Remove CallerResolver members accessor

A collaborator could find and message a lead, but a lead had nowhere to read a
collaborator's sessionId, so the channel only worked once the collaborator
spoke first. fleet_list now carries a collaborators array, and
CallerResolver.collaborators() has its first caller outside the resolver.

Visible to the primary, an architect and a collaborator; absent for a worker.
The rule is that the roles which may see a collaborator row are the roles that
can act on it, and a worker cannot send to a collaborator at all. Narrowed in
the payload the way coordinatorVisibleTo already does it, because fleet_list is
gated on READ and a worker holds READ.

Each row carries the registry name and the sessionId only. A collaborator is
never spawned and has no profile, so a lead row's context and seat fields have
no meaning for it.

mvn clean install: exit 0, BUILD SUCCESS, Tests run: 2005, Failures: 0.

Nothing yet pins the handler to collaboratorsVisibleTo, unlike the coordinator
flag, so a literal passed there would regress silently. Tracked in #710.

.claude/skills/fleets-status/SKILL.md

@@ -59,7 +59,7 @@ as `matches HEAD`, `drift`, or `unknown`; do not turn an unclear timestamp into
 Report the process identifier (PID) and uptime too:
 
 ```bash
-PIDS="$(pgrep -f 'target/fleetd.jar' || true)"
+PIDS="$(pgrep -f 'fleetd.jar' || true)"
 if [ -z "$PIDS" ]; then
   printf '%s\n' 'fleetd: not running'
 else

.claude/skills/handover/SKILL.md

@@ -164,6 +164,13 @@ fails.
 - **`accepted` does not mean your pane has been cleared.** It means every gate passed and the roll
   is scheduled to run once your current turn ends. Say your goodbye in the same turn — you will not
   get another one.
+- **If you are still running after that turn, the roll did not happen.** A roll that works clears
+  you, so surviving your own goodbye is itself the signal that it refused. Check with
+  `fleet_handover{action: "status", token}`, using the token you confirmed. `TURN_NEVER_SETTLED`
+  means your turn ran past `leadRollover.turnSettleSeconds` and **no `/clear` was ever sent**: your
+  context is intact and nothing was lost. Open a fresh request and retry. Never assume the roll
+  succeeded because `confirm` answered `accepted` — by the time it refuses, there is no caller left
+  to tell, so this check is the only thing that closes that gap.
 - **There is no terminal or session parameter, on purpose.** The pane is always your own, resolved
   from your connection, so you can only ever roll yourself.
 - **`operatorConfirmed` is your report of what a human told you.** Do not pass `true` because you

.claude/skills/redeploy-fleetd/SKILL.md

@@ -22,13 +22,22 @@ scripts/redeploy-fleetd.sh --yes     # skip the drain prompt (fleet already chec
 scripts/redeploy-fleetd.sh --no-build # restart the jar already on disk
 ```
 
-`--no-build` skips the build and restarts whatever jar is at `fleetd/target/fleetd.jar`. Use it only
-when you just built and nothing changed since. It gives up the protection in the next paragraph: no
-build runs, so a stale or missing jar is not caught early. The script still checks the file is there
-and dies with `no jar at … — run without --no-build` if it is not, but it cannot tell you the jar is
-old. A `mvn clean` in the tree deletes that jar while the daemon keeps running on it, and nothing
-degrades until the next restart. Run `--check` first: it prints the jar's hash and its modification
-time, so you can see for yourself whether the jar is missing or older than the code you mean to ship.
+`--no-build` skips the build and restarts whatever jar is at `fleetd/run/fleetd.jar` — the runtime
+path, not Maven's output path. Use it only when you just built and nothing changed since. It gives
+up the protection in the next paragraph: no build runs, so a stale or missing jar is not caught
+early. The script still checks the file is there and dies with `no jar at … — run without
+--no-build` if it is not, but it cannot tell you the jar is old.
+
+The daemon runs from `fleetd/run/fleetd.jar`, not from `fleetd/target/fleetd.jar` where Maven
+writes its output (fleetd #664). That split is what makes a bare `mvn install`/`mvn clean` in the
+main clone harmless now: neither can reach the file the running daemon holds open, because that
+file no longer lives under `target/` at all. Verify a merge by building in a throwaway git
+worktree anyway — a build still produces nothing the fleet runs until this script's own `mv` of
+`target/fleetd.jar` onto `run/fleetd.jar`, performed only after the old daemon is confirmed gone.
+Let only `scripts/redeploy-fleetd.sh` touch `fleetd/run/fleetd.jar`. Run `--check` first: it prints
+the BUILT jar (`target/fleetd.jar`) and the RUNNING jar (`run/fleetd.jar`) as two separately
+labelled hash-and-mtime facts, so a mismatch between them — a build sitting unswapped, or a stale
+runtime jar — is visible before you decide anything.
 
 It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
 old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a

CLAUDE.md

@@ -27,10 +27,11 @@ through its `fleet_*` tools. No session addresses a peer, a broker, or the netwo
 **Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.
 
-**Call `fleet_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
-your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
-carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
-was bound to. Don't infer what you can ask.
+**Call `fleet_whoami`.** It returns `primary`, `worker`, `architect`, or `collaborator`, resolved by
+the daemon from your connection — unforgeable, and the same resolution its authorization gate uses.
+A worker also carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the
+slot name it was bound to; a collaborator carries its registry name and its own `sessionId`, and
+**no `leader` key** — a collaborator is a named peer, not a primary. Don't infer what you can ask.
 
 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
 fires: the reply charter in your system prompt (*"You are a spawned member in the
@@ -38,12 +39,17 @@ claude-bridge fleet"*) ⇒ **spawned member**; fleet tools prefixed `mcp__fleet_
 member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
 `.mcp.json`, so it varies — and a member spawned before CB-632 still says `mcp__bridge__*`); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
 on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
-only `fleet_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+only `fleet_whoami` does. **And none of them fires for a collaborator at all**: every signal in the
+ladder detects a *spawned* member, while a collaborator is a tab a person opened by hand, so it has
+no charter, no fixed mount name and a normal environment. A collaborator that cannot call
+`fleet_whoami` therefore falls to the line below and acts as a worker. That is the safe direction —
+it under-privileges, and the refusals are loud — but it means a collaborator has no way to learn
+what it is except by asking. **Still unsure ⇒ act as a worker**, the most restricted member role. The
 two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
 loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
 and the sender silently receives nothing. Fail toward the recoverable error.
 
-### Invariants — both roles, no exceptions
+### Invariants — every role, no exceptions
 
 1. **Never set, export, or forward `ANTHROPIC_BASE_URL`** (or `ANTHROPIC_AUTH_TOKEN`). The primary
    stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
@@ -51,9 +57,10 @@ and the sender silently receives nothing. Fail toward the recoverable error.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
    side cannot see your screen. An answer that isn't in a `fleet_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
-   cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
-   reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
-   outside your role is refused, not queued.
+   cannot act as another session. Spawn/stop/drain are lead-only; **send is lead, architect, or
+   collaborator** — and a collaborator may send only to a lead or another collaborator, never to a
+   spawned member's terminal; reply/ask are only-as-itself — any peer may answer for its own pane,
+   and for no other. A call outside your role is refused, not queued.
 4. **Delivery is status-gated: one message per turn.** Don't busy-poll a peer's terminal and don't
    re-send because a call looks slow — the bridge delivers when the peer is `idle`, `blocked` or
    `done`. A spawned member must **also** have mounted the bridge MCP: until it has, it is not
@@ -161,6 +168,7 @@ you decide.
 | Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
 | Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
 | Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
+| Message a **collaborator** on this host | `fleet_send{sessionId: <their terminal>, content}` — but **`fleet_list` does not report collaborators**, so you cannot discover one: it must tell you its `sessionId`, which its own `fleet_whoami` gives it. Coordination only, **never** a task |
 | Answer a peer lead that messaged you | `fleet_send{coordId}` — or `{sessionId}` if they are on this host. **Not** `fleet_reply`: it has no peer route and the publish is refused |
 | Read your own held lead-to-lead mail (no ack) | `fleet_poll{coordId: <your own coord-id, from fleet_list's coordinator.selfId>}` — primary-only; never acks, so `fleet_list`'s `held[]` still shows it after. `fleet_list`'s `held[]` gives only a truncated preview — this is the only way to read the full body |
 | Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
@@ -234,6 +242,27 @@ simply complies has thrown away the reason there are two of you.
 7. **Never merge.** Stage files explicitly — never `git add -A` — and leave alone anything the
    project marks as not-yours-to-commit.
 
+### Collaborator — a named peer, not a member
+
+`fleet_whoami` answered `collaborator`, so your pane's tab matches a `fleet.collaborators.<name>.tab`
+entry. You are **not** a member: nothing delegates to you, you have no brief, no worktree and no
+ticket, and **you owe no `fleet_reply`** — the turn contract above is for a session a lead spawned,
+and it does not apply to you. Read it only to understand what the members around you are doing.
+
+What you may do: observe the fleet (`fleet_list`, `fleet_profiles`, `fleet_whoami`), and send to a
+lead or to another collaborator. What you may not: spawn, stop or drain anything, roll a lead's
+session, answer a member's `fleet_ask`, poll a ticket, or send to a spawned member's terminal. Each
+of those is refused at the gate, not queued.
+
+Two limits worth knowing before you hit them. **You cannot reach a worker** — not even to help one —
+because a worker belongs to the lead that spawned it, and routing around that would make you a
+second orchestrator with no plan. Send to the lead instead. And **you cannot read a ticket**, so you
+cannot collect a delegation's reply; ticket ids are a plain counter with no owner check, so holding
+one would let you walk every other session's answers.
+
+Being named buys you a channel, not authority. Your `fleet_send` to a lead is coordination between
+peers: the lead owes you no obedience, and you owe it none.
+
 ### Where each rule lives (don't duplicate — extend the right layer)
 
 | Layer | Scope | Reaches |
@@ -323,6 +352,13 @@ must obey belongs in the charter, not here.
   reference**, with the intent→tool table above as the short form. `McpContractDocTest` fails if
   that page names a `fleet_*` tool the server does not register. The flows are kept out of this
   file because this file loads into every session's context.
+- **The daemon runs from `fleetd/run/fleetd.jar`, not `fleetd/target/fleetd.jar`** (fleetd #664).
+  Maven's own output still lands at `fleetd/target/fleetd.jar` — that part of the build is
+  unchanged — but the running daemon never has that file open, so a bare `mvn install`/`mvn clean`
+  in the main clone no longer corrupts anything a live process is reading. Verify merges in a
+  throwaway git worktree anyway: a build in the main clone still ships nothing until
+  `scripts/redeploy-fleetd.sh` moves it into place with its own atomic `mv`, performed only after
+  the old daemon is confirmed gone. Let only that script touch `fleetd/run/fleetd.jar`.
 
 ### Redeploying the daemon — the lead may do this (primary only)
 
@@ -352,7 +388,7 @@ Before you call any work done, check the row that matches what you touched:
 | `ConnectionIdentity` / how a caller is resolved | the `fleet_whoami` paragraph and the fallback ladder |
 | `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__fleet__*`), and the layering table's top row |
 | the injector / status gating | invariant 4 |
-| worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
+| worktree provisioning or the parity overlay | the "every role reads this file" premise — it rests on the worker's worktree being a checkout of this repo |
 | `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
 | a new peer kind (non-Claude adapter) | what that peer can read — anything it must obey belongs in its charter, not in the block |
 | **anything an operator can use, configure, or observe** — an MCP tool, a `fleetd.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |

deploy/dev.ltms.fleetd.plist

@@ -47,7 +47,7 @@
         <string>/Users/dai.ha/LTMS/claude-bridge/scripts/fleetd-launchd-wrapper.sh</string>
         <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin/java</string>
         <string>-jar</string>
-        <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/target/fleetd.jar</string>
+        <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/run/fleetd.jar</string>
         <string>fleetd.yaml</string>
     </array>
 

deploy/fleetd.service

@@ -50,7 +50,7 @@ WorkingDirectory=%h/LTMS/fleetd/fleetd
 # and looks healthy, and the failure appears hours later as a member that cannot open a pull
 # request. exec keeps it one process, so systemd tracks the right PID.
 # This also avoids a SECOND copy of the secrets in a systemd drop-in: one source of truth.
-ExecStart=/bin/zsh -lc "exec java -jar target/fleetd.jar fleetd.yaml"
+ExecStart=/bin/zsh -lc "exec java -jar run/fleetd.jar fleetd.yaml"
 
 # PrivateTmp MUST stay false -- see herdr.service. fleetd creates the member ZDOTDIR scrub dir and
 # the opencode config dir under java.io.tmpdir, and the member pane (a herdr child, a different

fleetd/.gitignore

@@ -2,6 +2,10 @@
 target/
 dependency-reduced-pom.xml
 
+# The daemon's runtime jar (fleetd #664). scripts/redeploy-fleetd.sh moves the built jar here
+# with a same-filesystem rename; this is never Maven's output path and never belongs in git.
+run/
+
 # Local runtime config (copy from fleetd.example.yaml). Both names are ignored: fleetd.yaml is
 # the current name, and bridged.yaml is the legacy name Fleetd still falls back to.
 fleetd.yaml

fleetd/fleetd.example.yaml

@@ -62,11 +62,12 @@ bind:
 #
 # Leads are configured under `fleet.leaders:` — see THE FLEET further down.
 #
-# Two things stop the tab-name convention from becoming a way to claim leadership: the configured
-# member spaces are excluded from the scan, so nothing fleetd places can land in a matching tab;
-# and startup REFUSES a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel`
-# override, also matches — so the two namespaces cannot overlap by accident. The label is a NAME,
-# never a capability: what a pane may do is decided by the role the daemon resolves for it.
+# Two things stop the tab-name convention from becoming a way to claim leadership: startup REFUSES
+# a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel` override, also
+# matches, so the two namespaces cannot overlap by accident; and the CallerResolver asks the live
+# spawned-member roster BEFORE any tab map, so a live member is never mistaken for a lead no matter
+# what its tab says. The label is a NAME, never a capability: what a pane may do is decided by the
+# role the daemon resolves for it.
 
 # CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
 # idle (no open fleet_send driving it) past the quiet period. The fleet is one lead + architects +
@@ -659,9 +660,10 @@ fleet:
   #     tabPrefix: "lead:"           # only used to guard against a worker tabLabel colliding with
   #                                  # this convention at startup; plays no part in matching a lead
   #     scanIntervalSeconds: 10      # rescan cadence, and the worst case before a new tab is seen
-  #     workspace: leads             # where a launched lead's tab is created (default "leads").
-  #                                  # MUST NOT be a member workspace — those are excluded from the
-  #                                  # scan, so a lead placed in one is never found again.
+  #     workspace: leads             # where a launched lead's tab is created (default "fleet",
+  #                                  # the same shared space the members use). Sharing that space
+  #                                  # with members is the normal shipped shape: the scanner tells
+  #                                  # a lead from a member by the exact tab label, not by workspace.
   #     cwd: /path/to/repo           # the launched lead's working directory (default: fleetd's own)
   #     kind: claude                 # descriptive; reported by fleet_whoami
   #   gpt-sol-5.6:
@@ -669,6 +671,22 @@ fleet:
   #     kind: opencode
   #     model: openai/gpt-5.6-terra
 
+  # A collaborator tab, keyed by name (fleetd #669). A pane whose tab matches resolves as the
+  # COLLABORATOR role: `fleet_whoami` answers `collaborator`, and the session may observe the fleet
+  # (`fleet_list`, `fleet_profiles`, `fleet_whoami`) and `fleet_send` to a lead or to another
+  # collaborator. It may NOT spawn, stop or drain anything, roll a lead's session, answer a
+  # member's `fleet_ask`, poll a ticket, send across hosts, or send to a spawned member's terminal.
+  # Each of those is refused at the gate rather than queued.
+  # Recognise-only, like a profile-less `leaders:` entry above: there is no `profile:`, no
+  # `instances:` and no `kind:`. `tab:` is REQUIRED and is the only field identity depends on,
+  # matched case-insensitively — the same GET-THE-VALUE-RIGHT warning above the `leaders:` block
+  # applies here too.
+  # A lead cannot discover a collaborator yet (#703): `fleet_list` has no `collaborators` key, so
+  # the collaborator must speak first, or pass on the `sessionId` its own `fleet_whoami` reports.
+  # collaborators:
+  #   reviewer-alex:
+  #     tab: "collab: alex"
+
   # architects:
   #   architect-1:
   #     profile: opus                # a strong model, on the operator's subscription

fleetd/pom.xml

@@ -189,8 +189,10 @@
 
     <build>
         <!-- CB-634: the cutover renamed the module dir (bridged/ -> fleetd/), the jar, and the
-         launchd plist together. The installed plist names fleetd/target/fleetd.jar and
-         KeepAlive is armed, so this name, the plist, and the wrapper must move as one. -->
+         launchd plist together. fleetd #664: the installed plist and the systemd unit now name
+         fleetd/run/fleetd.jar, not this plugin's own output path — see
+         scripts/redeploy-fleetd.sh for the mv that gets a build from here to there. KeepAlive is
+         armed, so this name, the plist, and the wrapper must still move as one. -->
         <finalName>fleetd</finalName>
         <plugins>
             <plugin>

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -217,25 +217,28 @@ public final class Fleetd {
 
     /**
      * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a spawned
-     * member whose agent has connected the bridge MCP, <em>or</em> a lead.
+     * member whose agent has connected the bridge MCP, a lead, <em>or</em> a collaborator.
      *
      * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> member's boot
      * window, where herdr already reports {@code idle} but the TUI would drop an injected paste. That
      * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
-     * (or labelled its tab) only once it was up, so there is no boot window to guard.
+     * (or labelled its tab) only once it was up, so there is no boot window to guard. A collaborator
+     * is the same way — a person's own tab, matched to a configured name, never spawned.
      *
-     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code FleetMcp} marks presence
-     * for every spawned member (worker and architect), deliberately, since that map doubles as the
-     * member roster's availability signal and a lead counted there would show up as an available
-     * member. So without the second disjunct a lead is permanently un-deliverable: every
-     * lead→lead send sat on the gate for {@code READINESS_GRACE_POLLS} (~60s) and then failed
-     * having never been typed into the pane.
+     * <p>Neither a lead nor a collaborator is ever enrolled in {@link MemberPresence} — {@code
+     * FleetMcp} marks presence for every spawned member (worker and architect), deliberately, since
+     * that map doubles as the member roster's availability signal and a lead or collaborator counted
+     * there would show up as an available member. So without the second and third disjuncts a lead or
+     * collaborator is permanently un-deliverable: every send to one sat on the gate for
+     * {@code READINESS_GRACE_POLLS} (~60s) and then failed having never been typed into the pane.
      *
-     * <p>The lead set is read through the supplier on each call rather than snapshotted, so a lead
-     * discovered by {@code leadScan} after startup becomes deliverable without a restart.
+     * <p>Both sets are read through their supplier on each call rather than snapshotted, so a lead or
+     * collaborator discovered by {@code leadScan} after startup becomes deliverable without a restart.
      */
-    static Predicate<String> deliverableTo(MemberPresence presence, Supplier<Map<String, String>> leads) {
-        return target -> presence.isPresent(target) || leads.get().containsKey(target);
+    static Predicate<String> deliverableTo(MemberPresence presence, Supplier<Map<String, String>> leads,
+            Supplier<Map<String, String>> collaborators) {
+        return target -> presence.isPresent(target) || leads.get().containsKey(target)
+                || collaborators.get().containsKey(target);
     }
 
     /**
@@ -1075,7 +1078,33 @@ public final class Fleetd {
      */
     static FleetMcp.LeadConfigDirSource leadConfigDirSource(Supplier<Map<String, FleetConfig.Profile>> profiles,
             Map<String, FleetConfig.Leader> leaders) {
-        return new FleetMcp.LeadConfigDirSource(leadConfigDirLookup(profiles, leaders));
+        return new FleetMcp.LeadConfigDirSource(leadConfigDirLookup(profiles, leaders),
+                leadContextWindowLookup(profiles, leaders));
+    }
+
+    /**
+     * Per-lead-name factory for the effective auto-compact window {@link LeadContextGauge} scales
+     * its HIGH threshold against — the same {@code fleet.leaders.<name>.profile} link {@link
+     * #leadConfigDirLookup} already follows, one step further to that profile's own {@link
+     * FleetConfig.Profile#effectiveAutoCompactWindow()}. A lead entry that names no
+     * {@code profile:}, or whose named profile is not configured, or whose profile resolves no
+     * window at all, returns {@code null} — {@link LeadContextGauge} then falls back to its own
+     * fixed HIGH threshold.
+     */
+    static Function<String, Long> leadContextWindowLookup(Supplier<Map<String, FleetConfig.Profile>> profiles,
+            Map<String, FleetConfig.Leader> leaders) {
+        return leadName -> {
+            FleetConfig.Leader lead = leaders.get(leadName);
+            if (lead == null || lead.profile() == null || lead.profile().isBlank()) {
+                return null;
+            }
+            FleetConfig.Profile leadProfile = profiles.get().get(lead.profile());
+            if (leadProfile == null) {
+                return null;
+            }
+            Integer window = leadProfile.effectiveAutoCompactWindow();
+            return window == null ? null : window.longValue();
+        };
     }
 
     /**
@@ -1097,22 +1126,30 @@ public final class Fleetd {
      * @param liveLeadTerminals     terminal id → lead name for every CURRENTLY recognised lead
      * @param configDirForLeadName  lead name → {@code configDir}, normally {@link
      *                              #leadConfigDirLookup}'s return
+     * @param windowForLeadName     lead name → that lead's profile's effective auto-compact window,
+     *                              normally {@link #leadContextWindowLookup}'s return, and passed
+     *                              through to {@link LeadContextGauge#read} so the heartbeat's own
+     *                              HIGH reading scales with that lead's real window, or {@code null}
+     *                              when it cannot be resolved — either way {@link LeadContextGauge}
+     *                              falls back to its own fixed HIGH threshold
      */
     static Function<String, LeadContextGauge.Reading> leadContextLookup(LeadContextGauge gauge, AgentControl agents,
-            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName) {
+            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName,
+            Function<String, Long> windowForLeadName) {
         return terminal -> {
             String leadName = liveLeadTerminals.get().get(terminal);
             if (leadName == null) {
                 return LeadContextGauge.Reading.unknown();
             }
             String configDir = configDirForLeadName.apply(leadName);
+            Long effectiveWindow = windowForLeadName.apply(leadName);
             Agent live;
             try {
                 live = agents.get(terminal);
             } catch (RuntimeException e) {
                 return LeadContextGauge.Reading.unknown();
             }
-            return gauge.read(configDir, live.sessionId(), live.agentType());
+            return gauge.read(configDir, live.sessionId(), live.agentType(), effectiveWindow);
         };
     }
 
@@ -1124,9 +1161,10 @@ public final class Fleetd {
      * (see {@code FleetdLeadConfigDirSourceWiringTest}'s javadoc for the measured gap this shape closes).
      */
     static LeadHeartbeatLoop.LeadContextSource leadContextSource(LeadContextGauge gauge, AgentControl agents,
-            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName) {
+            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName,
+            Function<String, Long> windowForLeadName) {
         return new LeadHeartbeatLoop.LeadContextSource(
-                leadContextLookup(gauge, agents, liveLeadTerminals, configDirForLeadName));
+                leadContextLookup(gauge, agents, liveLeadTerminals, configDirForLeadName, windowForLeadName));
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/FleetdAssembly.java

@@ -43,6 +43,7 @@ import dev.ltms.fleet.msg.MessageService;
 import dev.ltms.fleet.msg.Rendezvous;
 import dev.ltms.fleet.msg.ReplyInbox;
 import dev.ltms.fleet.msg.ReplyPushLoop;
+import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerLauncher;
 import dev.ltms.fleet.placement.BackendOutagePolicy;
 import dev.ltms.fleet.placement.BackendQuarantine;
@@ -50,6 +51,7 @@ import dev.ltms.fleet.power.CaffeinateSleepAssertionMechanism;
 import dev.ltms.fleet.power.IdleSleepGuard;
 import dev.ltms.fleet.rest.FleetApp;
 import dev.ltms.fleet.session.GitWorktrees;
+import dev.ltms.fleet.session.MemberSession;
 import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.session.SessionReaper;
 import io.javalin.Javalin;
@@ -141,8 +143,12 @@ final class FleetdAssembly {
                 ? ports.connectHerdr(Path.of(cfg.memberHerdrSocket()))
                 : herdr;
         AtomicReference<Supplier<Map<String, String>>> leadsRef = new AtomicReference<>(Map::of);
+        // fleetd #669 Unit E: a collaborator's pane is opened by a person, exactly like a lead's,
+        // so its terminal must also route to the lead herdr daemon rather than the member one.
+        AtomicReference<Supplier<Map<String, String>>> collaboratorTerminalsRef = new AtomicReference<>(Map::of);
         HerdrRouter router = new HerdrRouter(herdr, memberHerdr,
-                target -> leadsRef.get().get().containsKey(target));
+                target -> leadsRef.get().get().containsKey(target)
+                        || collaboratorTerminalsRef.get().get().containsKey(target));
         // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
         // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
         // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
@@ -250,26 +256,47 @@ final class FleetdAssembly {
             log.info("leads: {} panes recognised {}", leadTerminals.size(), leadTerminals.values());
         }
         // CB-531/CB-579: discover leads by the tab labels the operator writes, one scanner per
-        // configured lead's own exact `tab:` label.
+        // configured lead's own exact `tab:` label. fleetd #669: the same scan also recognises a
+        // configured collaborator's tab, so one herdr pass answers both.
         final Supplier<Map<String, String>> leads;
+        final Supplier<Map<String, String>> collaboratorTerminals;
         var leaders = cfg.fleet().leaders();
-        if (!leaders.isEmpty()) {
+        var collaboratorsConfig = cfg.fleet().collaborators();
+        if (!leaders.isEmpty() || !collaboratorsConfig.isEmpty()) {
             Map<String, String> tabToName = new LinkedHashMap<>();
             leaders.forEach((name, leader) -> {
                 if (leader != null && leader.tab() != null && !leader.tab().isBlank()) {
                     tabToName.put(leader.tab(), name);
                 }
             });
-            int scanIntervalSeconds = leaders.values().iterator().next().scanIntervalSeconds();
+            Map<String, String> collaboratorTabToName = new LinkedHashMap<>();
+            collaboratorsConfig.forEach((name, collaborator) -> {
+                if (collaborator != null && collaborator.tab() != null && !collaborator.tab().isBlank()) {
+                    collaboratorTabToName.put(collaborator.tab(), name);
+                }
+            });
+            // A collaborator-only fleet configures no `leaders:` entry to read a scan interval from
+            // — FleetConfig.Collaborator carries no scanIntervalSeconds of its own. Falling back to
+            // FleetConfig.Leader's own compact-constructor default keeps a collaborator-only
+            // deployment on the same rescan cadence as the default lead cadence, instead of
+            // inventing a second number for the same kind of scan.
+            int scanIntervalSeconds = leaders.isEmpty()
+                    ? 10
+                    : leaders.values().iterator().next().scanIntervalSeconds();
             // This must use the lead daemon: scanning member tabs would demote the lead to a worker.
-            leads = new LeadTabScanner(herdr, tabToName, Set.of(),
+            LeadTabScanner scanner = new LeadTabScanner(herdr, tabToName, collaboratorTabToName, Set.of(),
                     TimeUnit.SECONDS.toNanos(scanIntervalSeconds), ports.nanoClock());
-            log.info("lead scan: tabs {} host a lead (rescan every {}s, shared fleet space)",
-                    tabToName.keySet(), scanIntervalSeconds);
+            leads = scanner;
+            collaboratorTerminals = scanner::collaborators;
+            log.info("lead/collaborator scan: tabs {} host a lead, tabs {} host a collaborator "
+                            + "(rescan every {}s, shared fleet space)",
+                    tabToName.keySet(), collaboratorTabToName.keySet(), scanIntervalSeconds);
         } else {
             leads = () -> leadTerminals;
+            collaboratorTerminals = Map::of;
         }
         leadsRef.set(leads);
+        collaboratorTerminalsRef.set(collaboratorTerminals);
 
         // CB-558: start any declared lead that is not already running. After the scanner is built,
         // and only when herdr answered — the launcher's whole safety property is that it can count
@@ -341,7 +368,7 @@ final class FleetdAssembly {
         // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
         MemberPresence presence = sessions.asPresence();
         TurnListener turnListener = Fleetd.turnListener(completion, sessions);
-        Predicate<String> deliverable = Fleetd.deliverableTo(presence, leads);
+        Predicate<String> deliverable = Fleetd.deliverableTo(presence, leads, collaboratorTerminals);
         // fleetd #556: registration is wired directly to `completion`, not folded into the
         // `turnListener` fan-out above — so it survives `sessions.onDelivered` (or any future
         // listener) throwing, regardless of call order.
@@ -405,7 +432,8 @@ final class FleetdAssembly {
                     TimeUnit.SECONDS.toNanos(hb.idleAfterSeconds()), hb.backoffMs(), hb.quietNudgeCap(),
                     metrics,
                     Fleetd.leadContextSource(leadContextGauge, router.leadAgents(), leads,
-                            Fleetd.leadConfigDirLookup(() -> config.get().profiles(), leaders)),
+                            Fleetd.leadConfigDirLookup(() -> config.get().profiles(), leaders),
+                            Fleetd.leadContextWindowLookup(() -> config.get().profiles(), leaders)),
                     Boolean.TRUE.equals(hb.contextHighNudge()), requireOperatorConfirm);
             heartbeat.start();
         } else {
@@ -451,6 +479,15 @@ final class FleetdAssembly {
         ConnectionIdentity identity = new ConnectionIdentity(
                 new PaneLocator(herdr, memberHerdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
 
+        // fleetd #669 Unit D: a live spawned member resolves as its own role, whatever a tab map
+        // says about the same terminal — read from the roster meant for a hot path (SessionManager
+        // javadoc), never rosterResolved(), since resolve() runs on every request.
+        Function<String, MemberRole> spawnedMemberRole = terminal -> sessions.roster().stream()
+                .filter(s -> terminal.equals(s.terminalId()))
+                .map(MemberSession::role)
+                .findFirst()
+                .orElse(null);
+
         // CB-501: one resolver behind both entry paths. Worker identity still comes from the
         // connection and is never token-gated, so enabling token mode cannot lock the fleet out.
         final CallerResolver callers;
@@ -460,11 +497,13 @@ final class FleetdAssembly {
                 throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
                         + " is unset or empty — export it before starting fleetd");
             }
-            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
+            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members,
+                    spawnedMemberRole, collaboratorTerminals);
             log.info("auth: token mode (bearer required for non-worker callers, env {})",
                     cfg.auth().tokenEnv());
         } else {
-            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members);
+            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members,
+                    spawnedMemberRole, collaboratorTerminals);
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 

fleetd/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -1,5 +1,7 @@
 package dev.ltms.fleet.auth;
 
+import java.util.function.Predicate;
+
 /**
  * The authorization table (CB-505), stated once and enforced on both entry paths.
  *
@@ -20,16 +22,22 @@ public final class Authz {
         SPAWN,
         /** Tear a worker peer down. */
         STOP,
-        /** Deliver a turn to a session (or answer a worker's question). */
+        /** Deliver a turn to a local session, addressed by {@code sessionId}. */
         SEND,
+        /** Resolve a worker's blocked question and resume its turn, addressed by {@code turnId}. */
+        ANSWER,
+        /** Address a peer lead on another daemon over the coordination broker, by {@code coordId}. */
+        COORD_SEND,
         /** A worker's terminal reply for its own turn. */
         REPLY,
         /** A worker's mid-turn question to the primary. */
         ASK,
         /** Collect held replies from a session's inbox. */
         DRAIN,
-        /** Read-only observation: status, roster, profiles, task polling. */
+        /** Read-only roster, profile, and identity observation: no ticket, task, or turn state. */
         READ,
+        /** Poll a ticket, or read a session's status. */
+        TASK_READ,
         /**
          * Read (never ack) this daemon's own held lead-to-lead coordination mail (fleetd #421).
          *
@@ -54,43 +62,92 @@ public final class Authz {
     }
 
     /**
-     * Whether {@code caller} may perform {@code action} against {@code targetSession}.
-     *
-     * @param targetSession the session id in the request path; only consulted for the worker-scoped
-     *                      actions ({@code REPLY}, {@code ASK}), ignored otherwise, may be
-     *                      {@code null}
+     * The fail-closed classifier: answers no for every target, so a collaborator's {@code SEND}
+     * is refused unless a caller supplies a real one. {@code CallerResolver#knownLeadOrCollaborator()}
+     * is the real one, read from the same lead and collaborator maps {@code CallerResolver#resolve}
+     * consults, so a target that classifier calls known is one {@code resolve} would actually
+     * resolve as a lead or collaborator.
+     */
+    public static final Predicate<String> NO_KNOWN_LEAD_OR_COLLABORATOR = target -> false;
+
+    /**
+     * Convenience form for a caller with no classifier to supply. Fails closed: a collaborator's
+     * {@code SEND} is refused, as if no terminal were a configured lead or collaborator — the
+     * same decision {@link #NO_KNOWN_LEAD_OR_COLLABORATOR} gives explicitly. Every other action's
+     * result is identical to the four-argument form's, since none of them consult the classifier.
      */
     public static boolean permits(Principal caller, Action action, String targetSession) {
+        return permits(caller, action, targetSession, NO_KNOWN_LEAD_OR_COLLABORATOR);
+    }
+
+    /**
+     * Whether {@code caller} may perform {@code action} against {@code targetSession}.
+     *
+     * @param targetSession           the session id in the request path; only consulted for the
+     *                                worker-scoped actions ({@code REPLY}, {@code ASK}) and for a
+     *                                collaborator's {@code SEND}, ignored otherwise, may be
+     *                                {@code null}
+     * @param knownLeadOrCollaborator whether a terminal is a configured lead or collaborator —
+     *                                consulted only for a collaborator's {@code SEND}, to confine
+     *                                it to another named peer and never a spawned member's
+     *                                terminal
+     */
+    public static boolean permits(Principal caller, Action action, String targetSession,
+                                   Predicate<String> knownLeadOrCollaborator) {
         if (caller == null || caller.isAnonymous()) {
             return false; // authenticated as nothing ⇒ authorized for nothing
         }
         return switch (action) {
-            // Fleet lifecycle is the primary's alone — spawn, stop, drain. An architect
-            // deliberately does NOT get these (CB-548), so it cannot tear down or stand up workers
-            // even though it coordinates them; and a worker driving any of these would be a worker
-            // escalating into the orchestrator role.
+            // Fleet lifecycle is the primary's alone — spawn, stop, drain. An architect and a
+            // collaborator deliberately do NOT get these, so neither can tear down or stand up
+            // workers even though one of them coordinates them; and a worker driving any of these
+            // would be a worker escalating into the orchestrator role.
             case SPAWN, STOP, DRAIN, HANDOVER -> caller.isPrimary();
 
-            // Delivering a turn is open to the primary and the architect: an architect delegates
-            // to workers (that is the role's point) but still has no lifecycle rights. A worker is
-            // excluded — sending would be it escalating.
-            case SEND -> caller.isPrimary() || caller.isArchitect();
+            // Delivering a turn to a local session is open to the primary, the architect, and a
+            // collaborator whose target is itself a configured lead or collaborator: the architect
+            // delegates to workers (that is the role's point); a collaborator may reach only
+            // another named peer, never a spawned member's terminal. A worker is excluded —
+            // sending would be it escalating.
+            case SEND -> caller.isPrimary() || caller.isArchitect()
+                    || (caller.isCollaborator() && knownLeadOrCollaborator.test(targetSession));
+
+            // Resolving a worker's blocked question is part of delegating to it, open to the same
+            // two roles that may stand up that delegation in the first place. Not a collaborator:
+            // resuming another session's turn is lifecycle-adjacent, not peer messaging.
+            case ANSWER -> caller.isPrimary() || caller.isArchitect();
+
+            // Leaves the daemon over the coordination broker rather than addressing a local
+            // session, open to the same two roles as ANSWER. Not a collaborator: it is a
+            // local-tab peer with no cross-host route.
+            case COORD_SEND -> caller.isPrimary() || caller.isArchitect();
 
             // The load-bearing rule: a caller acts only as the pane it occupies. CB-532 widened who
             // that can be — a lead answering another lead is replying for its OWN terminal, which
             // this already permits — while the rule itself is unchanged, and is what stops anyone
-            // forging a reply for a rendezvous someone else is waiting on. An architect's own pane
-            // passes through the same check, so it can answer a funnel that delegated to it. An
-            // unnamed primary (token/loopback, no pane) owns nothing and is still excluded.
+            // forging a reply for a rendezvous someone else is waiting on. An architect's or a
+            // collaborator's own pane passes through the same check, so each can answer a funnel
+            // that delegated to it. An unnamed primary (token/loopback, no pane) owns nothing and
+            // is still excluded.
             case REPLY, ASK -> caller.ownsSession(targetSession);
 
-            // Observation is open to every authenticated role: a worker legitimately polls its own
-            // status, and the roster carries no secrets.
-            case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
+            // READ is roster, profile, and identity observation — fleet_list, fleet_profiles, and
+            // fleet_whoami — and carries no secrets: no ticket reply, no pending question, and no
+            // other session's turn state. Those live under TASK_READ. METRICS is the separate
+            // Prometheus scrape. Both are open to every authenticated role, including a
+            // collaborator.
+            case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect()
+                    || caller.isCollaborator();
+
+            // Ticket polling and session status, open to every role READ is open to except a
+            // collaborator: ticket ids are a sequential counter with no owner check, so a holder
+            // could walk every ticket and read another session's delegation reply.
+            case TASK_READ -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
 
             // fleetd #421: reading held lead-to-lead mail is the primary's alone. An architect
             // holds READ today (CB-548), so "not primary" must mean not-architect here too — this
-            // is coordination between leads, not observation of the roster.
+            // is coordination between leads, not observation of the roster. The same reasoning
+            // excludes a collaborator.
             case COORD_READ -> caller.isPrimary();
         };
     }

fleetd/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -7,6 +7,7 @@ import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.util.Map;
 import java.util.function.Function;
+import java.util.function.Predicate;
 import java.util.function.Supplier;
 
 /**
@@ -19,6 +20,13 @@ import java.util.function.Supplier;
  *
  * <p><strong>Resolution order</strong> — connection identity first, token second, nothing third:
  * <ol>
+ *   <li>A loopback peer PID that maps to a pane this gateway itself spawned ⇒ that member's own
+ *       role: {@link Role#WORKER} for a dev, hunter, or reviewer; {@link Role#ARCHITECT} for an
+ *       architect, but only while the live slot role still confirms it (fleetd #424 — a slot
+ *       revoked from config demotes an already-bound session on its very next request, so the
+ *       roster's own role is never granted on its word alone). No tab map is consulted — a live
+ *       spawned member's identity comes from the registry that spawned it, never from a label a
+ *       pane could also carry.</li>
  *   <li>A loopback peer PID that maps to a pane named by {@code leaders:}, by the legacy
  *       {@code primary.terminal} pin, or by an operator-labelled lead tab (CB-307, CB-530, CB-531)
  *       ⇒ {@link Role#PRIMARY}, carrying that lead's
@@ -28,8 +36,10 @@ import java.util.function.Supplier;
  *       so two leads can work as peers rather than one being demoted.</li>
  *   <li>A loopback peer PID that maps to a pane bound to a CB-548 architect slot ⇒
  *       {@link Role#ARCHITECT}, carrying the slot name. Just unforgeable as a worker's, and
- *       resolved from the <em>live</em> terminal→slot binding (never a request argument), before
- *       the generic worker fallback.</li>
+ *       resolved from the <em>live</em> terminal→slot binding (never a request argument). This is
+ *       the case the previous step does not catch: a binding with no live spawned-member session.</li>
+ *   <li>A loopback peer PID that maps to an operator-labelled collaborator tab ⇒
+ *       {@link Role#COLLABORATOR}, carrying that collaborator's name.</li>
  *   <li>A loopback peer PID that maps to any other herdr pane ⇒ {@link Role#WORKER}. This is
  *       unforgeable (the OS reports the PID, herdr owns the PID→pane map) and is honoured
  *       regardless of auth mode, so enabling auth never breaks the fleet.</li>
@@ -64,6 +74,20 @@ public final class CallerResolver {
     private final Supplier<Map<String, String>> architectTerminals;
     private final Function<String, MemberRole> memberSlotRoles;
     private final Function<String, String> memberSlotNames;
+    /**
+     * terminal_id → the role of the live spawned member occupying it, or {@code null} for a
+     * terminal no spawned member occupies. Consulted first, ahead of every tab map: a live
+     * spawned member's identity is its own, whatever a tab map says about the same terminal.
+     * A function rather than the roster itself, so a resolve on the hot path never scans a list —
+     * the lookup strategy is the caller's to choose.
+     */
+    private final Function<String, MemberRole> spawnedMemberRole;
+    /**
+     * terminal_id → collaborator name; empty when none are configured. A supplier for the same
+     * reason as {@link #leadTerminals}: a collaborator tab recognised after construction (the tab
+     * scan discovering a newly-labelled tab) takes effect without a restart.
+     */
+    private final Supplier<Map<String, String>> collaboratorTerminals;
 
     /** Loopback-trust resolver: no token required, historical behaviour. Test-only. */
     CallerResolver(ConnectionIdentity identity) {
@@ -124,17 +148,42 @@ public final class CallerResolver {
     /**
      * Live registry form that can confirm a bound slot is an architect slot.
      *
-     * <p>This is the only public construction path. It keeps terminal bindings and slot roles in
-     * the same {@link MemberRegistry}, so a configured architect can resolve as an architect.
+     * <p>It keeps terminal bindings and slot roles in the same {@link MemberRegistry}, so a
+     * configured architect can resolve as an architect. No spawned-member roster or collaborator
+     * registry is consulted — equivalent to {@link #withLeadsAndMembers(ConnectionIdentity,
+     * boolean, String, Supplier, MemberRegistry, Function, Supplier)} with both absent. Kept for
+     * every caller that has neither to offer, so adding them did not churn every construction site.
      */
     public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
                                                        boolean tokenMode, String token,
                                                        Supplier<Map<String, String>> leadTerminals,
                                                        MemberRegistry members) {
+        return withLeadsAndMembers(identity, tokenMode, token, leadTerminals, members, null, null);
+    }
+
+    /**
+     * Live registry form that also resolves a live spawned member to its own role, and a
+     * configured collaborator tab to {@link Role#COLLABORATOR}.
+     *
+     * <p>This is the only public construction path that exercises the full resolution order.
+     *
+     * @param spawnedMemberRole      terminal_id → the role of the live spawned member occupying
+     *                               it, or {@code null} for a terminal no spawned member occupies.
+     *                               {@code null} here means no roster is consulted at all (every
+     *                               terminal falls through to the tab maps), not that none matches.
+     * @param collaboratorTerminals  terminal_id → collaborator name, live like {@code leadTerminals}
+     */
+    public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
+                                                       boolean tokenMode, String token,
+                                                       Supplier<Map<String, String>> leadTerminals,
+                                                       MemberRegistry members,
+                                                       Function<String, MemberRole> spawnedMemberRole,
+                                                       Supplier<Map<String, String>> collaboratorTerminals) {
         return new CallerResolver(identity, tokenMode, token, leadTerminals,
                 members == null ? null : members::snapshot,
                 members == null ? null : members::roleForSlot,
-                members == null ? null : members::nameForSlot);
+                members == null ? null : members::nameForSlot,
+                spawnedMemberRole, collaboratorTerminals);
     }
 
     private static Supplier<Map<String, String>> fixed(Map<String, String> leadTerminals) {
@@ -160,6 +209,17 @@ public final class CallerResolver {
                            Supplier<Map<String, String>> architectTerminals,
                            Function<String, MemberRole> memberSlotRoles,
                            Function<String, String> memberSlotNames) {
+        this(identity, tokenMode, token, leadTerminals, architectTerminals, memberSlotRoles,
+                memberSlotNames, null, null);
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals,
+                           Function<String, MemberRole> memberSlotRoles,
+                           Function<String, String> memberSlotNames,
+                           Function<String, MemberRole> spawnedMemberRole,
+                           Supplier<Map<String, String>> collaboratorTerminals) {
         if (tokenMode && (token == null || token.isBlank())) {
             throw new IllegalArgumentException(
                     "auth.mode=token requires a non-empty token; check that the env var named by "
@@ -172,6 +232,8 @@ public final class CallerResolver {
         this.architectTerminals = architectTerminals == null ? Map::of : architectTerminals;
         this.memberSlotRoles = memberSlotRoles == null ? _ -> null : memberSlotRoles;
         this.memberSlotNames = memberSlotNames == null ? Function.identity() : memberSlotNames;
+        this.spawnedMemberRole = spawnedMemberRole == null ? _ -> null : spawnedMemberRole;
+        this.collaboratorTerminals = collaboratorTerminals == null ? Map::of : collaboratorTerminals;
     }
 
     /**
@@ -188,14 +250,24 @@ public final class CallerResolver {
     }
 
     /**
-     * The currently-recognised architect slots, {@code terminal_id → slot name} (CB-548).
+     * The currently-recognised collaborator tabs, {@code terminal_id → name}.
      *
-     * <p>Read from the same supplier {@link #resolve} consults, so a slot that is <em>listed</em>
-     * here but would not <em>resolve</em> (or the reverse) cannot drift apart. Live for the same
-     * reason as {@link #leads()}.
+     * <p>Read from the same supplier {@link #resolve} consults, for the reason given in
+     * {@link #leads()}. Live for the same reason as {@link #leads()}.
      */
-    public Map<String, String> members() {
-        return architectTerminals.get();
+    public Map<String, String> collaborators() {
+        return collaboratorTerminals.get();
+    }
+
+    /**
+     * Whether {@code target} names a terminal this resolver would resolve as a lead or a
+     * collaborator — the classifier a collaborator's {@code SEND} is checked against, read from the
+     * exact maps {@link #resolve} consults so a target that would resolve as a lead or collaborator
+     * is never the one a collaborator is refused to reach, or the reverse.
+     */
+    public Predicate<String> knownLeadOrCollaborator() {
+        return target -> leadTerminals.get().containsKey(target)
+                || collaboratorTerminals.get().containsKey(target);
     }
 
     /**
@@ -208,6 +280,25 @@ public final class CallerResolver {
     public Principal resolve(String remoteAddr, int remotePort, String authorizationHeader) {
         ConnectionIdentity.Caller c = identity.resolve(remoteAddr, remotePort);
         if (c.terminal() != null) {
+            MemberRole spawnedRole = spawnedMemberRole.apply(c.terminal());
+            if (spawnedRole != null) {
+                // A live spawned member occupies this pane. Its identity is its own, whatever a tab
+                // map says about the same terminal — checked before every tab map, consulting none
+                // of them, so a tab label can never override a roster entry for the same terminal.
+                if (spawnedRole == MemberRole.ARCHITECT) {
+                    // The roster only answers THAT this pane is a live spawned member; config still
+                    // decides WHAT that member's slot grants (fleetd #424). A slot revoked after the
+                    // bind must still demote this session on its very next request, so the roster's
+                    // own ARCHITECT role is confirmed against the live slot role, exactly as the
+                    // architect-slot step below confirms a binding with no live member session.
+                    String slot = architectTerminals.get().get(c.terminal());
+                    if (slot != null && memberSlotRoles.apply(slot) == MemberRole.ARCHITECT) {
+                        return Principal.architect(memberSlotNames.apply(slot), c.terminal(), c.pid());
+                    }
+                    return Principal.worker(c.terminal(), c.pid());
+                }
+                return Principal.worker(c.terminal(), c.pid());
+            }
             String lead = leadTerminals.get().get(c.terminal());
             if (lead != null) {
                 // The config names this pane as a lead's own. The pane mapping is exactly as
@@ -221,10 +312,17 @@ public final class CallerResolver {
                 // The config/live binding names this pane as an architect slot's own. Same
                 // unforgeable pane mapping; the live binding, never a request argument, decides.
                 // Check the slot role too: this defence in depth prevents a bad lifecycle bind from
-                // escalating a dev, hunter or reviewer into an architect. Checked before
-                // the worker fallback.
+                // escalating a dev, hunter or reviewer into an architect. This is the case the
+                // spawned-member step above does not catch: a binding with no live member session.
                 return Principal.architect(memberSlotNames.apply(slot), c.terminal(), c.pid());
             }
+            String collaborator = collaboratorTerminals.get().get(c.terminal());
+            if (collaborator != null) {
+                // An operator-labelled collaborator tab, confirmed live by the same scan that
+                // confirms a lead tab. Checked last among the tab maps so a pane also matching one
+                // of the above keeps that stronger role.
+                return Principal.collaborator(collaborator, c.terminal(), c.pid());
+            }
             return Principal.worker(c.terminal(), c.pid()); // unforgeable; never token-gated
         }
 

fleetd/src/main/java/dev/ltms/fleet/auth/Principal.java

@@ -11,7 +11,9 @@ package dev.ltms.fleet.auth;
  * @param pid      the connecting process id, or {@code -1} when not resolvable (audit context)
  * @param name     for a lead resolved from the CB-530 {@code leaders:} registry, which lead it is;
  *                 for an architect resolved from the CB-548 {@code architects:} registry, which
- *                 slot it occupies; {@code null} for every other caller, including an unnamed primary
+ *                 slot it occupies; for a collaborator resolved from the {@code collaborators:}
+ *                 registry, which collaborator it is; {@code null} for every other caller,
+ *                 including an unnamed primary
  */
 public record Principal(Role role, String terminal, long pid, String name) {
 
