, null);
        } catch (ExecutionException e) {
@@ -549,13 +549,13 @@ public final class MessageService {
    }

    /**
-     * The primary's answer to a worker's {@code bridge_ask} (CB-205): resolve the worker's blocked
+     * The primary's answer to a worker's {@code fleet_ask} (CB-205): resolve the worker's blocked
     * question identified by {@code turnId}, then — like a fresh {@link #send} — block for the worker's
-     * eventual {@code bridge_reply} as it finishes the resumed turn. The worker session is derived from
+     * eventual {@code fleet_reply} as it finishes the resumed turn. The worker session is derived from
     * {@code turnId}, never a caller argument.
     *
     * <p>Unlike {@link #send} this does not re-inject through the {@link Injector}: the worker is
-     * mid-turn (already picked up), so the answer flows back through its own open {@code bridge_ask}
+     * mid-turn (already picked up), so the answer flows back through its own open {@code fleet_ask}
     * call, not a new status-gated delivery. The forward waiter is opened <em>before</em> the worker
     * is unblocked so a reply that lands the instant it resumes is not lost.
     */
@@ -624,9 +624,9 @@ public final class MessageService {
        tasks.put(ticket, task);
        if (pushLoop != null) {
            // CB-588: task.future only ever completes on a terminal phase (DONE or a failure) — a
-            // worker paused in bridge_ask leaves it running, per finishAsyncTask's own contract — so
+            // worker paused in fleet_ask leaves it running, per finishAsyncTask's own contract — so
            // this fires exactly once, from whichever path completes it: finishAsyncTask(task, result)
-            // below on any non-QUESTION outcome of send() — a worker's bridge_reply, the CB-106
+            // below on any non-QUESTION outcome of send() — a worker's fleet_reply, the CB-106
            // completion fallback, a CB-109 wedge, TIMED_OUT, BUSY, or BACKEND_EXHAUSTED — the same
            // finishAsyncTask reached via answer()'s finishAsyncTask(turnId, result) once a QUESTION
            // is resolved, completeExceptionally(t) just below when send() itself throws, or a CB-516
@@ -719,7 +719,7 @@ public final class MessageService {
     * too, its own {@code pendingTickets} entry would outlive the ticket it names: an unpolled ticket
     * (or one the reminder cap already gave up on) is pruned here but never collected there, so it
     * lingers in {@code pendingTickets} forever and rides along on every later nudge to the same lead
-     * — naming a ticket {@code bridge_poll} can no longer find (CB-588 follow-up).
+     * — naming a ticket {@code fleet_poll} can no longer find (CB-588 follow-up).
     */
    private void pruneTerminalTickets() {
        long cutoff = nowNanos.getAsLong() - TICKET_TTL_NANOS;
@@ -784,10 +784,10 @@ public final class MessageService {
    }

    /**
-     * The question {@code workerSession} is currently paused on via {@code bridge_ask}, if any
-     * (CB-582) — {@code bridge_status} uses this to show a pending question without the caller
+     * The question {@code workerSession} is currently paused on via {@code fleet_ask}, if any
+     * (CB-582) — {@code fleet_status} uses this to show a pending question without the caller
     * needing the ticket. {@code null} when the session has no open async question (including a
-     * session mid a <em>blocking</em> {@code bridge_ask}, which has no {@link Task} to look up — see
+     * session mid a <em>blocking</em> {@code fleet_ask}, which has no {@link Task} to look up — see
     * {@link PendingAsk}).
     */
    public PendingAsk pendingAsk(String workerSession) {
@@ -1,13 +1,13 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicLong;

 /**
- * The reply rendezvous: where a blocking {@code bridge_send} awaits how the worker's delegated turn
+ * The reply rendezvous: where a blocking {@code fleet_send} awaits how the worker's delegated turn
 * ends. The sending (primary) request thread {@link #open}s a waiter; it is resolved either by the
- * worker's explicit {@code bridge_reply} ({@link #resolve}, arriving on a different thread via
+ * worker's explicit {@code fleet_reply} ({@link #resolve}, arriving on a different thread via
 * {@code POST /sessions/{id}/reply}) or — the CB-106 fallback — by the injector observing the
 * worker's delegated turn return to idle without a reply ({@link #resolveCompletion}).
 *
@@ -27,14 +27,14 @@ public final class Rendezvous {