@@ -73,6 +75,19 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return new Principal(Role.ARCHITECT, terminal, pid, slotName);
     }
 
+    /**
+     * A collaborator: a human-opened tab recognised by its exact label in the
+     * {@code collaborators:} registry.
+     *
+     * <p>Carries {@link Role#COLLABORATOR}. {@code name} is reporting only — it lets
+     * {@code fleet_whoami} say which collaborator is asking. Identity is the {@code terminal}:
+     * like a worker's it comes from the connection, so {@code ownsSession} works exactly as it
+     * does for a worker — a collaborator acts as its own pane and no other.
+     */
+    public static Principal collaborator(String name, String terminal, long pid) {
+        return new Principal(Role.COLLABORATOR, terminal, pid, name);
+    }
+
     public boolean isPrimary() {
         return role == Role.PRIMARY;
     }
@@ -81,6 +96,10 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return role == Role.ARCHITECT;
     }
 
+    public boolean isCollaborator() {
+        return role == Role.COLLABORATOR;
+    }
+
     public boolean isWorker() {
         return role == Role.WORKER;
     }
@@ -120,6 +139,7 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return switch (role) {
             case WORKER -> "worker:" + terminal;
             case ARCHITECT -> "architect:" + name;
+            case COLLABORATOR -> "collaborator:" + name;
             case PRIMARY -> name == null ? "primary" : "leader:" + name;
             case ANONYMOUS -> "anonymous";
         };

fleetd/src/main/java/dev/ltms/fleet/auth/Role.java

@@ -34,6 +34,17 @@ public enum Role {
      */
     ARCHITECT,
 
+    /**
+     * A config-declared, human-opened tab recognised by its exact label (the {@code
+     * fleet.collaborators.<name>.tab} registry). Never spawned — identity comes from the
+     * connection, never a request argument, exactly like {@link #WORKER} and {@link #ARCHITECT}.
+     * May {@code SEND} only to a configured lead or collaborator, {@code REPLY}/{@code ASK} only
+     * as its own pane, and {@code READ}/{@code METRICS}; may not {@code SPAWN}/{@code STOP}/
+     * {@code DRAIN}/{@code HANDOVER}, poll a ticket ({@code TASK_READ}), or reach the
+     * coordination broker ({@code COORD_SEND}/{@code COORD_READ}).
+     */
+    COLLABORATOR,
+
     /** Authenticated as nothing. Authorized for nothing but {@code /healthz}. */
     ANONYMOUS
 }

fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -615,7 +615,7 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         // may bind to, AND what a slot already bound still grants) through its own instance of that
         // same supplier shape — see MemberRegistry.live and its class doc for the binding rule:
         // removing a slot revokes ARCHITECT on the bound pane's very next request, and only the slot
-        // OCCUPANCY survives, so the demoted session keeps its slot key until it unbinds. Only
+        // OCCUPANCY survives, so the demoted session keeps its slot key until it unbinds.
         // fleet.leaders is frozen (Fleetd.java:281 reads cfg.fleet().leaders() off the startup
         // snapshot to build both the LeadTabScanner's tab-label-to-name map, wired into
         // CallerResolver.withLeadsAndMembers at Fleetd.java:620/624, and — when herdr answered —
@@ -635,6 +635,11 @@ public final class ConfigRef implements Supplier<FleetConfig> {
                     + "live through that same supplier for placement AND through a separate supplier "
                     + "on MemberRegistry for spawn-time identity — both already applied");
         }
+        if (!Objects.equals(collaboratorsOf(old), collaboratorsOf(fresh))) {
+            changed.add("fleet: fleet.collaborators (each collaborator's tab) is read once at "
+                    + "startup to build the LeadTabScanner's identity map, which is not rebuilt on "
+                    + "reload, so a collaborator added, removed, or given a new tab: needs a restart");
+        }
         // Kept in step with SPLIT_KEYS the same way changedColdKeys is kept in step with COLD_KEYS —
         // every message here must be traceable to one of the split keys the class doc documents.
         // NOTE what this does NOT prove, per the javadoc above: it does not catch a SPLIT_KEYS
@@ -650,6 +655,11 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         return cfg.fleet() == null ? Map.of() : cfg.fleet().leaders();
     }
 
+    /** {@code cfg.fleet().collaborators()}, defensively, in case a caller hands in a non-defaulted config. */
+    private static Map<String, FleetConfig.Collaborator> collaboratorsOf(FleetConfig cfg) {
+        return cfg.fleet() == null ? Map.of() : cfg.fleet().collaborators();
+    }
+
     /**
      * {@link FleetConfig.Profile} record components deliberately left out of
      * {@link #sameLaunchSettings} because they are read <em>live</em>, not baked in at spawn — see

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -798,6 +798,25 @@ public record FleetConfig(
             return isSubscription() ? SUBSCRIPTION_CREDENTIAL_ID : profile;
         }
 
+        /**
+         * The auto-compaction window a launched Claude Code session actually runs on: {@code env:
+         * CLAUDE_CODE_AUTO_COMPACT_WINDOW} when it parses as an integer, since that environment
+         * variable wins over the {@code --autocompact} flag {@link #autoCompactWindow} produces (see
+         * {@code ClaudeCodeArguments}); {@link #autoCompactWindow} otherwise. {@code null} when
+         * neither resolves to a usable number.
+         */
+        public Integer effectiveAutoCompactWindow() {
+            String envValue = env.get(CLAUDE_CODE_AUTO_COMPACT_WINDOW_ENV);
+            if (envValue == null) {
+                return autoCompactWindow;
+            }
+            try {
+                return Integer.valueOf(envValue.trim());
+            } catch (NumberFormatException e) {
+                return autoCompactWindow;
+            }
+        }
+
         /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */
         public boolean hasGitToken() {
             return gitTokenEnv != null && !gitTokenEnv.isBlank();
@@ -1110,11 +1129,8 @@ public record FleetConfig(
      *                            {@code tab} can never be discovered, launched or not
      * @param instances           how many of this lead should be live (default 1). The daemon
      *                            launches only the shortfall, so a restart adopts rather than doubles
-     * @param tabPrefix           no longer used to find a lead's tab — {@code tab} is matched
-     *                            exactly. Its only remaining job is the startup collision guard
-     *                            ({@link #validateLeadTabPrefixes()}), which still uses it to refuse
-     *                            a worker {@code tabLabel} template that could be misread as a lead.
-     *                            Default {@code "lead:"}
+     * @param tabPrefix           lead-tab naming convention checked against member labels. Lead
+     *                            identity uses {@code tab}. Default {@code "lead:"}
      * @param scanIntervalSeconds how long a tab scan is cached before herdr is asked again; also the
      *                            worst case before a newly-labelled tab is recognised. Default 10
      * @param kind                which agent runs there ({@code claude}, {@code opencode}, …)
@@ -1160,6 +1176,25 @@ public record FleetConfig(
         }
     }
 
+    /**
+     * A tab fleetd recognises as a collaborator, keyed by name (fleetd #669).
+     *
+     * <p>Recognise-only: there is no {@code profile}, no {@code instances} and no {@code kind}.
+     * Nothing here ever launches a pane.
+     *
+     * <p>{@code tabPrefix} is absent. Identity is matched on the exact {@code tab} alone.
+     *
+     * @param tab the exact tab label hosting this collaborator, matched case-insensitively; the
+     *            only field identity depends on. Required — an entry with no {@code tab} can
+     *            never be discovered.
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record Collaborator(String tab) {
+        public Collaborator {
+            tab = (tab == null || tab.isBlank()) ? null : tab.strip();
+        }
+    }
+
     /**
      * One entry of a {@code fleet:} role pool — a role paired with the backend it runs on.
      *
@@ -1197,15 +1232,18 @@ public record FleetConfig(
      * is exactly compatible with that. The pool is also what replaced {@code defaultProfile:} — an
      * unqualified spawn names a role, and the role's pool supplies the candidates.
      *
-     * @param leaders     panes that orchestrate rather than are orchestrated, keyed by lead name
-     * @param architects  profiles the {@code architect} role may run on
-     * @param developers  profiles the {@code dev} role may run on
-     * @param hunters     profiles the {@code hunter} role may run on
-     * @param reviewers   profiles the {@code reviewer} role may run on
-     * @param charters    optional launch-charter text keyed by singular role wire name
-     * @param tabLabel    template for a member tab's label; {@code {role}}, {@code {profile}},
-     *                    {@code {model}} and {@code {n}} (a per role+profile counter) are
-     *                    substituted. Default {@link #DEFAULT_TAB_LABEL}
+     * @param leaders       panes that orchestrate rather than are orchestrated, keyed by lead name
+     * @param architects    profiles the {@code architect} role may run on
+     * @param developers    profiles the {@code dev} role may run on
+     * @param hunters       profiles the {@code hunter} role may run on
+     * @param reviewers     profiles the {@code reviewer} role may run on
+     * @param charters      optional launch-charter text keyed by singular role wire name
+     * @param tabLabel      template for a member tab's label; {@code {role}}, {@code {profile}},
+     *                      {@code {model}} and {@code {n}} (a per role+profile counter) are
+     *                      substituted. Default {@link #DEFAULT_TAB_LABEL}
+     * @param collaborators tabs fleetd recognises as collaborators (fleetd #669), keyed by name.
+     *                      Recognise-only, exactly like a {@code profile}-less {@link Leader}:
+     *                      nothing here is ever auto-launched.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
     public record Fleet(Map<String, Leader> leaders,
@@ -1214,13 +1252,11 @@ public record FleetConfig(
                         Map<String, Slot> hunters,
                         Map<String, Slot> reviewers,
                         Map<String, String> charters,
-                        String tabLabel) {
+                        String tabLabel,
+                        Map<String, Collaborator> collaborators) {
 
         /**
-         * Role first, so the tab bar reads as the fleet and so the label shares a namespace with a
-         * lead's {@code tabPrefix}. Because {@code {role}} comes from a closed enum, a generated
-         * member label can never begin with {@code "lead:"} — the clash that
-         * {@link #validateLeadTabPrefixes()} used to have to check for is unrepresentable here.
+         * Role first, so the tab bar identifies the member's fleet role.
          */
         public static final String DEFAULT_TAB_LABEL = "{role}: {profile} #{n}";
 
@@ -1232,26 +1268,30 @@ public record FleetConfig(
             reviewers = unmodifiableOrEmpty(reviewers);
             charters = unmodifiableOrEmpty(charters);
             tabLabel = (tabLabel == null || tabLabel.isBlank()) ? DEFAULT_TAB_LABEL : tabLabel;
+            collaborators = unmodifiableOrEmpty(collaborators);
         }
 
         /**
-         * A fleet with no configured launch charters — the shape every deployment had before
-         * CB-566, and what most tests want.
+         * A fleet with no configured launch charters and no collaborators — the shape every
+         * deployment had before CB-566, and what most tests want.
          *
          * <p>Kept deliberately, even though an overload that drops a new field is normally the
          * shape to avoid. It is safe here because nothing <em>reads</em> a charter through a
          * constructor: the launcher reads {@code fleet.charters()} from the live config. Jackson
          * binds the canonical constructor, so this one cannot swallow an operator's YAML.
+         * {@code collaborators} is dropped the same way and for the same reason: no caller of
+         * this overload has ever needed to set it, so it defaults to empty here exactly as the
+         * canonical constructor would default an absent YAML key.
          */
         public Fleet(Map<String, Leader> leaders, Map<String, Slot> architects,
                      Map<String, Slot> developers, Map<String, Slot> reviewers,
                      Map<String, String> charters, String tabLabel) {
-            this(leaders, architects, developers, null, reviewers, charters, tabLabel);
+            this(leaders, architects, developers, null, reviewers, charters, tabLabel, null);
         }
 
         public Fleet(Map<String, Leader> leaders, Map<String, Slot> architects,
                      Map<String, Slot> developers, Map<String, Slot> reviewers, String tabLabel) {
-            this(leaders, architects, developers, null, reviewers, null, tabLabel);
+            this(leaders, architects, developers, null, reviewers, null, tabLabel, null);
         }
 
         /**
@@ -1380,11 +1420,13 @@ public record FleetConfig(
      * called FROM the calling lead's own turn, so its pane is still {@code WORKING} the instant
      * {@code confirm()} validates every gate and schedules the roll. {@code
      * dev.ltms.fleet.lead.LeadRollover}'s deferred continuation waits up to this many seconds for
-     * that SAME pane to report an injectable state again — i.e. for the calling turn to actually
-     * end — before it sends {@code /clear} at all. If that wait times out, no {@code /clear} is
+     * that SAME pane to report {@code IDLE} or {@code DONE} — i.e. for the calling turn to actually
+     * end — before it sends {@code /clear} at all. {@code BLOCKED} does not count: that is a live
+     * turn merely paused, not one that has finished. If that wait times out, no {@code /clear} is
      * ever sent: a lead that never goes idle is still doing real work, and clearing it would
      * destroy live context. This is a separate wait from {@code clearSettleSeconds} below, which
-     * bounds the SECOND wait, for the pane to re-settle AFTER {@code /clear} has already gone out.
+     * bounds the SECOND wait, for the pane to reach {@code IDLE} or {@code DONE} again AFTER
+     * {@code /clear} has already gone out.
      *
      * @param handoverPath required when this block is present — where the handover file a fresh
      *                     lead session reads must live. There is no sane non-null default for an
@@ -1403,12 +1445,13 @@ public record FleetConfig(
      * @param maxDocAgeSeconds default 3600 — refuse a handover file whose modified time is older
      *                     than this many seconds, so a stale leftover from an earlier rollover
      *                     attempt can never be mistaken for a fresh one.
-     * @param turnSettleSeconds default 20 — bound on how long the deferred roll waits for the
-     *                     CALLING lead's own turn to end (its pane to report injectable again)
-     *                     before sending {@code /clear} at all. See the paragraph above.
+     * @param turnSettleSeconds default 300 — bound on how long the deferred roll waits for the
+     *                     CALLING lead's own turn to end (its pane to report {@code IDLE} or
+     *                     {@code DONE}) before sending {@code /clear} at all. See the paragraph
+     *                     above.
      * @param clearSettleSeconds default 20 — bound on how long to wait for the lead's pane to
-     *                     report an injectable state again after {@code /clear} before giving up. A
-     *                     roll that times out here never sends {@code bootstrapText}.
+     *                     report {@code IDLE} or {@code DONE} again after {@code /clear} before
+     *                     giving up. A roll that times out here never sends {@code bootstrapText}.
      * @param bootstrapText default a sentence naming the RESOLVED handover path — sent to the
      *                     lead's pane once it settles after {@code /clear}, telling the fresh
      *                     session where to read the handover and carry on. Left {@code null} here
@@ -1425,7 +1468,7 @@ public record FleetConfig(
         public LeadRollover {
             requireOperatorConfirm = requireOperatorConfirm == null || requireOperatorConfirm;
             maxDocAgeSeconds = (maxDocAgeSeconds == null || maxDocAgeSeconds <= 0) ? 3600 : maxDocAgeSeconds;
-            turnSettleSeconds = (turnSettleSeconds == null || turnSettleSeconds <= 0) ? 20 : turnSettleSeconds;
+            turnSettleSeconds = (turnSettleSeconds == null || turnSettleSeconds <= 0) ? 300 : turnSettleSeconds;
             clearSettleSeconds = (clearSettleSeconds == null || clearSettleSeconds <= 0) ? 20 : clearSettleSeconds;
             bootstrapText = (bootstrapText == null || bootstrapText.isBlank()) ? null : bootstrapText;
         }
@@ -1894,7 +1937,7 @@ public record FleetConfig(
 
     /** The {@code fleet:} child blocks whose direct children are slot names. */
     private static final Set<String> FLEET_POOL_KEYS =
-            Set.of("leaders", "architects", "developers", "hunters", "reviewers");
+            Set.of("leaders", "architects", "developers", "hunters", "reviewers", "collaborators");
 
     /**
      * Reject a {@code fleet:} role pool whose slot names repeat (CB-548, re-homed by CB-557).
@@ -1904,7 +1947,7 @@ public record FleetConfig(
      * daemon would never know. Jackson's YAML parser does not fail on duplicate mapping keys by
      * default, so duplicates are caught here, at parse time, before the map is built.
      *
-     * <p>Only the five pools <em>directly under the top-level {@code fleet:}</em> are considered,
+     * <p>Only the six pools <em>directly under the top-level {@code fleet:}</em> are considered,
      * and only their direct child keys (the slot names). A nested field elsewhere, even one also
      * named {@code developers:}, is ignored, so parsing of the rest of the config is unaffected.
      *
@@ -2184,6 +2227,12 @@ public record FleetConfig(
     static final int AUTO_COMPACT_WINDOW_MIN = 100_000;
     /** Highest {@code autoCompactWindow} Claude Code's {@code --autocompact <tokens>} flag accepts. */
     static final int AUTO_COMPACT_WINDOW_MAX = 1_000_000;
+    /**
+     * The {@code env:} key a launched Claude Code session reads for its auto-compaction window,
+     * ahead of the {@code --autocompact} launch flag {@code autoCompactWindow} produces (see
+     * {@link Profile#effectiveAutoCompactWindow()}).
+     */
+    static final String CLAUDE_CODE_AUTO_COMPACT_WINDOW_ENV = "CLAUDE_CODE_AUTO_COMPACT_WINDOW";
 
     /**
      * Reject a profile whose {@code autoCompactWindow:} is set but outside the token band Claude
@@ -2265,13 +2314,13 @@ public record FleetConfig(
             if (!(entry.getValue() instanceof Map<?, ?> profile)
                     || !(profile.get("autoCompactWindow") instanceof Number window)
                     || !(profile.get("env") instanceof Map<?, ?> env)
-                    || !env.containsKey("CLAUDE_CODE_AUTO_COMPACT_WINDOW")) {
+                    || !env.containsKey(CLAUDE_CODE_AUTO_COMPACT_WINDOW_ENV)) {
                 continue;
             }
             Object kind = profile.get("kind");
             boolean claudeCode = kind == null || String.valueOf(kind).isBlank()
                     || Profile.KIND_CLAUDE_CODE.equalsIgnoreCase(String.valueOf(kind));
-            Object envValue = env.get("CLAUDE_CODE_AUTO_COMPACT_WINDOW");
+            Object envValue = env.get(CLAUDE_CODE_AUTO_COMPACT_WINDOW_ENV);
             if (claudeCode && !String.valueOf(window).equals(String.valueOf(envValue))) {
                 String name = String.valueOf(entry.getKey());
                 names.add(name);
@@ -2657,30 +2706,21 @@ public record FleetConfig(
     }
 
     /**
-     * Reject a lead-scan convention that a worker tab would also satisfy (CB-531).
+     * Reject a member tab-label template that could render as a configured lead or collaborator
+     * tab or match a lead-tab naming convention, and reject two {@code fleet.leaders} or
+     * {@code fleet.collaborators} entries — across either registry — that share one exact tab.
      *
-     * <p>The scan reads a tab label and concludes "a lead lives here". fleetd also <em>writes</em>
-     * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
-     * a member template matches and the daemon starts labelling its own members as leads, promoting
-     * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
-     * The member-space exclusion in {@link dev.ltms.fleet.herdr.LeadTabScanner} already blocks the
-     * realistic path, but defence that depends on one workspace label holding is not defence enough
-     * for a privilege boundary.
+     * <p>{@code fleet.collaborators} has no {@code tabPrefix}: identity is matched on the exact
+     * {@code tab} alone, so only the exact-render check applies there, not the prefix check.
      *
-     * <p>CB-557 shrank this check rather than removing it. The default template is
-     * {@code "{role}: {profile} #{n}"} and {@code {role}} comes from a closed enum, so a
-     * <em>generated</em> label can no longer collide by construction. What remains checkable is what
-     * an operator still writes by hand: the {@code fleet.tabLabel} template and any per-profile
-     * {@code tabLabel} override.
-     *
-     * <p>Fatal rather than a warning, unlike {@link #warnUnknownTopLevelKeys}: an unknown key means
-     * a feature does nothing, while this means a feature does the opposite of what it says.
-     *
-     * @throws IllegalStateException when the fleet template or any profile's {@code tabLabel}
-     *                               override starts with a configured lead prefix
+     * @throws IllegalStateException when the fleet template or a profile {@code tabLabel} override
+     *                               can render as a configured lead or collaborator tab or match a
+     *                               lead-tab prefix, or when two entries — of either registry, or
+     *                               one of each — carry the same exact {@code tab}
+     *                               (case-insensitively)
      */
     public void validateLeadTabPrefixes() {
-        if (fleet == null || fleet.leaders().isEmpty()) {
+        if (fleet == null) {
             return;
         }
         List<String> bad = new ArrayList<>();
@@ -2688,28 +2728,190 @@ public record FleetConfig(
             if (leader == null) {
                 return;
             }
+            String tab = leader.tab();
             String prefix = leader.tabPrefix();
-            // The fleet-wide template is checked once per prefix: it labels every member that has no
-            // override, so one bad template promotes the entire fleet, not one profile.
-            if (startsWithIgnoreCase(fleet.tabLabel(), prefix)) {
+            if (templateCanRenderAs(fleet.tabLabel(), tab)) {
+                bad.add("fleet.tabLabel=\"" + fleet.tabLabel() + "\" can render as the tab of "
+                        + "lead '" + leadName + "' (\"" + tab + "\")");
+            } else if (startsWithIgnoreCase(fleet.tabLabel(), prefix)) {
                 bad.add("fleet.tabLabel=\"" + fleet.tabLabel() + "\" starts with the tabPrefix of "
                         + "lead '" + leadName + "' (\"" + prefix + "\")");
             }
             profiles().entrySet().stream()
-                    .filter(e -> startsWithIgnoreCase(e.getValue().tabLabel(), prefix))
                     .map(Map.Entry::getKey)
                     .sorted()
-                    .forEach(p -> bad.add("profile '" + p + "' overrides tabLabel with \""
-                            + profiles().get(p).tabLabel() + "\", which starts with the tabPrefix of "
-                            + "lead '" + leadName + "' (\"" + prefix + "\")"));
+                    .forEach(p -> {
+                        String label = profiles().get(p).tabLabel();
+                        if (templateCanRenderAs(label, tab)) {
+                            bad.add("profile '" + p + "' overrides tabLabel with \"" + label
+                                    + "\", which can render as the tab of lead '" + leadName
+                                    + "' (\"" + tab + "\")");
+                        } else if (startsWithIgnoreCase(label, prefix)) {
+                            bad.add("profile '" + p + "' overrides tabLabel with \"" + label
+                                    + "\", which starts with the tabPrefix of lead '" + leadName
+                                    + "' (\"" + prefix + "\")");
+                        }
+                    });
         });
+        fleet.collaborators().forEach((collabName, collaborator) -> {
+            if (collaborator == null) {
+                return;
+            }
+            String tab = collaborator.tab();
+            if (templateCanRenderAs(fleet.tabLabel(), tab)) {
+                bad.add("fleet.tabLabel=\"" + fleet.tabLabel() + "\" can render as the tab of "
+                        + "collaborator '" + collabName + "' (\"" + tab + "\")");
+            }
+            profiles().entrySet().stream()
+                    .map(Map.Entry::getKey)
+                    .sorted()
+                    .forEach(p -> {
+                        String label = profiles().get(p).tabLabel();
+                        if (templateCanRenderAs(label, tab)) {
+                            bad.add("profile '" + p + "' overrides tabLabel with \"" + label
+                                    + "\", which can render as the tab of collaborator '"
+                                    + collabName + "' (\"" + tab + "\")");
+                        }
+                    });
+        });
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: " + String.join("; ", bad)
+                    + ". Every member labelled that way would be read back as a lead or "
+                    + "collaborator and granted that identity's authority. Change one of the two "
+                    + "so member tabs cannot be confused with a lead's or collaborator's tab.");
+        }
+
+        List<String> collisions = new ArrayList<>();
+        List<String> leadNames = fleet.leaders().keySet().stream().sorted().toList();
+        for (int i = 0; i < leadNames.size(); i++) {
+            String nameA = leadNames.get(i);
+            Leader a = fleet.leaders().get(nameA);
+            if (a == null || a.tab() == null || a.tab().isBlank()) {
+                continue;
+            }
+            for (int j = i + 1; j < leadNames.size(); j++) {
+                String nameB = leadNames.get(j);
+                Leader b = fleet.leaders().get(nameB);
+                if (b == null || b.tab() == null || b.tab().isBlank()) {
+                    continue;
+                }
+                if (a.tab().equalsIgnoreCase(b.tab())) {
+                    collisions.add("lead '" + nameA + "' and lead '" + nameB + "' both use tab \""
+                            + a.tab() + "\"");
+                }
+            }
+        }
+        List<String> collabNames = fleet.collaborators().keySet().stream().sorted().toList();
+        for (int i = 0; i < collabNames.size(); i++) {
+            String nameA = collabNames.get(i);
+            Collaborator a = fleet.collaborators().get(nameA);
+            if (a == null || a.tab() == null || a.tab().isBlank()) {
+                continue;
+            }
+            for (int j = i + 1; j < collabNames.size(); j++) {
+                String nameB = collabNames.get(j);
+                Collaborator b = fleet.collaborators().get(nameB);
+                if (b == null || b.tab() == null || b.tab().isBlank()) {
+                    continue;
+                }
+                if (a.tab().equalsIgnoreCase(b.tab())) {
+                    collisions.add("collaborator '" + nameA + "' and collaborator '" + nameB
+                            + "' both use tab \"" + a.tab() + "\"");
+                }
+            }
+        }
+        for (String leadName : leadNames) {
+            Leader lead = fleet.leaders().get(leadName);
+            if (lead == null || lead.tab() == null || lead.tab().isBlank()) {
+                continue;
+            }
+            for (String collabName : collabNames) {
+                Collaborator collaborator = fleet.collaborators().get(collabName);
+                if (collaborator == null || collaborator.tab() == null
+                        || collaborator.tab().isBlank()) {
+                    continue;
+                }
+                if (lead.tab().equalsIgnoreCase(collaborator.tab())) {
+                    collisions.add("lead '" + leadName + "' and collaborator '" + collabName
+                            + "' both use tab \"" + lead.tab() + "\"");
+                }
+            }
+        }
+        if (collisions.isEmpty()) {
+            return;
+        }
+        throw new IllegalStateException("refusing to start: " + String.join("; ", collisions)
+                + ". Tab identity is matched exactly, so only one of two entries sharing a tab can "
+                + "ever be found — the other is silently unreachable. Give each lead and "
+                + "collaborator its own exact tab.");
+    }
+
+    private static boolean templateCanRenderAs(String template, String tab) {
+        if (template == null || template.isBlank() || tab == null || tab.isBlank()) {
+            return false;
+        }
+        var placeholders = Pattern.compile("\\{(?:role|profile|model|n)}").matcher(template);
+        StringBuilder expression = new StringBuilder("^");
+        int literalStart = 0;
+        while (placeholders.find()) {
+            expression.append(Pattern.quote(template.substring(literalStart, placeholders.start())));
+            expression.append(".*");
+            literalStart = placeholders.end();
+        }
+        expression.append(Pattern.quote(template.substring(literalStart))).append("$");
+        return Pattern.compile(expression.toString(), Pattern.CASE_INSENSITIVE).matcher(tab).matches();
+    }
+
+    /** Case-insensitive prefix test that tolerates a null or blank label. */
+    private static boolean startsWithIgnoreCase(String label, String prefix) {
+        if (label == null || prefix == null || prefix.isBlank()) {
+            return false;
+        }
+        String stripped = label.strip();
+        return stripped.regionMatches(true, 0, prefix, 0, prefix.length());
+    }
+
+    /**
+     * Reject a profile that places its members by {@code "pane"} while any {@code fleet.leaders}
+     * or {@code fleet.collaborators} entry names a {@code tab}. A pane-placed member lands inside
+     * the focused tab rather than its own, so it can land inside a lead's or collaborator's own
+     * labelled tab. {@link dev.ltms.fleet.herdr.LeadTabScanner} identifies a lead or collaborator
+     * purely by that tab's label — it does not exclude the member space — so a member that ends up
+     * there would be read back as that lead or collaborator and granted that identity's authority.
+     *
+     * <p>Only an entry with a non-blank {@code tab} is in scope: one with no {@code tab} feeds
+     * nothing into {@link dev.ltms.fleet.herdr.LeadTabScanner}, so it creates no hazard here.
+     *
+     * @throws IllegalStateException when any {@code profiles:} entry is pane-placed while any
+     *                               {@code fleet.leaders} or {@code fleet.collaborators} entry
+     *                               names a non-blank {@code tab}
+     */
+    public void validatePanePlacementAgainstLeadTabs() {
+        if (fleet == null) {
+            return;
+        }
+        boolean anyLeaderHasTab = fleet.leaders().values().stream()
+                .anyMatch(leader -> leader != null && leader.tab() != null && !leader.tab().isBlank());
+        boolean anyCollaboratorHasTab = fleet.collaborators().values().stream()
+                .anyMatch(c -> c != null && c.tab() != null && !c.tab().isBlank());
+        if (!anyLeaderHasTab && !anyCollaboratorHasTab) {
+            return;
+        }
+        List<String> bad = new ArrayList<>();
+        profiles().entrySet().stream()
+                .filter(e -> !e.getValue().tabPlacement())
+                .map(Map.Entry::getKey)
+                .sorted()
+                .forEach(bad::add);
         if (bad.isEmpty()) {
             return;
         }
-        throw new IllegalStateException("refusing to start: " + String.join("; ", bad)
-                + ". Every member labelled that way would be read back as a lead and granted "
-                + "spawn/stop/send on the whole fleet. Change one of the two so member tabs and "
-                + "lead tabs cannot be confused.");
+        throw new IllegalStateException("refusing to start: profile(s) " + bad
+                + " use placement: pane while fleet.leaders or fleet.collaborators names a tab. A "
+                + "pane-placed member can land inside that labelled tab and be read back as the "
+                + "lead or collaborator, granted that identity's authority. Set placement: tab for "
+                + "each named profile, or remove the tab from every fleet.leaders and "
+                + "fleet.collaborators entry.");
     }
 
     /**
@@ -2732,15 +2934,6 @@ public record FleetConfig(
         }
     }
 
-    /** Case-insensitive prefix test that tolerates a null/blank label. */
-    private static boolean startsWithIgnoreCase(String label, String prefix) {
-        if (label == null || prefix == null || prefix.isBlank()) {
-            return false;
-        }
-        String stripped = label.strip();
-        return stripped.regionMatches(true, 0, prefix, 0, prefix.length());
-    }
-
     /**
      * Reject a subscription profile whose {@code env:} block tries to reseat the Anthropic binding
      * (CB-542).
@@ -2825,8 +3018,14 @@ public record FleetConfig(
      * so duplicates are unrepresentable by construction once loaded — and {@link #load(Path)}
      * already rejects a duplicated slot name at parse time, before the map collapses.
      *
-     * @throws IllegalStateException when a slot names no profile or an unknown one, or when a lead
-     *                               can be neither found nor created, naming the offending entry
+     * <p>Also rejects a {@code fleet.collaborators} entry with no (or a blank) {@code tab}. A
+     * {@code profile}-less lead is still useful recognise-only — {@code tab} is the only field
+     * that matters to it either way. A collaborator carries no other field at all, so a blank
+     * {@code tab} leaves nothing for the entry to mean.
+     *
+     * @throws IllegalStateException when a slot names no profile or an unknown one, when a lead
+     *                               can be neither found nor created, or when a collaborator names
+     *                               no tab, naming the offending entry
      */
     public void validateMembers() {
         if (fleet == null) {
@@ -2864,6 +3063,16 @@ public record FleetConfig(
                         + "auto-launched, labelled) purely by its tab, so every entry must name one.");
             }
         });
+        fleet.collaborators().forEach((name, collaborator) -> {
+            if (collaborator == null) {
+                return;
+            }
+            if (collaborator.tab() == null || collaborator.tab().isBlank()) {
+                bad.add("fleet.collaborators." + name + " has no tab: — a collaborator is "
+                        + "recognised purely by its tab, and carries no other field, so every "
+                        + "entry must name one.");
+            }
+        });
         if (!bad.isEmpty()) {
             throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
         }
@@ -2912,11 +3121,11 @@ public record FleetConfig(
      * Runs every validator this class declares — found by reflection, not by name.
      *
      * <p>fleetd ticket "central allow-list of usable models", follow-up: mutation testing found
-     * that although each of the six validators above was well pinned on its own, nothing proved
+     * that although each validator above was well pinned on its own, nothing proved
      * either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()}) still
-     * invoked it — deleting a call site left the full suite green. The fix is not a seventh test
-     * per caller; a hand-maintained list of six names here would have the exact same defect its
-     * own javadoc would warn against: the seventh validator someone adds next month has no reason
+     * invoked it — deleting a call site left the full suite green. The fix is not one more test
+     * per caller; a hand-maintained list of names here would have the exact same defect its
+     * own javadoc would warn against: the next validator someone adds has no reason
      * to be added to it. So this method does not name any validator. It sweeps {@link
      * #getClass()}'s own public, no-argument, {@code void} methods whose name starts with {@code
      * "validate"} (excluding itself) and invokes every one it finds, via {@link
@@ -2925,7 +3134,7 @@ public record FleetConfig(
      * which it silently never runs.
      *
      * <p>{@code Fleetd.main} and {@link ConfigRef#reload()} each call this one method instead of
-     * the six individually — see the comments at those two call sites for why
+     * each validator individually — see the comments at those two call sites for why
      * each must run it.
      *
      * <p>Methods run in a fixed (alphabetical) order, so a config with more than one violation
@@ -2942,9 +3151,9 @@ public record FleetConfig(
     /**
      * The reflective sweep behind {@link #validateAll()}, kept as its own method — taking any
      * {@code target}, not just {@code this} — so a test can prove the MECHANISM is generic (it
-     * would sweep a seventh {@code validateXxx()} method added to any class, not just something
-     * special-cased to today's six on {@link FleetConfig}) without needing to add a real, unwanted
-     * seventh validator to this class just to exercise that claim. See {@code
+     * would sweep any new {@code validateXxx()} method added to any class, not just something
+     * special-cased to the set {@link FleetConfig} declares today) without needing to add a real,
+     * unwanted extra validator to this class just to exercise that claim. See {@code
      * FleetConfigValidateAllTest} for that proof.
      *
      * @param target an object whose public, no-argument, {@code void} methods named {@code

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrRouter.java

@@ -11,12 +11,18 @@ public final class HerdrRouter implements AutoCloseable {
     private final AgentControl memberAgents;
     private final WorkspaceControl leadSpaces;
     private final WorkspaceControl memberSpaces;
-    private final Predicate<String> isLead;
+    private final Predicate<String> routeToLead;
 
-    public HerdrRouter(HerdrClient lead, HerdrClient member, Predicate<String> isLead) {
+    /**
+     * @param routeToLead true for a terminal whose pane lives in the lead herdr daemon — a lead's
+     *                     own pane or a configured collaborator's, both opened by a person at a
+     *                     terminal rather than spawned, so both are found in the lead daemon rather
+     *                     than the member one
+     */
+    public HerdrRouter(HerdrClient lead, HerdrClient member, Predicate<String> routeToLead) {
         this.lead = Objects.requireNonNull(lead, "lead");
         this.member = member != null ? member : lead;
-        this.isLead = Objects.requireNonNull(isLead, "isLead");
+        this.routeToLead = Objects.requireNonNull(routeToLead, "routeToLead");
         leadAgents = new AgentControl(this.lead);
         memberAgents = this.member == this.lead ? leadAgents : new AgentControl(this.member);
         leadSpaces = new WorkspaceControl(this.lead);
@@ -27,7 +33,7 @@ public final class HerdrRouter implements AutoCloseable {
     public WorkspaceControl leadSpaces() { return leadSpaces; }
     public AgentControl memberAgents() { return memberAgents; }
     public WorkspaceControl memberSpaces() { return memberSpaces; }
-    public AgentControl agentsFor(String targetId) { return isLead.test(targetId) ? leadAgents : memberAgents; }
+    public AgentControl agentsFor(String targetId) { return routeToLead.test(targetId) ? leadAgents : memberAgents; }
 
     HerdrClient leadClient() { return lead; }
     HerdrClient memberClient() { return member; }

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -37,8 +37,11 @@ import java.util.function.Supplier;
  * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
  * anything a pane could take for itself. Three properties keep that honest:
  * <ol>
- *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
- *       become a lead by being placed — as a split, say — inside a matching tab.</li>
+ *   <li>{@code excludedWorkspaceLabels} can filter a workspace out of the scan, but this class does
+ *       not by itself stop a worker from landing inside a matching tab — a caller may pass an empty
+ *       set, and the daemon does. The guard against that is {@code
+ *       FleetConfig.validatePanePlacementAgainstLeadTabs}: it refuses, at startup, any profile that
+ *       places members by pane while a lead names a tab.</li>
  *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
  *       {@link WorkspaceControl}, which no {@code fleet_*} tool exposes. The label is writable by
  *       the human at the terminal and by nobody the bridge is defending against.</li>
@@ -93,13 +96,19 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
 
     private static final Logger log = LoggerFactory.getLogger(LeadTabScanner.class);
 
+    /** What a matched tab names: a lead or a collaborator. */
+    private enum Kind { LEAD, COLLABORATOR }
+
+    /** One matched tab's name and what it names. */
+    private record Entry(String name, Kind kind) {}
+
     private final HerdrClient herdr;
-    private final Map<String, String> tabToName;
+    private final Map<String, Entry> tabToEntry;
     private final Set<String> excludedWorkspaceLabels;
     private final long ttlNanos;
     private final LongSupplier clock;
 
-    private Map<String, String> cached = Map.of();
+    private Map<String, Entry> cached = Map.of();
     private long scannedAtNanos;
     private boolean everScanned;
 
@@ -123,26 +132,53 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
      */
     public LeadTabScanner(HerdrClient herdr, Map<String, String> tabToName,
                           Set<String> excludedWorkspaceLabels, long ttlNanos, LongSupplier clock) {
+        this(herdr, tabToName, Map.of(), excludedWorkspaceLabels, ttlNanos, clock);
+    }
+
+    /**
+     * As {@link #LeadTabScanner(HerdrClient, Map, Set, long, LongSupplier)}, additionally scanning
+     * for configured collaborator tabs in the same pass.
+     *
+     * @param collaboratorTabToName every configured collaborator's exact tab label → its name
+     *                              ({@code fleet.collaborators.<name>.tab}), matched the same way as
+     *                              {@code tabToName}
+     */
+    public LeadTabScanner(HerdrClient herdr, Map<String, String> tabToName,
+                          Map<String, String> collaboratorTabToName,
+                          Set<String> excludedWorkspaceLabels, long ttlNanos, LongSupplier clock) {
         this.herdr = herdr;
-        this.tabToName = normalize(tabToName);
+        this.tabToEntry = buildTabIndex(tabToName, collaboratorTabToName);
         this.excludedWorkspaceLabels = excludedWorkspaceLabels == null
                 ? Set.of() : Set.copyOf(excludedWorkspaceLabels);
         this.ttlNanos = ttlNanos;
         this.clock = clock;
     }
 
-    /** Keys stripped and lower-cased once, so every lookup is a plain map hit. */
-    private static Map<String, String> normalize(Map<String, String> tabToName) {
-        if (tabToName == null || tabToName.isEmpty()) {
-            return Map.of();
+    /**
+     * Keys stripped and lower-cased once, so every lookup is a plain map hit. Leads and
+     * collaborators merge into a single index, so {@link #scan()} matches both kinds in one pass
+     * over the tab list; a label naming both a lead and a collaborator takes the lead entry —
+     * leads are put last, so a colliding key's lead entry is the one that overwrites — since a lead
+     * can already do everything a collaborator can. Config validation already refuses a lead and a
+     * collaborator sharing one exact tab, so this ordering is defence in depth, not the control.
+     */
+    private static Map<String, Entry> buildTabIndex(Map<String, String> tabToName,
+                                                     Map<String, String> collaboratorTabToName) {
+        Map<String, Entry> out = new LinkedHashMap<>();
+        putNormalized(out, collaboratorTabToName, Kind.COLLABORATOR);
+        putNormalized(out, tabToName, Kind.LEAD);
+        return Collections.unmodifiableMap(out);
+    }
+
+    private static void putNormalized(Map<String, Entry> out, Map<String, String> tabToName, Kind kind) {
+        if (tabToName == null) {
+            return;
         }
-        Map<String, String> out = new LinkedHashMap<>();
         tabToName.forEach((tab, name) -> {
             if (tab != null && !tab.isBlank() && name != null && !name.isBlank()) {
-                out.put(tab.strip().toLowerCase(Locale.ROOT), name);
+                out.put(tab.strip().toLowerCase(Locale.ROOT), new Entry(name, kind));
             }
         });
-        return Collections.unmodifiableMap(out);
     }
 
     /**
@@ -153,6 +189,29 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
      */
     @Override
     public synchronized Map<String, String> get() {
+        return byKind(refresh(), Kind.LEAD);
+    }
+
+    /**
+     * The current {@code terminal_id → collaborator name} map, sharing the same scan and cache as
+     * {@link #get()} — both kinds are matched in one pass, so this never costs a second herdr call.
+     */
+    public synchronized Map<String, String> collaborators() {
+        return byKind(refresh(), Kind.COLLABORATOR);
+    }
+
+    private static Map<String, String> byKind(Map<String, Entry> entries, Kind kind) {
+        Map<String, String> out = new LinkedHashMap<>();
+        entries.forEach((terminal, entry) -> {
+            if (entry.kind() == kind) {
+                out.put(terminal, entry.name());
+            }
+        });
+        return Collections.unmodifiableMap(out);
+    }
+
+    /** Rescans if the cache has expired, otherwise returns the cached answer. */
+    private Map<String, Entry> refresh() {
         long now = clock.getAsLong();
         if (everScanned && now - scannedAtNanos < ttlNanos) {
             return cached;
@@ -162,21 +221,21 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
         scannedAtNanos = now;
         everScanned = true;
         try {
-            Map<String, String> fresh = scan();
+            Map<String, Entry> fresh = scan();
             if (!fresh.equals(cached)) {
-                log.info("lead panes: {}", fresh);
+                log.info("lead/collaborator panes: {}", fresh);
             }
             cached = fresh;
         } catch (HerdrException e) {
-            log.warn("lead-tab scan failed, keeping the {} lead(s) already known: {}",
+            log.warn("lead-tab scan failed, keeping the {} entr(y/ies) already known: {}",
                     cached.size(), e.getMessage());
         }
         return cached;
     }
 
     /** One full pass: labelled tabs → live agents in them → those panes' terminals. */
-    private Map<String, String> scan() {
-        Map<String, String> nameByTab = new LinkedHashMap<>();
+    private Map<String, Entry> scan() {
+        Map<String, Entry> entryByTab = new LinkedHashMap<>();
         for (JsonNode w : herdr.call("workspace.list").path("workspaces")) {
             Workspace ws = Workspace.from(w);
             if (ws.workspaceId() == null || excludedWorkspaceLabels.contains(ws.label())) {
@@ -184,21 +243,22 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
             }
             for (JsonNode t : herdr.call("tab.list", Map.of("workspace_id", ws.workspaceId())).path("tabs")) {
                 Tab tab = Tab.from(t);
-                String name = leadNameOf(tab.label());
-                if (name != null && tab.tabId() != null) {
-                    nameByTab.put(tab.tabId(), name);
+                Entry entry = entryOf(tab.label());
+                if (entry != null && tab.tabId() != null) {
+                    entryByTab.put(tab.tabId(), entry);
                 }
             }
         }
 
-        if (nameByTab.isEmpty()) {
+        if (entryByTab.isEmpty()) {
             gracedTerminals = Set.of();
             return Map.of();
         }
 
-        // fleetd #359: a labelled tab is only a lead when herdr also reports a running agent in
-        // it — the same liveness signal LeadLauncher.countLeads trusts for the identical purpose.
-        // Without this, a tab left behind by a session that has since died reads as live forever.
+        // fleetd #359: a labelled tab is only a lead (or collaborator) when herdr also reports a
+        // running agent in it — the same liveness signal LeadLauncher.countLeads trusts for the
+        // identical purpose. Without this, a tab left behind by a session that has since died reads
+        // as live forever.
         Set<String> tabsWithAgent = new HashSet<>();
         for (JsonNode a : herdr.call("agent.list").path("agents")) {
             String tabId = a.path("tab_id").asText(null);
@@ -207,18 +267,18 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
             }
         }
 
-        Map<String, String> byTerminal = new LinkedHashMap<>();
+        Map<String, Entry> byTerminal = new LinkedHashMap<>();
         Set<String> stillGraced = new HashSet<>();
         // One pane.list for every tab: panes carry tab_id, so the join is local.
         for (JsonNode p : herdr.call("pane.list", Map.of()).path("panes")) {
             String tabId = p.path("tab_id").asText(null);
-            String name = nameByTab.get(tabId);
+            Entry entry = entryByTab.get(tabId);
             String terminal = p.path("terminal_id").asText(null);
-            if (name == null || terminal == null || terminal.isBlank()) {
+            if (entry == null || terminal == null || terminal.isBlank()) {
                 continue;
             }
             if (tabsWithAgent.contains(tabId)) {
-                byTerminal.put(terminal, name);
+                byTerminal.put(terminal, entry);
                 continue;
             }
             // No agent reported for this tab, but its tab/pane are still here — this is the
@@ -227,7 +287,7 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
             // reported as live; a terminal we never reported live gets none, so the original #359
             // fix (a genuinely dead tab is never reported) is unaffected for the common case.
             if (cached.containsKey(terminal) && !gracedTerminals.contains(terminal)) {
-                byTerminal.put(terminal, name);
+                byTerminal.put(terminal, entry);
                 stillGraced.add(terminal);
             }
         }
@@ -236,18 +296,19 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
     }
 
     /**
-     * The lead name a tab label declares, or {@code null} if it names none of the configured leads.
+     * The entry a tab label declares, or {@code null} if it names neither a configured lead nor a
+     * configured collaborator.
      *
-     * <p>Exact match (case-insensitive, ends stripped) against {@link #tabToName} — no prefix
+     * <p>Exact match (case-insensitive, ends stripped) against {@link #tabToEntry} — no prefix
      * stripping, so an operator's {@code "lead: something-else"} tab is never mistaken for a
      * configured lead just because it shares a prefix. The match strips a trailing
      * {@link PendingCloseMarker} first, so a tab {@code LeadLauncher} has flagged as maybe-dead but
      * not yet closed keeps resolving normally while that reconcile is pending.
      */
-    private String leadNameOf(String label) {
+    private Entry entryOf(String label) {
         if (label == null) {
             return null;
         }
-        return tabToName.get(PendingCloseMarker.strip(label).toLowerCase(Locale.ROOT));
+        return tabToEntry.get(PendingCloseMarker.strip(label).toLowerCase(Locale.ROOT));
     }
 }

fleetd/src/main/java/dev/ltms/fleet/lead/LeadContextGauge.java

@@ -68,8 +68,10 @@ import java.util.function.LongSupplier;
  * (never the whole 52 MB a long-lived transcript reaches on the host this was measured on), and
  * {@link #DEFAULT_CACHE_TTL_MILLIS} bounds how often that bounded read actually happens — a burst
  * of {@code fleet_list} calls inside one TTL window reads the file once. One instance's cache is
- * keyed by {@code (configDir, sessionId)}, so it is safe to share across every lead a single
- * {@code fleet_list} call reports on.
+ * keyed by {@code (configDir, sessionId, highThreshold)}, so it is safe to share across every lead
+ * a single {@code fleet_list} call reports on, and a call that resolves a different effective
+ * window for the same lead never reads back a state computed against the other window's
+ * threshold.
  */
 public final class LeadContextGauge {
 
@@ -97,14 +99,19 @@ public final class LeadContextGauge {
     static final long DEFAULT_CACHE_TTL_MILLIS = 5_000;
 
     /**
-     * Live tokens at or above this count report {@link State#HIGH}. On the host this was measured
-     * on, auto-compaction actually fires around 267,000–270,000 tokens, but the point of a HIGH
-     * state is to warn before that happens, not at it — 200,000 is the standard Claude context
-     * window size and a sensible built-in default: no config key is required to pick it, and a
-     * lead crossing it is already deep enough into its window that a compaction is foreseeable.
+     * Fallback HIGH threshold used when a caller resolves no effective auto-compact window for the
+     * lead being read (see {@link #read(String, String, String, Long)}) — the built-in default so
+     * no config key is required to get a warning at all.
      */
     static final long HIGH_THRESHOLD_TOKENS = 200_000;
 
+    /**
+     * The fraction of a resolved effective auto-compact window that HIGH warns at, so the warning
+     * margin scales with the window instead of only ever meaning something against the fixed
+     * {@link #HIGH_THRESHOLD_TOKENS} fallback.
+     */
+    static final double HIGH_THRESHOLD_FRACTION = 2.0 / 3.0;
+
     /** The only peer kind this reader understands ({@code Agent.agentType()}'s wire value). */
     private static final String CLAUDE_AGENT_TYPE = "claude";
 
@@ -165,8 +172,13 @@ public final class LeadContextGauge {
      *                  {@code "claude"} (including {@code null}, meaning undetected) reports
      *                  {@link State#UNKNOWN} — this reader only understands Claude Code's own
      *                  transcript format
+     * @param effectiveWindowTokens the caller's resolved effective auto-compact window for this
+     *                              lead's own profile, or {@code null} when it cannot be resolved.
+     *                              HIGH fires at {@link #HIGH_THRESHOLD_FRACTION} of this value;
+     *                              {@code null} (or a non-positive value) falls back to the fixed
+     *                              {@link #HIGH_THRESHOLD_TOKENS}
      */
-    public Reading read(String configDir, String sessionId, String agentType) {
+    public Reading read(String configDir, String sessionId, String agentType, Long effectiveWindowTokens) {
         if (sessionId == null || sessionId.isBlank()) {
             return Reading.unknown();
         }
@@ -176,18 +188,27 @@ public final class LeadContextGauge {
         String base = (configDir == null || configDir.isBlank())
                 ? System.getProperty("user.home") + "/.claude"
                 : configDir;
-        String cacheKey = base + '\u0000' + sessionId;
+        long highThreshold = highThreshold(effectiveWindowTokens);
+        String cacheKey = base + '\u0000' + sessionId + '\u0000' + highThreshold;
         long now = clock.getAsLong();
         CacheEntry cached = cache.get(cacheKey);
         if (cached != null && now - cached.readAtMillis() < ttlMillis) {
             return cached.reading();
         }
-        Reading fresh = readUncached(base, sessionId);
+        Reading fresh = readUncached(base, sessionId, highThreshold);
         cache.put(cacheKey, new CacheEntry(fresh, now));
         return fresh;
     }
 
-    private Reading readUncached(String base, String sessionId) {
+    /** {@link #HIGH_THRESHOLD_FRACTION} of {@code effectiveWindowTokens}, or the fixed fallback. */
+    private static long highThreshold(Long effectiveWindowTokens) {
+        if (effectiveWindowTokens == null || effectiveWindowTokens <= 0) {
+            return HIGH_THRESHOLD_TOKENS;
+        }
+        return (long) (effectiveWindowTokens * HIGH_THRESHOLD_FRACTION);
+    }
+
+    private Reading readUncached(String base, String sessionId, long highThreshold) {
         diskReads.incrementAndGet();
         Path file = findTranscript(base, sessionId);
         if (file == null) {
@@ -199,7 +220,7 @@ public final class LeadContextGauge {
         } catch (IOException e) {
             return Reading.unknown();
         }
-        return parse(tail);
+        return parse(tail, highThreshold);
     }
 
     /**
@@ -258,7 +279,7 @@ public final class LeadContextGauge {
      * read raced — see the "torn final line" section of the class javadoc) is skipped, not fatal.
      * Only when none of the remaining lines parse does this report {@link State#UNKNOWN}.
      */
-    private Reading parse(TailRead tail) {
+    private Reading parse(TailRead tail, long highThreshold) {
         String text = new String(tail.bytes(), StandardCharsets.UTF_8);
         List<String> lines = new ArrayList<>(List.of(text.split("\n", -1)));
         if (!lines.isEmpty() && lines.get(lines.size() - 1).isEmpty()) {
@@ -299,7 +320,7 @@ public final class LeadContextGauge {
         if (tokens == null) {
             return new Reading(State.UNKNOWN, null, compactions);
         }
-        State state = tokens >= HIGH_THRESHOLD_TOKENS ? State.HIGH : State.OK;
+        State state = tokens >= highThreshold ? State.HIGH : State.OK;
         return new Reading(state, tokens, compactions);
     }
 

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -201,8 +201,8 @@ public final class LeadLauncher {
     /**
      * How many live leads exist per configured name, and which of that name's labelled tabs are
      * <em>not</em> live: a running agent in a tab labelled with that lead's exact {@code tab}
-     * (CB-579). Member workspaces are excluded, exactly as the scanner excludes them: a member must
-     * not be counted as a lead because it happens to sit in a matching tab.
+     * (CB-579). A member sitting in the same shared workspace is not counted as a lead because its
+     * tab carries a different label, not because any workspace is excluded from this count.
      *
      * <p>There used to be a second path here — a running agent on the terminal a
      * {@code fleet.leaders.<name>.terminal} pin named, for a lead opened and pinned by hand. That

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -114,6 +114,13 @@ public final class FleetMcp {
      * dev.ltms.fleet.herdr.PaneLocator} — that a real assembly wired up. See {@link #identity()}.
      */
     private final ConnectionIdentity identity;
+    /**
+     * Kept as a field (rather than only captured by the {@code contextExtractor} closure) so
+     * {@link #denyFor} can read {@link CallerResolver#knownLeadOrCollaborator()} — the classifier a
+     * collaborator's {@code SEND} is checked against, built from the same lead and collaborator
+     * maps {@link #identity}-based resolution reads.
+     */
+    private final CallerResolver callers;
     private final Metrics metrics;      // CB-502: null → auth failures not counted
     private final CapacitySource capacity;
     private final HealthCoverageSource healthCoverage;
@@ -284,10 +291,15 @@ public final class FleetMcp {
      *                      no profile, or that profile sets no {@code configDir} override — either
      *                      way {@link LeadContextGauge} then falls back to its own built-in default,
      *                      exactly as before this ticket
+     * @param windowFor    lead name → that lead's profile's effective auto-compact window (see
+     *                      {@code dev.ltms.fleet.config.FleetConfig.Profile
+     *                      #effectiveAutoCompactWindow()}), or {@code null} when it cannot be
+     *                      resolved — either way {@link LeadContextGauge} falls back to its own
+     *                      fixed HIGH threshold
      */
-    public record LeadConfigDirSource(Function<String, String> configDirFor) {
-        /** Inert source — every lead reads {@link LeadContextGauge}'s built-in default {@code configDir}. */
-        public static LeadConfigDirSource none() { return new LeadConfigDirSource(_ -> null); }
+    public record LeadConfigDirSource(Function<String, String> configDirFor, Function<String, Long> windowFor) {
+        /** Inert source — every lead reads {@link LeadContextGauge}'s built-in defaults. */
+        public static LeadConfigDirSource none() { return new LeadConfigDirSource(_ -> null, _ -> null); }
     }
 
     /**
@@ -404,6 +416,7 @@ public final class FleetMcp {
         this.authorizationEnforced = Objects.requireNonNull(authorizationMode, "authorizationMode")
                 == AuthorizationMode.ENFORCED;
         this.identity = identity;
+        this.callers = callers;
         this.leadChannel = leadChannel;
         this.peers = peers == null ? List.of() : List.copyOf(peers);
         this.capacity = capacity;
@@ -547,6 +560,7 @@ public final class FleetMcp {
                     return listFleet(workers, sessions, messages, capacity, healthCoverage, loopHealth, quarantine, outage,
                             leadSeats, leadContextGauge, leadConfigDirs, callers.leads(),
                             callerTerminal(exchange),
+                            callers.collaborators(), collaboratorsVisibleTo(principal(exchange)),
                             new CoordinationSource(leadChannel, peers),
                             coordinatorVisibleTo(principal(exchange)));
                 };
@@ -684,8 +698,8 @@ public final class FleetMcp {
         if (!authorizationEnforced) {
             return null; // AuthorizationMode.UNENFORCED: authorization not enforced (fleetd #518)
         }
-        if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ) {
+        if (Authz.permits(caller, action, target, callers.knownLeadOrCollaborator())) {
+            if (action != Authz.Action.READ && action != Authz.Action.TASK_READ) {
                 AuditLog.allowed(caller, action, target); // reads would drown the trail
             }
             return null;
@@ -730,6 +744,21 @@ public final class FleetMcp {
         return caller.isPrimary();
     }
 
+    /**
+     * fleetd #703: who may see {@code fleet_list}'s {@code collaborators} array — a roster of the
+     * human-opened tabs this daemon recognises as named peers. Visible to exactly the roles that
+     * may {@link Authz.Action#SEND} to a named peer ({@code Authz.java}'s {@code SEND} case):
+     * the primary, an architect, and a collaborator (reaching another collaborator or a lead). A
+     * worker holds {@code READ} but can never {@code SEND} to a collaborator, so listing them to a
+     * worker would expose which human tabs exist on the host with no use to that caller. Split out
+     * for the same reason as {@link #coordinatorVisibleTo}: the decision must be unit-testable
+     * without fabricating an SDK {@code McpSyncServerExchange}, and the handler must call this
+     * named predicate rather than inlining the check.
+     */
+    static boolean collaboratorsVisibleTo(Principal caller) {
+        return caller.isPrimary() || caller.isArchitect() || caller.isCollaborator();
+    }
+
     /** The worker identity resolved from this call's connection, or {@code null} if the primary. */
     private static String callerTerminal(McpSyncServerExchange exchange) {
         Object v = exchange.transportContext().get(CALLER_TERMINAL);
@@ -1030,31 +1059,21 @@ public final class FleetMcp {
     }
 
     /**
-     * Which authorization action a {@code fleet_poll} call needs, decided by its arguments
-     * (fleetd #272, widened by fleetd #421).
+     * Which authorization action a {@code fleet_poll} call needs, decided by its arguments.
      *
-     * <p>{@code fleet_poll} is now <strong>three operations behind one tool name</strong>. With
+     * <p>{@code fleet_poll} is <strong>three operations behind one tool name</strong>. With
      * {@code ticket} it observes an async delegation and changes nothing, which is a {@link
-     * Authz.Action#READ}. With {@code target} it calls {@link MessageService#drainReplies} on that
-     * session -- the replies are removed from the inbox and a second call returns nothing -- so it
-     * is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for removing a
-     * single message, and the same one the REST path uses at {@code FleetApp.drainReplies}. With
-     * {@code coordId} it reads (never acks) this daemon's own held lead-to-lead mail, which is a
-     * {@link Authz.Action#COORD_READ} -- <strong>not</strong> {@code READ}, even though nothing is
-     * consumed: {@code READ}'s grant is open to every authenticated role on the premise that the
-     * roster carries no secrets, and a lead-to-lead body is not the roster. Mapping a non-destructive
-     * peer-mail read to {@code READ} would let any worker read every peer lead's mail in full.
-     *
-     * <p>Before this method existed (fleetd #272) the handler passed a constant {@code READ} for
-     * both of the original branches. {@code READ} is open to every authenticated role, so any
-     * worker could read a peer's id out of {@code fleet_list} and destroy the replies that peer had
-     * queued for the primary. The gate failed open, and it did so because the required action is a
-     * function of the arguments while the handler chose it before looking at them.
+     * Authz.Action#TASK_READ}. With {@code target} it calls {@link MessageService#drainReplies} on
+     * that session -- the replies are removed from the inbox and a second call returns nothing --
+     * so it is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for
+     * removing a single message, and the same one the REST path uses at
+     * {@code FleetApp.drainReplies}. With {@code coordId} it reads (never acks) this daemon's own
+     * held lead-to-lead mail, which is a {@link Authz.Action#COORD_READ} -- <strong>not</strong>
+     * {@code TASK_READ} or {@code READ}: a lead-to-lead body is a different inbox from either, and
+     * folding it into either would let any worker or architect read every peer lead's mail in full.
      *
      * <p>The choice lives in this method, and not inline in the handler, so that a test can assert
-     * the mapping the handler actually uses. {@code FleetMcpAuthzTest} already checked every
-     * {@link Authz.Action} against every {@link Role} and passed throughout -- it tested the policy
-     * table, which was correct, while the defect was in which action the caller handed it.
+     * the mapping the handler actually uses.
      *
      * <p>Checked first, and exclusively of {@code target}: a call naming {@code coordId} is reading
      * a different inbox entirely (this daemon's own lead channel, never a worker's), so it takes
@@ -1067,7 +1086,30 @@ public final class FleetMcp {
         if (!isBlank(coordId)) {
             return Authz.Action.COORD_READ;
         }
-        return isBlank(target) ? Authz.Action.READ : Authz.Action.DRAIN;
+        return isBlank(target) ? Authz.Action.TASK_READ : Authz.Action.DRAIN;
+    }
+
+    /**
+     * Which authorization action a {@code fleet_send} call needs, decided by its arguments.
+     *
+     * <p>{@code fleet_send} is three call shapes behind one tool name, mirroring {@link
+     * #pollAction}. With {@code coordId} it addresses a peer lead on another daemon over the
+     * coordination broker, which is {@link Authz.Action#COORD_SEND}. With {@code turnId} it
+     * resolves a worker's blocked {@code fleet_ask} and resumes that turn, which is {@link
+     * Authz.Action#ANSWER}. Otherwise it delivers to a local session by {@code sessionId}, which is
+     * the plain {@link Authz.Action#SEND}.
+     *
+     * <p>Checked in the same order the handler branches: {@code coordId} first and exclusively of
+     * {@code turnId}, matching {@link #sendToLead}'s own mutual-exclusion check.
+     *
+     * @param coordId the {@code coordId} argument of the call, or {@code null}/blank when absent
+     * @param turnId  the {@code turnId} argument of the call, or {@code null}/blank when absent
+     */
+    static Authz.Action sendAction(String coordId, String turnId) {
+        if (!isBlank(coordId)) {
+            return Authz.Action.COORD_SEND;
+        }
+        return isBlank(turnId) ? Authz.Action.SEND : Authz.Action.ANSWER;
     }
 
     /**
@@ -1092,10 +1134,11 @@ public final class FleetMcp {
      */
     private static Authz.Action authzAction(FleetTool tool, Map<String, Object> arguments) {
         return switch (tool) {
-            case SEND -> Authz.Action.SEND;
+            case SEND -> sendAction(str(arguments, "coordId"), str(arguments, "turnId"));
             case REPLY -> Authz.Action.REPLY;
             case ASK -> Authz.Action.ASK;
-            case STATUS, LIST, PROFILES, WHOAMI -> Authz.Action.READ;
+            case STATUS -> Authz.Action.TASK_READ;
+            case LIST, PROFILES, WHOAMI -> Authz.Action.READ;
             case POLL -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
             case ACK -> Authz.Action.DRAIN;
             case SPAWN -> Authz.Action.SPAWN;
@@ -1290,6 +1333,18 @@ public final class FleetMcp {
             }
             return text(json(m));
         }
+        if (caller.isCollaborator()) {
+            // A collaborator's name is its slot in the collaborators: registry; sessionId is its
+            // pane so a peer knows where to reach it. No leader key: a collaborator is not a
+            // primary for authorization, unlike a lead.
+            if (caller.name() != null) {
+                m.put("collaborator", caller.name());
+            }
+            if (caller.terminal() != null) {
+                m.put("sessionId", caller.terminal());
+            }
+            return text(json(m));
+        }
         if (!caller.isWorker()) {
             // CB-530: which lead, once more than one pane is configured as one. `role` deliberately
             // still reads "primary" — the fallback ladder in CLAUDE.md keys on it, and a lead IS a
@@ -1722,7 +1777,8 @@ public final class FleetMcp {
                                                Map<String, String> leads, String selfTerm,
                                                CoordinationSource coordination) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, loopHealth, quarantine,
-                OutageSource.none(), LeadSeatSource.none(), new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm, coordination, false);
+                OutageSource.none(), LeadSeatSource.none(), new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm,
+                Map.of(), false, coordination, false);
     }
 
     /** As above, plus fleetd #201 Unit 5 cool-off facts (see {@link OutageSource}). */
@@ -1731,7 +1787,8 @@ public final class FleetMcp {
                                                QuarantineSource quarantine, OutageSource outage,
                                                Map<String, String> leads, String selfTerm) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, LoopHealthSource.none(), quarantine, outage,
-                LeadSeatSource.none(), new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm, CoordinationSource.none(), false);
+                LeadSeatSource.none(), new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm,
+                Map.of(), false, CoordinationSource.none(), false);
     }
 
     /**
@@ -1748,7 +1805,8 @@ public final class FleetMcp {
                                                QuarantineSource quarantine, Map<String, String> leads, String selfTerm,
                                                CoordinationSource coordination) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, LoopHealthSource.none(), quarantine, OutageSource.none(),
-                LeadSeatSource.none(), new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm, coordination, false);
+                LeadSeatSource.none(), new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm,
+                Map.of(), false, coordination, false);
     }
 
     /** As above, plus fleetd #201 Unit 5 cool-off facts (see {@link OutageSource}). */
@@ -1757,7 +1815,8 @@ public final class FleetMcp {
                                                QuarantineSource quarantine, OutageSource outage,
                                                Map<String, String> leads, String selfTerm, CoordinationSource coordination) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, LoopHealthSource.none(), quarantine, outage,
-                LeadSeatSource.none(), new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm, coordination, false);
+                LeadSeatSource.none(), new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm,
+                Map.of(), false, coordination, false);
     }
 
     /**
@@ -1779,7 +1838,8 @@ public final class FleetMcp {
                                                LeadSeatSource leadSeats, Map<String, String> leads, String selfTerm,
                                                CoordinationSource coordination) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, LoopHealthSource.none(), quarantine, outage,
-                leadSeats, new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm, coordination, false);
+                leadSeats, new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm,
+                Map.of(), false, coordination, false);
     }
 
     /**
@@ -1803,7 +1863,8 @@ public final class FleetMcp {
                                                 LeadSeatSource leadSeats, Map<String, String> leads, String selfTerm,
                                                 CoordinationSource coordination, boolean callerIsPrimary) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, LoopHealthSource.none(), quarantine,
-                outage, leadSeats, new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm, coordination, callerIsPrimary);
+                outage, leadSeats, new LeadContextGauge(), LeadConfigDirSource.none(), leads, selfTerm,
+                Map.of(), false, coordination, callerIsPrimary);
     }
 
     /**
@@ -1813,6 +1874,13 @@ public final class FleetMcp {
      * matter); the one caller that matters for caching, {@code fleet_list}'s MCP handler, passes
      * its own single long-lived instance instead (see {@code FleetMcp}'s {@code leadContextGauge}
      * field).
+     *
+     * @param collaborators        terminal_id → collaborator name, live from the resolver
+     *                              ({@link dev.ltms.fleet.auth.CallerResolver#collaborators()})
+     * @param collaboratorsVisible whether this caller may see the {@code collaborators} array (see
+     *                             {@link #collaboratorsVisibleTo}); every wrapper overload above
+     *                             passes {@code false}, so a test that wants the row must call this
+     *                             overload with an explicit {@code true}
      */
     static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
                                                  CapacitySource capacity, HealthCoverageSource healthCoverage,
@@ -1821,6 +1889,7 @@ public final class FleetMcp {
                                                LeadSeatSource leadSeats, LeadContextGauge contextGauge,
                                                LeadConfigDirSource leadConfigDirs,
                                                Map<String, String> leads, String selfTerm,
+                                               Map<String, String> collaborators, boolean collaboratorsVisible,
                                                CoordinationSource coordination, boolean callerIsPrimary) {
         try {
             Map<String, Agent> live = workers.list().stream()
@@ -1847,6 +1916,16 @@ public final class FleetMcp {
             result.put("loopHealth", Map.of(
                     "statusPoller", loopHealth.statusPoller().get().name(),
                     "sessionReaper", loopHealth.sessionReaper().get().name()));
+            // fleetd #703: a collaborator tab is a person's own tab, so the row is assembled and
+            // included only for the roles that may SEND to a named peer -- gate BEFORE assembling
+            // it, same reason as the coordinator row just below: the key must be absent for a
+            // worker, never present-and-empty.
+            if (collaboratorsVisible) {
+                result.put("collaborators", collaborators.entrySet().stream()
+                        .sorted(Map.Entry.comparingByValue())
+                        .map(e -> collaboratorRow(e.getKey(), e.getValue()))
+                        .toList());
+            }
             // fleetd #439: coordinator/coordinatorView is lead-to-lead coordination state and must
             // never reach a worker or an architect -- gate BEFORE assembling it, not after, so the
             // key is absent rather than present-and-empty.
@@ -2153,7 +2232,22 @@ public final class FleetMcp {
             m.put("self", true);
         }
         String configDir = leadConfigDirs.configDirFor().apply(name);
-        m.put("context", contextView(contextGauge, live, configDir));
+        Long effectiveWindow = leadConfigDirs.windowFor().apply(name);
+        m.put("context", contextView(contextGauge, live, configDir, effectiveWindow));
+        return m;
+    }
+
+    /**
+     * fleetd #703: one row of the {@code collaborators} array — a named peer's registry name and
+     * the herdr {@code terminal_id} a {@code fleet_send} must target to reach it. No status, no
+     * context gauge, no profile: a collaborator is never spawned and carries no profile, so those
+     * fields have no meaning for it, and the scan behind {@code terminal} only reports a tab it
+     * actually found in herdr, so a tab nobody has open does not appear here at all.
+     */
+    private static Map<String, Object> collaboratorRow(String terminal, String name) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("name", name);
+        m.put("sessionId", terminal);
         return m;
     }
 
@@ -2163,12 +2257,15 @@ public final class FleetMcp {
      * {@code fleet.leaders.<name>.profile} → that profile's own {@code configDir:} — or {@code null}
      * when the lead's entry names no profile, or that profile sets no override, in which case
      * {@link LeadContextGauge#read} falls back to its own built-in default
-     * ({@code <user.home>/.claude}).
+     * ({@code <user.home>/.claude}). {@code effectiveWindowTokens} is the same lead's resolved
+     * auto-compact window, or {@code null} when it cannot be resolved, in which case the gauge
+     * falls back to its own fixed HIGH threshold instead.
      */
-    private static Map<String, Object> contextView(LeadContextGauge contextGauge, Agent live, String configDir) {
+    private static Map<String, Object> contextView(LeadContextGauge contextGauge, Agent live, String configDir,
+                                                     Long effectiveWindowTokens) {
         String sessionId = live == null ? null : live.sessionId();
         String agentType = live == null ? null : live.agentType();
-        LeadContextGauge.Reading reading = contextGauge.read(configDir, sessionId, agentType);
+        LeadContextGauge.Reading reading = contextGauge.read(configDir, sessionId, agentType, effectiveWindowTokens);
         Map<String, Object> c = new LinkedHashMap<>();
         c.put("state", reading.state().name().toLowerCase());
         if (reading.tokens() != null) {
@@ -2379,7 +2476,12 @@ public final class FleetMcp {
                         + "msgId/from/preview, never the full body), and one row per coordinator.peers "
                         + "coord-id ('peers': coordId/reachable, plus pending/consumers when reachable) — "
                         + "this is peer DISCOVERY for cross-host leads, distinct from the local 'leads' "
-                        + "array above. It is omitted entirely when no coordinator is configured.",
+                        + "array above. It is omitted entirely when no coordinator is configured. A "
+                        + "'collaborators' array, visible only to the primary, an architect, and a "
+                        + "collaborator (never a worker), reports every other named peer tab this daemon "
+                        + "recognises: each row is 'name' (its registry name) and 'sessionId' (the "
+                        + "terminal id a fleet_send targets to reach it). Absent entirely for a worker, "
+                        + "whatever is configured.",
                 objectSchema(Map.of(), List.of()));
     }
 

fleetd/src/main/java/dev/ltms/fleet/msg/LeadHeartbeatLoop.java

@@ -461,9 +461,9 @@ public final class LeadHeartbeatLoop {
                     .append(reading.compactions()).append(' ').append(compactionWord).append(" so far.");
         } else {
             // A HIGH reading always carries a non-null token count today: LeadContextGauge only
-            // reaches HIGH by comparing a number against HIGH_THRESHOLD_TOKENS. That invariant
-            // lives in another class and nothing asserts it, so this branch does not rely on it —
-            // it drops the token clause rather than printing "null tokens".
+            // reaches HIGH by comparing a number against a threshold. That invariant lives in
+            // another class and nothing asserts it, so this branch does not rely on it — it drops
+            // the token clause rather than printing "null tokens".
             sb.append(" (").append(reading.compactions()).append(' ').append(compactionWord)
                     .append(" so far).");
         }

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -49,22 +49,52 @@ import java.util.stream.Collectors;
  */
 public final class FleetApp {
 
-    /** The authorization action the matching route handler hands to {@link #allow}. */
+    /**
+     * The authorization action the matching route handler hands to {@link #allow}, for a route
+     * whose action does not depend on the request body.
+     */
     static Authz.Action routeAction(String route) {
+        return routeAction(route, null);
+    }
+
+    /**
+     * As above, plus the one route whose action depends on the body: {@code POST
+     * /sessions/{id}/message} carries a {@code turnId} (the answer-a-blocked-worker shape) or not
+     * (a plain delivery), mirroring {@code FleetMcp#sendAction}'s split of the same two call
+     * shapes over MCP. {@code turnId} is ignored by every other route.
+     *
+     * @param turnId the request body's {@code turnId}, or {@code null}/blank when absent or not
+     *               applicable to this route
+     */
+    static Authz.Action routeAction(String route, String turnId) {
         return switch (route) {
             case "GET /metrics" -> Authz.Action.METRICS;
             case "POST /members" -> Authz.Action.SPAWN;
             case "DELETE /members/{paneId}" -> Authz.Action.STOP;
-            case "POST /sessions/{id}/message" -> Authz.Action.SEND;
+            case "POST /sessions/{id}/message" -> turnId == null || turnId.isBlank()
+                    ? Authz.Action.SEND : Authz.Action.ANSWER;
             case "POST /sessions/{id}/reply" -> Authz.Action.REPLY;
             case "GET /sessions/{id}/replies" -> Authz.Action.DRAIN;
             case "POST /sessions/{id}/ask" -> Authz.Action.ASK;
             case "GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                    "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.READ;
+                    "GET /member-credentials" -> Authz.Action.READ;
+            case "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.TASK_READ;
             default -> throw new IllegalArgumentException("route has no authorization gate: " + route);
         };
     }
 
+    /**
+     * The second gate for {@code POST /sessions/{id}/message}: checked only when {@code turnId}
+     * is present and non-blank, against {@link Authz.Action#ANSWER}. A request with no {@code
+     * turnId} passes this gate unconditionally, without consulting {@code permit} at all, having
+     * already cleared the coarse {@link Authz.Action#SEND} grant checked ahead of it.
+     *
+     * @param permit reports whether the caller holds the named grant
+     */
+    static boolean answerGatePasses(String turnId, Predicate<Authz.Action> permit) {
+        return turnId == null || turnId.isBlank() || permit.test(Authz.Action.ANSWER);
+    }
+
     /** Default blocking window for a message; kept under typical HTTP idle timeouts. */
     private static final long DEFAULT_MESSAGE_TIMEOUT_MS = 25_000;
     private static final long MAX_MESSAGE_TIMEOUT_MS = 120_000;
@@ -236,6 +266,21 @@ public final class FleetApp {
         return app;
     }
 
+    /**
+     * The authorization decision behind {@link #allow}, taking the caller directly rather than
+     * pulling it from a servlet {@link Context} — unit-testable without fabricating a live
+     * request, the same reason {@code FleetMcp#denyFor} is split from {@code FleetMcp#deny}.
+     *
+     * @param knownLeadOrCollaborator the classifier a collaborator's {@code SEND} is checked
+     *                                against; pass {@link #auth}'s own {@code
+     *                                knownLeadOrCollaborator()} to exercise the real production
+     *                                gate, as {@link #allow} does
+     */
+    static boolean permitsFor(Principal caller, Authz.Action action, String target,
+                              Predicate<String> knownLeadOrCollaborator) {
+        return Authz.permits(caller, action, target, knownLeadOrCollaborator);
+    }
+
     /**
      * Gate a handler on the CB-505 authorization table. Returns {@code true} when the request may
      * proceed; otherwise writes the error response and returns {@code false}.
@@ -249,8 +294,9 @@ public final class FleetApp {
             return true; // legacy: authorization not enforced
         }
         Principal caller = ctx.attribute(CALLER);
-        if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ && action != Authz.Action.METRICS) {
+        if (permitsFor(caller, action, target, auth.knownLeadOrCollaborator())) {
+            if (action != Authz.Action.READ && action != Authz.Action.METRICS
+                    && action != Authz.Action.TASK_READ) {
                 AuditLog.allowed(caller, action, target); // reads would drown the trail
             }
             return true;
@@ -603,26 +649,37 @@ public final class FleetApp {
      * status-gated injector and block until the worker returns a structured {@code fleet_reply}.
      * Times out with a typed 202 (working / queued / busy) rather than an error — the message may
      * still land.
+     *
+     * <p>Two call shapes share this route, exactly as {@code fleet_send} does over MCP (see
+     * {@code FleetMcp#sendAction}): a plain delivery to {@code id}, and -- when the body carries
+     * {@code turnId} -- resolving a worker's blocked question. The coarse {@link
+     * Authz.Action#SEND} grant is checked first, before the body is read at all; only once that
+     * passes is the body parsed, and a present {@code turnId} is then checked again against
+     * {@link Authz.Action#ANSWER}. A body that fails to parse is rejected with 400 and reaches
+     * neither {@code messages.answer} nor {@code messages.send}.
      */
     private void sendMessage(Context ctx) {
         String id = ctx.pathParam("id");
         if (!allow(ctx, routeAction("POST /sessions/{id}/message"), id)) {
             return;
         }
-        String content;
-        String turnId;
-        long timeout;
-        boolean wait;
+        JsonNode body;
         try {
-            JsonNode body = mapper.readTree(ctx.body());
-            content = body.path("content").asText("");
-            turnId = body.path("turnId").asText(null);
-            timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
-            wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
+            body = mapper.readTree(ctx.body());
         } catch (Exception e) {
+            body = null;
+        }
+        if (body == null) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
             return;
         }
+        String turnId = body.path("turnId").asText(null);
+        if (!answerGatePasses(turnId, action -> allow(ctx, action, id))) {
+            return;
+        }
+        String content = body.path("content").asText("");
+        long timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
+        boolean wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
         if (content.isBlank()) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "content is required"));
             return;

fleetd/src/test/java/dev/ltms/fleet/FleetDeliverabilityTest.java

@@ -14,10 +14,12 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
  * CB-534: the injector's readiness gate must open for a lead as well as for a present worker.
+ * fleetd #669 follow-up: the same gate must also open for a collaborator, which — like a lead —
+ * is never enrolled in {@link MemberPresence} and never discovered by the lead scan.
  *
- * <p>The bug these cover was silent and slow: a lead was never marked present (only workers are), so
- * every lead→lead delivery sat on the gate for the full readiness grace and failed ~60s later without
- * a keystroke ever reaching the pane.
+ * <p>The bug these cover was silent and slow: a lead (and later a collaborator) was never marked
+ * present (only workers are) and never counted as a lead, so every send to one sat on the gate for
+ * the full readiness grace and failed ~60s later without a keystroke ever reaching the pane.
  */
 class FleetDeliverabilityTest {
 
@@ -25,19 +27,25 @@ class FleetDeliverabilityTest {
         return () -> m;
     }
 
+    private static Supplier<Map<String, String>> collaborators(Map<String, String> m) {
+        return () -> m;
+    }
+
     @Test
     @DisplayName("a worker that has connected its MCP is deliverable")
     void presentWorkerIsDeliverable() {
         MemberPresence presence = new MemberPresence();
         presence.markPresent("term_worker");
 
-        assertTrue(Fleetd.deliverableTo(presence, leads(Map.of())).test("term_worker"));
+        assertTrue(Fleetd.deliverableTo(presence, leads(Map.of()), collaborators(Map.of()))
+                .test("term_worker"));
     }
 
     @Test
     @DisplayName("a worker still in its boot window is held back")
     void absentWorkerIsNotDeliverable() {
-        assertFalse(Fleetd.deliverableTo(new MemberPresence(), leads(Map.of())).test("term_booting"));
+        assertFalse(Fleetd.deliverableTo(new MemberPresence(), leads(Map.of()), collaborators(Map.of()))
+                .test("term_booting"));
     }
 
     @Test
@@ -45,19 +53,31 @@ class FleetDeliverabilityTest {
     void leadIsDeliverableWithoutPresence() {
         MemberPresence presence = new MemberPresence();
         Predicate<String> deliverable =
-                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));
+                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")), collaborators(Map.of()));
 
         assertFalse(presence.isPresent("term_lead"), "a lead is never enrolled in worker presence");
         assertTrue(deliverable.test("term_lead"), "…and must be deliverable anyway");
     }
 
     @Test
-    @DisplayName("an unknown terminal is deliverable to neither")
+    @DisplayName("a collaborator is deliverable without ever being marked present or scanned as a lead")
+    void collaboratorIsDeliverableWithoutPresenceOrLeadStatus() {
+        MemberPresence presence = new MemberPresence();
+        Predicate<String> deliverable = Fleetd.deliverableTo(presence, leads(Map.of()),
+                collaborators(Map.of("term_collab", "kevin")));
+
+        assertFalse(presence.isPresent("term_collab"), "a collaborator is never enrolled in worker presence");
+        assertTrue(deliverable.test("term_collab"), "…and must be deliverable anyway");
+    }
+
+    @Test
+    @DisplayName("an unknown terminal is deliverable to none of presence, leads, or collaborators")
     void strangerIsNotDeliverable() {
         MemberPresence presence = new MemberPresence();
         presence.markPresent("term_worker");
 
-        assertFalse(Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")))
+        assertFalse(Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")),
+                        collaborators(Map.of("term_collab", "kevin")))
                 .test("term_stranger"));
     }
 
@@ -65,22 +85,47 @@ class FleetDeliverabilityTest {
     @DisplayName("a lead discovered after startup becomes deliverable with no restart")
     void leadSetIsReadThroughOnEveryCall() {
         Map<String, String> discovered = new HashMap<>();
-        Predicate<String> deliverable = Fleetd.deliverableTo(new MemberPresence(), leads(discovered));
+        Predicate<String> deliverable =
+                Fleetd.deliverableTo(new MemberPresence(), leads(discovered), collaborators(Map.of()));
 
         assertFalse(deliverable.test("term_late"));
         discovered.put("term_late", "gpt-sol-5.6"); // leadScan picks up a newly labelled tab
         assertTrue(deliverable.test("term_late"), "the supplier must be re-read, not snapshotted");
     }
 
+    @Test
+    @DisplayName("a collaborator discovered after startup becomes deliverable with no restart")
+    void collaboratorSetIsReadThroughOnEveryCall() {
+        Map<String, String> discovered = new HashMap<>();
+        Predicate<String> deliverable =
+                Fleetd.deliverableTo(new MemberPresence(), leads(Map.of()), collaborators(discovered));
+
+        assertFalse(deliverable.test("term_late_collab"));
+        discovered.put("term_late_collab", "kevin"); // the same tab scan picks up a newly labelled collaborator tab
+        assertTrue(deliverable.test("term_late_collab"), "the supplier must be re-read, not snapshotted");
+    }
+
     @Test
     @DisplayName("forgetting a torn-down worker does not strip a lead of its deliverability")
     void forgetDoesNotDisarmALead() {
         MemberPresence presence = new MemberPresence();
         Predicate<String> deliverable =
-                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));
+                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")), collaborators(Map.of()));
 
         presence.forget("term_lead"); // the injector's cleanup path runs against every target
 
         assertTrue(deliverable.test("term_lead"));
     }
+
+    @Test
+    @DisplayName("forgetting a torn-down worker does not strip a collaborator of its deliverability")
+    void forgetDoesNotDisarmACollaborator() {
+        MemberPresence presence = new MemberPresence();
+        Predicate<String> deliverable = Fleetd.deliverableTo(presence, leads(Map.of()),
+                collaborators(Map.of("term_collab", "kevin")));
+
+        presence.forget("term_collab"); // the injector's cleanup path runs against every target
+
+        assertTrue(deliverable.test("term_collab"));
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyAuthorizationModeTest.java

@@ -0,0 +1,166 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.auth.Authz;
+import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Asserts that the {@link FleetMcp} built by {@link FleetdAssembly#assembleAndStart} applies the
+ * authorization table: a worker is refused {@code SPAWN}, and the primary is allowed it.
+ */
+class FleetdAssemblyAuthorizationModeTest {
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Binding a real port would clash with any daemon already listening on it.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private TestResourcePorts ports;
+
+    @AfterEach
+    void tearDown() {
+        if (ports != null && ports.shutdownHook != null) {
+            ports.shutdownHook.run();
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                health:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                """);
+        return FleetConfig.load(file);
+    }
+
+    private FleetMcp assemble(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        ports = new TestResourcePorts();
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        return runtime.mcp();
+    }
+
+    /**
+     * Invokes {@code FleetMcp#denyFor}, which is package-private to {@code dev.ltms.fleet.mcp}
+     * while this test is in {@code dev.ltms.fleet}. Nothing here catches a missing method: if
+     * {@code denyFor} is renamed or removed, {@link NoSuchMethodException} propagates and the
+     * test fails.
+     */
+    private static McpSchema.CallToolResult denyFor(FleetMcp mcp, Principal caller, Authz.Action action,
+                                                      String target) throws Exception {
+        Method m = FleetMcp.class.getDeclaredMethod("denyFor", Principal.class, Authz.Action.class, String.class);
+        m.setAccessible(true);
+        return (McpSchema.CallToolResult) m.invoke(mcp, caller, action, target);
+    }
+
+    @Test
+    void productionBootPathRefusesAnUnauthorizedCallerThroughTheAssembledFleetMcp(@TempDir Path dir)
+            throws Exception {
+        FleetMcp mcp = assemble(dir);
+
+        McpSchema.CallToolResult deniedForWorker = denyFor(mcp, Principal.worker("term_a", 200),
+                Authz.Action.SPAWN, "term_a");
+        assertNotNull(deniedForWorker,
+                "a worker must not be able to fleet_spawn through the assembled FleetMcp");
+        assertTrue(deniedForWorker.isError(), "a refusal is returned as an MCP tool error");
+
+        McpSchema.CallToolResult allowedForPrimary = denyFor(mcp, Principal.primary(100),
+                Authz.Action.SPAWN, "term_a");
+        assertNull(allowedForPrimary,
+                "control: the primary must still be allowed to fleet_spawn — otherwise the worker "
+                        + "refusal above would pass even with the gate wired backwards");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyCollaboratorHerdrRoutingTest.java

@@ -0,0 +1,165 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+
+/**
+ * fleetd #669 Unit E. Reaches the real {@link dev.ltms.fleet.herdr.HerdrRouter} that {@link
+ * FleetdAssembly#assembleAndStart} builds and wires — not a copy built for this test — and proves
+ * that a configured collaborator's terminal routes to the LEAD herdr daemon.
+ *
+ * <p>Two distinct {@link FakeHerdr} instances are required, the same pattern {@code
+ * FleetdAssemblyConnectionIdentityTest} and {@code FleetdLeadRolloverAssemblyTest} already use:
+ * with one client shared between {@code herdrSocket} and {@code memberHerdrSocket},
+ * {@code HerdrRouter} folds {@code leadAgents} and {@code memberAgents} into the same instance
+ * (see its constructor), and {@code agentsFor} would return that one object regardless of whether
+ * the collaborator map was ever consulted — invisible to a mutation of the predicate this ticket
+ * fixes. This test's two sockets resolve to two different fakes, so the assertion only passes when
+ * the collaborator's terminal is actually recognised and routed to the lead one.
+ */
+class FleetdAssemblyCollaboratorHerdrRoutingTest {
+
+    private static final Path LEAD_SOCKET = Path.of("/fake/lead-herdr.sock");
+    private static final Path MEMBER_SOCKET = Path.of("/fake/member-herdr.sock");
+
+    private static final class RecordingResourcePorts implements ResourcePorts {
+        final Map<Path, HerdrClient> herdrsBySocket = new LinkedHashMap<>();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            HerdrClient client = herdrsBySocket.get(socketPath);
+            if (client == null) {
+                throw new IllegalStateException("no fake herdr registered for socket " + socketPath);
+            }
+            return client;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Do not bind a real port in this assembly test.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                herdrSocket: "%s"
+                memberHerdrSocket: "%s"
+                idleSleepGuard:
+                  enabled: false
+                fleet:
+                  collaborators:
+                    reviewer-alex:
+                      tab: "collab: alex"
+                profiles:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                """.formatted(LEAD_SOCKET, MEMBER_SOCKET));
+        return FleetConfig.load(file);
+    }
+
+    @Test
+    void assembledRouterRoutesACollaboratorTerminalToTheLeadDaemon(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        RecordingResourcePorts ports = new RecordingResourcePorts();
+
+        // The fixed FakeHerdr fixture already ties terminal "term_a" to a live agent on tab
+        // "w2:t7" (pane "w2:p7") — seeding only the tab LABEL to match the configured collaborator
+        // is enough to make LeadTabScanner resolve "term_a" as that collaborator. Seeded on the
+        // LEAD fake only: a collaborator's pane lives in the lead daemon, exactly like a lead's.
+        FakeHerdr lead = new FakeHerdr().withTab("w2", "w2:t7", "collab: alex");
+        FakeHerdr member = new FakeHerdr();
+        ports.herdrsBySocket.put(LEAD_SOCKET, lead);
+        ports.herdrsBySocket.put(MEMBER_SOCKET, member);
+
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        try {
+            assertSame(runtime.router().leadAgents(), runtime.router().agentsFor("term_a"),
+                    "a configured collaborator's terminal must route to the LEAD daemon — "
+                            + "FleetdAssembly must wire the collaborator map into the router's "
+                            + "predicate, not just LeadTabScanner.get()");
+            assertSame(runtime.router().memberAgents(), runtime.router().agentsFor("term_shell"),
+                    "control: a terminal naming neither a lead nor a collaborator (term_shell, on "
+                            + "the unlabelled tab w2:t8) must still route to the member daemon");
+        } finally {
+            assertNotNull(ports.shutdownHook, "control: assembly must capture its shutdown hook");
+            ports.shutdownHook.run();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyFleetAppTest.java

@@ -58,20 +58,31 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
  * {@code HttpClient} — no accessor needed for this half.
  *
  * <p><strong>{@code GET /sessions} could not be driven the same way</strong>, so this class does
- * not pin the merge half of the deleted test's javadoc. {@code /sessions} requires
- * {@code Authz.Action.READ}, which — through the REAL assembly's real {@code
- * CallerResolver}/{@code ConnectionIdentity} (built with a hardcoded {@code
- * new LsofPeerPidLookup()}) — needs {@code Caller.resolved()}, i.e. a real positive pid from
- * {@code lsof}. {@code LsofPeerPidLookup} excludes its own pid (see its javadoc), and a JUnit
- * test's HTTP client and the daemon under test share one JVM pid, so the resolved pid is always
- * {@code -1} and every such request is refused as {@code ANONYMOUS} (fleetd #317's fail-closed
- * rule) before the route handler — and its {@code memberHerdr} merge — is ever reached. Verified
- * directly: driving {@code GET /sessions} here returns {@code 401 unauthenticated}, not the
- * merged body. {@code FleetAppTwoDaemonTest} avoids this because it builds {@code FleetApp} with
- * {@code callers: null}, which is not what the real assembly passes. The {@code /healthz} pin
- * below is what this class relies on for CB-185's {@code FleetApp} half; {@code
- * FleetAppTwoDaemonTest} remains the full behavioural proof that {@code FleetApp} itself merges
- * {@code /sessions} correctly once handed two clients.
+ * not pin the merge half of the deleted test's javadoc. This class configures no {@code auth:}
+ * block, so it runs under the default {@code loopback-trust} mode ({@code FleetConfig}). Under
+ * that mode, {@code /sessions} requires {@code Authz.Action.READ}, which — through the REAL
+ * assembly's real {@code CallerResolver}/{@code ConnectionIdentity} (built with a hardcoded
+ * {@code new LsofPeerPidLookup()}) — needs {@code Caller.resolved()}, i.e. a real positive pid
+ * from {@code lsof}. {@code LsofPeerPidLookup} excludes its own pid (see its javadoc), and a
+ * JUnit test's HTTP client and the daemon under test share one JVM pid, so the resolved pid is
+ * always {@code -1} and every such request is refused as {@code ANONYMOUS} (fleetd #317's
+ * fail-closed rule) before the route handler — and its {@code memberHerdr} merge — is ever
+ * reached. Verified directly: driving {@code GET /sessions} here returns {@code 401
+ * unauthenticated}, not the merged body. {@code FleetAppTwoDaemonTest} avoids this because it
+ * builds {@code FleetApp} with {@code callers: null}, which is not what the real assembly
+ * passes. The {@code /healthz} pin below is what this class relies on for CB-185's {@code
+ * FleetApp} half; {@code FleetAppTwoDaemonTest} remains the full behavioural proof that
+ * {@code FleetApp} itself merges {@code /sessions} correctly once handed two clients.
+ *
+ * <p><strong>This refusal is {@code loopback-trust}-specific, not a property of {@code
+ * CallerResolver} in general.</strong> Under {@code auth.mode: token}, {@code
+ * CallerResolver#resolve} returns before ever consulting {@code Caller.resolved()} or {@code
+ * Caller.scanComplete()}: a request carrying a valid bearer token in its {@code Authorization}
+ * header resolves to {@code Role#PRIMARY} with no pid lookup at all, so the same-JVM-pid
+ * exclusion above never comes into play. {@code FleetdQuarantineOutageDualWindowAssemblyTest}
+ * and {@code FleetdListReportingSourcesAssemblyTest} both drive {@code Authz.Action.READ} this
+ * way, over a real {@code McpSyncClient}/{@code HttpClient} against a real {@code
+ * FleetdAssembly#assembleAndStart}, and both get the real response rather than a refusal.
  *
  * <p><strong>fleetd #629 follow-up.</strong> The fix below (see {@link TwoHerdrResourcePorts})
  * makes {@link #healthzGoesRedWhenTheLeadDaemonIsDownEvenThoughTheMemberIsUp}'s fake {@code

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyLeadTabScannerExclusionTest.java

@@ -0,0 +1,200 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.msg.LeadChannelHandle;
+import dev.ltms.fleet.msg.LeadCoordLoop;
+import dev.ltms.fleet.msg.LeadMessage;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #670 — pins the {@code excludedWorkspaceLabels} argument {@link FleetdAssembly}'s
+ * production boot path passes to {@link LeadTabScanner} ({@code Set.of()}).
+ *
+ * <p>{@code LeadTabScannerTest} already covers this constructor parameter, but it builds its own
+ * {@link LeadTabScanner} with its own set, so it tests the seam and proves nothing about the
+ * producer. This test instead reaches the exact object {@link FleetdAssembly#assembleAndStart}
+ * builds: a {@code fleet.leaders:} block makes the assembly construct a real
+ * {@link LeadTabScanner} for its local {@code leads} supplier, and a {@code coordinator:} block
+ * makes it hand that same supplier instance to {@link LeadCoordLoop} (fleetd #637), which stores
+ * it as a field. Reflection recovers it from there, and then from the scanner itself, so the
+ * assertion is against the real production argument rather than a copy built for this test.
+ */
+class FleetdAssemblyLeadTabScannerExclusionTest {
+
+    private static final class FakeLeadChannel implements LeadChannelHandle {
+        @Override
+        public void publish(String toCoordId, LeadMessage message) {
+        }
+
+        @Override
+        public List<LeadMessage> peek() {
+            return List.of();
+        }
+
+        @Override
+        public void ack(String msgId) {
+        }
+
+        @Override
+        public String selfCoordId() {
+            return "test-lead";
+        }
+
+        @Override
+        public boolean heldDurable() {
+            return true;
+        }
+
+        @Override
+        public MailboxState inspect(String coordId) {
+            return MailboxState.unknown(coordId);
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> new FakeLeadChannel();
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Do not bind a real port in this assembly test.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                coordinator:
+                  uri: "amqp://fake-lead-broker/vh"
+                  selfId: "test-lead"
+                fleet:
+                  leaders:
+                    primary:
+                      tab: "lead: primary"
+                      profile: sonnet
+                profiles:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                """);
+        return FleetConfig.load(file);
+    }
+
+    @Test
+    void productionBootPathPassesNoExcludedWorkspaceLabels(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        TestResourcePorts ports = new TestResourcePorts();
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        try {
+            LeadCoordLoop coordLoop = runtime.leadCoordLoop();
+            assertNotNull(coordLoop, "control: a configured coordinator: block must build LeadCoordLoop");
+
+            Field leadsField = LeadCoordLoop.class.getDeclaredField("leads");
+            leadsField.setAccessible(true);
+            @SuppressWarnings("unchecked")
+            Supplier<Map<String, String>> leads = (Supplier<Map<String, String>>) leadsField.get(coordLoop);
+
+            assertInstanceOf(LeadTabScanner.class, leads,
+                    "control: a non-empty fleet.leaders: block must make FleetdAssembly build a real "
+                            + "LeadTabScanner for its `leads` supplier, not the Map::of fallback — "
+                            + "otherwise this test would pass for the wrong reason");
+
+            Field excludedField = LeadTabScanner.class.getDeclaredField("excludedWorkspaceLabels");
+            excludedField.setAccessible(true);
+            Set<?> excluded = (Set<?>) excludedField.get(leads);
+
+            assertTrue(excluded.isEmpty(),
+                    "FleetdAssembly must pass an empty excludedWorkspaceLabels to "
+                            + "LeadTabScanner — scanning member tabs would demote the lead to a worker");
+        } finally {
+            assertNotNull(ports.shutdownHook, "control: assembly must capture its shutdown hook");
+            ports.shutdownHook.run();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyLoopHealthTest.java

@@ -0,0 +1,180 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.inject.LoopWatchdog;
+import dev.ltms.fleet.mcp.FleetMcp;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #612 Shape A, rank 10: {@link FleetdAssembly} creates one {@link FleetMcp.LoopHealthSource}
+ * from the real started {@code StatusPoller} and {@code SessionReaper}, then gives it to two operator
+ * windows. These tests reach the real assembled objects through {@link FleetdRuntime}, rather than
+ * building a second source beside them. A hardcoded {@code RUNNING} source would pass a simple
+ * "running" test, so the mutation proof also mis-wires the source to never-started loops: both
+ * windows must then report {@code STOPPED} and these assertions go red.
+ */
+class FleetdAssemblyLoopHealthTest {
+
+    private static final class RecordingResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new dev.ltms.fleet.msg.InMemoryReplyInbox();
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException("no coordinator is configured");
+            };
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("healthy FakeHerdr must not be polled");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Bind runtime.app() to an ephemeral port only in the REST assertion below.
+        }
+    }
+
+    private final HttpClient http = HttpClient.newHttpClient();
+    private RecordingResourcePorts ports;
+    private FleetdRuntime runtime;
+    private Javalin boundApp;
+
+    @AfterEach
+    void tearDown() {
+        if (boundApp != null) {
+            boundApp.stop();
+        }
+        if (runtime != null) {
+            runtime.close();
+        }
+        if (ports != null) {
+            assertNotNull(ports.shutdownHook, "the assembly must register its shutdown hook");
+            assertTrue(ports.herdr.closed, "FleetdRuntime.close must close the real assembled herdr client");
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                lifecycle:
+                  idleTtlSeconds: 600
+                idleSleepGuard:
+                  enabled: false
+                health:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                """);
+        return FleetConfig.load(file);
+    }
+
+    private void assemble(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        ports = new RecordingResourcePorts();
+        runtime = FleetdAssembly.assembleAndStart(
+                new AssemblyInputs(cfg, new ConfigRef(dir.resolve("fleetd.yaml"), cfg),
+                        new SubscriptionGuard(cfg.guard().hostSet())), ports);
+    }
+
+    @Test
+    void fleetListUsesTheRunningLoopsInTheRealAssembledMcp(@TempDir Path dir) throws Exception {
+        assemble(dir);
+
+        // The field is the exact source captured by FleetMcp's fleet_list handler. Reflection is
+        // necessary because FleetMcp has no public source accessor; it is not a source-text check.
+        FleetMcp.LoopHealthSource loopHealth = loopHealthOf(runtime.mcp());
+        assertRunning(loopHealth, "FleetMcp's real fleet_list source");
+    }
+
+    @Test
+    void healthzUsesTheRunningLoopsInTheRealAssembledApp(@TempDir Path dir) throws Exception {
+        assemble(dir);
+        boundApp = runtime.app().start("127.0.0.1", 0);
+
+        HttpRequest request = HttpRequest.newBuilder(
+                URI.create("http://127.0.0.1:" + boundApp.port() + "/healthz")).GET().build();
+        HttpResponse<String> response = http.send(request, HttpResponse.BodyHandlers.ofString());
+        assertEquals(200, response.statusCode(), response.body());
+        assertTrue(response.body().contains("\"statusPoller\":\"RUNNING\""), response.body());
+        assertTrue(response.body().contains("\"sessionReaper\":\"RUNNING\""), response.body());
+    }
+
+    private static FleetMcp.LoopHealthSource loopHealthOf(FleetMcp mcp) throws Exception {
+        Field field = FleetMcp.class.getDeclaredField("loopHealth");
+        field.setAccessible(true);
+        return (FleetMcp.LoopHealthSource) field.get(mcp);
+    }
+
+    private static void assertRunning(FleetMcp.LoopHealthSource source, String consumer) {
+        assertEquals(LoopWatchdog.State.RUNNING, source.statusPoller().get(),
+                consumer + " must report the started real StatusPoller as RUNNING");
+        assertEquals(LoopWatchdog.State.RUNNING, source.sessionReaper().get(),
+                consumer + " must report the started real SessionReaper as RUNNING");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyTimingDefaultsTest.java

@@ -0,0 +1,190 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.StatusPoller;
+import dev.ltms.fleet.msg.LeadChannelHandle;
+import dev.ltms.fleet.msg.LeadCoordLoop;
+import dev.ltms.fleet.msg.LeadMessage;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.msg.ReplyPushLoop;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+/**
+ * Asserts that the assembled loops use the production reminder, coordination, and delivery timing
+ * defaults when no {@code primary:} block configures the reply-push values.
+ */
+class FleetdAssemblyTimingDefaultsTest {
+
+    private static final class FakeLeadChannel implements LeadChannelHandle {
+        @Override
+        public void publish(String toCoordId, LeadMessage message) {
+        }
+
+        @Override
+        public List<LeadMessage> peek() {
+            return List.of();
+        }
+
+        @Override
+        public void ack(String msgId) {
+        }
+
+        @Override
+        public String selfCoordId() {
+            return "test-lead";
+        }
+
+        @Override
+        public boolean heldDurable() {
+            return true;
+        }
+
+        @Override
+        public MailboxState inspect(String coordId) {
+            return MailboxState.unknown(coordId);
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> new FakeLeadChannel();
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private TestResourcePorts ports;
+
+    @AfterEach
+    void tearDown() {
+        if (ports != null && ports.shutdownHook != null) {
+            ports.shutdownHook.run();
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                coordinator:
+                  uri: "amqp://fake-lead-broker/vh"
+                  selfId: "test-lead"
+                """);
+        return FleetConfig.load(file);
+    }
+
+    private FleetdRuntime assemble(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        ports = new TestResourcePorts();
+        return FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+    }
+
+    private static long longField(Object target, String name) throws Exception {
+        Field field = target.getClass().getDeclaredField(name);
+        field.setAccessible(true);
+        return field.getLong(target);
+    }
+
+    @Test
+    void productionBootPathUsesTheExpectedLoopTimingDefaults(@TempDir Path dir) throws Exception {
+        FleetdRuntime runtime = assemble(dir);
+
+        ReplyPushLoop pushLoop = runtime.pushLoop();
+        assertEquals(5, longField(pushLoop, "maxReminders"),
+                "without primary:, ReplyPushLoop must stop after five reminder attempts");
+        assertEquals(15_000L, longField(pushLoop, "backoffMs"),
+                "without primary:, ReplyPushLoop must wait fifteen seconds before the next reminder");
+
+        LeadCoordLoop leadCoordLoop = runtime.leadCoordLoop();
+        assertNotNull(leadCoordLoop, "control: coordinator: must build LeadCoordLoop");
+        assertEquals(3_000L, longField(leadCoordLoop, "intervalMs"),
+                "LeadCoordLoop must poll for peer-lead mail every three seconds");
+
+        StatusPoller poller = runtime.poller();
+        assertEquals(Injector.POLL_INTERVAL_MILLIS, longField(poller, "intervalMillis"),
+                "StatusPoller must use Injector's delivery poll interval");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyTurnRegistrarBehaviouralTest.java

@@ -0,0 +1,184 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.TurnListener;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #612 rank 12 — {@code FleetdAssembly} supplies the {@link Injector}'s {@code TurnRegistrar}
+ * with {@code Fleetd.turnRegistrar(completion)}. The normal delivery path cannot distinguish that
+ * registrar from {@code TurnRegistrar.NOOP}: {@link dev.ltms.fleet.inject.CompletionResolver#onDelivered}
+ * registers the same turn shortly afterwards. The distinction matters when a delivery listener throws
+ * after the pane received the message but before normal completion runs. The registrar must already have
+ * registered the waiter with the REAL assembled resolver, so a later completion can still resolve it.
+ *
+ * <p>The test installs a throwing wrapper around the real assembled listener. It does not replace the
+ * registrar or resolver. This constructs the narrow failure condition without a sleep, then observes the
+ * real resolver through {@link FleetdRuntime#completion()}. An inert registrar, or a registrar wired to a
+ * throwaway resolver, leaves this waiter's turn absent from the real resolver and makes the final assertion
+ * fail.
+ */
+class FleetdAssemblyTurnRegistrarBehaviouralTest {
+
+    private static final String TARGET = "term_a";
+
+    private static final class ControllableResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        final AtomicLong nowNanos = new AtomicLong(1_000_000_000L);
+        Runnable shutdownHook;
+
+        void advanceSeconds(long seconds) {
+            nowNanos.addAndGet(TimeUnit.SECONDS.toNanos(seconds));
+        }
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> {
+                throw new UnsupportedOperationException("no broker: block is configured");
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException("no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return nowNanos::get;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return nowNanos::get;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Do not bind a real port in this assembly test.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                fleet:
+                  leaders:
+                    primary:
+                      tab: "lead: primary"
+                      profile: sonnet
+                profiles:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                """);
+        return FleetConfig.load(file);
+    }
+
+    @Test
+    void realAssembledResolverStillResolvesAfterDeliveredListenerThrows(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        ControllableResourcePorts ports = new ControllableResourcePorts();
+        ports.herdr.withTab("w2", "w2:t7", "lead: primary");
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        try {
+            Injector injector = runtime.injector();
+            installThrowingDeliveredListener(injector);
+
+            CompletableFuture<Rendezvous.Resolution> waiter = new CompletableFuture<>();
+            injector.enqueue(TARGET, "brief", new TurnToken(TARGET, waiter));
+
+            IllegalStateException thrown = assertThrows(IllegalStateException.class,
+                    () -> injector.onStatus(TARGET, AgentStatus.IDLE),
+                    "control: delivery must reach the installed listener and it must throw after delivery");
+            assertTrue(thrown.getMessage().contains("listener failure"), thrown::getMessage);
+
+            ports.herdr.readText("worker report after the listener failure");
+            ports.advanceSeconds(3);
+            runtime.completion().resolveBeforePostAction(TARGET);
+
+            assertTrue(waiter.isDone(),
+                    "FleetdAssembly must wire the Injector registrar to this runtime's real CompletionResolver: "
+                            + "after a delivered listener throws, resolveBeforePostAction must still find and "
+                            + "resolve the registered waiter");
+        } finally {
+            assertTrue(ports.shutdownHook != null, "control: assembly must capture its shutdown hook");
+            ports.shutdownHook.run();
+            assertTrue(ports.herdr.closed, "teardown control: the captured shutdown hook must close herdr");
+        }
+    }
+
+    private static void installThrowingDeliveredListener(Injector injector) throws Exception {
+        Field field = Injector.class.getDeclaredField("turnListener");
+        field.setAccessible(true);
+        field.set(injector, new TurnListener() {
+            @Override
+            public void onTurnComplete(String target) {
+            }
+
+            @Override
+            public void onDelivered(String target, TurnToken token) {
+                throw new IllegalStateException("listener failure after delivery");
+            }
+        });
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdConfigRefWiringTest.java

@@ -24,8 +24,8 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  * {@code ConfigRefTest} and {@code FleetdConfigRefCharterToolSurfaceWiringTest} case — because
  * neither of those tests constructs its {@code ConfigRef} through {@code main}; both build their own
  * instance directly, wired with the check by hand. That silent regression is exactly the shape
- * {@link FleetdBackendQuarantineWiringTest}, {@link FleetdLeadSeatWiringTest} and {@link
- * FleetdCompletionResolverWiringTest} already guard against for their own constructor arguments —
+ * {@link FleetdBackendQuarantineAssemblyTest}, {@link FleetdLeadSeatAssemblyTest} and {@link
+ * FleetdCompletionResolverAssemblyTest} already guard against for their own constructor arguments —
  * this class is the same class of gap for fleetd #474's {@code extraValidation} argument, following
  * their approach.
  *

fleetd/src/test/java/dev/ltms/fleet/FleetdHerdrControlConstructionTest.java

@@ -2,16 +2,67 @@ package dev.ltms.fleet;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
+/**
+ * {@code AgentControl} caches {@code paneByTerminal}, so {@code HerdrRouter} must be its only
+ * production factory — a second instance means a second cache; the same reasoning applies to
+ * {@code WorkspaceControl}. {@code HerdrRouter}'s constructor is the one place both are built.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a {@code
+ * HerdrRouter} and never runs {@code FleetdAssembly.assembleAndStart} — a green result proves only
+ * that neither watched file's text contains {@code new AgentControl(} or {@code new
+ * WorkspaceControl(}. It does not prove the instances {@code HerdrRouter} does build are the ones
+ * actually wired through the rest of the daemon, and it does not cover a bypass written into a
+ * production file other than the two this test reads.
+ */
 class FleetdHerdrControlConstructionTest {
+
+    private static String source(String relativePath) throws Exception {
+        return Files.readString(Path.of(relativePath));
+    }
+
     @Test
+    @DisplayName("[SOURCE TEXT] Fleetd.java never constructs AgentControl or WorkspaceControl directly")
     void fleetdDelegatesStatefulControlsToTheRouter() throws Exception {
-        // AgentControl caches paneByTerminal, so the router must be its only production factory.
-        String source = Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
-        assertFalse(source.contains("new AgentControl("));
-        assertFalse(source.contains("new WorkspaceControl("));
+        String source = source("src/main/java/dev/ltms/fleet/Fleetd.java");
+
+        // A broken read (wrong working directory, wrong path, a file that came back empty) would
+        // make the assertFalse checks below pass vacuously — a "clean" negative check that actually
+        // checked nothing. Guard against that first, with an anchor that has nothing to do with
+        // this mutation, so a bad read fails loudly here instead of silently proving nothing below.
+        assertTrue(source.contains("public final class Fleetd"),
+                "the read of Fleetd.java did not come back containing its own class declaration — "
+                        + "the assertFalse checks below would pass vacuously on a broken read; fix the "
+                        + "read before trusting this test.");
+
+        assertFalse(source.contains("new AgentControl("),
+                "Fleetd.java must not construct AgentControl directly — HerdrRouter is its only "
+                        + "production factory");
+        assertFalse(source.contains("new WorkspaceControl("),
+                "Fleetd.java must not construct WorkspaceControl directly — HerdrRouter is its only "
+                        + "production factory");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] FleetdAssembly.java never constructs AgentControl or WorkspaceControl directly")
+    void fleetdAssemblyDelegatesStatefulControlsToTheRouter() throws Exception {
+        String source = source("src/main/java/dev/ltms/fleet/FleetdAssembly.java");
+
+        assertTrue(source.contains("final class FleetdAssembly"),
+                "the read of FleetdAssembly.java did not come back containing its own class "
+                        + "declaration — the assertFalse checks below would pass vacuously on a broken "
+                        + "read; fix the read before trusting this test.");
+
+        assertFalse(source.contains("new AgentControl("),
+                "FleetdAssembly.java must not construct AgentControl directly — HerdrRouter is its "
+                        + "only production factory");
+        assertFalse(source.contains("new WorkspaceControl("),
+                "FleetdAssembly.java must not construct WorkspaceControl directly — HerdrRouter is "
+                        + "its only production factory");
     }
 }

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadConfigDirSourceAssemblyTest.java

@@ -0,0 +1,213 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * fleetd #612 Shape A, unit r5 — {@code FleetdAssembly.java:488} wires {@link
+ * FleetMcp.LeadConfigDirSource} with {@code Fleetd.leadConfigDirSource(() -> config.get().profiles(),
+ * leaders)}. {@link FleetdLeadConfigDirSourceWiringTest} already pins that the FACTORY itself
+ * delegates to the real {@link Fleetd#leadConfigDirLookup} — but, by its own javadoc, it "does not
+ * and structurally cannot cover" whether the real call site in {@code FleetdAssembly} still calls
+ * that factory at all. Measured there: swapping that one-line call for a bare {@code
+ * FleetMcp.LeadConfigDirSource.none()} compiles with 0 errors and leaves the full suite green.
+ *
+ * <p>This is the literal fleetd #602/#606 defect, one call site away from its own fix: {@code main}
+ * (now {@code FleetdAssembly}) used to build {@code LeadConfigDirSource.none()} inline, the whole
+ * suite passed, and the live daemon reported {@code "state":"unknown"} for every lead's context,
+ * forever, with no test noticing. The fix extracted the factory; this test is the one that proves
+ * {@code FleetdAssembly}'s own call site still reaches it.
+ *
+ * <p>This test drives the REAL {@link FleetMcp} the real {@link FleetdAssembly#assembleAndStart}
+ * builds, reached through {@link FleetdRuntime#mcp()}, and reads the {@code leadConfigDirs} field it
+ * was constructed with via reflection — {@code FleetMcp} exposes no public accessor for it (unlike
+ * {@code quarantineSource()}/{@code leadSeatSource()}), so there is no non-reflective route to the
+ * live instance. The assertion resolves a REAL lead name against a REAL configured {@code
+ * configDir:}: {@link FleetMcp.LeadConfigDirSource#none()} (the historical defect, and the
+ * mis-wire this test's mutation cycles reintroduce) always returns {@code null} regardless of the
+ * input, so a non-null, config-matching answer is a property {@code none()} can never produce by
+ * accident.
+ */
+class FleetdLeadConfigDirSourceAssemblyTest {
+
+    private static final String LEAD_NAME = "opus";
+    private static final String LEAD_TAB = "lead: opus";
+    private static final String LEAD_PROFILE = "sonnet";
+
+    private static final class RecordingResourcePorts implements ResourcePorts {
+
+        final FakeHerdr herdr = new FakeHerdr();
+        final SentinelReplyInbox replyInbox = new SentinelReplyInbox();
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> replyInbox;
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            // Never invoked: this test's FakeHerdr answers immediately, so awaitHerdr never polls.
+            return () -> {
+                throw new UnsupportedOperationException("herdrPollWait must not be called — herdr is healthy");
+            };
+        }
+    }
+
+    private static final class SentinelReplyInbox implements ReplyInbox, AutoCloseable {
+        @Override
+        public void own(String target) {
+        }
+
+        @Override
+        public void release(String target) {
+        }
+
+        @Override
+        public void publish(String target, String msgId, String content) {
+        }
+
+        @Override
+        public List<InboxMessage> peek(String target) {
+            return List.of();
+        }
+
+        @Override
+        public boolean ack(String target, String msgId) {
+            return false;
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir, String configDir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                fleet:
+                  leaders:
+                    %s:
+                      tab: "%s"
+                      profile: %s
+                profiles:
+                  %s:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    configDir: "%s"
+                """.formatted(LEAD_NAME, LEAD_TAB, LEAD_PROFILE, LEAD_PROFILE, configDir));
+        return FleetConfig.load(f);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static FleetMcp.LeadConfigDirSource leadConfigDirSourceOf(FleetMcp mcp) throws Exception {
+        Field field = FleetMcp.class.getDeclaredField("leadConfigDirs");
+        field.setAccessible(true);
+        return (FleetMcp.LeadConfigDirSource) field.get(mcp);
+    }
+
+    @Test
+    @DisplayName("[BEHAVIOURAL] the real assembled LeadConfigDirSource resolves a lead's REAL "
+            + "configured configDir, not the none() stand-in's hardcoded null")
+    void assembledLeadConfigDirSourceResolvesTheRealConfiguredConfigDir(@TempDir Path dir) throws Exception {
+        String configuredConfigDir = "/mnt/fake-lead-configdir";
+        FleetConfig cfg = writeConfig(dir, configuredConfigDir);
+        ConfigRef config = new ConfigRef(dir.resolve("fleetd.yaml"), cfg);
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        RecordingResourcePorts ports = new RecordingResourcePorts();
+        // Label FakeHerdr's own default pane's tab (term_a / w2:p7 / w2:t7, already carrying a live
+        // agent) to match fleet.leaders.opus.tab exactly, so LeadLauncher.ensureLeads() sees the
+        // lead as already live and does not try to auto-launch a second one.
+        ports.herdr.withTab("w2", "w2:t7", LEAD_TAB);
+
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg, config, guard), ports);
+        try {
+            FleetMcp.LeadConfigDirSource source = leadConfigDirSourceOf(runtime.mcp());
+
+            assertEquals(configuredConfigDir, source.configDirFor().apply(LEAD_NAME),
+                    "fleet.leaders." + LEAD_NAME + ".profile (" + LEAD_PROFILE + ") configures "
+                            + "configDir: " + configuredConfigDir + " — the real assembled source must "
+                            + "resolve it. FleetMcp.LeadConfigDirSource.none() (the inert stand-in "
+                            + "this test's mutation cycles swap the call site for, and the historical "
+                            + "fleetd #602/#606 defect) always reports null here, whatever the input");
+
+            // A lead name the config does not recognise still resolves to null, not a crash — the
+            // same source, applied to an input that must stay at the inert answer even on the real,
+            // non-inert instance.
+            assertNull(source.configDirFor().apply("no-such-lead"));
+        } finally {
+            // Surefire runs the whole suite in one JVM fork (fleetd/pom.xml sets no forkCount /
+            // reuseForks), so the scheduler/loops this assembly starts must be torn down here, on the
+            // failure path too — hence try/finally rather than a bare statement at the end.
+            runtime.close();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadConfigDirSourceWindowWiringTest.java

@@ -0,0 +1,63 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.mcp.FleetMcp;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * Pins {@link Fleetd#leadConfigDirSource}'s own wiring of the window lookup into the returned
+ * {@link FleetMcp.LeadConfigDirSource}, not only the detached {@link Fleetd#leadContextWindowLookup}
+ * factory it delegates to. Calls the producer directly, with real {@link FleetConfig.Profile}/
+ * {@link FleetConfig.Leader} fixtures, and asserts on {@code windowFor()} — the companion of
+ * {@link FleetdLeadConfigDirSourceWiringTest}, which pins the same factory's {@code configDirFor()}.
+ */
+class FleetdLeadConfigDirSourceWindowWiringTest {
+
+    private static FleetConfig.Profile profileWithWindow(String name, Integer autoCompactWindow) {
+        return new FleetConfig.Profile(name, null, "claude-sonnet-5", null, null, null,
+                "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
+                null, null, true, null, null, null, null, null, autoCompactWindow, null);
+    }
+
+    private static FleetConfig.Leader leadOnProfile(String profile) {
+        return new FleetConfig.Leader(profile, "lead: primary", 1, "lead:", 10, "claude", "claude-sonnet-5");
+    }
+
+    @Test
+    @DisplayName("the returned source resolves the lead's REAL configured effective window, not a hardcoded null")
+    void resolvesTheRealConfiguredWindow() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("opus", profileWithWindow("opus", 250_000));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+
+        FleetMcp.LeadConfigDirSource source = Fleetd.leadConfigDirSource(() -> profiles, leaders);
+
+        assertEquals(250_000L, source.windowFor().apply("primary"),
+                "windowFor must delegate to the real leadContextWindowLookup, not a stub that always "
+                        + "returns null");
+    }
+
+    @Test
+    @DisplayName("a lead on a profile with no window configured still resolves to null, not a crash")
+    void leadWithNoWindowConfiguredResolvesToNull() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("opus", profileWithWindow("opus", null));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+
+        FleetMcp.LeadConfigDirSource source = Fleetd.leadConfigDirSource(() -> profiles, leaders);
+
+        assertNull(source.windowFor().apply("primary"));
+    }
+
+    @Test
+    @DisplayName("an unrecognised lead name resolves to null, not a thrown exception")
+    void unrecognisedLeadNameResolvesToNull() {
+        FleetMcp.LeadConfigDirSource source = Fleetd.leadConfigDirSource(Map::of, Map.of());
+
+        assertNull(source.windowFor().apply("ghost-lead"));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextLookupTest.java

@@ -99,7 +99,7 @@ class FleetdLeadContextLookupTest {
     @DisplayName("an unrecognised terminal resolves to UNKNOWN, not a thrown exception")
     void unrecognisedTerminalResolvesToUnknown() {
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
-                new LeadContextGauge(), throwingAgentControl(), Map::of, name -> null);
+                new LeadContextGauge(), throwingAgentControl(), Map::of, name -> null, name -> null);
 
         LeadContextGauge.Reading reading = assertDoesNotThrow(() -> lookup.apply("ghost-terminal"));
 
@@ -112,7 +112,7 @@ class FleetdLeadContextLookupTest {
     void agentsGetThrowingDegradesToUnknown() {
         Map<String, String> liveLeadTerminals = Map.of(LEAD_TERMINAL, LEAD_NAME);
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
-                new LeadContextGauge(), throwingAgentControl(), () -> liveLeadTerminals, name -> null);
+                new LeadContextGauge(), throwingAgentControl(), () -> liveLeadTerminals, name -> null, name -> null);
 
         LeadContextGauge.Reading reading = assertDoesNotThrow(() -> lookup.apply(LEAD_TERMINAL));
 
@@ -128,7 +128,7 @@ class FleetdLeadContextLookupTest {
         AgentControl agents = agentControlStub(SESSION_ID, "claude", "idle");
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
                 new LeadContextGauge(), agents, () -> liveLeadTerminals,
-                name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = lookup.apply(LEAD_TERMINAL);
 
@@ -146,7 +146,7 @@ class FleetdLeadContextLookupTest {
         AgentControl agents = agentControlStub(SESSION_ID, "opencode", "idle");
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
                 new LeadContextGauge(), agents, () -> liveLeadTerminals,
-                name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = lookup.apply(LEAD_TERMINAL);
 

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextSourceWindowAssemblyTest.java

@@ -0,0 +1,223 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.lead.LeadContextGauge;
+import dev.ltms.fleet.msg.LeadHeartbeatLoop;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * fleetd #659: {@code FleetdAssembly.java} wires {@code Fleetd.leadContextSource}'s window-lookup
+ * argument with {@code Fleetd.leadContextWindowLookup(() -> config.get().profiles(), leaders)} —
+ * but nothing called the real assembled {@link LeadHeartbeatLoop} far enough to prove that
+ * argument is the one the live heartbeat reads through. Measured: swapping that one call-site
+ * argument for {@code _ -> null} compiles with 0 errors and leaves the full suite green.
+ *
+ * <p>This test drives the REAL {@link LeadHeartbeatLoop} the real {@link
+ * FleetdAssembly#assembleAndStart} builds, reached through {@link FleetdRuntime#heartbeat()}, and
+ * reads its private {@code contextSource} field via reflection — the loop exposes no public
+ * accessor for it, the same reason {@link FleetdLeadConfigDirSourceAssemblyTest} reflects on
+ * {@code FleetMcp.leadConfigDirs}. The configured profile's {@code autoCompactWindow: 100000}
+ * resolves a HIGH threshold of {@code 66666} ({@link LeadContextGauge}'s {@code 2/3} fraction) —
+ * far below the fixed {@code 200000} fallback a lost window argument would silently revert to.
+ * {@code 90000} live tokens sits between the two: HIGH under the real window, OK under the
+ * fallback — a property the fallback can never produce by accident.
+ */
+class FleetdLeadContextSourceWindowAssemblyTest {
+
+    private static final String LEAD_NAME = "opus";
+    private static final String LEAD_TAB = "lead: opus";
+    private static final String LEAD_PROFILE = "sonnet";
+    /** {@code FakeHerdr}'s own default {@code agent.list} entry: terminal {@code term_a}, session {@code sess-1111}. */
+    private static final String LEAD_TERMINAL = "term_a";
+    private static final String LEAD_SESSION_ID = "sess-1111";
+
+    private static final class RecordingResourcePorts implements ResourcePorts {
+
+        final FakeHerdr herdr = new FakeHerdr();
+        final SentinelReplyInbox replyInbox = new SentinelReplyInbox();
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> replyInbox;
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            // Never invoked: this test's FakeHerdr answers immediately, so awaitHerdr never polls.
+            return () -> {
+                throw new UnsupportedOperationException("herdrPollWait must not be called — herdr is healthy");
+            };
+        }
+    }
+
+    private static final class SentinelReplyInbox implements ReplyInbox, AutoCloseable {
+        @Override
+        public void own(String target) {
+        }
+
+        @Override
+        public void release(String target) {
+        }
+
+        @Override
+        public void publish(String target, String msgId, String content) {
+        }
+
+        @Override
+        public List<InboxMessage> peek(String target) {
+            return List.of();
+        }
+
+        @Override
+        public boolean ack(String target, String msgId) {
+            return false;
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static String usageLine(long tokens) {
+        return "{\"type\":\"assistant\",\"message\":{\"role\":\"assistant\",\"usage\":{"
+                + "\"input_tokens\":" + tokens + ",\"cache_read_input_tokens\":0,\"cache_creation_input_tokens\":0}}}";
+    }
+
+    /** Lays out {@code <configDir>/projects/<anySlug>/<sessionId>.jsonl} carrying one usage record. */
+    private static void writeTranscript(Path configDir, String sessionId, long tokens) throws IOException {
+        Path projectDir = configDir.resolve("projects").resolve("some-project-slug");
+        Files.createDirectories(projectDir);
+        Files.writeString(projectDir.resolve(sessionId + ".jsonl"), usageLine(tokens) + "\n", StandardCharsets.UTF_8);
+    }
+
+    private static FleetConfig writeConfig(Path dir, String configDir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                leadHeartbeat:
+                  idleAfterSeconds: 600
+                  backoffMs: 15000
+                  quietNudgeCap: 5
+                fleet:
+                  leaders:
+                    %s:
+                      tab: "%s"
+                      profile: %s
+                profiles:
+                  %s:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    configDir: "%s"
+                    autoCompactWindow: 100000
+                """.formatted(LEAD_NAME, LEAD_TAB, LEAD_PROFILE, LEAD_PROFILE, configDir));
+        return FleetConfig.load(f);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static LeadHeartbeatLoop.LeadContextSource contextSourceOf(LeadHeartbeatLoop heartbeat) throws Exception {
+        Field field = LeadHeartbeatLoop.class.getDeclaredField("contextSource");
+        field.setAccessible(true);
+        return (LeadHeartbeatLoop.LeadContextSource) field.get(heartbeat);
+    }
+
+    @Test
+    @DisplayName("[BEHAVIOURAL] the real assembled heartbeat loop resolves HIGH against the lead's "
+            + "REAL configured window, not the fixed 200000 fallback a lost window argument reverts to")
+    void assembledHeartbeatContextSourceResolvesTheRealConfiguredWindow(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir, dir.toString());
+        writeTranscript(dir, LEAD_SESSION_ID, 90_000);
+        ConfigRef config = new ConfigRef(dir.resolve("fleetd.yaml"), cfg);
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        RecordingResourcePorts ports = new RecordingResourcePorts();
+        // Label FakeHerdr's own default pane's tab (term_a / w2:p7 / w2:t7, already carrying a live
+        // agent on session sess-1111) to match fleet.leaders.opus.tab exactly, so LeadTabScanner
+        // recognises it as the live "opus" lead without a second auto-launched pane.
+        ports.herdr.withTab("w2", "w2:t7", LEAD_TAB).agentSessionId(LEAD_SESSION_ID);
+
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg, config, guard), ports);
+        try {
+            LeadHeartbeatLoop.LeadContextSource source = contextSourceOf(runtime.heartbeat());
+
+            LeadContextGauge.Reading reading = source.readingFor().apply(LEAD_TERMINAL);
+
+            assertEquals(LeadContextGauge.State.HIGH, reading.state(),
+                    "profiles." + LEAD_PROFILE + ".autoCompactWindow: 100000 resolves a HIGH threshold "
+                            + "of 66666 tokens — 90000 live tokens must read HIGH against it. Mutating "
+                            + "FleetdAssembly's window-lookup argument to `_ -> null` falls back to the "
+                            + "fixed 200000 threshold, under which 90000 reads OK instead: " + reading);
+        } finally {
+            // Surefire runs the whole suite in one JVM fork (fleetd/pom.xml sets no forkCount /
+            // reuseForks), so the scheduler/loops this assembly starts must be torn down here, on the
+            // failure path too — hence try/finally rather than a bare statement at the end.
+            runtime.close();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextSourceWiringTest.java

@@ -87,7 +87,8 @@ class FleetdLeadContextSourceWiringTest {
         Map<String, String> liveLeadTerminals = Map.of(LEAD_TERMINAL, LEAD_NAME);
 
         LeadHeartbeatLoop.LeadContextSource source = Fleetd.leadContextSource(new LeadContextGauge(),
-                agentControlStub(), () -> liveLeadTerminals, name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                agentControlStub(), () -> liveLeadTerminals,
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = source.readingFor().apply(LEAD_TERMINAL);
 
@@ -101,7 +102,7 @@ class FleetdLeadContextSourceWiringTest {
     @DisplayName("an unrecognised lead terminal resolves to UNKNOWN, not a thrown exception")
     void unrecognisedTerminalResolvesToUnknown() {
         LeadHeartbeatLoop.LeadContextSource source = Fleetd.leadContextSource(new LeadContextGauge(),
-                agentControlStub(), Map::of, name -> null);
+                agentControlStub(), Map::of, name -> null, name -> null);
 
         assertEquals(LeadContextGauge.State.UNKNOWN, source.readingFor().apply("ghost-terminal").state());
     }

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextWindowLookupTest.java

@@ -0,0 +1,96 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.function.Function;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * {@link Fleetd#leadContextWindowLookup} is the factory wired into {@code
+ * FleetMcp.LeadConfigDirSource} and {@code LeadHeartbeatLoop.LeadContextSource} so {@link
+ * dev.ltms.fleet.lead.LeadContextGauge} scales its HIGH threshold against a lead's own profile's
+ * effective auto-compact window instead of always the gauge's fixed fallback — the same {@code
+ * fleet.leaders.<name>.profile} link {@link Fleetd#leadConfigDirLookup} already follows, one step
+ * further to {@link FleetConfig.Profile#effectiveAutoCompactWindow()}.
+ */
+class FleetdLeadContextWindowLookupTest {
+
+    private static FleetConfig.Profile profileWithWindow(String name, Integer autoCompactWindow,
+            Map<String, String> env) {
+        return new FleetConfig.Profile(name, null, "claude-sonnet-5", null, null, null,
+                "tab", "fleet", "w #{n}", null, null, null, null, null, null, env,
+                null, null, true, null, null, null, null, null, autoCompactWindow, null);
+    }
+
+    private static FleetConfig.Leader leadOnProfile(String profile) {
+        return new FleetConfig.Leader(profile, "lead: primary", 1, "lead:", 10, "claude", "claude-sonnet-5");
+    }
+
+    @Test
+    @DisplayName("a lead on a profile that sets autoCompactWindow resolves to that window")
+    void leadOnAProfileWithAutoCompactWindowResolvesToIt() {
+        Map<String, FleetConfig.Profile> profiles =
+                Map.of("opus", profileWithWindow("opus", 250_000, Map.of()));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(() -> profiles, leaders);
+
+        assertEquals(250_000L, lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("yaml and env disagree: the lookup resolves the env value, not the yaml one")
+    void yamlAndEnvDisagreeLookupResolvesTheEnvValue() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("opus",
+                profileWithWindow("opus", 250_000, Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "150000")));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(() -> profiles, leaders);
+
+        assertEquals(150_000L, lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("a lead entry with no `profile:` resolves to null, not a thrown exception")
+    void recogniseOnlyLeadWithNoProfileResolvesToNull() {
+        Map<String, FleetConfig.Profile> profiles =
+                Map.of("opus", profileWithWindow("opus", 250_000, Map.of()));
+        FleetConfig.Leader recogniseOnly = new FleetConfig.Leader(null, "lead: primary", 1, "lead:", 10,
+                "claude", "claude-sonnet-5");
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", recogniseOnly);
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(() -> profiles, leaders);
+
+        assertNull(lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("a lead naming a profile that is not configured resolves to null, not a thrown exception")
+    void leadOnAnUnconfiguredProfileResolvesToNull() {
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("ghost-profile"));
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(Map::of, leaders);
+
+        assertNull(lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("a lead on a profile that resolves no window at all resolves to null")
+    void leadOnAProfileWithNoWindowResolvesToNull() {
+        Map<String, FleetConfig.Profile> profiles =
+                Map.of("opus", profileWithWindow("opus", null, Map.of()));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(() -> profiles, leaders);
+
+        assertNull(lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("an unrecognised lead name resolves to null, not a thrown exception")
+    void unrecognisedLeadNameResolvesToNull() {
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(Map::of, Map.of());
+
+        assertNull(lookup.apply("ghost-lead"));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdListReportingSourcesAssemblyTest.java

@@ -0,0 +1,243 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.msg.LeadChannelHandle;
+import dev.ltms.fleet.msg.LeadMessage;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import io.modelcontextprotocol.client.McpClient;
+import io.modelcontextprotocol.client.McpSyncClient;
+import io.modelcontextprotocol.client.transport.HttpClientStreamableHttpTransport;
+import io.modelcontextprotocol.spec.McpClientTransport;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.net.http.HttpRequest;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #612 Shape A ranks 9 and 11: drives the real {@code fleet_list} MCP route through a
+ * token-authenticated primary caller. The assertions read the response from the exact {@link
+ * dev.ltms.fleet.mcp.FleetMcp} instance assembled by {@link FleetdAssembly}, rather than a source
+ * scrape or a separately built reporting source.
+ *
+ * <p>The coordinator fixture contains a peer on purpose. Both a missing coordinator and an
+ * incorrectly wired peers argument can render as an empty list, so the non-empty peer assertion
+ * distinguishes the real call-site value from that inert result. Its fake mailbox never contacts a
+ * broker.
+ */
+class FleetdListReportingSourcesAssemblyTest {
+
+    private static final String TOKEN = "fleetd-r9-r11-test-token";
+    private static final String TOKEN_ENV = "FLEETD_R9_TEST_TOKEN";
+    private static final String PROFILE = "capacity-profile";
+    private static final String PEER = "peer-fleet";
+
+    private static final class FakeLeadChannel implements LeadChannelHandle {
+        @Override
+        public void publish(String toCoordId, LeadMessage message) {
+        }
+
+        @Override
+        public List<LeadMessage> peek() {
+            return List.of();
+        }
+
+        @Override
+        public void ack(String msgId) {
+        }
+
+        @Override
+        public String selfCoordId() {
+            return "test-lead";
+        }
+
+        @Override
+        public boolean heldDurable() {
+            return true;
+        }
+
+        @Override
+        public MailboxState inspect(String coordId) {
+            return MailboxState.unknown(coordId);
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        private final FakeHerdr herdr = new FakeHerdr();
+        private Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of(TOKEN_ENV, TOKEN);
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> new FakeLeadChannel();
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // The test binds runtime.app() itself, below.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("healthy FakeHerdr must not poll");
+            };
+        }
+    }
+
+    private FleetdRuntime runtime;
+    private TestResourcePorts ports;
+    private Javalin boundApp;
+
+    @AfterEach
+    void tearDown() {
+        if (boundApp != null) {
+            boundApp.stop();
+        }
+        if (ports != null && ports.shutdownHook != null) {
+            ports.shutdownHook.run();
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                auth:
+                  mode: token
+                  tokenEnv: %s
+                idleSleepGuard:
+                  enabled: false
+                health:
+                  enabled: true
+                  notifications:
+                    mode: webhook
+                profiles:
+                  %s:
+                    baseUrl: http://capacity.test:8000
+                    model: test-model
+                    maxLoad: 7
+                coordinator:
+                  uri: amqp://fake-coordinator/vh
+                  selfId: test-lead
+                  peers:
+                    - %s
+                """.formatted(TOKEN_ENV, PROFILE, PEER));
+        return FleetConfig.load(file);
+    }
+
+    private int assembleAndBind(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        ConfigRef config = new ConfigRef(dir.resolve("fleetd.yaml"), cfg);
+        ports = new TestResourcePorts();
+        runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg, config,
+                new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        boundApp = runtime.app().start("127.0.0.1", 0);
+        return boundApp.port();
+    }
+
+    private static String fleetList(int port) {
+        HttpRequest.Builder requestTemplate = HttpRequest.newBuilder()
+                .header("Authorization", "Bearer " + TOKEN);
+        McpClientTransport transport = HttpClientStreamableHttpTransport.builder("http://127.0.0.1:" + port)
+                .endpoint("/mcp")
+                .requestBuilder(requestTemplate)
+                .build();
+        try (McpSyncClient client = McpClient.sync(transport).build()) {
+            client.initialize();
+            McpSchema.CallToolResult response = client.callTool(McpSchema.CallToolRequest.builder("fleet_list")
+                    .arguments(Map.of()).build());
+            return ((McpSchema.TextContent) response.content().getFirst()).text();
+        }
+    }
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void fleetListReportsTheAssembledCapacitySource(@TempDir Path dir) throws Exception {
+        String response = fleetList(assembleAndBind(dir));
+
+        assertTrue(response.contains("\"capacity\""), response);
+        assertTrue(response.contains("\"" + PROFILE + "\""), response);
+        assertTrue(response.contains("\"maxLoad\":7"), response);
+    }
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void fleetListReportsTheAssembledHealthCoverageSource(@TempDir Path dir) throws Exception {
+        String response = fleetList(assembleAndBind(dir));
+
+        assertTrue(response.contains("\"healthCoverage\":\"full\""), response);
+    }
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void fleetListReportsTheAssembledCoordinatorPeers(@TempDir Path dir) throws Exception {
+        String response = fleetList(assembleAndBind(dir));
+
+        assertTrue(response.contains("\"coordinator\""), response);
+        assertTrue(response.contains("\"coordId\":\"" + PEER + "\""), response);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdQuarantineOutageDualWindowAssemblyTest.java