    /** How a delegated turn ended (or paused). */
    public enum Kind {
-        /** The worker called {@code bridge_reply} with a structured answer. */
+        /** The worker called {@code fleet_reply} with a structured answer. */
        REPLY,
-        /** The worker's turn finished without a {@code bridge_reply}; {@code text} is a scrape. */
+        /** The worker's turn finished without a {@code fleet_reply}; {@code text} is a scrape. */
        COMPLETION,
        /** The worker ran the turn then wedged (CB-109); {@code text} is the failure context. */
        FAILED,
        /**
-         * The turn finished without a {@code bridge_reply}, and the scrape matched the backend's
+         * The turn finished without a {@code fleet_reply}, and the scrape matched the backend's
         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
         * carrying the matched line. The pane is healthy — only the account is refusing — so this
         * is kept separate from a session simply going {@code GONE}.
@@ -43,7 +43,7 @@ public final class Rendezvous {
        /**
         * The worker paused mid-turn to ask the primary a question (CB-205 reverse rendezvous);
         * {@code text} is the question and {@code turnId} correlates the primary's answer back to
-         * the worker's blocked {@code bridge_ask}. Not terminal — the turn resumes after the answer.
+         * the worker's blocked {@code fleet_ask}. Not terminal — the turn resumes after the answer.
         */
        QUESTION
    }
@@ -75,7 +75,7 @@ public final class Rendezvous {
    /** Reverse rendezvous (CB-205): worker questions awaiting the primary's answer, keyed by {@code turnId}. */
    private final ConcurrentHashMap<String, AskWaiter> asks = new ConcurrentHashMap<>();
    private final AtomicLong askSeq = new AtomicLong();
-    /** Per-session index of the currently-open ask, so duplicate bridge_ask calls coalesce onto one turn. */
+    /** Per-session index of the currently-open ask, so duplicate fleet_ask calls coalesce onto one turn. */
    private final ConcurrentHashMap<String, String> openAsksBySession = new ConcurrentHashMap<>();

    /**
@@ -132,7 +132,7 @@ public final class Rendezvous {
        return complete(session, new Resolution(Kind.REPLY, content));
    }

-    // --- reverse rendezvous (CB-205 bridge_ask) ------------------------------------------------
+    // --- reverse rendezvous (CB-205 fleet_ask) ------------------------------------------------

    /**
     * Open a reverse-rendezvous waiter for a worker's mid-turn question. If {@code session} already has
@@ -166,7 +166,7 @@ public final class Rendezvous {
    }

    /**
-     * Surface a worker's mid-turn {@code question} by resolving the primary's open {@code bridge_send}
+     * Surface a worker's mid-turn {@code question} by resolving the primary's open {@code fleet_send}
     * with a {@link Kind#QUESTION} carrying {@code turnId}. Same session-keyed semantics as
     * {@link #resolve}: the one outstanding send for {@code session} unblocks with the question.
     *
@@ -184,7 +184,7 @@ public final class Rendezvous {
    }

    /**
-     * Resolve a worker's blocked {@code bridge_ask} with the primary's {@code answer}, unblocking it
+     * Resolve a worker's blocked {@code fleet_ask} with the primary's {@code answer}, unblocking it
     * to resume its turn.
     *
     * @return {@code true} if the ask was still open and got the answer; {@code false} if the
@@ -195,7 +195,7 @@ public final class Rendezvous {
        return w != null && w.answer().complete(answer);
    }

-    /** Drop a reverse-rendezvous turn once its {@code bridge_ask} has resolved (answered or lapsed). */
+    /** Drop a reverse-rendezvous turn once its {@code fleet_ask} has resolved (answered or lapsed). */
    public void closeAsk(String turnId) {
        AskWaiter w = asks.get(turnId);
        if (w == null) {
@@ -209,9 +209,9 @@ public final class Rendezvous {

    /**
     * Resolve a specific captured {@code waiter} as a completion (the delegated turn finished with no
-     * {@code bridge_reply}); {@code text} is the scraped transcript tail. The waiter is the one
+     * {@code fleet_reply}); {@code text} is the scraped transcript tail. The waiter is the one
     * captured when this turn was delivered, so a late completion for turn N cannot land on turn N+1's
-     * send (CB-116). A no-op if that waiter was already resolved — a raced {@code bridge_reply} wins.
+     * send (CB-116). A no-op if that waiter was already resolved — a raced {@code fleet_reply} wins.
     *
     * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
     */
@@ -233,7 +233,7 @@ public final class Rendezvous {

    /**
     * Resolve a specific captured {@code waiter} as {@link Kind#BACKEND_EXHAUSTED} (CB-578 stage A):
-     * the turn finished with no {@code bridge_reply} and the scrape matched the backend's configured
+     * the turn finished with no {@code fleet_reply} and the scrape matched the backend's configured
     * usage-limit pattern; {@code reason} carries the matched line. Like
     * {@link #resolveCompletion(CompletableFuture, String)} it targets the exact captured send
     * (CB-116). A no-op if that waiter was already resolved — first resolution wins.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import java.util.List;