@@ -0,0 +1,368 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.inject.CompletionResolver;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
+import dev.ltms.fleet.session.MemberSession;
+import io.javalin.Javalin;
+import io.modelcontextprotocol.client.McpClient;
+import io.modelcontextprotocol.client.McpSyncClient;
+import io.modelcontextprotocol.client.transport.HttpClientStreamableHttpTransport;
+import io.modelcontextprotocol.spec.McpClientTransport;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #612 Shape A, unit r4 — {@link FleetdAssembly}'s {@code quarantineSource} (lines 471-472)
+ * and {@code outageSource} (lines 473-476 at {@code main} = {@code 141ae3b}), EACH of which feeds
+ * two separate consumers: {@code FleetMcp} ({@code fleet_profiles}) and {@code FleetApp}
+ * ({@code GET /profiles}), one call site ({@code :484}/{@code :486}) into the MCP constructor and
+ * the SAME shared local again ({@code :529}) into the REST constructor.
+ *
+ * <p><strong>The property pinned here</strong> (from the ticket): when the real assembly has built
+ * a real {@link dev.ltms.fleet.placement.BackendQuarantine} holding a quarantined credential, and a
+ * real {@link dev.ltms.fleet.placement.BackendOutagePolicy} holding a cooling-off credential, BOTH
+ * operator windows must report that state — the real assembled {@code FleetMcp} (reached through
+ * {@link FleetdRuntime#mcp()}) and the real assembled REST surface (reached through {@link
+ * FleetdRuntime#app()}). A mutation that starves one consumer while leaving the other wired must
+ * make only that consumer's assertion go red.
+ *
+ * <p><strong>No source-text assertion anywhere in this file.</strong> Both windows are read off the
+ * REAL running objects: {@code fleet_profiles} is called through a real MCP client over a real
+ * HTTP connection to the servlet {@link FleetdAssembly} actually mounted, and {@code GET /profiles}
+ * is called through a real {@link java.net.http.HttpClient} against the real bound {@link
+ * FleetdRuntime#app()}. Neither is a copy built alongside the assembly for this test's benefit.
+ *
+ * <p><strong>How this gets past CB-185's own pid-resolution dead end.</strong> {@code
+ * FleetdAssemblyFleetAppTest}'s class javadoc explains that {@code GET /sessions} cannot be driven
+ * over real HTTP here because {@code LsofPeerPidLookup} excludes its own pid and an in-process test
+ * client/server share one JVM pid — every such request resolves {@code ANONYMOUS} and is refused
+ * before the handler runs. {@code GET /profiles} and {@code fleet_profiles} sit behind the exact
+ * same {@code Authz.Action.READ} gate. This test sidesteps the dead end instead of hitting it:
+ * {@code auth.mode: token} (see {@link dev.ltms.fleet.auth.CallerResolver#resolve}) resolves a
+ * caller to {@code PRIMARY} from a valid {@code Authorization: Bearer} header ALONE, with no pid
+ * resolution involved at all — the same technique {@code FleetMcpContextExtractorTest} already uses
+ * to drive a real {@code fleet_whoami} call through the real transport.
+ *
+ * <p><strong>How the quarantined/cooling-off state is set up.</strong> Both {@code BackendQuarantine}
+ * and {@code BackendOutagePolicy} are private to the collaborators the assembly wires them into, and
+ * (unlike {@code quarantineSource()}) neither {@code FleetMcp} nor {@code FleetApp} exposes a public
+ * accessor for the live {@code BackendOutagePolicy} instance. Rather than add one (acceptance
+ * criterion 1: no production change), this test drives the REAL production classification path —
+ * exactly the recipe {@code FleetdExhaustedPatternAssemblyTest} (quarantine) and {@code
+ * FleetdCompletionResolverAssemblyTest} (cool-off) already proved works end to end against this same
+ * {@link FleetdAssembly#assembleAndStart}: acquire a real {@link MemberSession}, feed the real {@link
+ * CompletionResolver} a pane scrape matching the profile's configured {@code exhaustedPattern} /
+ * {@code errorPattern}, and let the real {@code exhaustionSink}/{@code backendErrorSink} write into
+ * the real, shared tracker. Each setup step asserts its own {@link Rendezvous.Kind} as a CONTROL —
+ * if the resolver were never actually exercised, the setup itself fails loudly before either window
+ * is ever read.
+ */
+class FleetdQuarantineOutageDualWindowAssemblyTest {
+
+    private static final String TOKEN = "s3cret-r4-token";
+    private static final String TOKEN_ENV = "FLEETD_R4_TEST_TOKEN";
+
+    private static final class ControllableResourcePorts implements ResourcePorts {
+
+        final FakeHerdr herdr;
+        final AtomicLong nowNanos = new AtomicLong(1_000_000_000L); // arbitrary non-zero start
+        Runnable shutdownHook;
+
+        ControllableResourcePorts(FakeHerdr herdr) {
+            this.herdr = herdr;
+        }
+
+        void advanceSeconds(long seconds) {
+            nowNanos.addAndGet(TimeUnit.SECONDS.toNanos(seconds));
+        }
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of(TOKEN_ENV, TOKEN);
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            // Never invoked: this test's config has no `broker:` block.
+            return (uri, prefetch) -> {
+                throw new UnsupportedOperationException("replyInboxOpener must not be called — no broker: block");
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            // Never invoked: this test's config has no `coordinator:` block.
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return nowNanos::get;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return nowNanos::get;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            this.shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Deliberately never bind here — this test binds runtime.app() itself, for real, below.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            // Never invoked: this test's FakeHerdr answers immediately, so awaitHerdr never polls.
+            return () -> {
+                throw new UnsupportedOperationException("herdrPollWait must not be called — herdr is healthy");
+            };
+        }
+    }
+
+    private FleetdRuntime runtime;
+    private ControllableResourcePorts ports;
+    private Javalin boundApp;
+
+    @AfterEach
+    void tearDown() {
+        if (boundApp != null) {
+            boundApp.stop();
+        }
+        if (ports != null && ports.shutdownHook != null) {
+            ports.shutdownHook.run();
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir, int cooldownSeconds) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                auth:
+                  mode: token
+                  tokenEnv: %s
+                idleSleepGuard:
+                  enabled: false
+                quarantineCooldownSeconds: %d
+                profiles:
+                  exhaustprofile:
+                    baseUrl: http://exhausthost.local:8000
+                    model: sonnet
+                    exhaustedPattern: "usage limit reached"
+                  coolprofile:
+                    baseUrl: http://coolhost.local:8000
+                    model: sonnet
+                    errorPattern: "credential outage"
+                guard:
+                  offSubscriptionHosts:
+                    - exhausthost.local
+                    - coolhost.local
+                """.formatted(TOKEN_ENV, cooldownSeconds));
+        return FleetConfig.load(f);
+    }
+
+    /** Assembles the real graph, then binds the real {@code Javalin app} to an ephemeral port. */
+    private int assembleAndBind(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir, 120);
+        ConfigRef config = new ConfigRef(dir.resolve("fleetd.yaml"), cfg);
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        ports = new ControllableResourcePorts(new FakeHerdr());
+        runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg, config, guard), ports);
+        boundApp = runtime.app().start("127.0.0.1", 0);
+        return boundApp.port();
+    }
+
+    /**
+     * Drives the real assembled {@link CompletionResolver} through a scrape matching {@code
+     * exhaustprofile}'s configured {@code exhaustedPattern}, exactly {@code
+     * FleetdExhaustedPatternAssemblyTest}'s own recipe, so the real {@code exhaustionSink} quarantines
+     * the credential ({@code effectiveCredentialId() == "exhaustprofile"}, no explicit credentialId
+     * configured).
+     */
+    private void quarantineExhaustProfile(Path dir) {
+        MemberSession session = runtime.sessions().acquire("exhaustprofile", null, dir.toString(), null);
+        String target = session.terminalId();
+
+        CompletionResolver completion = runtime.completion();
+        CompletableFuture<Rendezvous.Resolution> waiter = new CompletableFuture<>();
+
+        ports.herdr.readText("idle, nothing yet");
+        completion.onDelivered(target, new TurnToken(target, waiter, null));
+        ports.herdr.readText("usage limit reached: try again in a few hours");
+        ports.advanceSeconds(3); // clear CompletionResolver.MIN_TURN_NANOS (2s), no real sleep
+        completion.resolveBeforePostAction(target);
+
+        Rendezvous.Resolution resolution = waiter.getNow(null);
+        assertTrue(resolution != null && resolution.kind() == Rendezvous.Kind.BACKEND_EXHAUSTED,
+                "CONTROL: setup must classify as BACKEND_EXHAUSTED before either window is read — "
+                        + "if this fails, the assembled resolver was never actually exercised: " + resolution);
+    }
+
+    /**
+     * Drives the real assembled {@link CompletionResolver} with TWO distinct targets on {@code
+     * coolprofile}, each matching its configured {@code errorPattern}, exactly {@code
+     * FleetdCompletionResolverAssemblyTest}'s own recipe, so the real {@code backendErrorSink} cools
+     * the credential off ({@code effectiveCredentialId() == "coolprofile"}).
+     */
+    private void coolOffCoolProfile(Path dir) {
+        MemberSession s1 = runtime.sessions().acquire("coolprofile", null, dir.toString(), null);
+        MemberSession s2 = runtime.sessions().acquire("coolprofile", null, dir.toString(), null);
+        CompletionResolver completion = runtime.completion();
+
+        String t1 = s1.terminalId();
+        CompletableFuture<Rendezvous.Resolution> w1 = new CompletableFuture<>();
+        ports.herdr.readText("idle 1");
+        completion.onDelivered(t1, new TurnToken(t1, w1, null));
+        ports.herdr.readText("credential outage: upstream 503");
+        ports.advanceSeconds(3);
+        completion.resolveBeforePostAction(t1);
+        Rendezvous.Resolution r1 = w1.getNow(null);
+        assertTrue(r1 != null && r1.kind() == Rendezvous.Kind.FAILED,
+                "CONTROL: target1's setup must classify FAILED (backend error): " + r1);
+
+        String t2 = s2.terminalId();
+        CompletableFuture<Rendezvous.Resolution> w2 = new CompletableFuture<>();
+        ports.herdr.readText("idle 2");
+        completion.onDelivered(t2, new TurnToken(t2, w2, null));
+        ports.herdr.readText("credential outage: upstream 503 again");
+        ports.advanceSeconds(3);
+        completion.resolveBeforePostAction(t2);
+        Rendezvous.Resolution r2 = w2.getNow(null);
+        assertTrue(r2 != null && r2.kind() == Rendezvous.Kind.FAILED,
+                "CONTROL: target2's setup must classify FAILED (backend error) — two distinct "
+                        + "targets are required to cross BackendOutagePolicy.THRESHOLD: " + r2);
+    }
+
+    /** Calls the real {@code fleet_profiles} tool over a real MCP client, token-authenticated as PRIMARY. */
+    private static McpSchema.CallToolResult callProfilesViaMcp(int port) {
+        HttpRequest.Builder requestTemplate = HttpRequest.newBuilder().header("Authorization", "Bearer " + TOKEN);
+        McpClientTransport transport = HttpClientStreamableHttpTransport.builder("http://127.0.0.1:" + port)
+                .endpoint("/mcp")
+                .requestBuilder(requestTemplate)
+                .build();
+        try (McpSyncClient client = McpClient.sync(transport).build()) {
+            client.initialize();
+            return client.callTool(McpSchema.CallToolRequest.builder("fleet_profiles").arguments(Map.of()).build());
+        }
+    }
+
+    private static String textOf(McpSchema.CallToolResult r) {
+        return ((McpSchema.TextContent) r.content().getFirst()).text();
+    }
+
+    /** Calls the real {@code GET /profiles} route over a real {@link HttpClient}, same token. */
+    private static String getProfilesViaRest(int port) throws Exception {
+        HttpClient http = HttpClient.newHttpClient();
+        HttpRequest req = HttpRequest.newBuilder(URI.create("http://127.0.0.1:" + port + "/profiles"))
+                .header("Authorization", "Bearer " + TOKEN)
+                .GET().build();
+        HttpResponse<String> res = http.send(req, HttpResponse.BodyHandlers.ofString());
+        assertEquals(200, res.statusCode(), "GET /profiles must succeed with the real token: " + res.body());
+        return res.body();
+    }
+
+    // --- quarantineSource (FleetdAssembly.java :471-472) --------------------------------------
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void quarantinedCredentialIsReportedByTheRealAssembledFleetMcp(@TempDir Path dir) throws Exception {
+        int port = assembleAndBind(dir);
+        quarantineExhaustProfile(dir);
+
+        String out = textOf(callProfilesViaMcp(port));
+
+        assertTrue(out.contains("\"quarantined\""), "fleet_profiles must report a quarantined "
+                + "section once the real BackendQuarantine holds a quarantined credential: " + out);
+        assertTrue(out.contains("\"exhaustprofile\""), out);
+        assertTrue(out.contains("\"quarantinedForSeconds\""), out);
+    }
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void quarantinedCredentialIsReportedByTheRealAssembledFleetApp(@TempDir Path dir) throws Exception {
+        int port = assembleAndBind(dir);
+        quarantineExhaustProfile(dir);
+
+        String out = getProfilesViaRest(port);
+
+        assertTrue(out.contains("\"quarantined\""), "GET /profiles must report a quarantined "
+                + "section once the real BackendQuarantine holds a quarantined credential: " + out);
+        assertTrue(out.contains("\"exhaustprofile\""), out);
+        assertTrue(out.contains("\"quarantinedForSeconds\""), out);
+    }
+
+    // --- outageSource (FleetdAssembly.java :473-476) -------------------------------------------
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void coolingOffCredentialIsReportedByTheRealAssembledFleetMcp(@TempDir Path dir) throws Exception {
+        int port = assembleAndBind(dir);
+        coolOffCoolProfile(dir);
+
+        String out = textOf(callProfilesViaMcp(port));
+
+        assertTrue(out.contains("\"coolingOff\""), "fleet_profiles must report a coolingOff "
+                + "section once the real BackendOutagePolicy holds a cooling-off credential: " + out);
+        assertTrue(out.contains("\"coolprofile\""), out);
+        assertTrue(out.contains("\"coolingOffForSeconds\""), out);
+    }
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void coolingOffCredentialIsReportedByTheRealAssembledFleetApp(@TempDir Path dir) throws Exception {
+        int port = assembleAndBind(dir);
+        coolOffCoolProfile(dir);
+
+        String out = getProfilesViaRest(port);
+
+        assertTrue(out.contains("\"coolingOff\""), "GET /profiles must report a coolingOff "
+                + "section once the real BackendOutagePolicy holds a cooling-off credential: " + out);
+        assertTrue(out.contains("\"coolprofile\""), out);
+        assertTrue(out.contains("\"coolingOffForSeconds\""), out);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/auth/AuthzTest.java

@@ -14,6 +14,7 @@ class AuthzTest {
     private static final Principal ANON = Principal.anonymous();
     private static final Principal ARCH_DESIGN = Principal.architect("lead-designer", "term_design", 400);
     private static final Principal ARCH_OTHER = Principal.architect("reviewer", "term_review", 500);
+    private static final Principal COLLABORATOR = Principal.collaborator("ops", "term_collab", 600);
 
     @Test
     void anonymousIsAuthorizedForNothing() {
@@ -38,6 +39,37 @@ class AuthzTest {
         }
     }
 
+    /**
+     * {@code fleet_send} is three call shapes behind one action name until {@code
+     * FleetMcp#sendAction} picks one: a plain local {@link Authz.Action#SEND}, the {@code coordId}
+     * route ({@link Authz.Action#COORD_SEND}), and the {@code turnId} answer form ({@link
+     * Authz.Action#ANSWER}). All three carry the same grant as the undivided action did — a worker
+     * is excluded from every one, exactly as it was excluded from the one combined action before.
+     */
+    @Test
+    void theThreeSendShapesCarryTheSameGrantAsTheOldUndividedAction() {
+        for (Authz.Action a : new Authz.Action[]{SEND, COORD_SEND, ANSWER}) {
+            assertTrue(Authz.permits(PRIMARY, a, "term_a"), "the primary may " + a);
+            assertTrue(Authz.permits(ARCH_DESIGN, a, "term_a"), "an architect may " + a);
+            assertFalse(Authz.permits(WORKER_A, a, "term_a"),
+                    "a worker performing " + a + " would be escalating into the orchestrator role");
+            assertFalse(Authz.permits(ANON, a, "term_a"));
+        }
+    }
+
+    /**
+     * {@code fleet_poll{ticket}} and {@code fleet_status} are {@link Authz.Action#TASK_READ}, split
+     * out of the roster-only {@link Authz.Action#READ} (fleetd #678). The grant is unchanged from
+     * what the undivided {@code READ} action gave every one of these callers.
+     */
+    @Test
+    void taskReadCarriesTheSameGrantReadDidBeforeTheSplit() {
+        assertTrue(Authz.permits(PRIMARY, TASK_READ, null));
+        assertTrue(Authz.permits(WORKER_A, TASK_READ, null));
+        assertTrue(Authz.permits(ARCH_DESIGN, TASK_READ, null));
+        assertFalse(Authz.permits(ANON, TASK_READ, null));
+    }
+
     @Test
     void aWorkerMayReplyAndAskOnlyAsItself() {
         assertTrue(Authz.permits(WORKER_A, REPLY, "term_a"));
@@ -135,4 +167,87 @@ class AuthzTest {
         assertFalse(Authz.isUnauthenticated(WORKER_A));
         assertFalse(Authz.isUnauthenticated(PRIMARY));
     }
+
+    // ── the collaborator matrix ─────────────────────────────────────────────────────────────────
+
+    /**
+     * {@code SEND} for a collaborator is the one grant that is conditional rather than fixed:
+     * flipping only the classifier's answer for the target flips only this outcome.
+     */
+    @Test
+    void aCollaboratorMaySendOnlyWhenTheClassifierAcceptsTheTarget() {
+        assertTrue(Authz.permits(COLLABORATOR, SEND, "term_lead", target -> true),
+                "the classifier accepting the target must grant SEND");
+        assertFalse(Authz.permits(COLLABORATOR, SEND, "term_lead", target -> false),
+                "the classifier refusing the target must deny SEND");
+        assertFalse(Authz.permits(COLLABORATOR, SEND, "term_lead"),
+                "the real production classifier recognises no terminal yet, so SEND is refused today");
+    }
+
+    /**
+     * Control for the test above: every other action's result for a collaborator does not move
+     * when the classifier does. Only {@code SEND} is wired to it.
+     */
+    @Test
+    void theClassifierMovesOnlySendForACollaborator() {
+        for (Authz.Action a : Authz.Action.values()) {
+            if (a == SEND) {
+                continue;
+            }
+            assertEquals(
+                    Authz.permits(COLLABORATOR, a, "term_lead"),
+                    Authz.permits(COLLABORATOR, a, "term_lead", target -> true),
+                    a + " must not depend on the classifier at all");
+        }
+    }
+
+    @Test
+    void aCollaboratorMayReadAndScrapeMetrics() {
+        assertTrue(Authz.permits(COLLABORATOR, READ, null));
+        assertTrue(Authz.permits(COLLABORATOR, METRICS, null));
+    }
+
+    @Test
+    void aCollaboratorMayReplyAndAskOnlyAsItsOwnPane() {
+        assertTrue(Authz.permits(COLLABORATOR, REPLY, "term_collab"),
+                "its own pane is its own");
+        assertTrue(Authz.permits(COLLABORATOR, ASK, "term_collab"));
+
+        assertFalse(Authz.permits(COLLABORATOR, REPLY, "term_design"),
+                "a collaborator must not reply on another pane");
+        assertFalse(Authz.permits(COLLABORATOR, REPLY, null),
+                "an absent target must not pass the own-session rule");
+    }
+
+    /**
+     * Every action denied to a collaborator, asserted denied even when the classifier would
+     * accept any target — proving none of these is actually gated on the classifier at all.
+     */
+    @Test
+    void aCollaboratorIsDeniedLifecycleCoordinationAndTicketPolling() {
+        for (Authz.Action a : new Authz.Action[]{SPAWN, STOP, DRAIN, HANDOVER, ANSWER, COORD_SEND,
+                COORD_READ, TASK_READ}) {
+            assertFalse(Authz.permits(COLLABORATOR, a, "term_lead", target -> true),
+                    "a collaborator must not " + a + " even when the classifier accepts every target");
+        }
+    }
+
+    @Test
+    void aCollaboratorIsNotCountedAsPrimaryWorkerOrArchitect() {
+        assertFalse(COLLABORATOR.isPrimary());
+        assertFalse(COLLABORATOR.isWorker());
+        assertFalse(COLLABORATOR.isArchitect());
+        assertTrue(COLLABORATOR.isCollaborator());
+    }
+
+    /**
+     * A collaborator is never spawned, so it must not be enrolled in the presence map as an
+     * available member. Control: both a worker and an architect — which ARE spawned — still are.
+     */
+    @Test
+    void isSpawnedMemberIsFalseForACollaboratorButTrueForAWorkerAndAnArchitect() {
+        assertFalse(COLLABORATOR.isSpawnedMember());
+        assertTrue(WORKER_A.isSpawnedMember());
+        assertTrue(ARCH_DESIGN.isSpawnedMember());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/auth/CallerResolverTest.java

@@ -460,7 +460,6 @@ class CallerResolverTest {
         assertTrue(members.bind("architect:lead-designer", "term_a")); // the later lifecycle binds the slot
 
         assertEquals(Role.ARCHITECT, r.resolve("127.0.0.1", 42, null).role());
-        assertEquals("architect:lead-designer", r.members().get("term_a"));
     }
 
     @Test
@@ -523,4 +522,129 @@ class CallerResolverTest {
         }
     }
 
+    // ── fleetd #669 Unit D: a live spawned member outranks every tab map ────────────────────────
+
+    /**
+     * Criterion 1: a terminal present in BOTH the spawned-member roster AND the lead tab map
+     * resolves as its member role, not as a lead — the roster is checked first, consulting no tab
+     * map at all when it matches.
+     */
+    @Test
+    void aSpawnedMemberWinsOverALeadTabForTheSamePane() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
+                        () -> Map.of("term_a", "opus-5.0"), new MemberRegistry(null),
+                        t -> "term_a".equals(t) ? MemberRole.DEV : null, Map::of)
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role(),
+                "a live spawned member's own identity must win over a tab map naming the same pane a lead");
+        assertEquals("term_a", p.terminal());
+    }
+
+    /** A spawned architect in the roster resolves ARCHITECT, carrying its bound slot's name. */
+    @Test
+    void aSpawnedArchitectInTheRosterResolvesArchitectWithItsSlotName() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                        boundMembers("architect:lead-designer", MemberRole.ARCHITECT),
+                        t -> "term_a".equals(t) ? MemberRole.ARCHITECT : null, Map::of)
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.ARCHITECT, p.role());
+        assertEquals("lead-designer", p.name());
+        assertEquals("term_a", p.terminal());
+    }
+
+    /**
+     * fleetd #424 regression: the roster only answers THAT a pane is a live spawned member; config
+     * still decides WHAT that member's slot grants. A slot revoked after the bind must still demote
+     * the session on its very next request, exactly as it would for a pane with no roster entry at
+     * all — the roster's own ARCHITECT role must never be granted on its word alone.
+     *
+     * <p>{@code bind} refuses an unconfigured slot, so the revoked state can only be reached by
+     * binding while the slot is configured and then swapping the config out from under it, the way
+     * a live reload does.
+     */
+    @Test
+    void aRevokedArchitectSlotDemotesALiveSpawnedArchitectToWorker() {
+        FleetConfig.Fleet configured = new FleetConfig.Fleet(Map.of(),
+                Map.of("lead-designer", new FleetConfig.Slot("sonnet")), Map.of(), Map.of(), null);
+        java.util.concurrent.atomic.AtomicReference<FleetConfig.Fleet> live =
+                new java.util.concurrent.atomic.AtomicReference<>(configured);
+        MemberRegistry members = MemberRegistry.live(live::get);
+        assertTrue(members.bind("architect:lead-designer", "term_a"));
+
+        live.set(new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(), null)); // slot revoked
+
+        // Setup controls: the slot is really gone from config, but the occupancy is still there —
+        // otherwise this test would pass for the wrong reason.
+        assertNull(members.roleForSlot("architect:lead-designer"), "setup control: the slot must be gone from config");
+        assertEquals("architect:lead-designer", members.snapshot().get("term_a"),
+                "setup control: the binding itself must still be there");
+
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                        members, t -> "term_a".equals(t) ? MemberRole.ARCHITECT : null, Map::of)
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role(),
+                "a revoked slot must demote a live spawned architect on its very next request");
+    }
+
+    /** Criterion 3: a configured collaborator tab that is not a spawned member resolves COLLABORATOR. */
+    @Test
+    void aConfiguredCollaboratorTabResolvesToCollaboratorCarryingItsName() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                        new MemberRegistry(null), t -> null, () -> Map.of("term_a", "ops"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.COLLABORATOR, p.role());
+        assertEquals("ops", p.name());
+        assertEquals("term_a", p.terminal());
+    }
+
+    /** Regression: an empty collaborator registry leaves every pane exactly as before. */
+    @Test
+    void anEmptyCollaboratorRegistryLeavesEveryPaneAsBefore() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                        new MemberRegistry(null), t -> null, Map::of)
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role());
+        assertNull(p.name());
+    }
+
+    @Test
+    void describeNamesTheCollaborator() {
+        assertEquals("collaborator:ops", Principal.collaborator("ops", "term_a", 1).describe());
+    }
+
+    // ── fleetd #669 Unit D: knownLeadOrCollaborator() reads the same maps resolve() does ───────────
+
+    @Test
+    void knownLeadOrCollaboratorIsTrueForALeadTerminal() {
+        CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
+                () -> Map.of("term_lead", "opus-5.0"), new MemberRegistry(null), t -> null, Map::of);
+
+        assertTrue(r.knownLeadOrCollaborator().test("term_lead"));
+        assertFalse(r.knownLeadOrCollaborator().test("term_other"));
+    }
+
+    @Test
+    void knownLeadOrCollaboratorIsTrueForACollaboratorTerminal() {
+        CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                new MemberRegistry(null), t -> null, () -> Map.of("term_collab", "ops"));
+
+        assertTrue(r.knownLeadOrCollaborator().test("term_collab"));
+        assertFalse(r.knownLeadOrCollaborator().test("term_other"));
+    }
+
+    @Test
+    void knownLeadOrCollaboratorIsFalseForASpawnedMembersTerminal() {
+        // The exact scenario a collaborator's SEND must never reach: a live spawned member's own
+        // terminal, which is neither a configured lead nor a configured collaborator.
+        CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                new MemberRegistry(null), t -> "term_a".equals(t) ? MemberRole.DEV : null, Map::of);
+
+        assertFalse(r.knownLeadOrCollaborator().test("term_a"));
+    }
+
 }

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTest.java

@@ -107,6 +107,8 @@ class ConfigRefTest {
 
         assertTrue(out.applied());
         assertTrue(out.deferred().isEmpty());
+        assertTrue(out.split().stream().noneMatch(s -> s.contains("fleet.collaborators")),
+                out.split().toString());
         assertEquals("new charter", ref.get().fleet().charterFor(
                 dev.ltms.fleet.peer.MemberRole.ARCHITECT));
     }
@@ -786,14 +788,100 @@ class ConfigRefTest {
         assertTrue(out.split().getFirst().startsWith("fleet:"), out.split().toString());
         assertTrue(out.split().getFirst().contains("restart"), out.split().toString());
         assertTrue(out.split().getFirst().contains("live"), out.split().toString());
+        assertTrue(out.split().stream().noneMatch(s -> s.contains("fleet.collaborators")),
+                out.split().toString());
         assertTrue(out.summary().contains("partially live"), out.summary());
         // The snapshot still carries the new value — the LeadTabScanner's identity map and
         // LeadLauncher's auto-launch are what wait for a restart; a reload rebuilds neither.
         assertEquals("lead: opus-b", ref.get().fleet().leaders().get("opus").tab());
     }
 
+    @Test
+    void addingAFleetCollaboratorIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        assertCollaboratorChangeIsReported(dir, """
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex"
+                """, "add a collaborator");
+    }
+
+    @Test
+    void removingAFleetCollaboratorIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex"
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("fleet: {}\n"));
+        assertCollaboratorSplit(ref.reload(), "remove a collaborator");
+    }
+
+    @Test
+    void changingAFleetCollaboratorTabIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex-a"
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex-b"
+                """));
+        assertCollaboratorSplit(ref.reload(), "change a collaborator tab");
+    }
+
+    @Test
+    void unchangedFleetCollaboratorsProduceNoSplitReport(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        String config = yaml("""
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex"
+                """);
+        Files.writeString(f, config);
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, config);
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.split().isEmpty(), out.split().toString());
+    }
+
+    private static void assertCollaboratorChangeIsReported(Path dir, String changed, String action)
+            throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("fleet: {}\n"));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml(changed));
+        assertCollaboratorSplit(ref.reload(), action);
+    }
+
+    private static void assertCollaboratorSplit(ConfigRef.Outcome out, String action) {
+        assertTrue(out.applied(), action);
+        assertTrue(out.deferred().isEmpty(), out.deferred().toString());
+        assertEquals(1, out.split().size(), out.split().toString());
+        String report = out.split().getFirst();
+        assertTrue(report.startsWith("fleet: fleet.collaborators"), report);
+        assertTrue(report.contains("read once at startup"), report);
+        assertTrue(report.contains("restart"), report);
+    }
+
     /**
-     * fleetd #333: {@code fleet.leaders} is the ONLY frozen part of {@code fleet:}. A reload that
+     * fleetd #333: {@code fleet.leaders} is a frozen part of {@code fleet:}. A reload that
      * changes {@code tabLabel} (or charters, or a role pool) without touching {@code fleet.leaders}
      * must stay fully hot with nothing reported — proving {@link ConfigRef#changedSplitKeys}
      * compares {@code fleet.leaders} specifically rather than the whole {@code Fleet} record, which

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigProfileEffectiveAutoCompactWindowTest.java

@@ -0,0 +1,65 @@
+package dev.ltms.fleet.config;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * {@link FleetConfig.Profile#effectiveAutoCompactWindow()} resolves the window a launched Claude
+ * Code session actually runs on, not just the {@code autoCompactWindow:} launch flag — {@code env:
+ * CLAUDE_CODE_AUTO_COMPACT_WINDOW} overrides that flag, so a profile setting both resolves from the
+ * environment variable.
+ */
+class FleetConfigProfileEffectiveAutoCompactWindowTest {
+
+    private static FleetConfig.Profile profile(Integer autoCompactWindow, Map<String, String> env) {
+        return new FleetConfig.Profile("sonnet", null, "claude-sonnet-5", null, null, null,
+                "tab", "fleet", "w #{n}", null, null, null, null, null, null, env,
+                null, null, true, null, null, null, null, null, autoCompactWindow, null);
+    }
+
+    @Test
+    @DisplayName("yaml and env disagree: the env var wins, not the yaml key")
+    void yamlAndEnvDisagreeEnvWins() {
+        FleetConfig.Profile p = profile(250_000, Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "150000"));
+
+        assertEquals(150_000, p.effectiveAutoCompactWindow(),
+                "the two inputs must give DIFFERENT thresholds (150,000 vs 250,000) and the env value must win");
+    }
+
+    @Test
+    @DisplayName("only autoCompactWindow set: that value resolves")
+    void onlyAutoCompactWindowSetResolvesToIt() {
+        FleetConfig.Profile p = profile(250_000, Map.of());
+
+        assertEquals(250_000, p.effectiveAutoCompactWindow());
+    }
+
+    @Test
+    @DisplayName("only the env var set: that value resolves")
+    void onlyEnvVarSetResolvesToIt() {
+        FleetConfig.Profile p = profile(null, Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "150000"));
+
+        assertEquals(150_000, p.effectiveAutoCompactWindow());
+    }
+
+    @Test
+    @DisplayName("neither set: resolves to null")
+    void neitherSetResolvesToNull() {
+        FleetConfig.Profile p = profile(null, Map.of());
+
+        assertNull(p.effectiveAutoCompactWindow());
+    }
+
+    @Test
+    @DisplayName("an unparseable env value falls back to autoCompactWindow rather than throwing")
+    void unparseableEnvValueFallsBackToAutoCompactWindow() {
+        FleetConfig.Profile p = profile(250_000, Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "not-a-number"));
+
+        assertEquals(250_000, p.effectiveAutoCompactWindow());
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -676,12 +676,8 @@ class FleetConfigTest {
         assertEquals(5, hb.quietNudgeCap());
     }
 
-    /**
-     * The hazard the guard exists for: fleetd writes worker tab labels and reads lead tab labels.
-     * Overlap the two and every worker it spawns is read back as a lead.
-     */
     @Test
-    void aLeadPrefixThatAProfileTabLabelOverrideAlsoMatchesRefusesToStart(@TempDir Path dir)
+    void aProfileTabLabelOverrideMatchingALeadTabRefusesToStart(@TempDir Path dir)
             throws Exception {
         Path f = dir.resolve("collide.yaml");
         Files.writeString(f, """
@@ -689,32 +685,33 @@ class FleetConfigTest {
                   port: 8080
                 profiles:
                   gx10:
-                    tabLabel: "lead: {profile} #{n}"
+                    tabLabel: "alpha"
                 fleet:
                   leaders:
                     opus:
-                      tab: "lead: opus"
-                      tabPrefix: "lead:"
+                      tab: "alpha"
                 """);
         FleetConfig cfg = FleetConfig.load(f);
 
         IllegalStateException e =
                 assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
         assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+        assertTrue(e.getMessage().contains("alpha"), "the message must name the offending label");
     }
 
-    /** A bad fleet-wide template promotes every member, not one profile — so it is checked too. */
     @Test
-    void aFleetTabLabelThatMatchesALeadPrefixRefusesToStart(@TempDir Path dir) throws Exception {
+    void aFleetTabLabelTemplateThatCanRenderAsALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("collide-template.yaml");
         Files.writeString(f, """
                 bind:
                   port: 8080
+                profiles:
+                  pha: {}
                 fleet:
-                  tabLabel: "lead: {role} {profile}"
+                  tabLabel: "al{profile}"
                   leaders:
                     opus:
-                      tab: "lead: opus"
+                      tab: "alpha"
                 """);
         FleetConfig cfg = FleetConfig.load(f);
 
@@ -723,12 +720,28 @@ class FleetConfigTest {
         assertTrue(e.getMessage().contains("fleet.tabLabel"));
     }
 
-    /**
-     * The point of making role the label's first field: {@code {role}} comes from a closed enum, so
-     * a generated label cannot begin with {@code "lead:"} however the fleet is configured.
-     */
     @Test
-    void theDefaultTabLabelCannotCollideWithTheDefaultLeadPrefix(@TempDir Path dir) throws Exception {
+    void anExactFleetTabLabelCollisionRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("exact-tab-collision.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  tabLabel: "alpha"
+                  leaders:
+                    alpha:
+                      tab: "alpha"
+                """);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                () -> FleetConfig.load(f).validateAll());
+        assertTrue(e.getMessage().contains("fleet.tabLabel"),
+                "the message must name the offending label");
+        assertTrue(e.getMessage().contains("alpha"), "the message must name the colliding lead tab");
+    }
+
+    @Test
+    void aFleetTabLabelTemplateThatCannotRenderAsALeadTabIsAllowed(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("ok.yaml");
         Files.writeString(f, """
                 bind:
@@ -737,17 +750,13 @@ class FleetConfigTest {
                   gx10:
                     baseUrl: http://gx00.gw:8000
                 fleet:
+                  tabLabel: "worker-{profile}"
                   leaders:
                     opus:
-                      tab: "lead: opus"
+                      tab: "alpha"
                 """);
 
-        assertDoesNotThrow(() -> FleetConfig.load(f).validateLeadTabPrefixes());
-        for (MemberRole role : MemberRole.values()) {
-            assertFalse(FleetConfig.Fleet.DEFAULT_TAB_LABEL
-                            .replace("{role}", role.wireName()).startsWith("lead:"),
-                    "no role renders a label that reads as a lead");
-        }
+        assertDoesNotThrow(() -> FleetConfig.load(f).validateAll());
     }
 
     @Test
@@ -765,6 +774,164 @@ class FleetConfigTest {
                 "a label that collides with a convention nobody reads is not a problem");
     }
 
+    /**
+     * fleetd #677: identity is matched on a lead's exact {@code tab} alone, so two leads sharing
+     * one tab means only one of them is ever found — the guard must catch this independently of
+     * the member-template checks above.
+     */
+    @Test
+    void twoLeadsSharingTheSameExactTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("shared-tab.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "shared tab"
+                    sonnet:
+                      tab: "shared tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("opus"), "the message must name one offending lead");
+        assertTrue(e.getMessage().contains("sonnet"), "the message must name the other offending lead");
+    }
+
+    /**
+     * fleetd #693: the guard matches tabs case-insensitively, because
+     * {@code LeadTabScanner} keys its tab map on a lowercased label — two tabs differing only in
+     * case collide there too, and the guard must catch that independently of the exact-match case
+     * above.
+     */
+    @Test
+    void twoLeadsSharingTheSameTabInDifferentCaseRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("shared-tab-case.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "Shared Tab"
+                    sonnet:
+                      tab: "shared tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("opus"), "the message must name one offending lead");
+        assertTrue(e.getMessage().contains("sonnet"), "the message must name the other offending lead");
+    }
+
+    /** Control for {@link #twoLeadsSharingTheSameExactTabRefusesToStart}: distinct tabs load cleanly. */
+    @Test
+    void twoLeadsWithDistinctExactTabsAreAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("distinct-tabs.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "opus tab"
+                    sonnet:
+                      tab: "sonnet tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateLeadTabPrefixes);
+    }
+
+    // ── validatePanePlacementAgainstLeadTabs ────────────────────────────────────────────────────
+
+    /**
+     * The hazard this guard closes: a pane-placed member lands inside the focused tab rather than
+     * its own, so it can land inside a lead's labelled tab and be read back as that lead.
+     */
+    @Test
+    void aPanePlacedProfileWithALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-hazard.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                cfg::validatePanePlacementAgainstLeadTabs);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
+    @Test
+    void aPanePlacedProfileWithNoLeadTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-no-tab.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      profile: gx10
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a leader with no tab feeds nothing into the scanner, so pane placement is safe");
+    }
+
+    @Test
+    void aTabPlacedProfileWithALeadTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("tab-safe.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: tab
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a member in its own tab cannot land inside a lead's tab");
+    }
+
+    /** Proves the reflective sweep behind {@code validateAll} really reaches this validator. */
+    @Test
+    void validateAllAlsoRefusesPanePlacementAgainstALeadTab(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-hazard-sweep.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateAll);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
     // ── CB-530/CB-579: the leaders registry ─────────────────────────────────────────────────────
 
     @Test
@@ -833,6 +1000,273 @@ class FleetConfigTest {
                 "no primary.terminal pin ⇒ nothing registered, even with fleet.leaders configured");
     }
 
+    // ── fleetd #669: the collaborators registry ────────────────────────────────────────────────
+
+    /**
+     * {@code Fleet} is {@code @JsonIgnoreProperties(ignoreUnknown = true)}, so a config naming
+     * {@code fleet.collaborators.<name>.tab} loads with no exception whether or not the key is
+     * ever read into the object model. Asserting only "no exception" would pass both before and
+     * after the real fix, so this asserts the parsed value is actually reachable from the loaded
+     * {@code FleetConfig} — the one thing a vacuous "no exception" test cannot tell apart.
+     */
+    @Test
+    void collaboratorsBlockIsActuallyParsedNotSilentlyDropped(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("collaborators.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    reviewer-alex:
+                      tab: "collab: alex"
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertEquals("collab: alex", cfg.fleet().collaborators().get("reviewer-alex").tab());
+    }
+
+    /** A collaborator carries no field other than {@code tab}, so a blank one is meaningless. */
+    @Test
+    void aCollaboratorWithNoTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("useless-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    ghost: {}
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateMembers);
+        assertTrue(e.getMessage().contains("ghost"), "the message must name the useless entry");
+        assertTrue(e.getMessage().contains("tab:"), "the message must say what is missing");
+    }
+
+    /** Control for {@link #aCollaboratorWithNoTabRefusesToStart}: a named tab loads cleanly. */
+    @Test
+    void aCollaboratorWithATabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("named-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    reviewer-alex:
+                      tab: "collab: alex"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateMembers);
+    }
+
+    /**
+     * fleetd #669: the fleet-wide {@code tabLabel} template can render as a collaborator tab, the
+     * same hazard {@link #aFleetTabLabelTemplateThatCanRenderAsALeadTabRefusesToStart} covers on
+     * the lead side. Drives the fleet-wide branch directly, with no profile override involved.
+     */
+    @Test
+    void aFleetTabLabelTemplateThatCanRenderAsACollaboratorTabRefusesToStart(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("collide-template-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  tabLabel: "al{profile}"
+                  collaborators:
+                    alex:
+                      tab: "alpha"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("fleet.tabLabel"));
+        assertTrue(e.getMessage().contains("alex"), "the message must name the offending collaborator");
+    }
+
+    /**
+     * fleetd #669: a member tabLabel that can render as a configured collaborator tab is the same
+     * hazard as the lead case above — a member labelled that way is read back as the collaborator.
+     */
+    @Test
+    void aProfileTabLabelOverrideMatchingACollaboratorTabRefusesToStart(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("collide-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    tabLabel: "collab-tab"
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collab-tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+        assertTrue(e.getMessage().contains("collab-tab"), "the message must name the offending label");
+    }
+
+    /** Control: a profile tabLabel that cannot render as the collaborator tab is allowed. */
+    @Test
+    void aProfileTabLabelThatCannotRenderAsACollaboratorTabIsAllowed(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("ok-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    tabLabel: "worker-{profile}"
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collab-tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateLeadTabPrefixes);
+    }
+
+    /** fleetd #669: identity is matched on a collaborator's exact tab, so two sharing one are unreachable. */
+    @Test
+    void twoCollaboratorsSharingTheSameExactTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("shared-collaborator-tab.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "shared tab"
+                    sam:
+                      tab: "Shared Tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("alex"), "the message must name one offending collaborator");
+        assertTrue(e.getMessage().contains("sam"), "the message must name the other offending collaborator");
+    }
+
+    /** Control for {@link #twoCollaboratorsSharingTheSameExactTabRefusesToStart}: distinct tabs load cleanly. */
+    @Test
+    void twoCollaboratorsWithDistinctExactTabsAreAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("distinct-collaborator-tabs.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "alex tab"
+                    sam:
+                      tab: "sam tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateLeadTabPrefixes);
+    }
+
+    /**
+     * fleetd #669: a collaborator tab equal to a lead tab crosses a privilege boundary — the worst
+     * of the three new collisions, since only one of the two identities is ever found.
+     */
+    @Test
+    void aCollaboratorTabEqualToALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("lead-collaborator-collision.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "shared tab"
+                  collaborators:
+                    alex:
+                      tab: "Shared Tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("opus"), "the message must name the offending lead");
+        assertTrue(e.getMessage().contains("alex"), "the message must name the offending collaborator");
+    }
+
+    /** Control for {@link #aCollaboratorTabEqualToALeadTabRefusesToStart}: distinct tabs load cleanly. */
+    @Test
+    void aLeadAndACollaboratorWithDistinctTabsAreAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("lead-collaborator-ok.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead tab"
+                  collaborators:
+                    alex:
+                      tab: "collab tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateLeadTabPrefixes);
+    }
+
+    /**
+     * fleetd #669: a pane-placed member can land in a collaborator's labelled tab exactly as it
+     * can land in a lead's — {@code validatePanePlacementAgainstLeadTabs()} must fire even when
+     * {@code fleet.leaders} is empty, which is the early-return the brief flagged as the bug.
+     */
+    @Test
+    void aPanePlacedProfileWithACollaboratorTabRefusesToStartEvenWithNoLeaders(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("pane-hazard-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collab: alex"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                cfg::validatePanePlacementAgainstLeadTabs);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
+    /** Control: a pane-placed profile with no lead or collaborator tab configured is allowed. */
+    @Test
+    void aPanePlacedProfileWithNoLeaderOrCollaboratorTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-no-tab-at-all.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  collaborators:
+                    alex: {}
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a collaborator with no tab feeds nothing into the scanner, so pane placement is safe");
+    }
+
     // ── CB-548: the architects registry ────────────────────────────────────────────────────────
 
     @Test
@@ -1105,6 +1539,60 @@ class FleetConfigTest {
         assertEquals(Set.of("sonnet"), cfg.fleet().pool(MemberRole.REVIEWER).keySet());
     }
 
+    /**
+     * A duplicated name in {@code fleet.collaborators} is refused at parse time, like any other
+     * {@code fleet:} pool. See {@link #duplicateSlotNamesInOnePoolAreRejectedAtParseTime}.
+     */
+    @Test
+    void duplicateCollaboratorNamesAreRejectedAtParseTime(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("collaborator-dup.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collab: alex"
+                    alex:
+                      tab: "collab: alex, second"
+                """);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, () -> FleetConfig.load(f));
+        assertTrue(e.getMessage().contains("alex"),
+                "the refusal names the duplicated entry, was: " + e.getMessage());
+        assertTrue(e.getMessage().contains("fleet.collaborators"),
+                "the refusal names the pool the duplicate is in, was: " + e.getMessage());
+    }
+
+    /**
+     * Control for {@link #duplicateCollaboratorNamesAreRejectedAtParseTime}: the same name reused
+     * across the collaborators registry and a member role pool is the role × profile matrix doing
+     * its job in the other pool, not a mistake — only a repeat within one pool loses an entry.
+     */
+    @Test
+    void theSameNameInCollaboratorsAndAnotherPoolIsNotADuplicate(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("collaborator-cross-pool.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                fleet:
+                  architects:
+                    alex:
+                      profile: sonnet
+                  collaborators:
+                    alex:
+                      tab: "collab: alex"
+                """);
+
+        FleetConfig cfg = assertDoesNotThrow(() -> FleetConfig.load(f));
+        assertEquals(Set.of("alex"), cfg.fleet().pool(MemberRole.ARCHITECT).keySet());
+        assertEquals(Set.of("alex"), cfg.fleet().collaborators().keySet());
+    }
+
     @Test
     void duplicateKeysOutsideTheFleetPoolsAreUnaffected(@TempDir Path dir) throws Exception {
         // The duplicate check is scoped to the fleet pools — a duplicate elsewhere is not this
@@ -3089,4 +3577,41 @@ class FleetConfigTest {
         FleetConfig cfg = FleetConfig.load(f);
         assertTrue(cfg.models().offIds().isEmpty());
     }
+
+    // ── fleetd #651: leadRollover.turnSettleSeconds default resolution ─────────────────────────
+
+    @Test
+    void turnSettleSecondsDefaultsTo300WhenUnset(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("bare-rollover.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\nleadRollover: {}\n");
+
+        FleetConfig.LeadRollover rollover = FleetConfig.load(f).leadRollover();
+        assertNotNull(rollover);
+        assertEquals(300, rollover.turnSettleSeconds());
+    }
+
+    @Test
+    void turnSettleSecondsUsesAnExplicitPositiveValue(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("rollover.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                leadRollover:
+                  turnSettleSeconds: 45
+                """);
+
+        FleetConfig.LeadRollover rollover = FleetConfig.load(f).leadRollover();
+        assertEquals(45, rollover.turnSettleSeconds());
+    }
+
+    @Test
+    void turnSettleSecondsFallsBackTo300WhenZeroOrNegative(@TempDir Path dir) throws Exception {
+        Path zero = dir.resolve("zero.yaml");
+        Files.writeString(zero, "bind:\n  port: 8080\nleadRollover:\n  turnSettleSeconds: 0\n");
+        assertEquals(300, FleetConfig.load(zero).leadRollover().turnSettleSeconds());
+
+        Path negative = dir.resolve("negative.yaml");
+        Files.writeString(negative, "bind:\n  port: 8080\nleadRollover:\n  turnSettleSeconds: -5\n");
+        assertEquals(300, FleetConfig.load(negative).leadRollover().turnSettleSeconds());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -17,62 +17,21 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
- * The gap this class exists to close: mutation testing on the fleetd ticket "central allow-list
- * of usable models" found that although {@link FleetConfig#validateModels()}'s own logic was well
- * pinned, nothing proved either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()})
- * still invoked it — deleting the call site left the full suite green (1478/0/0/0). A follow-up
- * measurement (same technique — remove one call site, run the suite, not read the code) found the
- * SAME gap for all five of {@link FleetConfig}'s other validators at startup, and for four of the
- * six inside {@link ConfigRef#reload()}. This is a class of gap, not one line's mistake: every one
- * of those thirteen tests called the validator itself directly, never the real caller that was
- * supposed to.
+ * Tests the reflective validator sweep and {@link FleetConfig#validateAll()} reachability.
  *
- * <p>The fix replaces the six individual {@code cfg.validateXxx()} calls at each of the two real
- * call sites with one {@link FleetConfig#validateAll()}, which reaches every validator by
- * reflection rather than by a hand-maintained list of names. A hand-maintained list of six names
- * would have exactly the defect it replaces: the seventh validator someone adds next month has no
- * reason to be added to it, and nothing would say so. This class proves TWO separate claims, and
- * keeps them separate on purpose:
- *
- * <ol>
- *   <li>{@link #theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames()} and its neighbours
- *       prove the reflective sweep itself ({@link FleetConfig#invokeAllValidators}) is a general
- *       mechanism — it runs whatever public, no-arg, void {@code validateXxx()} methods a class
- *       happens to declare today, including a class with more of them than {@link FleetConfig}
- *       has right now. This is the proof that a future, real seventh validator on {@link
- *       FleetConfig} would be swept automatically, without needing to add a real (unwanted)
- *       seventh validator just to exercise the claim.</li>
- *   <li>{@link #validateAllReachesEveryOneOfTodaysSixValidators()} proves {@link
- *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
- *       reaches each of today's six real validators — reusing the exact minimal failing
- *       configurations {@code FleetConfigTest} already established for each one directly, so a
- *       single call to {@code validateAll()} is shown to reproduce every one of those six
- *       failures.</li>
- * </ol>
- *
- * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
- * FleetdStartupValidationTest} (which prove the real startup call site still calls {@code
- * validateAll()}) and the {@code ConfigRefTest} reload tests (which prove the same for {@link
- * ConfigRef#reload()}), removing {@code cfg.validateAll();} from either real call site now fails
- * a test in this module.
- *
- * <p><b>What is NOT pinned, measured rather than assumed.</b> Reverting {@link
- * FleetConfig#validateAll()} to a hardcoded list of today's six method calls leaves the whole
- * suite green (measured at review: 1491 tests, 0 failures). Nothing ties {@code validateAll()} to
- * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
- * 2 proves {@code validateAll()} reaches today's six, and a hardcoded list satisfies both. So the
- * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
- * #fleetConfigDeclaresExactlyTheseSixValidatorsToday()}: it fails the moment a seventh validator
- * is declared, which forces whoever adds it to look at this file.
+ * <p>{@link #theSweepRunsEveryValidateMethodOnAnUnrelatedClass()} and its neighbours
+ * prove that {@link FleetConfig#invokeAllValidators} runs each public, no-arg, void
+ * {@code validateXxx()} method on its target. {@link #fleetConfigDeclaresExactlyTheseValidatorsToday()}
+ * is the canary for the validator set. {@link #validateAllReachesEveryOneOfTodaysRealValidators()}
+ * is the reachability check for that set.
  */
 class FleetConfigValidateAllTest {
 
-    // ── Claim 1: the reflective sweep is a general mechanism, not six names in disguise ──────────
+    // ── Claim 1: the reflective sweep is a general mechanism ─────────────────────────────────────
 
     /**
-     * A throwaway fixture class, unrelated to {@link FleetConfig} in every way except shape: three
-     * public, no-arg, void methods named {@code validateXxx}. Proves the sweep works on ANY class
-     * with this shape, not on something special-cased to {@link FleetConfig}.
+     * Fixture with public, no-arg, void methods named {@code validateXxx}. It proves the sweep uses
+     * the target's method shape rather than special handling for {@link FleetConfig}.
      */
     static class ThreeValidators {
         final List<String> ran = new ArrayList<>();
@@ -91,7 +50,7 @@ class FleetConfigValidateAllTest {
     }
 
     @Test
-    void theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames() {
+    void theSweepRunsEveryValidateMethodOnAnUnrelatedClass() {
         ThreeValidators target = new ThreeValidators();
         FleetConfig.invokeAllValidators(target);
         assertEquals(List.of("validateAlpha", "validateBeta", "validateGamma"), target.ran,
@@ -101,12 +60,8 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * The core of the "self-maintaining" requirement: the exact same class shape as {@link
-     * ThreeValidators}, plus one more method — standing in for "a developer adds a validator next
-     * month". Nothing about the sweep changes to pick it up; the new method is invoked purely
-     * because it exists and matches the shape. This is what makes adding a seventh real validator
-     * to {@link FleetConfig} safe without touching {@link FleetConfig#validateAll()} or either
-     * call site — there is no "wire it in" step left to forget.
+     * Fixture with an added valid method. It proves the sweep reaches a method because it matches
+     * the validator shape.
      */
     static class FourValidators {
         final List<String> ran = new ArrayList<>();
@@ -134,7 +89,7 @@ class FleetConfigValidateAllTest {
         FleetConfig.invokeAllValidators(target);
         assertEquals(List.of("validateAlpha", "validateBeta", "validateDelta", "validateGamma"),
                 sorted(target.ran),
-                "the fourth method must be reached automatically — proving a class can grow the "
+                "the added method must be reached automatically — proving a class can grow the "
                         + "set of things it validates with no change to the sweep itself");
     }
 
@@ -209,18 +164,24 @@ class FleetConfigValidateAllTest {
                         + "name) must all be skipped");
     }
 
-    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches all six today ──
+    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches every validator ──
 
     /**
      * Reflectively enumerates {@link FleetConfig}'s own public, no-arg, void {@code validateXxx()}
      * methods (excluding {@code validateAll} itself) — the exact same filter {@link
      * FleetConfig#invokeAllValidators} applies. This is not the mechanism proof (that is claim 1,
-     * above, on an unrelated class) — it is a visible denominator: today there are six, named
-     * here, so a reader adding a seventh sees this assertion name the new count rather than a
-     * silent pass at the old one.
+     * above, on an unrelated class) — it is a visible denominator: today there are eight, named in
+     * the {@code Set.of} below, so a reader adding or removing one sees this assertion name the new
+     * count rather than a silent pass at the old one. The count lives only in that set, not in this
+     * method's name, so the two cannot drift apart.
+     *
+     * <p>This assertion alone proves only that the validator exists with the right shape — it
+     * cannot prove {@code validateAll()} actually reaches it. Only {@link
+     * #validateAllReachesEveryOneOfTodaysRealValidators()} proves reachability, which is why this
+     * method's failure message sends the reader there too.
      */
     @Test
-    void fleetConfigDeclaresExactlyTheseSixValidatorsToday() {
+    void fleetConfigDeclaresExactlyTheseValidatorsToday() {
         Set<String> names = new TreeSet<>();
         for (Method m : FleetConfig.class.getMethods()) {
             if (java.lang.reflect.Modifier.isPublic(m.getModifiers())
@@ -233,12 +194,18 @@ class FleetConfigValidateAllTest {
         }
         assertEquals(new TreeSet<>(Set.of("validateAuthExposure", "validateLeadTabPrefixes",
                 "validateSubscriptionProfiles", "validateCharters", "validateMembers",
-                "validateModels", "validateLeadRollover")), names,
-                "FleetConfig's public validate*() methods changed. Do TWO things, in this "
+                "validateModels", "validateLeadRollover", "validatePanePlacementAgainstLeadTabs")),
+                names,
+                "FleetConfig's public validate*() methods changed. Do THREE things, in this "
                         + "order. First confirm validateAll() still delegates to "
                         + "invokeAllValidators(this) — a hardcoded list there passes every other "
                         + "test in this class, so this assertion is the only place that will ever "
-                        + "make you check. Only then update the expected set to match.");
+                        + "make you check. Second, update the expected set below to match. Third, "
+                        + "add or remove a case for that validator in "
+                        + "validateAllReachesEveryOneOfTodaysRealValidators() below — this "
+                        + "assertion proves only that the validator exists with the right shape, "
+                        + "never that validateAll() reaches it; that enumeration is the test that "
+                        + "does.");
     }
 
     /** A minimal, otherwise-valid file — same shape FleetConfigTest and ConfigRefTest use. */
@@ -262,14 +229,21 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * The heart of claim 2: for each of today's six real validators, a minimal file that fails
-     * ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
-     * directly — must also fail through {@link FleetConfig#validateAll()}. If a future edit to
-     * {@code validateAll()} silently dropped one validator from the sweep (e.g. a typo'd name
-     * filter), exactly one of these six would start passing when it must not.
+     * The heart of claim 2: for every one of today's real validators, a minimal file that
+     * fails ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
+     * directly, or a dedicated minimal fixture where no other test drives that validator through
+     * {@code validateAll()} — must also fail through {@link FleetConfig#validateAll()}. If a
+     * future edit to {@code validateAll()} silently dropped one of these from the sweep
+     * (e.g. a typo'd name filter), exactly one of them would start passing when it must not.
+     *
+     * <p>This is the single place that proves {@code validateAll()} reaches a given validator.
+     * Adding or removing a validator on {@link FleetConfig} must add or remove a case here, not
+     * only an updated name in {@link #fleetConfigDeclaresExactlyTheseValidatorsToday()}'s expected
+     * set — that assertion proves the validator's shape, never that {@code validateAll()} reaches
+     * it.
      */
     @Test
-    void validateAllReachesEveryOneOfTodaysSixValidators(@TempDir Path dir) throws Exception {
+    void validateAllReachesEveryOneOfTodaysRealValidators(@TempDir Path dir) throws Exception {
         // validateAuthExposure: a non-loopback bind without token mode.
         assertValidateAllRefuses(dir, "auth-exposure.yaml", """
                 bind:
@@ -277,16 +251,16 @@ class FleetConfigValidateAllTest {
                   port: 8765
                 """, "auth.mode: token");
 
-        // validateLeadTabPrefixes: a fleet-wide tabLabel that starts with a lead's own tabPrefix.
+        // validateLeadTabPrefixes: a fleet-wide tabLabel that equals a lead tab.
         assertValidateAllRefuses(dir, "lead-tab-prefixes.yaml", """
                 bind:
                   host: 127.0.0.1
                   port: 8765
                 fleet:
-                  tabLabel: "lead: {role} {profile}"
+                  tabLabel: "alpha"
                   leaders:
                     opus:
-                      tab: "lead: opus"
+                      tab: "alpha"
                 """, "fleet.tabLabel");
 
         // validateSubscriptionProfiles: subscription: true with env: reseating ANTHROPIC_BASE_URL.
@@ -342,6 +316,29 @@ class FleetConfigValidateAllTest {
                   allow:
                     - model: claude-sonnet-5
                 """, "rogue");
+
+        // validatePanePlacementAgainstLeadTabs: a pane-placed profile while a lead names a tab.
+        assertValidateAllRefuses(dir, "pane-placement.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """, "gx10");
+
+        // validateLeadRollover: a leadRollover: block present with no handoverPath.
+        assertValidateAllRefuses(dir, "lead-rollover.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                leadRollover:
+                  requireOperatorConfirm: false
+                """, "handoverPath");
     }
 
     private static void assertValidateAllRefuses(Path dir, String fileName, String yaml,

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -51,6 +51,7 @@ public final class FakeHerdr implements HerdrClient {
     private boolean noPanes = false;
     private volatile String agentStatus = "idle"; // steady-state agent.get status
     private volatile String agentType = "claude"; // detected agent kind on agent.get; null = undetected
+    private volatile String agentSessionId = null; // agent_session.value on agent.get; null = omitted
     private volatile String readText = "worker transcript tail"; // canned agent.read output
     private int pinnedStarts = 0;   // how many upcoming agent.start calls report a fixed pane
     private String pinnedStartTerminal;
@@ -173,6 +174,16 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
+    /**
+     * Set the {@code agent_session.value} that {@code agent.get} reports for {@code term_a} — the
+     * default omits the field entirely (herdr not yet having resolved one), matching the real
+     * daemon's own "not resolved yet" shape.
+     */
+    public FakeHerdr agentSessionId(String sessionId) {
+        this.agentSessionId = sessionId;
+        return this;
+    }
+
     /**
      * Make {@code agent.get} succeed normally for its first {@code okCalls} invocations, then fail
      * every call after that with {@code code} — fleetd #176 fix 1's "backend exited mid-wait"
@@ -311,10 +322,12 @@ public final class FakeHerdr implements HerdrClient {
                         }
                     }
                     String agentField = agentType == null ? "null" : "\"" + agentType + "\"";
+                    String sessionField = agentSessionId == null ? ""
+                            : ",\"agent_session\":{\"kind\":\"id\",\"value\":\"" + agentSessionId + "\"}";
                     yield mapper.readTree(("""
                         {"type":"agent_info","agent":{"terminal_id":"term_a","agent":%s,
-                          "agent_status":"%s","workspace_id":"w2","tab_id":"w2:t7","pane_id":"w2:p7"}}""")
-                            .formatted(agentField, agentStatus));
+                          "agent_status":"%s","workspace_id":"w2","tab_id":"w2:t7","pane_id":"w2:p7"%s}}""")
+                            .formatted(agentField, agentStatus, sessionField));
                 }
                 case "agent.read" -> mapper.readTree(mapper.writeValueAsString(
                         java.util.Map.of("type", "agent_read", "read", java.util.Map.of("text", readText))));

fleetd/src/test/java/dev/ltms/fleet/herdr/HerdrRouterTest.java

@@ -2,6 +2,8 @@ package dev.ltms.fleet.herdr;
 
 import org.junit.jupiter.api.Test;
 
+import java.util.Map;
+
 import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertNotSame;
 
@@ -28,4 +30,44 @@ class HerdrRouterTest {
         assertSame(router.leadAgents(), router.agentsFor("lead"));
         assertSame(router.memberAgents(), router.agentsFor("member"));
     }
+
+    /**
+     * fleetd #669 Unit E. The predicate shape here is exactly what {@code FleetdAssembly} builds:
+     * true when the terminal is a known lead OR a known collaborator. Two distinct clients are
+     * required — with one shared client {@code agentsFor} would return the same object regardless
+     * of the predicate's answer, and this assertion would pass whether or not the collaborator map
+     * was ever consulted.
+     */
+    @Test
+    void collaboratorTerminalRoutesToTheLeadDaemon() {
+        FakeHerdr lead = new FakeHerdr();
+        FakeHerdr member = new FakeHerdr();
+        Map<String, String> leads = Map.of("term_lead", "primary");
+        Map<String, String> collaborators = Map.of("term_collab", "reviewer-alex");
+        HerdrRouter router = new HerdrRouter(lead, member,
+                id -> leads.containsKey(id) || collaborators.containsKey(id));
+
+        assertSame(router.leadAgents(), router.agentsFor("term_collab"),
+                "a configured collaborator's terminal must route to the LEAD daemon, not the member "
+                        + "one — its pane is opened by a person, exactly like a lead's");
+    }
+
+    /**
+     * Companion to {@link #collaboratorTerminalRoutesToTheLeadDaemon}: a terminal that is neither a
+     * known lead nor a known collaborator must still route to the member daemon. Without this, a
+     * predicate of {@code _ -> true} would also pass the test above.
+     */
+    @Test
+    void terminalInNeitherMapStillRoutesToTheMemberDaemon() {
+        FakeHerdr lead = new FakeHerdr();
+        FakeHerdr member = new FakeHerdr();
+        Map<String, String> leads = Map.of("term_lead", "primary");
+        Map<String, String> collaborators = Map.of("term_collab", "reviewer-alex");
+        HerdrRouter router = new HerdrRouter(lead, member,
+                id -> leads.containsKey(id) || collaborators.containsKey(id));
+
+        assertSame(router.memberAgents(), router.agentsFor("term_worker"),
+                "a terminal absent from both maps must stay on the member daemon — the fix widens "
+                        + "the predicate, it does not make it unconditionally true");
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/herdr/LeadTabScannerTest.java

@@ -163,6 +163,13 @@ class LeadTabScannerTest {
         return new LeadTabScanner(herdr, tabToName, Set.of("fleetd-workers"), TTL, clock::get);
     }
 
+    private LeadTabScanner scannerWithCollaborators(TopologyHerdr herdr, Map<String, String> tabToName,
+                                                     Map<String, String> collaboratorTabToName,
+                                                     AtomicLong clock) {
+        return new LeadTabScanner(herdr, tabToName, collaboratorTabToName,
+                Set.of("fleetd-workers"), TTL, clock::get);
+    }
+
     @Test
     void everyConfiguredTabBecomesALeadNamedByItsEntry() {
         Map<String, String> leads = scanner(twoLeads(), twoLeadsConfigured(), new AtomicLong()).get();
@@ -198,9 +205,12 @@ class LeadTabScannerTest {
     }
 
     /**
-     * The guard that matters: fleetd labels its own worker tabs, so if a worker space were scanned
-     * a naming accident would promote the fleet. The exclusion is by workspace, not by hoping the
-     * worker template never collides.
+     * Covers the {@code excludedWorkspaceLabels} parameter: a tab in an excluded workspace is never
+     * matched, whatever its label. Production always constructs this class with an empty set (CB-558,
+     * {@code FleetdAssembly}), so this parameter plays no part in the live guard against a worker
+     * tab being mistaken for a lead — that guard is {@code CallerResolver} asking the live
+     * spawned-member roster before any tab map. This test exists because the parameter still exists
+     * and is worth covering on its own terms.
      */
     @Test
     void aTabInAWorkerSpaceIsNeverALeadEvenWhenItsLabelMatches() {
@@ -212,6 +222,29 @@ class LeadTabScannerTest {
         assertFalse(scanner(herdr, tabToName, new AtomicLong()).get().containsKey("term_impostor"));
     }
 
+    /**
+     * The shipped shape (CB-558, {@code FleetdAssembly}): production always constructs this class
+     * with an empty {@code excludedWorkspaceLabels}, and a lead's {@code workspace:} default is the
+     * same shared {@code "fleet"} space the members use. A lead tab is still found when it sits in
+     * the exact same workspace as a member-labelled tab — the scanner tells them apart by the exact
+     * tab label, not by which workspace either one is in.
+     */
+    @Test
+    void aLeadIsDiscoveredWhenItsWorkspaceIsTheSameAsTheMemberWorkspace() {
+        TopologyHerdr herdr = new TopologyHerdr()
+                .workspace("w1", "fleet")
+                .tab("w1:t1", "w1", "lead: opus-5.0")
+                .tab("w1:t2", "w1", "worker: gx10 #1")
+                .pane("w1:p1", "w1:t1", "term_opus")
+                .pane("w1:p2", "w1:t2", "term_worker");
+        LeadTabScanner s = new LeadTabScanner(herdr, Map.of("lead: opus-5.0", "opus-5.0"),
+                Set.of(), TTL, new AtomicLong()::get);
+
+        assertEquals("opus-5.0", s.get().get("term_opus"),
+                "a lead sharing the members' workspace is still discovered — the label, not the "
+                        + "workspace, is what matches it");
+    }
+
     @Test
     void aLabelWithNoConfiguredEntryIsIgnored() {
         TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
@@ -232,8 +265,9 @@ class LeadTabScannerTest {
 
     @Test
     void everyPaneInALeadTabResolvesAsThatLead() {
-        // A human may split their own lead tab. Both panes are theirs, so both are that lead —
-        // nothing fleetd placed can land here (see the worker-space test above).
+        // A human may split their own lead tab. Both panes are theirs, so both are that lead.
+        // A pane-placed member landing here instead is refused at startup by
+        // FleetConfig.validatePanePlacementAgainstLeadTabs, not by this scanner.
         TopologyHerdr herdr = twoLeads().pane("w1:p1b", "w1:t1", "term_opus_split");
 
         assertEquals("opus-5.0",
@@ -463,4 +497,75 @@ class LeadTabScannerTest {
 
         assertEquals(afterFirst, herdr.calls, "the failure path must be rate-limited too");
     }
+
+    // ── fleetd #669 Unit D: a collaborator tab is matched the same way as a lead tab, one pass ─────
+
+    @Test
+    void aConfiguredCollaboratorTabIsReportedByCollaboratorsNotByGet() {
+        TopologyHerdr herdr = new TopologyHerdr()
+                .workspace("w1", "main")
+                .tab("w1:t1", "w1", "collab: ops")
+                .pane("w1:p1", "w1:t1", "term_ops");
+        LeadTabScanner s = scannerWithCollaborators(herdr, Map.of(), Map.of("collab: ops", "ops"),
+                new AtomicLong());
+
+        assertEquals(Map.of("term_ops", "ops"), s.collaborators(),
+                "a collaborator tab is matched exactly like a lead tab");
+        assertEquals(Map.of(), s.get(), "a collaborator tab must never also appear as a lead");
+    }
+
+    /**
+     * Criterion 4, scanner level: a collaborator tab that is labelled but runs no agent is not
+     * reported — the same #359 liveness cross-check a lead tab gets.
+     */
+    @Test
+    void aDeadCollaboratorTabIsNotReported() {
+        TopologyHerdr herdr = new TopologyHerdr()
+                .workspace("w1", "main")
+                .tab("w1:t1", "w1", "collab: ops")
+                .pane("w1:p1", "w1:t1", "term_ops")
+                .deadAgent("w1:t1");
+        LeadTabScanner s = scannerWithCollaborators(herdr, Map.of(), Map.of("collab: ops", "ops"),
+                new AtomicLong());
+
+        assertFalse(s.collaborators().containsKey("term_ops"),
+                "a dead collaborator tab must never resolve as a live collaborator");
+    }
+
+    /**
+     * Both kinds are matched in a single pass over the same tab list — not a second scanner, not a
+     * second scan. Proven by herdr call count: scanning one lead tab and one collaborator tab in the
+     * same instance costs exactly as many calls as scanning two lead tabs in {@link #twoLeads()}.
+     */
+    @Test
+    void leadsAndCollaboratorsAreMatchedInOnePassOverTheSameScan() {
+        TopologyHerdr oneOfEach = new TopologyHerdr()
+                .workspace("w1", "main")
+                .tab("w1:t1", "w1", "lead: opus-5.0")
+                .tab("w1:t2", "w1", "collab: ops")
+                .pane("w1:p1", "w1:t1", "term_opus")
+                .pane("w1:p2", "w1:t2", "term_ops");
+        LeadTabScanner s = scannerWithCollaborators(oneOfEach, Map.of("lead: opus-5.0", "opus-5.0"),
+                Map.of("collab: ops", "ops"), new AtomicLong());
+
+        assertEquals(Map.of("term_opus", "opus-5.0"), s.get());
+        assertEquals(Map.of("term_ops", "ops"), s.collaborators());
+
+        TopologyHerdr twoLeadsBaseline = twoLeads();
+        scanner(twoLeadsBaseline, twoLeadsConfigured(), new AtomicLong()).get();
+
+        assertEquals(twoLeadsBaseline.calls, oneOfEach.calls,
+                "one lead tab + one collaborator tab must cost exactly as many herdr calls as two "
+                        + "lead tabs — proof this is one pass, not a second scan");
+    }
+
+    /** Regression: with no collaborators configured, every existing lead-only behaviour is unchanged. */
+    @Test
+    void anEmptyCollaboratorMapLeavesCollaboratorsEmptyAndGetUnaffected() {
+        LeadTabScanner s = scannerWithCollaborators(twoLeads(), twoLeadsConfigured(), Map.of(),
+                new AtomicLong());
+
+        assertEquals(Map.of(), s.collaborators());
+        assertEquals(Map.of("term_opus", "opus-5.0", "term_gpt", "gpt-sol-5.6"), s.get());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeHighThresholdTest.java

@@ -0,0 +1,104 @@
+package dev.ltms.fleet.lead;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * {@code LeadContextGauge}'s HIGH threshold scales with the caller's resolved effective
+ * auto-compact window, so the margin it warns at makes sense against a window that can legally sit
+ * as low as {@code 100_000}, not only against the fixed fallback. These properties pin that
+ * scaling, its boundary, and the fallback used when no window is resolvable.
+ */
+class LeadContextGaugeHighThresholdTest {
+
+    private static final String SESSION_ID = "55555555-5555-5555-5555-555555555555";
+
+    private static String usageLine(long tokens) {
+        return "{\"type\":\"assistant\",\"message\":{\"role\":\"assistant\",\"usage\":{"
+                + "\"input_tokens\":" + tokens + ",\"cache_read_input_tokens\":0,\"cache_creation_input_tokens\":0}}}";
+    }
+
+    private static String writeTranscript(Path configDir, String sessionId, long tokens) throws IOException {
+        Path projectDir = configDir.resolve("projects").resolve("some-project-slug");
+        Files.createDirectories(projectDir);
+        Files.writeString(projectDir.resolve(sessionId + ".jsonl"), usageLine(tokens) + "\n", StandardCharsets.UTF_8);
+        return configDir.toString();
+    }
+
+    @Test
+    @DisplayName("an effective window of 100000 reports HIGH strictly below 100000")
+    void effectiveWindowOf100000ReportsHighStrictlyBelow100000(@TempDir Path tmp) throws IOException {
+        // 90,000 is below the 100,000 window itself, but above a fixed 200,000 fallback would ever
+        // reach — only a threshold that scales with the window can report HIGH here.
+        String configDir = writeTranscript(tmp, SESSION_ID, 90_000);
+        LeadContextGauge gauge = new LeadContextGauge();
+
+        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", 100_000L);
+
+        assertEquals(LeadContextGauge.State.HIGH, reading.state(),
+                "90,000 tokens against a 100,000 effective window must already be HIGH, with margin to spare "
+                        + "before a compaction at the window itself");
+    }
+
+    @Test
+    @DisplayName("the boundary sits strictly between OK and HIGH on both sides")
+    void boundarySitsStrictlyBetweenOkAndHighOnBothSides(@TempDir Path tmp) throws IOException {
+        long window = 100_000L;
+        long threshold = (long) (window * (2.0 / 3.0)); // 66,666
+
+        String belowConfigDir = writeTranscript(tmp.resolve("below"), SESSION_ID, threshold - 1);
+        LeadContextGauge belowGauge = new LeadContextGauge();
+        assertEquals(LeadContextGauge.State.OK,
+                belowGauge.read(belowConfigDir, SESSION_ID, "claude", window).state(),
+                "one token short of the threshold must stay OK");
+
+        String atConfigDir = writeTranscript(tmp.resolve("at"), SESSION_ID, threshold);
+        LeadContextGauge atGauge = new LeadContextGauge();
+        assertEquals(LeadContextGauge.State.HIGH,
+                atGauge.read(atConfigDir, SESSION_ID, "claude", window).state(),
+                "exactly at the threshold must already be HIGH");
+    }
+
+    @Test
+    @DisplayName("with no effective window resolvable, the threshold is still the fixed 200000 default")
+    void noEffectiveWindowFallsBackToTheFixed200000Default(@TempDir Path tmp) throws IOException {
+        String belowConfigDir = writeTranscript(tmp.resolve("below"), SESSION_ID, 199_999);
+        LeadContextGauge belowGauge = new LeadContextGauge();
+        assertEquals(LeadContextGauge.State.OK,
+                belowGauge.read(belowConfigDir, SESSION_ID, "claude", null).state(),
+                "one token short of the fixed default must stay OK when no window is resolvable");
+
+        String atConfigDir = writeTranscript(tmp.resolve("at"), SESSION_ID, 200_000);
+        LeadContextGauge atGauge = new LeadContextGauge();
+        assertEquals(LeadContextGauge.State.HIGH,
+                atGauge.read(atConfigDir, SESSION_ID, "claude", null).state(),
+                "the fixed default must still be 200,000 when no window is resolvable");
+    }
+
+    @Test
+    @DisplayName("a second read with a different window, within the TTL, reports against its own window, not the first call's cached state")
+    void aSecondReadWithADifferentWindowWithinTheTtlReportsAgainstItsOwnWindow(@TempDir Path tmp) throws IOException {
+        String configDir = writeTranscript(tmp, SESSION_ID, 90_000);
+        long[] now = {0L};
+        LeadContextGauge gauge = new LeadContextGauge(() -> now[0], 5_000);
+
+        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude", 100_000L);
+        assertEquals(LeadContextGauge.State.HIGH, first.state(),
+                "90,000 tokens against a 100,000 window is HIGH");
+
+        now[0] += 1_000; // stays inside the 5,000ms TTL — the cache key must still vary with the window
+        LeadContextGauge.Reading second = gauge.read(configDir, SESSION_ID, "claude", 1_000_000L);
+
+        assertEquals(LeadContextGauge.State.OK, second.state(),
+                "90,000 tokens against a 1,000,000 window must report OK regardless of the previous call's "
+                        + "window, even while that call's cache entry is still within its TTL");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeTest.java

@@ -85,7 +85,7 @@ class LeadContextGaugeTest {
                 usageLine(40_000, 5_000, 3_000)); // last record: 48,000
         LeadContextGauge gauge = new LeadContextGauge();
 
-        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude");
+        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(48_000L, first.tokens(), "must total input+cache_read+cache_creation of the LAST usage record");
         assertEquals(LeadContextGauge.State.OK, first.state());
 
@@ -93,7 +93,7 @@ class LeadContextGaugeTest {
         // must change with it, not stay pinned to the first fixture's total.
         String otherSession = "22222222-2222-2222-2222-222222222222";
         writeTranscript(tmp, otherSession, usageLine(100_000, 50_000, 50_000)); // last record: 200,000
-        LeadContextGauge.Reading second = gauge.read(configDir, otherSession, "claude");
+        LeadContextGauge.Reading second = gauge.read(configDir, otherSession, "claude", null);
         assertEquals(200_000L, second.tokens());
         assertTrue(second.tokens() != first.tokens(), "changing N in the fixture must change the reported number");
     }
@@ -111,12 +111,12 @@ class LeadContextGaugeTest {
                 compactionLine(),
                 usageLine(3_000, 0, 0));
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading twoCompactions = gauge.read(tmp.toString(), sessionTwoCompactions, "claude");
+        LeadContextGauge.Reading twoCompactions = gauge.read(tmp.toString(), sessionTwoCompactions, "claude", null);
         assertEquals(2, twoCompactions.compactions());
 
         String sessionZeroCompactions = "44444444-4444-4444-4444-444444444444";
         writeTranscript(tmp, sessionZeroCompactions, usageLine(3_000, 0, 0));
-        LeadContextGauge.Reading zeroCompactions = gauge.read(tmp.toString(), sessionZeroCompactions, "claude");
+        LeadContextGauge.Reading zeroCompactions = gauge.read(tmp.toString(), sessionZeroCompactions, "claude", null);
         assertEquals(0, zeroCompactions.compactions(), "changing K in the fixture must change the reported count");
     }
 
@@ -126,7 +126,7 @@ class LeadContextGaugeTest {
     @DisplayName("a missing transcript file reports UNKNOWN with no token number")
     void missingFileIsUnknown(@TempDir Path tmp) {
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());
         assertNull(reading.tokens());
     }
@@ -148,7 +148,7 @@ class LeadContextGaugeTest {
             assumeFalse(Files.isReadable(file),
                     "runs as root (CI container): the read bit does not stop root, so this case cannot be set up here");
             LeadContextGauge gauge = new LeadContextGauge();
-            LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
+            LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", null);
             assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());
             assertNull(reading.tokens());
         } finally {
@@ -171,7 +171,7 @@ class LeadContextGaugeTest {
         Files.writeString(file, lastCompleteLine + "\n" + tornLine, StandardCharsets.UTF_8);
 
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.OK, reading.state(),
                 "a torn final line must not turn a good earlier reading into UNKNOWN");
         assertEquals(6_000L, reading.tokens(),
@@ -187,7 +187,7 @@ class LeadContextGaugeTest {
                 "{this is not json at all",
                 "neither is this{{{");
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.UNKNOWN, reading.state(),
                 "every line unparseable is the real format-change signal and must still report UNKNOWN");
         assertNull(reading.tokens());
@@ -224,12 +224,12 @@ class LeadContextGaugeTest {
         AtomicLong now = new AtomicLong(0);
         LeadContextGauge gauge = new LeadContextGauge(now::get, 5_000);
 
-        gauge.read(configDir, SESSION_ID, "claude");
-        gauge.read(configDir, SESSION_ID, "claude"); // still inside the TTL window
+        gauge.read(configDir, SESSION_ID, "claude", null);
+        gauge.read(configDir, SESSION_ID, "claude", null); // still inside the TTL window
         assertEquals(1, gauge.diskReadCount(), "two reads inside the TTL must touch disk once");
 
         now.set(6_000); // past the TTL
-        gauge.read(configDir, SESSION_ID, "claude");
+        gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(2, gauge.diskReadCount(), "a read past the TTL must touch disk again");
     }
 
@@ -241,8 +241,8 @@ class LeadContextGaugeTest {
         String configDir = writeTranscript(tmp, SESSION_ID, usageLine(1_000, 0, 0));
         LeadContextGauge gauge = new LeadContextGauge();
 
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, "opencode").state());
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, null).state());
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, null, "claude").state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, "opencode", null).state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, null, null).state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, null, "claude", null).state());
     }
 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -63,6 +63,17 @@ class FleetMcpAuthzTest {
 
     /** A fully wired FleetMcp on fakes — constructing it is itself part of what is under test. */
     private FleetMcp mcp(boolean enforce) {
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> 999_999);
+        return mcp(enforce, CallerResolver.withLeadsAndMembers(identity, false, null,
+                Map::of, new MemberRegistry(null)));
+    }
+
+    /**
+     * As {@link #mcp(boolean)}, with an explicit {@link CallerResolver} — so a test can wire known
+     * leads/collaborators and drive {@code denyFor}'s real {@code knownLeadOrCollaborator()}
+     * classifier instead of the default empty one.
+     */
+    private FleetMcp mcp(boolean enforce, CallerResolver callers) {
         FleetConfig.Profile cfg = new FleetConfig.Profile(
                 "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
                 "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
@@ -83,9 +94,7 @@ class FleetMcpAuthzTest {
         // to be omitted to reach "legacy" is now always real, and AuthorizationMode is the
         // separate, explicit choice that governs enforcement.
         mcp = new FleetMcp(messages, workers, sessions, identity, sessions.asPresence(),
-                new PrimaryRegistry(null),
-                CallerResolver.withLeadsAndMembers(identity, false, null,
-                Map::of, new MemberRegistry(null)),
+                new PrimaryRegistry(null), callers,
                 enforce ? FleetMcp.AuthorizationMode.ENFORCED : FleetMcp.AuthorizationMode.UNENFORCED,
                 metrics, FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
                 FleetMcp.QuarantineSource.none(), null, FleetMcp.OutageSource.none(),
@@ -97,6 +106,7 @@ class FleetMcpAuthzTest {
     private static final Principal WORKER_A = Principal.worker("term_a", 200);
     private static final Principal ANON = Principal.anonymous();
     private static final Principal ARCH_DESIGN = Principal.architect("lead-designer", "term_design", 400);
+    private static final Principal COLLABORATOR = Principal.collaborator("ops", "term_collab", 600);
 
     // --- the table, enforced on THIS path too ---------------------------------------------------
 
@@ -156,6 +166,45 @@ class FleetMcpAuthzTest {
         }
     }
 
+    /**
+     * fleetd #669 Unit A: {@code SEND} is split into three actions ({@link Authz.Action#SEND},
+     * {@link Authz.Action#COORD_SEND}, {@link Authz.Action#ANSWER}), each carrying the same grant
+     * the one undivided action gave. An architect holds all three, exactly as it held the one.
+     */
+    @Test
+    void anArchitectMayUseAllThreeSendShapesOverMcp() {
+        FleetMcp m = mcp(true);
+        for (Authz.Action a : new Authz.Action[]{Authz.Action.SEND, Authz.Action.COORD_SEND,
+                Authz.Action.ANSWER}) {
+            assertNull(m.denyFor(ARCH_DESIGN, a, "term_a"),
+                    a + " carries the same grant the undivided SEND action gave an architect");
+        }
+    }
+
+    /** The other half of the same split: a worker is excluded from all three, as it was from one. */
+    @Test
+    void aWorkerMayNotUseAnySendShapeOverMcp() {
+        FleetMcp m = mcp(true);
+        for (Authz.Action a : new Authz.Action[]{Authz.Action.SEND, Authz.Action.COORD_SEND,
+                Authz.Action.ANSWER}) {
+            McpSchema.CallToolResult denied = m.denyFor(WORKER_A, a, "term_a");
+            assertNotNull(denied, a + " must stay refused to a worker");
+            assertTrue(denied.isError(), "a refusal is returned as an MCP tool error");
+        }
+    }
+
+    /**
+     * fleetd #669 Unit A / #678: {@code TASK_READ} (ticket polling, session status) is split out of
+     * the roster-only {@code READ}, carrying forward the grant the undivided action gave. A worker
+     * still has both — it never gained or lost anything by the split.
+     */
+    @Test
+    void aWorkerKeepsBothReadActionsAfterTheSplit() {
+        FleetMcp m = mcp(true);
+        assertNull(m.denyFor(WORKER_A, Authz.Action.READ, null));
+        assertNull(m.denyFor(WORKER_A, Authz.Action.TASK_READ, null));
+    }
+
     @Test
     void anArchitectMayReplyAndAskOnlyAsItsOwnPaneOverMcp() {
         FleetMcp m = mcp(true);
@@ -187,6 +236,39 @@ class FleetMcpAuthzTest {
                 "the caller IS authenticated — it is just not the right role");
     }
 
+    /**
+     * {@code denyFor} passes the real production classifier, not a test-supplied one — no
+     * terminal is recognised as a configured lead or collaborator, so a collaborator's SEND is
+     * refused over MCP.
+     */
+    @Test
+    void aCollaboratorMayNotSendOverMcpWithTheRealProductionClassifier() {
+        FleetMcp m = mcp(true);
+        McpSchema.CallToolResult denied = m.denyFor(COLLABORATOR, Authz.Action.SEND, "term_lead");
+        assertNotNull(denied, "no terminal is recognised as a lead or collaborator yet");
+        assertTrue(denied.isError());
+    }
+
+    /**
+     * fleetd #669 Unit D: wires a real {@link CallerResolver} with a known lead and a known
+     * collaborator tab, and leaves a spawned member's own terminal recognised by neither map — so a
+     * collaborator's SEND reaches both named peers and is refused for the spawned member's terminal,
+     * over MCP's {@code denyFor}.
+     */
+    @Test
+    void aCollaboratorMaySendToAKnownLeadOrCollaboratorButNotToASpawnedMembersTerminal() {
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> 999_999);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, false, null,
+                () -> Map.of("term_lead_known", "lead-x"), new MemberRegistry(null),
+                t -> null, () -> Map.of("term_collab_known", "ops2"));
+        FleetMcp m = mcp(true, callers);
+
+        assertNull(m.denyFor(COLLABORATOR, Authz.Action.SEND, "term_lead_known"));
+        assertNull(m.denyFor(COLLABORATOR, Authz.Action.SEND, "term_collab_known"));
+        assertNotNull(m.denyFor(COLLABORATOR, Authz.Action.SEND, "term_a"),
+                "a spawned member's own terminal must stay unreachable, even once the classifier is real");
+    }
+
     @Test
     void theLegacyConstructorLeavesTheGateOpen() {
         // The 22 pre-existing FleetMcpTest cases rely on no authorization being enforced.
@@ -284,6 +366,58 @@ class FleetMcpAuthzTest {
                         + "calling, not pass a literal boolean -- found: " + trailing);
     }
 
+    // --- fleetd #703: who may see fleet_list's collaborators array -------------------------------
+
+    /**
+     * fleetd #703: {@link FleetMcp#collaboratorsVisibleTo} is the whole policy decision for
+     * {@code fleet_list}'s {@code collaborators} array. Visible to exactly the roles that may
+     * {@code SEND} to a named peer -- the primary, an architect, and a collaborator itself -- never
+     * a worker, which holds {@code READ} but can never {@code SEND} to a collaborator, and never an
+     * anonymous caller.
+     */
+    @Test
+    void onlyPrimaryArchitectAndCollaboratorMaySeeTheCollaboratorsArray() {
+        assertTrue(FleetMcp.collaboratorsVisibleTo(PRIMARY), "the primary must see the collaborators array");
+        assertTrue(FleetMcp.collaboratorsVisibleTo(ARCH_DESIGN), "an architect must see the collaborators array");
+        assertTrue(FleetMcp.collaboratorsVisibleTo(COLLABORATOR), "a collaborator must see its own peer roster");
+        assertFalse(FleetMcp.collaboratorsVisibleTo(WORKER_A),
+                "a worker holds READ but can never SEND to a collaborator, so it must not see the array");
+        assertFalse(FleetMcp.collaboratorsVisibleTo(ANON), "authenticated as nothing must not see it either");
+    }
+
+    /**
+     * fleetd #703, same reasoning as {@link #theFleetListHandlerActuallyConsultsCoordinatorVisibleTo}:
+     * the predicate above can be perfectly correct while the one production call site never asks it.
+     * This reads {@code FleetMcp.java}'s own source and asserts the {@code fleet_list} handler's
+     * {@code listFleet(...)} call both threads {@code callers.collaborators()} into the payload and
+     * asks {@code collaboratorsVisibleTo(principal(exchange))} for the visibility flag, rather than a
+     * literal boolean or an empty map.
+     */
+    @Test
+    void theFleetListHandlerActuallyConsultsCollaboratorsVisibleTo() throws Exception {
+        String source = Files.readString(MCP_SOURCE);
+
+        int start = source.indexOf("listHandler =");
+        assertTrue(start >= 0, "could not find the fleet_list handler (listHandler) in " + MCP_SOURCE
+                + " -- the scrape has stopped matching, fix the anchor before trusting this test");
+        int end = source.indexOf("stopHandler =", start);
+        assertTrue(end > start, "could not find the handler declared after listHandler to bound the scrape");
+        String handlerBlock = source.substring(start, end);
+
+        // CONTROL: the block we scraped really does contain a call to listFleet(...) -- if this
+        // fails, the anchors above moved and the assertions below would otherwise pass on nothing.
+        assertTrue(handlerBlock.contains("listFleet("),
+                "control failed: the scraped listHandler block contains no listFleet( call at all -- "
+                        + "the anchors have drifted, this test is not testing what it claims to");
+
+        assertTrue(handlerBlock.contains("callers.collaborators()"),
+                "the fleet_list handler must thread callers.collaborators() into listFleet(...), not an "
+                        + "empty or literal map -- block: " + handlerBlock);
+        assertTrue(handlerBlock.contains("collaboratorsVisibleTo(principal(exchange))"),
+                "the fleet_list handler must ask collaboratorsVisibleTo(principal(exchange)) who is "
+                        + "calling, not pass a literal boolean -- block: " + handlerBlock);
+    }
+
     // --- which action each tool hands the gate (fleetd #272) ------------------------------------
 
     /**
@@ -297,35 +431,53 @@ class FleetMcpAuthzTest {
      * the whole time the defect was live -- the table was right, the action fed to it was wrong.
      */
     @Test
-    void pollingByTargetIsADrainAndPollingByTicketIsARead() {
+    void pollingByTargetIsADrainAndPollingByTicketIsATaskRead() {
         assertEquals(Authz.Action.DRAIN, FleetMcp.pollAction("term_b", null),
                 "poll by target removes the replies — that is a drain, not an observation");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, null),
-                "poll by ticket changes nothing");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction("  ", null),
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction(null, null),
+                "poll by ticket changes nothing, but is not the roster-only READ action");
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction("  ", null),
                 "a blank target is an absent target");
     }
 
     /**
      * fleetd #421: a coordId branch is a THIRD operation behind fleet_poll's one name, and it must
-     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ}, even though this
-     * branch also consumes nothing. READ's grant is open to every authenticated role on the premise
-     * that the roster carries no secrets; a lead-to-lead body is not the roster, so folding this
-     * branch into READ would let any worker read every peer lead's mail in full. coordId also takes
-     * priority over target when both happen to be present — it addresses a different inbox entirely.
+     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ} or {@link
+     * Authz.Action#TASK_READ}, even though this branch also consumes nothing. A lead-to-lead body
+     * is not the roster and not a ticket/status read, so folding this branch into either would let
+     * any worker or architect read every peer lead's mail in full. coordId also takes priority over
+     * target when both happen to be present — it addresses a different inbox entirely.
      */
     @Test
-    void pollingByCoordIdIsACoordReadNeverAPlainRead() {
+    void pollingByCoordIdIsACoordReadNeverAPlainOrTaskRead() {
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction(null, "mac-opus"),
-                "reading held peer mail must not be mapped to the everyone-readable READ action");
+                "reading held peer mail must not be mapped to a widely-readable action");
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("  ", "mac-opus"),
                 "a blank target must not fall through to READ/DRAIN when coordId is present");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, "  "),
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction(null, "  "),
                 "a blank coordId is an absent coordId, same as target/ticket");
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("term_b", "mac-opus"),
                 "coordId takes priority over target — this is a different inbox, not a drain");
     }
 
+    /**
+     * {@code fleet_send} is three call shapes behind one tool name, exactly as {@code fleet_poll}
+     * is (fleetd #669 Unit A). {@link FleetMcp#sendAction} picks the action from the arguments, not
+     * the handler, for the same reason {@link FleetMcp#pollAction} does: a test can assert the
+     * mapping the handler actually uses.
+     */
+    @Test
+    void sendMapsToThreeDifferentActionsByItsArguments() {
+        assertEquals(Authz.Action.SEND, FleetMcp.sendAction(null, null),
+                "a plain delivery, with neither coordId nor turnId, is a local SEND");
+        assertEquals(Authz.Action.COORD_SEND, FleetMcp.sendAction("mac-opus", null),
+                "coordId addresses a peer lead over the coordination broker");
+        assertEquals(Authz.Action.ANSWER, FleetMcp.sendAction(null, "turn-1"),
+                "turnId resolves a worker's blocked question");
+        assertEquals(Authz.Action.COORD_SEND, FleetMcp.sendAction("mac-opus", "turn-1"),
+                "coordId takes priority over turnId, mirroring sendToLead's own mutual-exclusion check");
+    }
+
     @Test
     void everyRegisteredToolHasItsHandlerActionPinned() {
         // fleetd #469: this used to scrape FleetMcp.java's tool("…") calls for the registered set —
@@ -344,16 +496,22 @@ class FleetMcpAuthzTest {
                 () -> tool + " is registered but has no pinned authorization action"));
 
         assertEquals(Authz.Action.SEND, FleetMcp.toolAction("fleet_send", Map.of()));
+        assertEquals(Authz.Action.SEND,
+                FleetMcp.toolAction("fleet_send", Map.of("sessionId", "term_a", "content", "hi")));
+        assertEquals(Authz.Action.COORD_SEND,
+                FleetMcp.toolAction("fleet_send", Map.of("coordId", "mac-opus", "content", "hi")));
+        assertEquals(Authz.Action.ANSWER,
+                FleetMcp.toolAction("fleet_send", Map.of("turnId", "turn-1", "content", "hi")));
         assertEquals(Authz.Action.REPLY, FleetMcp.toolAction("fleet_reply", Map.of()));
         assertEquals(Authz.Action.ASK, FleetMcp.toolAction("fleet_ask", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_status", Map.of()));
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.toolAction("fleet_status", Map.of()));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_ack", Map.of()));
         assertEquals(Authz.Action.SPAWN, FleetMcp.toolAction("fleet_spawn", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_list", Map.of()));
         assertEquals(Authz.Action.STOP, FleetMcp.toolAction("fleet_stop", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_profiles", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_whoami", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_poll", Map.of("target", "term_b")));
         assertEquals(Authz.Action.COORD_READ,
                 FleetMcp.toolAction("fleet_poll", Map.of("coordId", "mac-opus")));

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpLeadContextGaugeWiringTest.java

@@ -86,7 +86,7 @@ class FleetMcpLeadContextGaugeWiringTest {
         LeadContextGauge contextGauge = new LeadContextGauge();
         AtomicReference<String> configuredDir = new AtomicReference<>(dirA.toString());
         FleetMcp.LeadConfigDirSource source = new FleetMcp.LeadConfigDirSource(name ->
-                LEAD_NAME.equals(name) ? configuredDir.get() : null);
+                LEAD_NAME.equals(name) ? configuredDir.get() : null, _ -> null);
 
         String firstRead = textOf(listFleet(herdr, sessions, contextGauge, source));
         assertTrue(firstRead.contains("\"tokens\":11000"),
@@ -121,6 +121,7 @@ class FleetMcpLeadContextGaugeWiringTest {
                 FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
                 FleetMcp.LoopHealthSource.none(), FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(),
                 FleetMcp.LeadSeatSource.none(), contextGauge, leadConfigDirs,
-                Map.of(LEAD_TERMINAL, LEAD_NAME), LEAD_TERMINAL, FleetMcp.CoordinationSource.none(), false);
+                Map.of(LEAD_TERMINAL, LEAD_NAME), LEAD_TERMINAL, Map.of(), false,
+                FleetMcp.CoordinationSource.none(), false);
     }
 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -10,6 +10,7 @@ import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.AgentStatus;
 import dev.ltms.fleet.herdr.FakeHerdr;
 import dev.ltms.fleet.inject.LoopWatchdog;
+import dev.ltms.fleet.lead.LeadContextGauge;
 import dev.ltms.fleet.herdr.PaneLocator;
 import dev.ltms.fleet.herdr.WorkspaceControl;
 import dev.ltms.fleet.inject.Injector;
@@ -879,6 +880,83 @@ class FleetMcpTest {
         assertTrue(out.contains("x".repeat(80) + "…"), "expected an 80-char preview with an ellipsis: " + out);
     }
 