@@ -1,10 +1,10 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -19,9 +19,9 @@ import java.util.stream.Collectors;

 /**
 * A status-gated push loop that nudges a lead's own herdr pane when it has uncollected work
- * waiting: a worker reply queued with no live {@code bridge_send} to resolve it (CB-307), an
- * async delegation ticket ({@code bridge_send(wait:false)}) that reached a terminal phase
- * (CB-588), or an async ticket's worker pausing mid-turn in {@code bridge_ask} to await an answer
+ * waiting: a worker reply queued with no live {@code fleet_send} to resolve it (CB-307), an
+ * async delegation ticket ({@code fleet_send(wait:false)}) that reached a terminal phase
+ * (CB-588), or an async ticket's worker pausing mid-turn in {@code fleet_ask} to await an answer
 * (CB-582).
 *
 * <p><strong>CB-590: one schedule per lead.</strong> All three kinds of work are triggered
@@ -50,24 +50,24 @@ import java.util.stream.Collectors;
 public final class ReplyPushLoop {

    private static final Logger log = LoggerFactory.getLogger(ReplyPushLoop.class);
-    static final String NUDGE_FORMAT = "Worker %s returned a reply — run bridge_poll(target=%s) to collect it";
+    static final String NUDGE_FORMAT = "Worker %s returned a reply — run fleet_poll(target=%s) to collect it";
    /** Coalesced form, several uncollected replies for the same lead. */
    static final String REPLIES_NUDGE_FORMAT =
-            "%d workers returned replies — run bridge_poll(target=...) for each to collect them: %s";
+            "%d workers returned replies — run fleet_poll(target=...) for each to collect them: %s";
    /** Singular form, one uncollected ticket. */
    static final String TICKET_NUDGE_FORMAT =
-            "Ticket %s finished%s — run bridge_poll(ticket=%s) to collect it";
+            "Ticket %s finished%s — run fleet_poll(ticket=%s) to collect it";
    /** Coalesced form, several uncollected tickets for the same lead. */
    static final String TICKETS_NUDGE_FORMAT =
-            "%d tickets finished%s — run bridge_poll(ticket=...) for each to collect them: %s";
-    /** Singular form, one worker paused mid-turn in bridge_ask (CB-582) — names the answer call directly. */
+            "%d tickets finished%s — run fleet_poll(ticket=...) for each to collect them: %s";
+    /** Singular form, one worker paused mid-turn in fleet_ask (CB-582) — names the answer call directly. */
    static final String QUESTION_NUDGE_FORMAT =
-            "Worker %s asked a question (ticket %s) — answer it with bridge_send(turnId=\"%s\", "
+            "Worker %s asked a question (ticket %s) — answer it with fleet_send(turnId=\"%s\", "
                    + "content=...) to resume its turn:\n%s";
    /** Coalesced form, several open questions for the same lead. */
    static final String QUESTIONS_NUDGE_FORMAT =
-            "%d workers are paused on a question — run bridge_poll(ticket=...) for each, then answer "
-                    + "with bridge_send(turnId=..., content=...): %s";
+            "%d workers are paused on a question — run fleet_poll(ticket=...) for each, then answer "
+                    + "with fleet_send(turnId=..., content=...): %s";

    private final PrimaryRegistry primaryRegistry;
    private final AgentControl agents;
@@ -87,7 +87,7 @@ public final class ReplyPushLoop {
    /** Tickets that have gone terminal but not yet been polled, keyed by ticket. */
    private final ConcurrentHashMap<String, PendingTicket> pendingTickets = new ConcurrentHashMap<>();
    /**
-     * Open {@code bridge_ask} questions not yet answered or lapsed, keyed by {@code turnId}
+     * Open {@code fleet_ask} questions not yet answered or lapsed, keyed by {@code turnId}
     * (CB-582). A question's own nudge count is tracked the same per-item way as
     * {@link #pendingTickets} (CB-598): a fresh question keeps its source eligible regardless of
     * how depleted an older, still-open question's count is.
@@ -118,7 +118,7 @@ public final class ReplyPushLoop {
    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
    private void countNudge(String outcome) {
        if (metrics != null) {
-            metrics.inc(BridgedMetrics.PUSH_NUDGES, "outcome", outcome);
+            metrics.inc(FleetMetrics.PUSH_NUDGES, "outcome", outcome);
        }
    }