+    // --- fleetd #703: fleet_list's collaborators array -------------------------------------------
+
+    /** Calls the canonical {@code listFleet} overload directly, so a test can set the collaborators
+     * payload and its visibility independently of a real {@code Principal} / MCP exchange. */
+    private static McpSchema.CallToolResult listFleetWithCollaborators(FakeHerdr h,
+            Map<String, String> collaborators, boolean collaboratorsVisible) {
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        return FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.LoopHealthSource.none(), FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(),
+                FleetMcp.LeadSeatSource.none(), new LeadContextGauge(), FleetMcp.LeadConfigDirSource.none(),
+                Map.of(), "", collaborators, collaboratorsVisible,
+                FleetMcp.CoordinationSource.none(), false);
+    }
+
+    /**
+     * fleetd #703 acceptance A: a visible caller with one configured collaborator gets a
+     * {@code collaborators} row whose key ({@code CallerResolver.collaborators()}'s
+     * {@code terminal_id -> name} entry) lands as that row's {@code sessionId}, and {@code leads}/
+     * {@code members} are unaffected by the new key.
+     */
+    @Test
+    void listReportsACollaboratorsRowKeyedByTheCollaboratorsTerminalId() {
+        FakeHerdr h = new FakeHerdr();
+        String out = textOf(listFleetWithCollaborators(h, Map.of("term_collab", "ops"), true));
+
+        assertTrue(out.contains("\"collaborators\":["), out);
+        assertTrue(out.contains("\"name\":\"ops\""), out);
+        assertTrue(out.contains("\"sessionId\":\"term_collab\""), out);
+        assertTrue(out.contains("\"leads\":[]"), out);
+        assertTrue(out.contains("\"members\":[]"), out);
+    }
+
+    /**
+     * fleetd #703 acceptance A, control half: with no collaborator configured, the key is absent
+     * (caller cannot see it) or an empty array (caller can), and {@code leads}/{@code members} are
+     * unchanged either way.
+     */
+    @Test
+    void listOmitsOrEmptiesCollaboratorsWhenNoneAreConfigured() {
+        FakeHerdr h = new FakeHerdr();
+
+        String visibleButEmpty = textOf(listFleetWithCollaborators(h, Map.of(), true));
+        assertTrue(visibleButEmpty.contains("\"collaborators\":[]"), visibleButEmpty);
+        assertTrue(visibleButEmpty.contains("\"leads\":[]"), visibleButEmpty);
+        assertTrue(visibleButEmpty.contains("\"members\":[]"), visibleButEmpty);
+
+        String notVisible = textOf(listFleetWithCollaborators(h, Map.of(), false));
+        assertFalse(notVisible.contains("\"collaborators\""), notVisible);
+        assertTrue(notVisible.contains("\"leads\":[]"), notVisible);
+        assertTrue(notVisible.contains("\"members\":[]"), notVisible);
+    }
+
+    /**
+     * fleetd #703 acceptance B: a worker must not see the {@code collaborators} array at all, while
+     * an architect -- a role that also holds READ, same as a worker -- does see it. Both halves are
+     * asserted: a test that only checked the worker-hidden half would pass even if the feature were
+     * never wired up for anyone.
+     */
+    @Test
+    void listOmitsCollaboratorsForAWorkerAndIncludesThemForAnArchitect() {
+        FakeHerdr h = new FakeHerdr();
+        Map<String, String> collaborators = Map.of("term_collab", "ops");
+
+        String asWorker = textOf(listFleetWithCollaborators(h, collaborators,
+                FleetMcp.collaboratorsVisibleTo(Principal.worker("term_w", 1))));
+        assertFalse(asWorker.contains("\"collaborators\""),
+                "a worker must not see the collaborators array: " + asWorker);
+
+        String asArchitect = textOf(listFleetWithCollaborators(h, collaborators,
+                FleetMcp.collaboratorsVisibleTo(Principal.architect("design", "term_arch", 2))));
+        assertTrue(asArchitect.contains("\"collaborators\":["),
+                "an architect must see the collaborators array: " + asArchitect);
+        assertTrue(asArchitect.contains("\"sessionId\":\"term_collab\""), asArchitect);
+    }
+
     /**
      * fleetd #421: {@code mailbox.pending} counts only broker-ready messages, so a blocked lead's
      * normal, healthy state is {@code "pending": 0} next to a non-empty {@code held[]} — which
@@ -1837,6 +1915,32 @@ class FleetMcpTest {
         assertTrue(out.contains("\"sessionId\":\"term_design\""), out);
     }
 
+    /**
+     * A collaborator reports its own role and name, never the {@code leader} key a lead gets —
+     * {@code role} already reads {@code "collaborator"}, so a {@code leader} key alongside it
+     * would be self-contradicting. Control: the same call shape fed a named lead must still carry
+     * {@code leader}, so this is not passing because the key stopped being emitted for everyone.
+     */
+    @Test
+    void whoamiReportsACollaboratorWithNoLeaderKeyButALeadStillGetsOne() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw"));
+
+        McpSchema.CallToolResult collabRes = FleetMcp.whoami(
+                Principal.collaborator("ops", "term_collab", 700), sessions);
+        assertNotEquals(Boolean.TRUE, collabRes.isError());
+        String collabOut = textOf(collabRes);
+        assertTrue(collabOut.contains("\"role\":\"collaborator\""), collabOut);
+        assertTrue(collabOut.contains("\"collaborator\":\"ops\""), collabOut);
+        assertTrue(collabOut.contains("\"sessionId\":\"term_collab\""), collabOut);
+        assertFalse(collabOut.contains("leader"), collabOut);
+
+        McpSchema.CallToolResult leadRes = FleetMcp.whoami(
+                Principal.leader("opus", "term_lead", 100), sessions);
+        String leadOut = textOf(leadRes);
+        assertTrue(leadOut.contains("\"leader\":\"opus\""), leadOut);
+    }
+
     /**
      * CB-548: an architect SEND delegates as its own pane (recording the per-target delegation) but
      * must NEVER become the legacy singleton "primary" fallback — the per-target map does not cure

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -60,13 +60,25 @@ class MessageServiceTest {
         inbox.own(T);
     }
 
+    /**
+     * A send budget large enough that a test's own setup — {@link #awaitWaiting()} plus whatever
+     * status transitions it drives afterward — can never compete with it for the same clock. A test
+     * that needs {@code send.get(...)}'s own window to be the only timing bound it depends on uses
+     * {@link #sendAsync(String, long)} with this value instead of the default 5000 ms.
+     */
+    private static final long GENEROUS_SEND_BUDGET_MILLIS = 30_000;
+
     /** Run {@code send} on a background thread; the current thread drives the worker's turn. */
     private CompletableFuture<MessageService.Reply> sendAsync() {
         return sendAsync("do the task");
     }
 
     private CompletableFuture<MessageService.Reply> sendAsync(String content) {
-        return CompletableFuture.supplyAsync(() -> messages.send(T, content, 5000));
+        return sendAsync(content, 5000);
+    }
+
+    private CompletableFuture<MessageService.Reply> sendAsync(String content, long timeoutMillis) {
+        return CompletableFuture.supplyAsync(() -> messages.send(T, content, timeoutMillis));
     }
 
     private void awaitWaiting() throws InterruptedException {
@@ -80,7 +92,7 @@ class MessageServiceTest {
 
     @Test
     void completionFallbackResolvesATurnThatNeverCalledFleetReply() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
+        CompletableFuture<MessageService.Reply> send = sendAsync("do the task", GENEROUS_SEND_BUDGET_MILLIS);
         awaitWaiting();
 
         herdr.readText("$ prompt");                // pre-turn pane: no answer yet (baseline reference)
@@ -96,6 +108,32 @@ class MessageServiceTest {
         assertTrue(reply.completed(), "a scraped completion still counts as completed");
     }
 
+    /**
+     * Pins {@link #GENEROUS_SEND_BUDGET_MILLIS} as the budget {@link
+     * #completionFallbackResolvesATurnThatNeverCalledFleetReply} depends on. A 5500 ms delay between
+     * {@link #awaitWaiting()} and the status transitions that drive completion stands in for a loaded
+     * machine's setup overhead — comfortably past the 5000 ms budget this send no longer uses, and
+     * still well inside this method's own 30 000 ms budget. The only clock this test depends on is
+     * {@code send.get}'s own 10 s window.
+     */
+    @Test
+    void completionFallbackSurvivesASlowHarnessBecauseItsSendBudgetIsNotTheBindingClock() throws Exception {
+        CompletableFuture<MessageService.Reply> send = sendAsync("do the task", GENEROUS_SEND_BUDGET_MILLIS);
+        awaitWaiting();
+
+        Thread.sleep(5500);
+
+        herdr.readText("$ prompt");
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        herdr.readText("BUILD GREEN: 391 files");
+        injector.onStatus(T, AgentStatus.IDLE);
+
+        MessageService.Reply reply = send.get(10, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.COMPLETED_UNREPLIED, reply.outcome(),
+                "a slow harness must not be mistaken for a timed-out delivery");
+    }
+
     @Test
     void completionFallbackReplacesAnEchoedInjectedBriefWithNoReportOutcome() throws Exception {
         String brief = "Implement the requested change. ".repeat(20);

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppAuthTest.java

@@ -1,8 +1,12 @@
 package dev.ltms.fleet.rest;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.auth.Authz;
 import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.Principal;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -18,6 +22,7 @@ import dev.ltms.fleet.msg.Rendezvous;
 import dev.ltms.fleet.session.FakeWorktrees;
 import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.testing.CapturedLog;
 import io.javalin.Javalin;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
@@ -28,10 +33,13 @@ import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.ArrayList;
 import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
+import java.util.function.Predicate;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -122,12 +130,60 @@ class FleetAppAuthTest {
         assertEquals(Authz.Action.DRAIN, FleetApp.routeAction("GET /sessions/{id}/replies"));
         assertEquals(Authz.Action.ASK, FleetApp.routeAction("POST /sessions/{id}/ask"));
         for (String route : Set.of("GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
+                "GET /member-credentials")) {
             assertEquals(Authz.Action.READ, FleetApp.routeAction(route), route);
         }
+        for (String route : Set.of("GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
+            assertEquals(Authz.Action.TASK_READ, FleetApp.routeAction(route), route);
+        }
         assertThrows(IllegalArgumentException.class, () -> FleetApp.routeAction("GET /healthz"));
     }
 
+    /**
+     * fleetd #669 Unit A: {@code POST /sessions/{id}/message} is two call shapes behind one route,
+     * mirroring {@code fleet_send}'s MCP-side split into {@link Authz.Action#SEND} and {@link
+     * Authz.Action#ANSWER} ({@code FleetMcp#sendAction}). The route never carries a {@code coordId}
+     * shape — that peer-lead route is MCP-only — so only these two apply here.
+     */
+    @Test
+    void theMessageRouteIsASendWithNoTurnIdAndAnAnswerWithOne() {
+        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message", null));
+        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message", "  "));
+        assertEquals(Authz.Action.ANSWER, FleetApp.routeAction("POST /sessions/{id}/message", "turn-1"));
+    }
+
+    /**
+     * fleetd #689: {@code answerGatePasses} is the second, conditional gate behind {@code
+     * sendMessage}'s coarse {@link Authz.Action#SEND} check. With the {@code ANSWER} grant denied,
+     * a {@code turnId}-bearing request is refused while a plain one still passes — and the denied
+     * permit is queried only for the {@code turnId} case, never for the plain one, which is what
+     * proves this is a genuinely separate, conditional check rather than the {@code SEND} check
+     * renamed or an unconditional call whose result is ignored. Flipping only the {@code ANSWER}
+     * grant to allowed then flips only the {@code turnId} shape's outcome.
+     */
+    @Test
+    void answerGatePassesOnlyWhenTurnIdAbsentOrAnswerGranted() {
+        List<Authz.Action> queried = new ArrayList<>();
+        Predicate<Authz.Action> denyAnswer = action -> {
+            queried.add(action);
+            return false;
+        };
+
+        assertFalse(FleetApp.answerGatePasses("turn-1", denyAnswer),
+                "ANSWER denied ⇒ the turnId shape is refused");
+        assertEquals(List.of(Authz.Action.ANSWER), queried,
+                "the ANSWER grant, specifically, must be the one consulted");
+
+        queried.clear();
+        assertTrue(FleetApp.answerGatePasses(null, denyAnswer),
+                "no turnId ⇒ the plain shape passes even though ANSWER is denied");
+        assertTrue(FleetApp.answerGatePasses("  ", denyAnswer), "a blank turnId is treated as absent");
+        assertEquals(List.of(), queried, "the plain shape must never consult the permit at all");
+
+        assertTrue(FleetApp.answerGatePasses("turn-1", action -> true),
+                "flipping only the ANSWER grant to allowed flips only the turnId shape's outcome");
+    }
+
     private static Set<String> routesTheServerRegisters() {
         try {
             String source = Files.readString(REST_SOURCE).lines()
@@ -147,6 +203,74 @@ class FleetAppAuthTest {
         }
     }
 
+    /**
+     * {@code permitsFor} is the exact decision {@link FleetApp#allow} makes, passing the real
+     * production classifier rather than a test-supplied one — built from an empty {@link
+     * CallerResolver}, so no terminal is recognised as a configured lead or collaborator and a
+     * collaborator's SEND is refused through the REST gate.
+     */
+    @Test
+    void aCollaboratorMayNotSendOverRestWithTheRealProductionClassifier() {
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(new FakeHerdr()), _ -> 700L);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, false, null,
+                Map::of, new MemberRegistry(null));
+        Principal collaborator = Principal.collaborator("ops", "term_collab", 700);
+        assertFalse(FleetApp.permitsFor(collaborator, Authz.Action.SEND, "term_lead",
+                        callers.knownLeadOrCollaborator()),
+                "no terminal is recognised as a lead or collaborator yet");
+    }
+
+    /**
+     * fleetd #669 Unit D: wires a real {@link CallerResolver} with a known lead and a known
+     * collaborator tab, and a spawned member's own terminal recognised by neither map. A
+     * collaborator's SEND reaches the known lead and the known collaborator, and is refused for the
+     * spawned member's terminal — over the REST route, not just the unit-level classifier, so a
+     * test covering only MCP cannot leave this route open.
+     */
+    @Test
+    void aCollaboratorMaySendToAKnownLeadOrCollaboratorButNotToASpawnedMembersTerminalOverRest() throws Exception {
+        int port = startWithRealClassifier(FakeHerdr.WORKER_PID,
+                Map.of("term_lead_known", "lead-x"), Map.of("term_a", "ops2"));
+
+        HttpResponse<String> toLead = send(port, "POST", "/sessions/term_lead_known/message",
+                "{\"content\":\"hi\",\"wait\":false}", null);
+        assertEquals(202, toLead.statusCode(), toLead.body());
+
+        HttpResponse<String> toSpawnedMembersTerminal = send(port, "POST", "/sessions/term_worker/message",
+                "{\"content\":\"hi\",\"wait\":false}", null);
+        assertEquals(403, toSpawnedMembersTerminal.statusCode(), toSpawnedMembersTerminal.body());
+    }
+
+    /**
+     * As {@link #start}, but with explicit lead/collaborator maps and no spawned-member roster, so
+     * a test can wire the real {@link CallerResolver#knownLeadOrCollaborator()} classifier instead
+     * of the default empty one.
+     */
+    private int startWithRealClassifier(long pid, Map<String, String> leadTerminals,
+                                        Map<String, String> collaboratorTerminals) {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile wcfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        AgentControl agents = new AgentControl(herdr);
+        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(
+                agents, new WorkspaceControl(herdr), new SubscriptionGuard(Set.of("gx00.gw")),
+                Map.of(wcfg.profile(), wcfg), wcfg.profile(),
+                k -> "FLEETD_WORKER_TOKEN".equals(k) ? "tok-abc" : null);
+        SessionManager sessions = new SessionManager(workers, new FakeWorktrees());
+        Injector injector = new Injector(agents);
+        MessageService messages = new MessageService(agents, injector, new Rendezvous());
+
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> pid);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, false, null,
+                () -> leadTerminals, new MemberRegistry(null), t -> null, () -> collaboratorTerminals);
+        metrics = FleetMetrics.create(sessions, new dev.ltms.fleet.msg.InMemoryReplyInbox());
+
+        app = new FleetApp(herdr, workers, sessions, messages, sessions.asPresence(), null,
+                callers, metrics).build().start("127.0.0.1", 0);
+        return app.port();
+    }
+
     // --- loopback-trust: the caller is the primary -------------------------------------------
 
     @Test
@@ -192,6 +316,107 @@ class FleetAppAuthTest {
                 "draining an inbox is the primary's collection step");
     }
 
+    /**
+     * fleetd #669 Unit A: the {@code turnId} shape of {@code POST /sessions/{id}/message} maps to
+     * {@link Authz.Action#ANSWER}, not the plain {@link Authz.Action#SEND} the test above drives —
+     * a worker must stay refused on this shape too, exactly as it was refused on the one undivided
+     * action before the split.
+     */
+    @Test
+    void aWorkerMayNotAnswerAnotherSessionsBlockedQuestionOverRest() throws Exception {
+        int port = start(FakeHerdr.WORKER_PID, false, null);
+
+        assertEquals(403, send(port, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null).statusCode(),
+                "resolving another session's blocked question would be a worker escalating too");
+    }
+
+    /**
+     * fleetd #689: a caller refused the coarse {@link Authz.Action#SEND} grant is refused on
+     * {@code SEND} specifically, even on the {@code turnId}-bearing shape that otherwise raises
+     * the check to {@link Authz.Action#ANSWER} — proving {@code turnId} was never read from the
+     * body before the refusal (reading it would have changed which action is named in the 403).
+     * The same caller refused with no body at all gets the identical detail, which could not hold
+     * if the decision depended on anything read from the body. Control: a caller who IS granted
+     * reaches past the gate and the body is used normally.
+     */
+    @Test
+    void aDeniedCallerIsRefusedOnSendEvenWithATurnIdBodyAndNeverReadsTheBody() throws Exception {
+        int workerPort = start(FakeHerdr.WORKER_PID, false, null); // denied: not primary/architect
+
+        HttpResponse<String> withTurnId = send(workerPort, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+        assertEquals(403, withTurnId.statusCode());
+        assertTrue(withTurnId.body().contains("may not SEND"),
+                "the SEND check must be the one that fired, not ANSWER — ANSWER would only be "
+                        + "reachable by having already read turnId out of the body");
+
+        HttpResponse<String> noBody = send(workerPort, "POST", "/sessions/term_b/message", null, null);
+        assertEquals(403, noBody.statusCode());
+        assertTrue(noBody.body().contains("may not SEND"),
+                "refused identically with no body at all — the refusal cannot depend on body content");
+
+        // Control: a primary IS granted SEND, so the same turnId body is read and acted on —
+        // reaching messages.answer, which reports this unknown turnId as a stale one.
+        int primaryPort = start(999_999, false, null);
+        HttpResponse<String> granted = send(primaryPort, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+        assertEquals(409, granted.statusCode());
+        assertTrue(granted.body().contains("stale_turn"), "a granted caller's body IS read and acted on");
+    }
+
+    /**
+     * fleetd #689 (ticket comment 18353): the only place {@code sendMessage}'s call to {@code
+     * answerGatePasses} is observable is the audit trail — {@code allow()} logs an {@code
+     * "allowed"} entry for every granted action except {@code READ}/{@code METRICS}/{@code
+     * TASK_READ}, and {@code ANSWER} is none of those. A granted {@code turnId} request must
+     * therefore log both a {@code SEND} and an {@code ANSWER} entry; a granted plain request must
+     * log {@code SEND} alone. A unit test of the extracted helper pins the helper; this pins the
+     * call site — deleting the {@code answerGatePasses} call from {@code sendMessage} leaves the
+     * helper's own test green but turns this one red.
+     */
+    @Test
+    void aGrantedTurnIdRequestAuditsBothSendAndAnswerButAPlainRequestAuditsSendAlone() throws Exception {
+        int port = start(999_999, false, null); // primary: granted both SEND and ANSWER
+        ObjectMapper mapper = new ObjectMapper();
+
+        try (CapturedLog audit = CapturedLog.at("audit", Level.INFO)) {
+            send(port, "POST", "/sessions/term_b/message",
+                    "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+
+            List<String> allowed = allowedActions(audit, mapper);
+            assertTrue(allowed.contains("SEND"),
+                    "a turnId request must still clear the coarse SEND grant first");
+            assertTrue(allowed.contains("ANSWER"),
+                    "a turnId request must ALSO clear the ANSWER grant — this is the call site itself");
+        }
+
+        try (CapturedLog audit = CapturedLog.at("audit", Level.INFO)) {
+            send(port, "POST", "/sessions/term_b/message",
+                    "{\"content\":\"hi\",\"timeoutMs\":50}", null);
+
+            List<String> allowed = allowedActions(audit, mapper);
+            assertEquals(List.of("SEND"), allowed,
+                    "a plain request must log SEND and nothing else — ANSWER is conditional on "
+                            + "turnId, not something every request happens to log");
+        }
+    }
+
+    private static List<String> allowedActions(CapturedLog audit, ObjectMapper mapper) {
+        return audit.events().stream()
+                .map(ILoggingEvent::getFormattedMessage)
+                .map(line -> {
+                    try {
+                        return mapper.readTree(line);
+                    } catch (Exception e) {
+                        throw new AssertionError("audit line is not valid JSON: " + line, e);
+                    }
+                })
+                .filter(n -> "allowed".equals(n.path("outcome").asText()))
+                .map(n -> n.path("action").asText())
+                .toList();
+    }
+
     // --- token mode ---------------------------------------------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppTest.java

@@ -675,6 +675,26 @@ class FleetAppTest {
         assertEquals(400, postMessage(port, "{}").statusCode());
     }
 
+    /**
+     * fleetd #689: a body that fails to parse is rejected with 400 before {@code turnId} is ever
+     * read from it, so it reaches neither {@code messages.answer} (which needs a {@code turnId})
+     * nor {@code messages.send} — confirmed here for {@code send} by the fake agent's idle status,
+     * which would otherwise make an immediate {@code agent.prompt} delivery observable.
+     */
+    @Test
+    void malformedBodyReturns400AndNeverReachesSendOrAnswer() throws Exception {
+        FakeHerdr herdr = new FakeHerdr().agentStatus("idle"); // idle ⇒ send would deliver right away if reached
+        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
+
+        HttpResponse<String> res = postMessage(port, "not json at all");
+        assertEquals(400, res.statusCode());
+        JsonNode err = mapper.readTree(res.body());
+        assertEquals("bad_request", err.get("error").asText());
+        assertEquals("body must be JSON", err.get("detail").asText());
+        assertFalse(herdr.called("agent.prompt"),
+                "a malformed body must never reach messages.send's delivery");
+    }
+
     @Test
     void sessionStatusReportsLiveAgentStatus() throws Exception {
         FakeHerdr herdr = new FakeHerdr().agentStatus("blocked");

scripts/config-edit.sh

@@ -2,6 +2,10 @@
 #
 # The one auditable way to edit the live fleetd.yaml.
 #
+# `--set` uses yq and rewrites the whole YAML document in yq's output style. Use `--from` for a
+# candidate whose comment alignment or other formatting carries meaning: it copies that file
+# verbatim while keeping this script's backup, parse check, atomic install, and verdict read-back.
+#
 # fleetd ticket #635 — why this exists at all: fleetd.yaml is gitignored and holds the live
 # fleet's settings. A bad raw edit reaches a daemon that is already serving, so a direct `Edit`
 # on it is refused by policy. This script is the allow-listed alternative, and it is not just
@@ -46,6 +50,11 @@
 #   scripts/config-edit.sh --dry-run --set <yq-path>=<value>
 #   scripts/config-edit.sh --restore
 #
+# `--set` rewrites the whole file in yq's output style, not only the requested keys. The script
+# warns before installation when the candidate changes more lines than its number of --set pairs.
+# Use `--from <candidate.yaml>` when comment alignment or other formatting is meaningful: --from
+# copies the candidate verbatim, with no yq round-trip.
+#
 # `--set .a.b=` (an empty value — a forgotten typo) is REFUSED, not accepted as "clear the
 # field": a null value falls back to its default rather than erroring, which is silent, not
 # safe. To clear a key on purpose, write a literal null: `--set .a.b=null`. Every other value
@@ -154,18 +163,10 @@ done
 # story: a YAML block scalar (`|`, `|-`, `>`, `>-`, ...) puts the VALUE on the lines that follow
 # the key, each indented deeper than it. The key-name match above only ever sees the key line
 # itself, so those continuation lines used to flow straight through unredacted while the key line
-# right above them printed a reassuring "<redacted>" — an incomplete redactor that looks complete
-# is worse than one that visibly does nothing, because it stops a reviewer from looking further.
-# The fix is structural, not another name to match: once a key line is masked, every following
-# line indented STRICTLY DEEPER than that key is masked too, by indentation alone, until the
-# indentation returns to the key's own level or shallower. This needs no knowledge of the key's
-# name, so it covers a block scalar under any masked key — but ONLY while that key's own line is
-# itself inside the hunk being printed. `diff -u` prints just three lines of context, so a block
-# scalar's body often reaches this function with its key line left out; there is then nothing to
-# anchor to, `masked` is never set, and the body prints in full. A blank line inside a block
-# scalar loses the anchor the same way, because a blank diff line measures as indent 0. Both are
-# measured and filed as fleetd #639 — do not read this paragraph as a guarantee that a masked
-# key's value can never be printed.
+# right above them printed a reassuring "<redacted>". The redactor maps masked continuation lines
+# from each complete file before it reads the diff. It then masks a printed line when that file
+# line is inside a masked key's value. This covers block-scalar bodies even when the key line is
+# outside the printed hunk, and it keeps blank lines inside the value masked.
 #
 # `redact` is always fed `diff -u` output, and every line of a unified diff starts with exactly
 # one of ' ', '+', '-' (the three body markers; '@'/'-'/'+' for the three header-line kinds too).
@@ -174,37 +175,113 @@ done
 # column shallower than it really is, and either wrongly escapes a continuation mask or wrongly
 # ends one early. Tabs are out of scope: YAML forbids them for indentation, and this is a bounded
 # fix, not a YAML parser.
+map_masked_lines() {
+  local file="$1" side="$2" line content indent lead key line_number=0
+  local masked=0 masked_indent=0
+
+  case "$side" in
+    old) OLD_MASKED_LINES=() ;;
+    new) NEW_MASKED_LINES=() ;;
+    *) die "internal error: unknown redaction map side $side" ;;
+  esac
+
+  while IFS= read -r line || [ -n "$line" ]; do
+    line_number=$((line_number + 1))
+    content="$line"
+    indent=0
+    while [ "${content:$indent:1}" = " " ]; do indent=$((indent + 1)); done
+
+    if [ "$masked" = 1 ]; then
+      if [ -z "${content// /}" ] || [ "$indent" -gt "$masked_indent" ]; then
+        case "$side" in
+          old) OLD_MASKED_LINES[$line_number]=1 ;;
+          new) NEW_MASKED_LINES[$line_number]=1 ;;
+        esac
+        continue
+      fi
+      masked=0
+    fi
+
+    if [[ "$content" =~ ^([[:space:]]*)([A-Za-z0-9_.-]+:) ]]; then
+      lead="${BASH_REMATCH[1]}"
+      key="${BASH_REMATCH[2]}"
+      if [[ "$key" =~ (TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|URI|_KEY) ]]; then
+        masked=1
+        masked_indent="$indent"
+      fi
+    fi
+  done < "$file"
+}
+
+# Masks every `scheme://user:pass@host` userinfo on one line of text, replacing just that
+# userinfo with `<redacted>` and leaving the rest of the line untouched, byte for byte. The
+# pattern stops at the first `/`, whitespace, or `@` reached after `://` — a URI's userinfo
+# component cannot contain any of those three characters — so a URI with no userinfo, followed
+# later on the same line by an unrelated `@`, never matches. The `g` flag matters: a line can
+# carry more than one URI. Shared by every caller that prints a line which may hold a
+# credentialed URI, so the bound lives in exactly one place.
+mask_url_userinfo() {
+  printf '%s\n' "$1" | sed -E 's#://[^@/[:space:]]*@#://<redacted>@#g'
+}
+
 redact() {
-  local line prefix content indent lead key
-  local masked=0 masked_indent=0 saved_nocasematch=0
+  local old_file="$1" new_file="$2"
+  local line prefix content indent lead key old_line=0 new_line=0 in_hunk=0
+  local old_masked new_masked saved_nocasematch=0
   shopt -q nocasematch && saved_nocasematch=1
   shopt -s nocasematch
-  sed -E 's#://[^@]*@#://<redacted>@#g' | while IFS= read -r line || [ -n "$line" ]; do
+
+  map_masked_lines "$old_file" old
+  map_masked_lines "$new_file" new
+
+  while IFS= read -r line || [ -n "$line" ]; do
+    if [[ "$line" =~ ^@@\ -([0-9]+)(,([0-9]+))?\ \+([0-9]+)(,([0-9]+))?\ @@ ]]; then
+      old_line="${BASH_REMATCH[1]}"
+      new_line="${BASH_REMATCH[4]}"
+      in_hunk=1
+      printf '%s\n' "$line"
+      continue
+    fi
+
     case "$line" in
       [\ +-]*) prefix="${line:0:1}"; content="${line:1}" ;;
       *)       prefix="";            content="$line" ;;
     esac
 
+    old_masked=0
+    new_masked=0
+    if [ "$in_hunk" = 1 ]; then
+      case "$prefix" in
+        ' ')
+          [ "${OLD_MASKED_LINES[$old_line]:-}" = 1 ] && old_masked=1
+          [ "${NEW_MASKED_LINES[$new_line]:-}" = 1 ] && new_masked=1
+          old_line=$((old_line + 1)); new_line=$((new_line + 1)) ;;
+        -)
+          [ "${OLD_MASKED_LINES[$old_line]:-}" = 1 ] && old_masked=1
+          old_line=$((old_line + 1)) ;;
+        +)
+          [ "${NEW_MASKED_LINES[$new_line]:-}" = 1 ] && new_masked=1
+          new_line=$((new_line + 1)) ;;
+      esac
+    fi
+
     indent=0
     while [ "${content:$indent:1}" = " " ]; do indent=$((indent + 1)); done
 
-    if [ "$masked" = 1 ] && [ "$indent" -gt "$masked_indent" ]; then
+    if [ "$old_masked" = 1 ] || [ "$new_masked" = 1 ]; then
       printf '%s%*s<redacted>\n' "$prefix" "$indent" ""
       continue
     fi
-    masked=0
 
     if [[ "$content" =~ ^([[:space:]]*)([A-Za-z0-9_.-]+:) ]]; then
       lead="${BASH_REMATCH[1]}"
       key="${BASH_REMATCH[2]}"
       if [[ "$key" =~ (TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|URI|_KEY) ]]; then
         printf '%s%s%s <redacted>\n' "$prefix" "$lead" "$key"
-        masked=1
-        masked_indent="$indent"
         continue
       fi
     fi
-    printf '%s\n' "$line"
+    mask_url_userinfo "$line"
   done
   [ "$saved_nocasematch" = 1 ] || shopt -u nocasematch
 }
@@ -463,6 +540,50 @@ parse_check() {
   yq eval '.' "$1" >/dev/null 2>&1
 }
 
+# Count logical changed lines in a unified diff. A replacement counts once, while an added or
+# deleted line also counts once. One changed `--set` value normally produces one changed line.
+changed_line_count() {
+  local before="$1" after="$2" line count=0 old_count=0 new_count=0
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      ---\ *|+++\ *|@@\ *)
+        if [ "$old_count" -gt "$new_count" ]; then
+          count=$((count + old_count))
+        else
+          count=$((count + new_count))
+        fi
+        old_count=0
+        new_count=0
+        ;;
+      -*) old_count=$((old_count + 1)) ;;
+      +*) new_count=$((new_count + 1)) ;;
+      *)
+        if [ "$old_count" -gt "$new_count" ]; then
+          count=$((count + old_count))
+        else
+          count=$((count + new_count))
+        fi
+        old_count=0
+        new_count=0
+        ;;
+    esac
+  done < <(diff -u "$before" "$after" || true)
+  if [ "$old_count" -gt "$new_count" ]; then
+    count=$((count + old_count))
+  else
+    count=$((count + new_count))
+  fi
+  printf '%s' "$count"
+}
+
+warn_set_reformat() {
+  local before="$1" after="$2" changed
+  changed="$(changed_line_count "$before" "$after")"
+  if [ "$changed" -gt "${#SETS[@]}" ]; then
+    warn "--set changed $changed candidate lines for ${#SETS[@]} pair(s); yq reformatted the whole file. Use --from for meaningful comment alignment or formatting."
+  fi
+}
+
 install_candidate() {
   local cand="$1" live="$2"
   mv -f "$cand" "$live"
@@ -470,6 +591,12 @@ install_candidate() {
 
 # -------------------------------------------------------------------------------- the report path
 #
+# Masks basic-auth userinfo (scheme://user:pass@host) in a daemon verdict line before it reaches
+# the terminal.
+mask_verdict_userinfo() {
+  mask_url_userinfo "$1"
+}
+
 # Prints the literal command the operator (or a test) can run to restore the backup by hand — the
 # absolute path to THIS script plus the overrides actually in force, so it works from any cwd.
 restore_command_line() {
@@ -489,8 +616,8 @@ restore_and_confirm() {
   ok "restored from $backup"
   if wait_for_verdict "$LOG" "$mark2" "$WAIT_SECONDS"; then
     case "$VERDICT_KIND" in
-      refused) warn "the RESTORE was also refused by the daemon: $VERDICT_LINE" ;;
-      *)       ok "restore confirmed: $VERDICT_LINE" ;;
+      refused) warn "the RESTORE was also refused by the daemon: $(mask_verdict_userinfo "$VERDICT_LINE")" ;;
+      *)       ok "restore confirmed: $(mask_verdict_userinfo "$VERDICT_LINE")" ;;
     esac
   else
     warn "the restore is on disk, but no confirming verdict line appeared within ${WAIT_SECONDS}s"
@@ -506,7 +633,7 @@ report_outcome() {
 
   say "waiting for the daemon's verdict (up to ${WAIT_SECONDS}s)"
   if wait_for_verdict "$LOG" "$mark" "$WAIT_SECONDS"; then
-    kind="$VERDICT_KIND"; line="$VERDICT_LINE"
+    kind="$VERDICT_KIND"; line="$(mask_verdict_userinfo "$VERDICT_LINE")"
   else
     kind="none"
   fi
@@ -563,7 +690,7 @@ check_mode() {
   local verdict
   verdict="$(last_verdict_line "$LOG")"
   if [ -n "$verdict" ]; then
-    ok "last verdict in log: $verdict"
+    ok "last verdict in log: $(mask_verdict_userinfo "$verdict")"
   else
     warn "no reload verdict line found in $LOG"
   fi
@@ -624,10 +751,14 @@ run_edit() {
   fi
   ok "candidate parses"
 
+  if [ "$MODE" = "set" ]; then
+    warn_set_reformat "$backup" "$cand"
+  fi
+
   apply_mode "$cand" "$orig_mode"
 
   say "change (redacted)"
-  diff -u "$backup" "$cand" | redact || true
+  diff -u "$backup" "$cand" | redact "$backup" "$cand" || true
 
   say "install"
   install_candidate "$cand" "$CONFIG" \
@@ -655,8 +786,11 @@ dry_run_diff() {
     rm -f "$cand"; CAND=""
     die "candidate does not parse as valid YAML — this was a --dry-run, nothing would have been installed either"
   fi
+  if [ "$MODE" = "set" ]; then
+    warn_set_reformat "$CONFIG" "$cand"
+  fi
   say "dry run — diff (redacted), nothing installed"
-  diff -u "$CONFIG" "$cand" | redact || true
+  diff -u "$CONFIG" "$cand" | redact "$CONFIG" "$cand" || true
   rm -f "$cand"; CAND=""
   return 0
 }

scripts/redeploy-fleetd.sh

@@ -71,20 +71,22 @@ set -euo pipefail
 
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 MODULE="$REPO/fleetd"
-JAR="$MODULE/target/fleetd.jar"
-# fleetd #493: never build into the path a running process holds. The build writes here first
-# (Maven's shade plugin has finalName=fleetd, so `clean install` still lands its output at
-# target/fleetd.jar — that part is unchanged and out of this script's control), but this script
-# now moves it out to JAR_STAGED immediately, and only swaps it back to JAR (a plain `mv`, so a
-# rename, never a byte-by-byte overwrite) after the OLD daemon has been confirmed exited. See
-# stage_built_jar/swap_staged_jar below.
-JAR_STAGED="$MODULE/target/fleetd-new.jar"
+# fleetd #664: the runtime path and Maven's output path are no longer the same file. Maven's
+# shade plugin (finalName=fleetd) always lands a fresh build at target/fleetd.jar — that is
+# Maven's own output directory and this script does not change it — but the daemon is launched
+# from $JAR instead, outside target/ entirely. That split is the whole fix: neither `mvn install`
+# nor `mvn clean` can ever reach the file a running daemon holds open, because that file no
+# longer lives under target/ at all. See swap_if_built/swap_staged_jar below for the one `mv`
+# that moves a build from one path to the other, and only after the old daemon is confirmed gone.
+BUILD_JAR="$MODULE/target/fleetd.jar"
+JAR="$MODULE/run/fleetd.jar"
 OUT="$MODULE/fleetd.out"
-# Matches BOTH the absolute form and the relative `java -jar target/fleetd.jar` a hand-start
-# produces from inside fleetd/. Anchoring on the absolute path alone was a real bug: the daemon
-# restarted correctly and the script still reported "no process appeared", because it launched with
-# a relative path and then looked for an absolute one.
-PATTERN='target/fleetd.jar'
+# Matches a fleetd daemon's command line wherever its jar sits — absolute or relative, under
+# run/, under target/, or anywhere else a build or a hand-start might point it. Detecting a
+# daemon this script did not start, including one running from a jar outside $JAR's own
+# directory, is this pattern's whole job; running_pid()'s `comm = java` allowlist below is what
+# keeps that breadth from counting a shell that merely types the pattern as literal text.
+PATTERN='fleetd.jar'
 HEALTH='http://127.0.0.1:8765/healthz'
 STOP_WAIT=30      # seconds to wait for a clean exit before reporting failure
 HEALTH_WAIT=60    # seconds to wait for /healthz to answer after start — fleetd #603: also the pid-
@@ -169,10 +171,10 @@ hash256() {
   fi
 }
 
-# Reports the hash of $JAR by default, or of whatever path is passed — used to report the STAGED
-# jar right after a build (before it has been swapped in) without ever changing what a bare
-# `jar_id` (no args) means: the live path, $JAR. --check and the final "pid ..., jar ..." line
-# both call it with no args on purpose, so neither can ever be fooled by a leftover staged file.
+# Reports the hash of $JAR by default, or of whatever path is passed — used to report the BUILT
+# jar at $BUILD_JAR (before it has been swapped in) without ever changing what a bare `jar_id`
+# (no args) means: the live path, $JAR. --check and the final "pid ..., jar ..." line both call
+# it with no args on purpose, so neither can ever be fooled by a leftover build output.
 # fleetd #550 — THREE distinct answers now, not two: `[ -f "$f" ]` already separates "the jar is
 # not there" (-> "absent") from "the jar is there"; for the second case, hash256 itself separates
 # "hashed it" (a 12-char hex string) from "could not hash it" (-> "unhashable", when no hasher is
@@ -180,15 +182,35 @@ hash256() {
 # was the whole defect this ticket fixes.
 jar_id() { local f="${1:-$JAR}"; [ -f "$f" ] && hash256 "$f" || echo "absent"; }
 
+# fleetd #664 — under the old layout $JAR and the build output were the same file, so "jar on
+# disk" was one fact. Now they are two: $BUILD_JAR (target/fleetd.jar, whatever Maven last wrote,
+# by this script or by a bare `mvn install` run by hand) and $JAR (run/fleetd.jar, whatever the
+# daemon actually has open). Printing one label for both was the trap this ticket exists to close
+# — during the incident it would have shown the NEW jar's hash while the JVM ran the OLD one.
+# Pure (reads jar_id/date, never mutates), so a test can call it directly without reaching the
+# main flow — the same shape swap_if_built/drain_gate_refusal already use.
+report_jar_state() {
+  local built_hash running_hash built_mtime running_mtime
+  built_hash="$(jar_id "$BUILD_JAR")"
+  running_hash="$(jar_id "$JAR")"
+  built_mtime="$([ -f "$BUILD_JAR" ] && date -r "$BUILD_JAR" '+%Y-%m-%d %H:%M:%S' || echo 'none')"
+  running_mtime="$([ -f "$JAR" ] && date -r "$JAR" '+%Y-%m-%d %H:%M:%S' || echo 'none')"
+  ok "built jar   (target/fleetd.jar): $built_hash  ($built_mtime)"
+  ok "running jar (run/fleetd.jar):    $running_hash  ($running_mtime)"
+  if [ "$built_hash" != "absent" ] && [ "$running_hash" != "absent" ] && [ "$built_hash" != "$running_hash" ]; then
+    warn "built jar and running jar differ — target/fleetd.jar was rebuilt since the running daemon last started and is not yet live"
+  fi
+}
+
 # fleetd #593 — `pgrep -f "$PATTERN"` matches ANY process whose full command line CONTAINS the
 # pattern text, and that is not the same thing as "is the daemon". A shell that merely embeds the
 # pattern as literal text — a human typing this exact investigation by hand, an ssh-shaped
 # `sh -c '...; ...'`, a pipeline, or any other non-exec'ing shell that never replaced itself with
 # the pattern-holding command — still shows up in that match, and it is the INSTRUMENT, not the
-# daemon. Measured live on this Mac: `sh -c 'echo "target/fleetd.jar" >/dev/null; sleep 30' &`
+# daemon. Measured live on this Mac: `sh -c 'echo "run/fleetd.jar" >/dev/null; sleep 30' &`
 # leaves a real `sh` process alive (it forks for the `sleep`, it does not exec into it) whose own
-# `ps -o args` is `sh -c echo "target/fleetd.jar" >/dev/null; sleep 30` — `pgrep -f "$PATTERN"`
-# matches that line right alongside the real `java -jar target/fleetd.jar` process. `pgrep -c`
+# `ps -o args` is `sh -c echo "run/fleetd.jar" >/dev/null; sleep 30` — `pgrep -f "$PATTERN"`
+# matches that line right alongside the real `java -jar run/fleetd.jar` process. `pgrep -c`
 # (an in-one-call count) does not exist on BSD/macOS at all, so this cannot be fixed by switching
 # pgrep flags — it has to filter what pgrep already found, after the fact, in a way that still
 # runs on BSD.
@@ -210,7 +232,7 @@ jar_id() { local f="${1:-$JAR}"; [ -f "$f" ] && hash256 "$f" || echo "absent"; }
 # launched as `java -jar ...` — a native image, a renamed launcher — `running_pid()` silently
 # returns nothing and `assert_single_daemon` stops noticing a second daemon at all. For a guard,
 # that false-negative direction is the worse one to be wrong in. This is not a new assumption,
-# though: `PATTERN='target/fleetd.jar'` two lines up already assumes the daemon is a jar, which
+# though: `PATTERN='fleetd.jar'` two lines up already assumes the daemon is a jar, which
 # is only ever run by `java`. If that launch method changes, `PATTERN` stops matching anything
 # before this allowlist would ever get the chance to be wrong — the allowlist rides on the same
 # assumption that is already load-bearing, it does not add a new one. Whoever changes the launch
@@ -229,16 +251,12 @@ running_pid() {
   printf '%s' "$out"
 }
 
-# fleetd #493 — three small, independently testable pieces of "never build into the path a
-# running process holds":
+# fleetd #493/#664 — the independently testable pieces of "never build into the path a running
+# process holds":
 #
-#   stage_built_jar   moves the jar Maven just produced OUT of the live path and onto the staging
-#                      path, immediately after a successful build. Dies (leaving the OLD daemon
-#                      untouched — this runs before the stop step) if Maven reported success but
-#                      left no jar behind, or if the move itself fails.
-#   require_no_build_jar   the --no-build path never builds or stages anything: it must find a
-#                      jar already sitting at the live path from an earlier successful run, and
-#                      die with the same truthful message this script has always used if not.
+#   require_no_build_jar   the --no-build path never builds anything: it must find a jar already
+#                      sitting at the live path ($JAR, under run/) from an earlier successful run,
+#                      and die with the same truthful message this script has always used if not.
 #   wait_for_daemon_exit   polls running_pid() for up to $1 seconds and reports whether the OLD
 #                      daemon actually exited — extracted to its own function so the main flow
 #                      can be relied on to call swap_staged_jar only AFTER this returns success,
@@ -248,14 +266,10 @@ running_pid() {
 #                      so this is never a write into a path a running process holds — by the time
 #                      it runs, nothing holds that path anymore. If it fails, the caller must not
 #                      start a new daemon: die() below already refuses that by exiting the script.
-stage_built_jar() {
-  [ -f "$JAR" ] || die "build succeeded but produced no jar at $JAR — cannot stage it for restart.
-      The running daemon was NOT touched."
-  mv -f "$JAR" "$JAR_STAGED" \
-    || die "could not move the freshly built jar from $JAR to the staging path $JAR_STAGED.
-        The running daemon was NOT touched."
-}
-
+#                      fleetd #664: the "staged" jar swap_if_built passes in is now $BUILD_JAR
+#                      itself (target/fleetd.jar, Maven's own output) — a build no longer needs to
+#                      be moved off the live path right after compiling, because target/ was never
+#                      the live path to begin with.
 require_no_build_jar() {
   [ -f "$JAR" ] || die "no jar at $JAR — run without --no-build"
 }
@@ -282,8 +296,7 @@ swap_staged_jar() {
 #
 # The defect: the swap step used to be guarded inline by `if [ "$DO_BUILD" = 1 ]` in the main flow.
 # Changing that to `if false` left the suite green and the swap never ran, so a redeploy reported
-# every step succeeding while the daemon started on no jar at all (stage_built_jar has already moved
-# the freshly built one to $JAR_STAGED by then) or on a stale one.
+# every step succeeding while the daemon started on no jar at all or on a stale one.
 # test_swap_ordered_after_wait_and_before_start could not catch it: it reads this script's own text
 # and compares line positions, and a same-line edit moves no line.
 #
@@ -312,7 +325,12 @@ swap_if_built() {
   local do_build="$1"
   should_swap "$do_build" || return 0
   say "swap"
-  swap_staged_jar "$JAR_STAGED" "$JAR"
+  # fleetd #664: $JAR now lives under run/, a directory target/ never created. mkdir -p here,
+  # not inside swap_staged_jar itself — that function's own contract is tested on a missing
+  # parent directory (a failing mv), and widening it to auto-create one would change what that
+  # test proves.
+  mkdir -p "$(dirname "$JAR")"
+  swap_staged_jar "$BUILD_JAR" "$JAR"
   ok "jar in place: $(jar_id)"
 }
 
@@ -610,6 +628,45 @@ check_log_path_matches_plist() {
   ok "log path check: script and plist agree ($resolved_out)"
 }
 
+# Reads the launchd plist's ProgramArguments for the argument that follows "-jar", resolves it
+# alongside $jar_path, and dies when the two differ. Call it only when the agent is loaded; it
+# never touches launchd or the daemon itself.
+check_jar_path_matches_plist() {
+  local jar_path="$1" plist_path="$2"
+  local plist_args plist_jar resolved_jar resolved_plist_jar
+  if ! plist_args="$(/usr/libexec/PlistBuddy -c 'Print :ProgramArguments' "$plist_path" 2>/dev/null)"; then
+    die "launchd agent is loaded but PlistBuddy could not read ProgramArguments from
+        $plist_path
+      — cannot verify which jar the supervised daemon launches. Fix the plist before
+      redeploying supervised."
+  fi
+  plist_jar="$(printf '%s\n' "$plist_args" | awk '
+      { gsub(/^[ \t]+|[ \t]+$/, "") }
+      prev == "-jar" { print; exit }
+      { prev = $0 }
+    ')"
+  if [ -z "$plist_jar" ]; then
+    die "launchd agent is loaded but its ProgramArguments at
+        $plist_path
+      do not contain a '-jar <path>' pair — cannot verify which jar the supervised daemon
+      launches. Fix the plist before redeploying supervised."
+  fi
+  resolved_jar="$(cd "$(dirname "$jar_path")" 2>/dev/null && pwd -P)/$(basename "$jar_path")" || true
+  resolved_plist_jar="$(cd "$(dirname "$plist_jar")" 2>/dev/null && pwd -P)/$(basename "$plist_jar")" || true
+  if [ -z "$resolved_jar" ] || [ -z "$resolved_plist_jar" ] || [ "$resolved_jar" != "$resolved_plist_jar" ]; then
+    die "jar path mismatch — this script deploys to
+        $jar_path  (resolved: ${resolved_jar:-<directory does not exist>})
+      but the loaded plist's ProgramArguments names
+        $plist_jar  (resolved: ${resolved_plist_jar:-<directory does not exist>})
+      The swap renames the built jar into place, so the old path stops existing after a redeploy;
+      a launchd-initiated start from this plist (a reboot, or KeepAlive after a crash) would then
+      run java against a missing file. Reinstall the plist at
+        $plist_path
+      so its ProgramArguments names $jar_path before redeploying supervised."
+  fi
+  ok "jar path check: script and plist agree ($resolved_jar)"
+}
+
 # fleetd #552: the post-restart fresh-log capture, pulled out of the main flow so it is testable by
 # sourcing (the same reason systemd_installed/systemd_loaded above guard their OWN mktemp inline
 # instead of leaving it bare) even though its only caller sits below the SOURCED guard. By the time
@@ -826,16 +883,25 @@ report_shutdown_drain() {
 #   --no-build, staged jar present -> ALSO "nothing changed", deliberately: --no-build itself builds
 #     and stages nothing (see require_no_build_jar above), so a staged jar found here is a leftover
 #     from an earlier, unrelated run. THIS run truly changed nothing, and the next DO_BUILD=1 run
-#     wipes that leftover before it builds (`rm -f "$JAR_STAGED"` in the build section above) — so
-#     there is nothing here for the operator to lose track of.
+#     wipes that leftover for free — `mvn clean` deletes all of target/, $BUILD_JAR included,
+#     before the build even starts — so there is nothing here for the operator to lose track of.
 #   --no-build, staged jar absent  -> "nothing changed"
 drain_gate_refusal() {
   local do_build="$1" staged_path="$2"
   if [ "$do_build" = 1 ] && [ -f "$staged_path" ]; then
+    # fleetd #664: under the old layout a build emptied the live path ($JAR) immediately, so
+    # --no-build's own check ("no jar at $JAR") was the thing that refused a rerun here. That is
+    # no longer true: a build never touches $JAR at all now, so $JAR still holds whatever was
+    # already running before this gate fired (reaching this message at all requires OLD_PID to
+    # have been set, which means a daemon was running from $JAR already) — a --no-build rerun
+    # would NOT refuse, it would just restart that same old jar and silently throw away the one
+    # sitting at %s.
     printf 'aborted — the running daemon was NOT touched, but the freshly built jar is sitting at
-        %s, not yet swapped into %s. Rerun WITHOUT --no-build to finish the restart —
-        the freshly built jar is no longer at the live path that --no-build requires — or
-        remove %s by hand if you want to discard this build.' "$staged_path" "$JAR" "$staged_path"
+        %s, not yet swapped into %s. Rerun WITHOUT --no-build to finish the restart — a
+        --no-build rerun would NOT refuse here: %s already exists from before this run, so it
+        would restart the daemon on that OLD jar and silently discard the one you just built — or
+        remove %s by hand if you want to discard this build instead.' \
+      "$staged_path" "$JAR" "$JAR" "$staged_path"
   else
     printf 'aborted — nothing changed'
   fi
@@ -934,6 +1000,7 @@ report_supervisor_state() {
       SUPERVISED=1
       ok "launchd agent loaded ($LAUNCHD_LABEL) — launchd supervises this daemon"
       check_log_path_matches_plist "$OUT" "$LAUNCHD_PLIST"
+      check_jar_path_matches_plist "$JAR" "$LAUNCHD_PLIST"
       ;;
     systemd)
       SUPERVISED=1
@@ -1170,7 +1237,7 @@ if [ -n "$OLD_PID" ]; then
 else
   warn "no daemon running — this will be a cold start"
 fi
-ok "jar on disk: $(jar_id)  ($([ -f "$JAR" ] && date -r "$JAR" '+%Y-%m-%d %H:%M:%S' || echo 'none'))"
+report_jar_state
 ok "HEAD: $(git -C "$REPO" log --oneline -1)"
 
 # CB-594 / fleetd #492: supervision state. Installed and loaded are different facts — a
@@ -1252,9 +1319,6 @@ stop_if_check_only "$CHECK_ONLY"
 
 if [ "$DO_BUILD" = 1 ]; then
   say "build"
-  # fleetd #493: wipe a leftover staged jar from a previous failed/interrupted run BEFORE doing
-  # anything else, so that run's leftovers can never be mistaken for this run's output.
-  rm -f "$JAR_STAGED"
   BUILD_LOG="$(mktemp -t fleetd-build.XXXXXX)"
   echo "   log: $BUILD_LOG"
   if ! mvn -f "$MODULE/pom.xml" clean install > "$BUILD_LOG" 2>&1; then
@@ -1264,16 +1328,16 @@ if [ "$DO_BUILD" = 1 ]; then
   fi
   grep -E '^\[INFO\] Tests run:.*Failures' "$BUILD_LOG" | tail -1 | sed 's/^\[INFO\] /   /' || true
   ok "BUILD SUCCESS"
-  # fleetd #493: move the freshly built jar off the live path immediately — the running (OLD)
-  # daemon, if any, is still up at this point (build always runs before stop). From here until the
-  # swap step below (after the OLD daemon is confirmed gone), $JAR_STAGED is the only artefact this
-  # script treats as "the new jar" — $JAR itself is not touched again until the swap.
-  stage_built_jar
-  ok "jar now: $(jar_id "$JAR_STAGED")"
+  # fleetd #664: nothing to stage — $BUILD_JAR (target/fleetd.jar) is Maven's own output path and
+  # was never the live path, so the running (OLD) daemon, if any, was never at risk from this build
+  # at all. From here until the swap step below (after the OLD daemon is confirmed gone),
+  # $BUILD_JAR is the artefact this script treats as "the new jar" — $JAR itself is not touched
+  # again until the swap.
+  ok "jar now: $(jar_id "$BUILD_JAR")"
 else
   say "build skipped (--no-build)"
-  # fleetd #493: --no-build never builds or stages anything — it restarts whatever jar is already
-  # sitting at the live path from an earlier successful run. Same check, same message as before.
+  # fleetd #493: --no-build never builds anything — it restarts whatever jar is already sitting at
+  # the live path from an earlier successful run. Same check, same message as before.
   require_no_build_jar
 fi
 
@@ -1282,8 +1346,8 @@ fi
 # fleetd #555: run_drain_gate above is drain_gate_required + the prompt + drain_confirmed, called
 # unconditionally — it returns immediately when the gate is not required, and composes/dies through
 # refuse_drain_gate itself when the reply does not confirm. See #493/#517/#528 for why "nothing
-# changed" would be a lie once a build has staged a jar.
-run_drain_gate "$OLD_PID" "$ASSUME_YES" "$DO_BUILD" "$JAR_STAGED"
+# changed" would be a lie once a build has produced a jar not yet swapped in.
+run_drain_gate "$OLD_PID" "$ASSUME_YES" "$DO_BUILD" "$BUILD_JAR"
 
 # ------------------------------------------------------------------ stop
 #
@@ -1334,21 +1398,22 @@ fi
 
 # ------------------------------------------------------------------ swap
 #
-# fleetd #493: every branch above has now either confirmed the OLD daemon actually exited
-# (wait_for_daemon_exit, above) or established there was never one running to begin with. Only
-# NOW is it safe to put the freshly built jar at the path the NEXT `java -jar` (direct, or via
-# launchd/systemd's ExecStart) will read from — this mv is the one and only write to $JAR anywhere
+# fleetd #493/#664: every branch above has now either confirmed the OLD daemon actually exited
+# (wait_for_daemon_exit, above) or established there was never one running to begin with. Only NOW
+# is it safe to put the freshly built jar at the path the NEXT `java -jar` (direct, or via
+# launchd/systemd's ExecStart) will read from — a rename from $BUILD_JAR (target/) to $JAR (run/),
+# both under $MODULE and so on one filesystem. This mv is the one and only write to $JAR anywhere
 # in this script's mutating flow. If it fails, do not start: die() below exits before "start" runs.
 swap_if_built "$DO_BUILD"
 
 # ------------------------------------------------------------------ start
 # Unsupervised: login shell (zsh -l) is what puts the secrets on the daemon's environment, and cwd
-# must be fleetd/ because the daemon resolves fleetd.yaml, logs/ and target/ relative to it.
+# must be fleetd/ because the daemon resolves fleetd.yaml, logs/ and run/ relative to it.
 # Supervised (launchd): launchd does both — deploy/dev.ltms.fleetd.plist points ProgramArguments at
 # scripts/fleetd-launchd-wrapper.sh (CB-594), which is what execs the login shell in launchd's
 # place, and WorkingDirectory in the plist already pins fleetd/.
 # Supervised (systemd --user): the unit does both too — measured on the second host, ExecStart is
-# `/bin/zsh -lc "exec java -jar target/fleetd.jar fleetd.yaml"` (a login shell, same reason as
+# `/bin/zsh -lc "exec java -jar run/fleetd.jar fleetd.yaml"` (a login shell, same reason as
 # above) and WorkingDirectory is already pinned to fleetd/.
 
 say "start"

scripts/test-config-edit.sh

@@ -233,6 +233,66 @@ test_redaction_holds() {
   assert_contains "weight" "$RUN_OUTPUT" "a diff must have been demonstrably printed at all"
 }
 
+# redact()'s key-name filter only inspects the KEY, so a diff line whose key does not match
+# TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|URI|_KEY still reaches the final userinfo
+# sed even when its VALUE holds a credentialed URI. "note" is not a sensitive key name, so this
+# line must fall all the way through to that sed, not the earlier whole-value branch. The
+# trailing prose on both sides of the userinfo is a positive control: it proves the line reached
+# the userinfo sed (which touches only the userinfo) rather than the earlier branch (which would
+# have replaced the whole value with a bare "<redacted>" and dropped the prose).
+test_diff_line_userinfo_is_masked_with_positive_control() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note=see amqp://alice:wonderland@rabbit.local:5672/vhost for details'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-userinfo-case reload exit code"
+  assert_not_contains "alice:wonderland" "$RUN_OUTPUT" "the userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@rabbit.local:5672/vhost" "$RUN_OUTPUT" \
+    "the userinfo must be MASKED, not deleted — the rest of the value must survive"
+  assert_contains "note:" "$RUN_OUTPUT" "the key name must still reach the output"
+  assert_contains "see " "$RUN_OUTPUT" "prose BEFORE the userinfo must still reach the output"
+  assert_contains "for details" "$RUN_OUTPUT" "prose AFTER the userinfo must still reach the output"
+}
+
+# A diff line can hold a URL with no userinfo, followed later on the same line by an unrelated @
+# (free text in a string value, for example an email address). The line must pass through the
+# userinfo sed byte for byte: the match must stop at the end of the URL and must not treat the
+# later @ as a second userinfo delimiter.
+test_diff_line_uri_without_userinfo_survives_a_later_at_sign() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note2=see https://docs.local/guide and mail ops@example.com'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-no-userinfo-with-later-at-sign reload exit code"
+  assert_contains "note2: see https://docs.local/guide and mail ops@example.com" "$RUN_OUTPUT" \
+    "a URL with no userinfo plus a later @ on the same line must pass through byte for byte"
+}
+
+# Two credentialed URIs on one diff line must both be masked — the g flag matters.
+test_diff_line_masks_multiple_userinfo_with_g_flag() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note3=amqp://u1:p1@host1/vhost1 and amqp://u2:p2@host2/vhost2'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-two-userinfo-on-one-line reload exit code"
+  assert_not_contains "u1:p1" "$RUN_OUTPUT" "the first userinfo must never reach the output"
+  assert_not_contains "u2:p2" "$RUN_OUTPUT" "the second userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@host1/vhost1" "$RUN_OUTPUT" "the first URI must be masked"
+  assert_contains "amqp://<redacted>@host2/vhost2" "$RUN_OUTPUT" "the second URI must be masked"
+}
+
 # ------------------------------------------------------- acceptance criterion 9: forgotten value
 # `--set .a.b=` is a plausible typo (the value simply forgotten), and it must be refused outright
 # rather than silently nulling the field — a null numeric field falls back to its default, which
@@ -474,6 +534,90 @@ test_passphrase_key_is_redacted() {
   assert_not_contains "FAKELEAK-PASSPHRASE" "$RUN_OUTPUT" "passphrase case: the passphrase VALUE must never leak"
 }
 
+# ------------------- acceptance criterion 19: the key line falls outside the printed hunk
+# fleetd #656 — criteria 15a/15b both put the edit right next to the key line, so the key line is
+# always inside diff -u's default 3-line context. Neither covers the actual case #639 fixed: an
+# 8-line block-scalar body with only its SIXTH line changed, so the printed hunk (3 lines of
+# context on each side of the change) covers body lines 3-8 and never includes the "token:" key
+# line at all. The old, line-by-line redact() only ever masks after it has SEEN the key line go
+# past; with the key line outside the hunk it never sets its mask, and the whole body — the
+# changed line included — passes through raw. The control key sits right after the body, inside
+# the same hunk, so the positive control below proves the fix is not simply printing nothing.
+new_fixture_hunk_without_key_line() {
+  local dir
+  dir="$(mktemp -d "$TMP/fixture.XXXXXX")"
+  cat > "$dir/fleetd.yaml" <<'YAML'
+bind:
+  host: 127.0.0.1
+  port: 19999
+broker:
+  uri: amqp://user:hunter2@host/vhost
+auth:
+  token: |
+    SECRET-LINE-1
+    SECRET-LINE-2
+    SECRET-LINE-3
+    SECRET-LINE-4
+    SECRET-LINE-5
+    SECRET-LINE-6
+    SECRET-LINE-7
+    SECRET-LINE-8
+  control: CTRL-MUST-APPEAR
+profiles:
+  sonnet:
+    weight: 3
+    maxLoad: 5
+YAML
+  : > "$dir/fleetd.out"
+  printf '%s' "$dir"
+}
+
+test_key_line_outside_hunk_is_still_redacted() {
+  local dir
+  dir="$(new_fixture_hunk_without_key_line)"
+  sed 's/SECRET-LINE-6$/SECRET-LINE-6-CHANGED/' "$dir/fleetd.yaml" > "$dir/candidate.yaml"
+
+  start_run "$dir" 5 --from "$dir/candidate.yaml"
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "hunk-without-key-line case reload exit code"
+  # Positive control FIRST: without this, a diff that printed nothing at all would pass the
+  # negative assertion right below identically to a correctly redacted one.
+  assert_contains "CTRL-MUST-APPEAR" "$RUN_OUTPUT" "hunk-without-key-line case: the non-secret control line must still print unmasked"
+  assert_not_contains "SECRET-LINE-6-CHANGED" "$RUN_OUTPUT" "hunk-without-key-line case: the changed body line must never leak, even with the key line outside the printed hunk"
+}
+
+# ------------------------------- acceptance criterion 20: a blank line inside the value
+# fleetd #656 — the old, line-by-line redact() reset its mask on any line whose indentation was
+# not STRICTLY greater than the key's, and a wholly blank line has indentation 0, so it reset the
+# mask exactly like the "control:" line that legitimately ends the block scalar. Everything after
+# the blank line then printed raw. The current fix tracks masked lines by FILE line number instead
+# of by indentation seen so far, so a blank line inside the value stays masked.
+new_fixture_blank_line_in_value() {
+  local dir
+  dir="$(mktemp -d "$TMP/fixture.XXXXXX")"
+  printf 'bind:\n  host: 127.0.0.1\n  port: 19999\nbroker:\n  uri: amqp://user:hunter2@host/vhost\nauth:\n  token: |\n    LEAK-BEFORE-BLANK\n\n    LEAK-AFTER-BLANK\n  control: CTRL-MUST-APPEAR\nprofiles:\n  sonnet:\n    weight: 3\n    maxLoad: 5\n' > "$dir/fleetd.yaml"
+  : > "$dir/fleetd.out"
+  printf '%s' "$dir"
+}
+
+test_blank_line_inside_value_is_still_redacted() {
+  local dir
+  dir="$(new_fixture_blank_line_in_value)"
+  sed 's/LEAK-AFTER-BLANK$/LEAK-AFTER-BLANK-CHANGED/' "$dir/fleetd.yaml" > "$dir/candidate.yaml"
+
+  start_run "$dir" 5 --from "$dir/candidate.yaml"
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "blank-line-in-value case reload exit code"
+  assert_contains "CTRL-MUST-APPEAR" "$RUN_OUTPUT" "blank-line-in-value case: the non-secret control line must still print unmasked"
+  assert_not_contains "LEAK-AFTER-BLANK-CHANGED" "$RUN_OUTPUT" "blank-line-in-value case: the line after the blank must never leak"
+}
+
 # ----------------------------------- acceptance criterion 16: a failing --set must not echo value
 # fleetd #635 follow-up (ticket comment 17673, defect 8) — apply_set_pairs used to echo the FULL
 # "$kv" (path=value, exactly as typed) in its yq-failure messages, so a broken --set with a
@@ -545,6 +689,116 @@ test_refusal_shape_from_parse_failure_wording_is_recognised() {
   assert_equals 4 "$RUN_RC" "the parse-failure refusal shape must also exit 4, not be read as silence"
 }
 
+# A verdict line carrying a credentialed URI has its userinfo masked, with a positive control
+# proving the rest of the line still reaches the output unchanged.
+test_verdict_userinfo_is_masked_with_positive_control() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf 'config reload from %s refused, keeping the running config: refusing to start: malformed pattern — profiles.local.errorPattern ("amqp://user:hunter2@host/vhost"): Unclosed character class near index 8\n' \
+    "$dir/fleetd.yaml" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "refusal-with-userinfo exit code"
+  assert_not_contains "user:hunter2" "$RUN_OUTPUT" "the userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@host/vhost" "$RUN_OUTPUT" \
+    "the userinfo must be MASKED, not deleted — the rest of the quoted value must survive"
+  # Positive control: the diagnostic prose on both sides of the userinfo must still reach the
+  # output. Without this, a mutant that drops the whole verdict line would pass identically.
+  assert_contains "malformed pattern" "$RUN_OUTPUT" "prose BEFORE the userinfo must still reach the output"
+  assert_contains "Unclosed character class near index 8" "$RUN_OUTPUT" \
+    "prose AFTER the userinfo must still reach the output"
+}
+
+# An ordinary refusal line quotes the offending pattern, not a credential, and must survive byte
+# for byte: the rewrite is scoped to userinfo only, and the quoted pattern is the detail an
+# operator needs to fix the refusal.
+test_ordinary_refusal_line_passes_through_unchanged() {
+  local dir real_line
+  dir="$(new_fixture)"
+  real_line="config reload from $dir/fleetd.yaml refused, keeping the running config: refusing to start: malformed pattern — profiles.local.errorPattern (\"[unclosed\"): Unclosed character class near index 8"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf '%s\n' "$real_line" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "ordinary refusal exit code"
+  assert_contains "$real_line" "$RUN_OUTPUT" \
+    "an ordinary refusal with no userinfo must pass through byte for byte, unchanged"
+}
+
+# A verdict line can hold a URI with NO userinfo and a later, unrelated @ further on in the same
+# line (an email address in diagnostic prose, for example). The rewrite must stop at the end of
+# the URI and must not treat the later @ as a second userinfo delimiter.
+test_uri_without_userinfo_survives_a_later_at_sign() {
+  local dir real_line
+  dir="$(new_fixture)"
+  real_line="config reload from $dir/fleetd.yaml refused, keeping the running config: broker.uri amqp://broker.local/vhost unreachable, contact ops@example.com"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf '%s\n' "$real_line" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "no-userinfo-with-later-at-sign exit code"
+  assert_contains "$real_line" "$RUN_OUTPUT" \
+    "a URI with no userinfo plus a later @ in the same line must pass through byte for byte"
+}
+
+# --set runs yq over the whole candidate. It warns when that changes more lines than the requested
+# pairs, but a simple file with only the intended changed line must stay quiet.
+new_fixture_reformat_sensitive() {
+  local dir
+  dir="$(mktemp -d "$TMP/fixture.XXXXXX")"
+  cat > "$dir/fleetd.yaml" <<'YAML'
+# A section comment that documents the next block.
+bind:
+  host: 127.0.0.1 # Keep this aligned with the port note.
+  port: 19999     # A fixture port.
+
+# These comments use their placement as documentation.
+profiles:
+  sonnet:
+    weight: 3
+    bootstrapText: >-
+      First line.
+      Second line.
+YAML
+  : > "$dir/fleetd.out"
+  printf '%s' "$dir"
+}
+
+test_set_warns_when_yq_reformats_extra_lines() {
+  local dir
+  dir="$(new_fixture_reformat_sensitive)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "reformat warning case reload exit code"
+  assert_contains "yq reformatted the whole file" "$RUN_OUTPUT" \
+    "a --set that changes extra candidate lines must warn before installation"
+}
+
+test_set_stays_quiet_without_formatting_churn() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "no-reformat warning case reload exit code"
+  assert_not_contains "yq reformatted the whole file" "$RUN_OUTPUT" \
+    "a --set that changes only its requested candidate line must not warn"
+}
+
 echo "== acceptance criterion 1: refusal restores byte for byte =="
 test_refusal_restores_byte_for_byte
 echo "== acceptance criterion 2: clean reload keeps the edit =="
@@ -559,6 +813,12 @@ echo "== acceptance criterion 6: the marker works =="
 test_marker_skips_lines_before_it
 echo "== acceptance criterion 7 (+13: redaction is proven to have run) =="
 test_redaction_holds
+echo "== fleetd #692: a diff line's userinfo is masked, rest of the value survives =="
+test_diff_line_userinfo_is_masked_with_positive_control
+echo "== fleetd #692: a diff line's URI with no userinfo survives a later @ in the line =="
+test_diff_line_uri_without_userinfo_survives_a_later_at_sign
+echo "== fleetd #692: two userinfo URIs on one diff line are both masked =="
+test_diff_line_masks_multiple_userinfo_with_g_flag
 echo "== acceptance criterion 9: a forgotten value refuses and installs nothing =="
 test_forgotten_value_refuses_and_installs_nothing
 echo "== acceptance criterion 10: an explicit clear writes a bare null =="
@@ -573,6 +833,10 @@ echo "== acceptance criterion 15a: a block scalar's continuation lines are redac
 test_block_scalar_continuation_is_redacted
 echo "== acceptance criterion 15b: a passphrase key is also recognised =="
 test_passphrase_key_is_redacted
+echo "== acceptance criterion 19: the key line falls outside the printed hunk =="
+test_key_line_outside_hunk_is_still_redacted
+echo "== acceptance criterion 20: a blank line inside the value =="
+test_blank_line_inside_value_is_still_redacted
 echo "== acceptance criterion 16: a failing --set must not echo its value =="
 test_failing_set_does_not_echo_its_value
 echo "== extra: dry-run never installs, and redacts =="
@@ -581,5 +845,15 @@ echo "== extra: --check is read-only and always exits 0 =="
 test_check_is_read_only_and_exits_zero
 echo "== extra: the parse-failure refusal shape is also recognised =="
 test_refusal_shape_from_parse_failure_wording_is_recognised
+echo "== verdict-redaction criteria 2+3: verdict userinfo is masked, rest of line survives =="
+test_verdict_userinfo_is_masked_with_positive_control
+echo "== verdict-redaction criterion 4: an ordinary refusal passes through unchanged =="
+test_ordinary_refusal_line_passes_through_unchanged
+echo "== fleetd #638: a URI with no userinfo survives a later @ in the same line =="
+test_uri_without_userinfo_survives_a_later_at_sign
+echo "== acceptance criterion 17: --set warns about yq formatting churn =="
+test_set_warns_when_yq_reformats_extra_lines
+echo "== acceptance criterion 18: --set stays quiet without formatting churn =="
+test_set_stays_quiet_without_formatting_churn
 
 printf 'PASS: config-edit acceptance criteria\n'

scripts/test-redeploy-fleetd.sh

@@ -447,7 +447,7 @@ test_assert_single_daemon_rejects_two_pids() {
 test_running_pid_excludes_self_matching_wrapper_shell() {
   local before after wrapper_pid
   before="$(running_pid)"
-  sh -c 'echo "target/fleetd.jar" >/dev/null; sleep 20' &
+  sh -c 'echo "run/fleetd.jar" >/dev/null; sleep 20' &
   wrapper_pid=$!
   sleep 0.3
   after="$(running_pid)"
@@ -475,11 +475,26 @@ test_running_pid_excludes_self_matching_wrapper_shell() {
 # `comm` from the actually-executed binary's own path, not from `exec -a`'s argv[0] override (BSD
 # ties `comm` to argv[0], which is what makes this technique work here) — so on Linux this
 # specific fixture might report `comm=sh`, not `comm=java`, even though the REAL daemon (a literal
-# `java -jar target/fleetd.jar` process, never fabricated) is unaffected either way. I could not
+# `java -jar run/fleetd.jar` process, never fabricated) is unaffected either way. I could not
 # verify this fixture's behavior on Linux, so test_running_pid_counts_a_pid_whose_comm_is_java
 # below backstops the same claim (the allowlist admits a pid whose comm is `java`) with a stubbed
 # `ps`, which is identical bash on every platform and carries no such platform question.
 test_running_pid_finds_a_real_java_named_second_process() {
+  local before after standin_pid
+  before="$(running_pid)"
+  ( exec -a java sh -c 'echo "run/fleetd.jar" >/dev/null; sleep 20' ) &
+  standin_pid=$!
+  sleep 0.3
+  after="$(running_pid)"
+  kill "$standin_pid" 2>/dev/null || true
+  wait "$standin_pid" 2>/dev/null || true
+  printf '%s\n' "$after" | grep -qxF "$standin_pid" \
+    || fail "running_pid() did not find a real second process (pid $standin_pid, comm forced to 'java' via exec -a) whose own argv holds the pattern: before=[$before] after=[$after]"
+}
+
+# PATTERN matches a fleetd jar in either build layout, not only the run/ one: a process whose
+# argv names a jar under target/ must be found too, the same way the run/ case above is.
+test_running_pid_finds_a_real_java_named_process_from_target_dir() {
   local before after standin_pid
   before="$(running_pid)"
   ( exec -a java sh -c 'echo "target/fleetd.jar" >/dev/null; sleep 20' ) &
@@ -489,7 +504,24 @@ test_running_pid_finds_a_real_java_named_second_process() {
   kill "$standin_pid" 2>/dev/null || true
   wait "$standin_pid" 2>/dev/null || true
   printf '%s\n' "$after" | grep -qxF "$standin_pid" \
-    || fail "running_pid() did not find a real second process (pid $standin_pid, comm forced to 'java' via exec -a) whose own argv holds the pattern: before=[$before] after=[$after]"
+    || fail "running_pid() did not find a real second process (pid $standin_pid, comm forced to 'java' via exec -a) naming a jar under target/: before=[$before] after=[$after]"
+}
+
+# Broadening PATTERN to match both build layouts must not also broaden it into matching a
+# non-exec'ing shell that merely holds the target/ text as a literal argument, the same
+# self-matching shape test_running_pid_excludes_self_matching_wrapper_shell above excludes for
+# the run/ text.
+test_running_pid_excludes_self_matching_wrapper_shell_naming_target_dir() {
+  local before after wrapper_pid
+  before="$(running_pid)"
+  sh -c 'echo "target/fleetd.jar" >/dev/null; sleep 20' &
+  wrapper_pid=$!
+  sleep 0.3
+  after="$(running_pid)"
+  kill "$wrapper_pid" 2>/dev/null || true
+  wait "$wrapper_pid" 2>/dev/null || true
+  [ "$after" = "$before" ] \
+    || fail "running_pid() counted a self-matching wrapper shell (pid $wrapper_pid, holding 'target/fleetd.jar' as literal text in its own argv, not the daemon): before=[$before] after=[$after]"
 }
 
 # fleetd #593 CORRECTION 1, hole 2 — the round-1 filter denied known shell names (sh/bash/zsh/
@@ -557,29 +589,30 @@ test_die_message_does_not_recommend_bare_pgrep_as_remediation() {
     || fail "assert_single_daemon's die message does not say in words that a pattern can match the caller (fleetd #593)"
 }
 
-# fleetd #511 — jar_id()'s no-argument default was unpinned by any test: nothing proved it reports
-# $JAR (the live path) rather than $JAR_STAGED. Both halves matter, so this pins both: the bare call
-# must hash the live jar, and an explicit path argument must hash THAT file, not fall back to $JAR.
-# Two files with different content, so a default pointed at the wrong one reports the wrong hash
-# rather than accidentally matching.
+# fleetd #511/#664 — jar_id()'s no-argument default was unpinned by any test: nothing proved it
+# reports $JAR (the live path) rather than whatever explicit path a caller passes it (e.g.
+# $BUILD_JAR). Both halves matter, so this pins both: the bare call must hash the live jar, and an
+# explicit path argument must hash THAT file, not fall back to $JAR. Two files with different
+# content, so a default pointed at the wrong one reports the wrong hash rather than accidentally
+# matching.
 test_jar_id_defaults_to_live_and_reports_explicit_path() {
-  local dir saved_jar="$JAR" saved_staged="$JAR_STAGED"
-  local live_hash staged_hash default_result explicit_result
+  local dir saved_jar="$JAR"
+  local live_hash other_hash default_result explicit_result other_path
   dir="$TMP/jar-id"; mkdir -p "$dir"
-  JAR="$dir/fleetd.jar"; JAR_STAGED="$dir/fleetd-new.jar"
+  JAR="$dir/fleetd.jar"; other_path="$dir/other.jar"
   printf 'live jar bytes' > "$JAR"
-  printf 'staged jar bytes, not the same content' > "$JAR_STAGED"
+  printf 'other jar bytes, not the same content' > "$other_path"
   # fleetd #550: this reference hash must be computed the same portable way jar_id() itself now
   # computes one — a bare, unguarded call to the macOS-only hasher here was exactly the item-2
   # defect, dying with "command not found" on any Linux runner that has no such hasher at all.
   live_hash="$(hash256 "$JAR")"
-  staged_hash="$(hash256 "$JAR_STAGED")"
+  other_hash="$(hash256 "$other_path")"
   default_result="$(jar_id)"
-  explicit_result="$(jar_id "$JAR_STAGED")"
-  JAR="$saved_jar"; JAR_STAGED="$saved_staged"
-  [ "$live_hash" != "$staged_hash" ] || fail "test fixture error: live and staged jars hashed the same"
+  explicit_result="$(jar_id "$other_path")"
+  JAR="$saved_jar"
+  [ "$live_hash" != "$other_hash" ] || fail "test fixture error: live and other jars hashed the same"
   assert_equals "$live_hash" "$default_result" "jar_id with no arguments must report the hash of \$JAR"
-  assert_equals "$staged_hash" "$explicit_result" "jar_id \"\$JAR_STAGED\" must report the hash of the staged jar, not fall back to \$JAR"
+  assert_equals "$other_hash" "$explicit_result" "jar_id with an explicit path must report the hash of that path, not fall back to \$JAR"
 }
 
 # fleetd #550 — closes a gap the test above leaves open. That test's own reference hash is now ALSO
@@ -651,34 +684,77 @@ test_jar_id_reports_unhashable_when_no_hasher_on_path() {
   assert_equals "unhashable" "$explicit_result" "jar_id (explicit path) with no hasher on PATH must report the same third state"
 }
 
-# fleetd #493 — never build into the path a running process holds. stage_built_jar/swap_staged_jar
-# are exercised directly against real files on disk (not stubs), because the whole point is file
+# fleetd #664 — report_jar_state is the --check fix: under the old layout $JAR and the build
+# output were the same file, so a single "jar on disk" fact covered both. Now they can disagree,
+# and this is the function that is supposed to show that. Agreeing case: two files with IDENTICAL
+# content must print both labels and never warn.
+test_report_jar_state_agrees_when_hashes_match() {
+  local dir saved_build="$BUILD_JAR" saved_jar="$JAR" output
+  dir="$TMP/report-jar-agree"; mkdir -p "$dir"
+  BUILD_JAR="$dir/target-fleetd.jar"; JAR="$dir/run-fleetd.jar"
+  printf 'identical jar bytes' > "$BUILD_JAR"
+  printf 'identical jar bytes' > "$JAR"
+  output="$(report_jar_state)"
+  BUILD_JAR="$saved_build"; JAR="$saved_jar"
+  printf '%s' "$output" | grep -qF 'built jar' \
+    || fail "report_jar_state did not label the built jar"
+  printf '%s' "$output" | grep -qF 'running jar' \
+    || fail "report_jar_state did not label the running jar"
+  if printf '%s' "$output" | grep -qF 'differ'; then
+    fail "report_jar_state warned about a mismatch when both jars have identical content"
+  fi
+}
+
+# The disagreeing case: this is the whole point of the ticket — a built jar that is NOT the
+# running jar must be visibly flagged, not silently printed as two unremarkable facts.
+test_report_jar_state_warns_when_hashes_differ() {
+  local dir saved_build="$BUILD_JAR" saved_jar="$JAR" output
+  dir="$TMP/report-jar-differ"; mkdir -p "$dir"
+  BUILD_JAR="$dir/target-fleetd.jar"; JAR="$dir/run-fleetd.jar"
+  printf 'freshly built jar bytes' > "$BUILD_JAR"
+  printf 'older running jar bytes' > "$JAR"
+  output="$(report_jar_state)"
+  BUILD_JAR="$saved_build"; JAR="$saved_jar"
+  printf '%s' "$output" | grep -qF 'differ' \
+    || fail "report_jar_state did not warn when the built jar and running jar disagree"
+}
+
+# Neither file existing (a fresh checkout, never built or deployed) must report two "absent"
+# facts and never a false mismatch warning — "absent" vs "absent" is agreement, not a diff.
+test_report_jar_state_both_absent_is_not_a_mismatch() {
+  local dir saved_build="$BUILD_JAR" saved_jar="$JAR" output
+  dir="$TMP/report-jar-absent"; mkdir -p "$dir"
+  BUILD_JAR="$dir/no-such-target.jar"; JAR="$dir/no-such-run.jar"
+  output="$(report_jar_state)"
+  BUILD_JAR="$saved_build"; JAR="$saved_jar"
+  printf '%s' "$output" | grep -qF 'absent' \
+    || fail "report_jar_state did not report absent for a missing built/running jar"
+  if printf '%s' "$output" | grep -qF 'differ'; then
+    fail "report_jar_state warned about a mismatch when both jars are simply absent"
+  fi
+}
+
+# Reads JAR and BUILD_JAR exactly as the script sources them, with nothing here assigning
+# either first. JAR must resolve outside $MODULE/target/, and JAR must differ from BUILD_JAR:
+# the daemon's live path and Maven's own build output are never the same file.
+test_jar_and_build_jar_are_sourced_outside_target_and_differ() {
+  source "$ROOT/scripts/redeploy-fleetd.sh"
+  case "$JAR" in
+    "$MODULE"/target/*)
+      fail "\$JAR must not live under \$MODULE/target/ — got $JAR" ;;
+  esac
+  [ "$JAR" != "$BUILD_JAR" ] \
+    || fail "\$JAR and \$BUILD_JAR must not be the same path — got $JAR"
+}
+
+# fleetd #493/#664 — never build into the path a running process holds. swap_staged_jar is
+# exercised directly against real files on disk (not stubs), because the whole point is file
 # behavior (does the content move, does the source disappear, does a failure leave both sides
-# intact) that a stubbed function cannot prove.
-test_stage_built_jar_moves_off_live_path() {
-  local dir jar staged saved_jar="$JAR" saved_staged="$JAR_STAGED"
-  dir="$TMP/stage-ok"; mkdir -p "$dir"
-  jar="$dir/fleetd.jar"; staged="$dir/fleetd-new.jar"
-  printf 'built jar bytes' > "$jar"
-  JAR="$jar"; JAR_STAGED="$staged"
-  stage_built_jar || fail "stage_built_jar rejected a real build output"
-  JAR="$saved_jar"; JAR_STAGED="$saved_staged"
-  [ ! -f "$jar" ] || fail "stage_built_jar left the jar behind at the live path $jar"
-  [ -f "$staged" ] || fail "stage_built_jar did not create the staged jar at $staged"
-  grep -qF 'built jar bytes' "$staged" || fail "staged jar does not carry the built content"
-}
-
-test_stage_built_jar_dies_when_build_produced_nothing() {
-  local dir output rc=0 saved_jar="$JAR" saved_staged="$JAR_STAGED"
-  dir="$TMP/stage-missing"; mkdir -p "$dir"
-  JAR="$dir/fleetd.jar"; JAR_STAGED="$dir/fleetd-new.jar"
-  output="$(stage_built_jar 2>&1)" || rc=$?
-  JAR="$saved_jar"; JAR_STAGED="$saved_staged"
-  [ "$rc" -ne 0 ] || fail "stage_built_jar accepted a missing build output"
-  printf '%s' "$output" | grep -qF "$dir/fleetd.jar" \
-    || fail "refusal message does not name the missing jar path"
-}
-
+# intact) that a stubbed function cannot prove. stage_built_jar no longer exists: under the #664
+# layout $BUILD_JAR (target/fleetd.jar) was never the live path, so a build has nothing to be
+# staged OUT of — swap_staged_jar is called directly against $BUILD_JAR/$JAR (see
+# test_swap_ordered_after_wait_and_before_start and the report_jar_state tests below for the rest
+# of that seam).
 test_swap_staged_jar_moves_staged_onto_live() {
   local dir staged live
   dir="$TMP/swap-ok"; mkdir -p "$dir"
@@ -989,24 +1065,26 @@ test_swap_ordered_after_wait_and_before_start() {
     || fail "swap_if_built (line $swap_line) is not before the start section (line $start_line)"
 }
 
-# fleetd #511: the drain-gate abort message (fired when a build has staged a jar but the operator
-# declines the drain confirmation) used to tell the operator to "Rerun (with or without --no-build)"
-# to finish the restart. That is wrong — by the time this message can fire, stage_built_jar has
-# already moved the jar off $JAR, so a rerun WITH --no-build hits require_no_build_jar's own refusal
-# ("no jar at $JAR — run without --no-build"). Like test_swap_ordered_after_wait_and_before_start
-# above, this code path is never reached by sourcing (the SOURCED guard stops before the main flow),
-# so the only way to pin its exact wording is to read the source.
+# fleetd #511: the drain-gate abort message (fired when a build has produced a jar but the
+# operator declines the drain confirmation) used to tell the operator to "Rerun (with or without
+# --no-build)" to finish the restart. That is wrong. fleetd #664 changed WHY it is wrong: under
+# the old layout a build emptied the live path immediately, so --no-build's own check refused a
+# rerun for you; now a build never touches the live path at all, so --no-build would NOT refuse —
+# it would quietly restart the daemon on the OLD jar and throw away the one just built. Like
+# test_swap_ordered_after_wait_and_before_start above, this code path is never reached by sourcing
+# (the SOURCED guard stops before the main flow), so the only way to pin its exact wording is to
+# read the source.
 test_drain_gate_abort_message_says_no_no_build() {
   local src="$ROOT/scripts/redeploy-fleetd.sh" msg
-  msg="$(grep -A3 -F 'aborted — the running daemon was NOT touched, but the freshly built jar is sitting at' "$src")"
+  msg="$(grep -A6 -F 'aborted — the running daemon was NOT touched, but the freshly built jar is sitting at' "$src")"
   [ -n "$msg" ] || fail "could not find the drain-gate staged-jar abort message in redeploy-fleetd.sh"
   if printf '%s' "$msg" | grep -qF 'with or without --no-build'; then
     fail "abort message still claims a rerun WITH --no-build can finish the restart"
   fi
   printf '%s' "$msg" | grep -qF 'WITHOUT --no-build' \
     || fail "abort message does not tell the operator to rerun without --no-build"
-  printf '%s' "$msg" | grep -qF 'no longer at the live path' \
-    || fail "abort message does not say why --no-build cannot finish the restart"
+  printf '%s' "$msg" | grep -qF 'silently discard' \
+    || fail "abort message does not say that --no-build would silently discard the build just made"
 }
 
 # fleetd #517 — the drain-gate abort branch itself. Before this, the only test of this message was
@@ -1149,19 +1227,22 @@ test_refuse_drain_gate_no_build_staged_absent() {
 #
 # fleetd #555 — the main flow's own call site moved: it used to read
 # `refuse_drain_gate "$DO_BUILD" "$JAR_STAGED"` directly; it now reads
-# `run_drain_gate "$OLD_PID" "$ASSUME_YES" "$DO_BUILD" "$JAR_STAGED"`, and run_drain_gate (tested
-# directly below by test_run_drain_gate_*) is what calls refuse_drain_gate with its own local names.
-# This grep now pins THAT call site — the thing that would go missing if a future edit deleted the
-# main flow's call to run_drain_gate altogether, the same residual gap #521/#528 already accepted for
-# swap_if_built/refuse_drain_gate (sourcing stops before the main flow runs, so no test in this file
-# can do better than reading the source for this one specific gap).
+# `run_drain_gate "$OLD_PID" "$ASSUME_YES" "$DO_BUILD" "$BUILD_JAR"` (fleetd #664 renamed the
+# fourth argument from $JAR_STAGED to $BUILD_JAR — same role, the not-yet-swapped-in jar — when
+# that path stopped being a separate staging file and became target/fleetd.jar itself), and
+# run_drain_gate (tested directly below by test_run_drain_gate_*) is what calls refuse_drain_gate
+# with its own local names. This grep now pins THAT call site — the thing that would go missing if
+# a future edit deleted the main flow's call to run_drain_gate altogether, the same residual gap
+# #521/#528 already accepted for swap_if_built/refuse_drain_gate (sourcing stops before the main
+# flow runs, so no test in this file can do better than reading the source for this one specific
+# gap).
 #
 # The grep ends `|| true`: this file runs under `set -euo pipefail`, so an ABSENT needle would fail
 # the assignment and `set -e` would kill the whole suite before the `[ -n ... ] || fail` guard below
 # ever ran — the exact dead-check shape fleetd #528 also flags as a sweep finding (see the PR body).
 test_run_drain_gate_call_site_present() {
   local src="$ROOT/scripts/redeploy-fleetd.sh" call_line
-  call_line="$(grep -Fn 'run_drain_gate "$OLD_PID" "$ASSUME_YES" "$DO_BUILD" "$JAR_STAGED"' "$src" | head -1 | cut -d: -f1 || true)"
+  call_line="$(grep -Fn 'run_drain_gate "$OLD_PID" "$ASSUME_YES" "$DO_BUILD" "$BUILD_JAR"' "$src" | head -1 | cut -d: -f1 || true)"
   [ -n "$call_line" ] \
     || fail "could not find the main flow's run_drain_gate call site in redeploy-fleetd.sh"
 }
@@ -1269,12 +1350,71 @@ test_run_drain_gate_declined_reply_refuses() {
   source "$ROOT/scripts/redeploy-fleetd.sh"
 }
 
+# Writes a launchd-plist fixture naming jar_path as the ProgramArguments entry after "-jar", so
+# check_jar_path_matches_plist has something real to read back.
+write_launchd_plist_fixture() {
+  local path="$1" jar_path="$2"
+  cat > "$path" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>test.fixture</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/usr/bin/java</string>
+    <string>-jar</string>
+    <string>$jar_path</string>
+    <string>fleetd.yaml</string>
+  </array>
+</dict>
+</plist>
+PLIST
+}
+
+# Agreeing case: a plist whose ProgramArguments names the same jar, resolved, must proceed and
+# say so, never die.
+test_check_jar_path_matches_plist_agrees_ok() {
+  local dir jar plist output rc=0
+  dir="$TMP/jar-path-agree"; mkdir -p "$dir/run"
+  jar="$dir/run/fleetd.jar"
+  plist="$dir/agree.plist"
+  write_launchd_plist_fixture "$plist" "$jar"
+  output="$(check_jar_path_matches_plist "$jar" "$plist" 2>&1)" || rc=$?
+  [ "$rc" -eq 0 ] \
+    || fail "check_jar_path_matches_plist must succeed when the plist names the same jar: $output"
+  printf '%s' "$output" | grep -qF 'jar path check' \
+    || fail "check_jar_path_matches_plist did not print the agreement line: $output"
+}
+
+# The disagreeing case, and the positive control this check exists for: a plist naming a
+# different jar must die, naming both paths.
+test_check_jar_path_matches_plist_mismatch_dies() {
+  local dir jar other_jar plist output rc=0
+  dir="$TMP/jar-path-mismatch"; mkdir -p "$dir/run" "$dir/target"
+  jar="$dir/run/fleetd.jar"
+  other_jar="$dir/target/fleetd.jar"
+  plist="$dir/mismatch.plist"
+  write_launchd_plist_fixture "$plist" "$other_jar"
+  output="$(check_jar_path_matches_plist "$jar" "$plist" 2>&1)" || rc=$?
+  [ "$rc" -ne 0 ] \
+    || fail "check_jar_path_matches_plist must die when the plist names a different jar"
+  printf '%s' "$output" | grep -qF "$jar" \
+    || fail "die message does not name this script's jar path: $output"
+  printf '%s' "$output" | grep -qF "$other_jar" \
+    || fail "die message does not name the plist's jar path: $output"
+}
+
 # fleetd #555 item 4 — the report-state dispatch on $SUPERVISOR_KIND. Inverting this used to report
 # the wrong supervisor and, for the launchd arm specifically, skip check_log_path_matches_plist.
 CHECK_LOG_PATH_CALLED=0
+CHECK_JAR_PATH_CALLED=0
 stub_check_log_path_recorder() {
   CHECK_LOG_PATH_CALLED=0
+  CHECK_JAR_PATH_CALLED=0
   check_log_path_matches_plist() { CHECK_LOG_PATH_CALLED=1; }
+  check_jar_path_matches_plist() { CHECK_JAR_PATH_CALLED=1; }
 }
 
 test_report_supervisor_state_launchd_sets_supervised_and_checks_log_path() {
@@ -1285,6 +1425,8 @@ test_report_supervisor_state_launchd_sets_supervised_and_checks_log_path() {
   [ "$SUPERVISED" = 1 ] || fail "report_supervisor_state launchd must set SUPERVISED=1"
   [ "$CHECK_LOG_PATH_CALLED" = 1 ] \
     || fail "report_supervisor_state launchd must call check_log_path_matches_plist"
+  [ "$CHECK_JAR_PATH_CALLED" = 1 ] \
+    || fail "report_supervisor_state launchd must call check_jar_path_matches_plist"
   source "$ROOT/scripts/redeploy-fleetd.sh"
 }
 
@@ -1296,6 +1438,8 @@ test_report_supervisor_state_systemd_sets_supervised_without_log_path_check() {
   [ "$SUPERVISED" = 1 ] || fail "report_supervisor_state systemd must set SUPERVISED=1"
   [ "$CHECK_LOG_PATH_CALLED" = 0 ] \
     || fail "report_supervisor_state systemd must NOT call check_log_path_matches_plist"
+  [ "$CHECK_JAR_PATH_CALLED" = 0 ] \
+    || fail "report_supervisor_state systemd must NOT call check_jar_path_matches_plist"
   source "$ROOT/scripts/redeploy-fleetd.sh"
 }
 
@@ -2153,6 +2297,8 @@ test_assert_single_daemon_accepts_one_pid
 test_assert_single_daemon_rejects_two_pids
 test_running_pid_excludes_self_matching_wrapper_shell
 test_running_pid_finds_a_real_java_named_second_process
+test_running_pid_finds_a_real_java_named_process_from_target_dir
+test_running_pid_excludes_self_matching_wrapper_shell_naming_target_dir
 test_running_pid_drops_a_pid_whose_comm_is_not_java
 test_running_pid_drops_a_pid_that_exited_before_the_comm_lookup
 test_running_pid_counts_a_pid_whose_comm_is_java
@@ -2161,8 +2307,10 @@ test_jar_id_defaults_to_live_and_reports_explicit_path
 test_hash256_computes_a_real_sha256
 test_jar_id_reports_absent_for_missing_file
 test_jar_id_reports_unhashable_when_no_hasher_on_path
-test_stage_built_jar_moves_off_live_path
-test_stage_built_jar_dies_when_build_produced_nothing
+test_report_jar_state_agrees_when_hashes_match
+test_report_jar_state_warns_when_hashes_differ
+test_report_jar_state_both_absent_is_not_a_mismatch
+test_jar_and_build_jar_are_sourced_outside_target_and_differ
 test_swap_staged_jar_moves_staged_onto_live
 test_swap_staged_jar_dies_without_staged_file
 test_swap_staged_jar_dies_when_mv_fails
@@ -2204,6 +2352,8 @@ test_drain_confirmed_false_on_anything_else
 test_run_drain_gate_skips_prompt_when_not_required
 test_run_drain_gate_confirmed_reply_does_not_refuse
 test_run_drain_gate_declined_reply_refuses
+test_check_jar_path_matches_plist_agrees_ok
+test_check_jar_path_matches_plist_mismatch_dies
 test_report_supervisor_state_launchd_sets_supervised_and_checks_log_path
 test_report_supervisor_state_systemd_sets_supervised_without_log_path_check
 test_report_supervisor_state_none_leaves_supervised_zero