@@ -130,7 +130,7 @@ public final class ReplyPushLoop {
    /**
     * Reply targets still pending for {@code lead} — registered via {@link #onReplyQueued} and
     * whose inbox still holds an unacked message. A target whose inbox has since drained (acked,
-     * or collected via a live {@code bridge_send} rendezvous instead) is dropped from
+     * or collected via a live {@code fleet_send} rendezvous instead) is dropped from
     * {@link #pendingReplies} here rather than lingering forever; there is no explicit "reply
     * collected" callback the way {@link #ticketCollected} exists for tickets, so the inbox itself
     * is the only signal.
@@ -323,7 +323,7 @@ public final class ReplyPushLoop {
    }

    /**
-     * Called when an async delegation ticket ({@code bridge_send(wait:false)}, CB-107) reaches a
+     * Called when an async delegation ticket ({@code fleet_send(wait:false)}, CB-107) reaches a
     * terminal phase — DONE or a failure. Unlike {@link #onReplyQueued}, which nudges about the
     * durable-inbox no-waiter path, this covers the path {@code MessageService.reply} takes when a
     * fire-and-poll send's own rendezvous waiter resolves the reply directly: that path returns
@@ -352,7 +352,7 @@ public final class ReplyPushLoop {
    }

    /**
-     * Called when a ticket's terminal state has been collected via {@code bridge_poll}. Removes it
+     * Called when a ticket's terminal state has been collected via {@code fleet_poll}. Removes it
     * from the pending set so a scheduled tick — and any nudge it sends — never names a ticket the
     * lead already has. A ticket that was never pending (unknown ticket, or one nudged with no push
     * loop configured) is a no-op.
@@ -362,16 +362,16 @@ public final class ReplyPushLoop {
    }

    /**
-     * Called when an async ticket's worker pauses mid-turn in {@code bridge_ask} (CB-582): the
-     * question is now visible via {@code bridge_poll} (Phase.ASKING), but the reverse-rendezvous
-     * window it opened with (~55s default, see {@code BridgeMcp}/{@code BridgedApp}) is far shorter
+     * Called when an async ticket's worker pauses mid-turn in {@code fleet_ask} (CB-582): the
+     * question is now visible via {@code fleet_poll} (Phase.ASKING), but the reverse-rendezvous
+     * window it opened with (~55s default, see {@code FleetMcp}/{@code FleetApp}) is far shorter
     * than a lead's normal minutes-long poll cadence — exactly the gap this closes. Resolves the
     * delegating lead the same way {@link #onTicketTerminal} does and coalesces onto the same
     * per-lead schedule (CB-590).
     *
-     * @param ticket   the async ticket the question belongs to (for {@code bridge_poll})
+     * @param ticket   the async ticket the question belongs to (for {@code fleet_poll})
     * @param target   the worker session that asked
-     * @param turnId   correlation id the lead answers with ({@code bridge_send turnId=...})
+     * @param turnId   correlation id the lead answers with ({@code fleet_send turnId=...})
     * @param question the question text
     */
    public void onQuestionOpened(String ticket, String target, String turnId, String question) {
@@ -386,7 +386,7 @@ public final class ReplyPushLoop {
    }

    /**
-     * Called when a worker's {@code bridge_ask} resolves — answered or lapsed unanswered — so a
+     * Called when a worker's {@code fleet_ask} resolves — answered or lapsed unanswered — so a
     * scheduled tick never nudges about a question the lead already handled. A {@code turnId} that
     * was never pending (never nudged, or already closed) is a no-op.
     */
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import java.util.concurrent.CompletableFuture;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 /**
 * Declared capabilities of a {@link PeerLauncher}. The protocol is the union across all
@@ -9,7 +9,7 @@ package dev.ltms.bridged.peer;
 public enum Capability {

    /**
-     * The peer supports {@code bridge_ask} rendezvous — pausing its delegated turn to ask
+     * The peer supports {@code fleet_ask} rendezvous — pausing its delegated turn to ask
     * the primary a question, then resuming once answered. All Claude Code peers support this.
     */
    MID_TURN_ASK,
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 import java.util.Locale;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 /**
 * An opaque handle returned by {@link PeerLauncher#spawn(SpawnRequest)}. The core routes on
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 import java.util.List;
 import java.util.Set;
@@ -13,11 +13,23 @@ import java.util.Set;
 * and naming conventions are all adapter-private — the core sees only the returned
 * {@link PeerHandle} whose {@code id()} is the registry/routing key.
 *
- * <p>The interface is a superset of what {@code SessionManager} and {@code Bridged.main} call
+ * <p>The interface is a superset of what {@code SessionManager} and {@code Fleetd.main} call
 * on the concrete launcher today.
 */
 public interface PeerLauncher {

+    /**
+     * The name every launcher gives the bridge's MCP server in the config it writes for its peer.
+     * The peer's tools are addressed as {@code mcp__<this>__fleet_*}, and {@code CLAUDE.md}'s
+     * role-detection ladder names that prefix, so the two must agree.
+     *
+     * <p>It is a constant because three launchers write it — {@code ClaudeCodeLauncher} and
+     * {@code LeadLauncher} into a {@code --mcp-config} literal, {@code OpenCodeLauncher} into an
+     * {@code opencode.json} node. Three hand-written copies of one name is how a rename lands in
+     * two of them (CB-632).
+     */
+    String MCP_MOUNT_NAME = "fleet";
+
    /**
     * The set of {@link Capability capabilities} this launcher declares. A peer whose profile
     * opts into a git-forge token should include {@link Capability#SELF_PR}; the base set for
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 /**
 * Thrown when a {@link PeerLauncher} starts a peer process but the peer
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 /**
 * What a caller asks for when spawning a peer.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -8,7 +8,7 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.LongSupplier;

 /**
- * Where a credential (not a profile — see {@code BridgedConfig.Profile#effectiveCredentialId()})
+ * Where a credential (not a profile — see {@code FleetConfig.Profile#effectiveCredentialId()})
 * sits out a cooldown after a {@code BACKEND_EXHAUSTED} classification (CB-578 stage B), so a fresh
 * spawn does not walk straight back onto the account that just refused on a usage limit.
 *
@@ -16,7 +16,7 @@ import java.util.function.LongSupplier;
 * models on the same OpenAI account) share one quarantine — {@link #quarantine} one credential id
 * and every profile whose {@code effectiveCredentialId()} equals it is quarantined too, without this
 * class knowing anything about profiles at all. That mapping is the caller's job (see
- * {@code CompositePeerLauncher} and {@code dev.ltms.bridged.inject.ExhaustionSink}).
+ * {@code CompositePeerLauncher} and {@code dev.ltms.fleet.inject.ExhaustionSink}).
 *
 * <p>The clock is injected ({@link LongSupplier}, conventionally {@code System::nanoTime} like
 * {@code FleetHealthMonitor}), never read inline, so a quarantine's expiry is testable without a
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * Backward-compatible placement: an unqualified spawn always resolves to the configured default
@@ -11,7 +11,7 @@ package dev.ltms.bridged.placement;
 *       a usage limit, not a transient capacity or reachability concern.
 *   <li>Weight 0 (CB-554): {@code fixed} is still automatic selection, so a profile the operator
 *       marked "never auto-select me" ({@code weight <= 0}) must be skipped here exactly as
- *       {@code weighted}/{@code round-robin} skip it — an explicit {@code bridge_spawn} naming
+ *       {@code weighted}/{@code round-robin} skip it — an explicit {@code fleet_spawn} naming
 *       the profile is unaffected, only this automatic fallback walk.
 * </ul>
 * A fleet where nothing is ever quarantined or weight-0 never exercises either path, so today's
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * A profile (and, in CB-308, a host) that can be chosen by a {@link PlacementPolicy}.
@@ -21,12 +21,12 @@ public record PlacementCandidate(String profile, String host, float weight, Inte
    /**
     * True when this candidate carries an explicit {@code weight <= 0} (CB-554) and must be
     * skipped by every automatic policy — the same way a quarantined or unreachable candidate is
-     * skipped. {@code BridgedConfig.Profile}'s compact constructor already normalises "absent" to
+     * skipped. {@code FleetConfig.Profile}'s compact constructor already normalises "absent" to
     * {@code 1.0} and "negative" to {@code 0.0}, so this is a plain threshold check here; it does
     * not need to distinguish "explicit 0" from "absent" itself.
     *
     * <p>Exclusion is about <em>automatic</em> selection only — an explicit
-     * {@code bridge_spawn{profile:"..."}} bypasses placement entirely and is unaffected.
+     * {@code fleet_spawn{profile:"..."}} bypasses placement entirely and is unaffected.
     */
    public boolean excluded() {
        return weight <= 0.0f;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.List;
 import java.util.Set;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * Thrown when a {@link PlacementPolicy} has no candidate available. Kept as a distinct type so
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * Factory for the built-in placement policies.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * How {@code bridged} chooses a worker profile when a spawn names none. Implementations are
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.ArrayList;
 import java.util.List;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.List;
 import java.util.concurrent.atomic.AtomicInteger;
--- a/Show More
+++ b/Show More