broker: uriEnv config + non-fatal unreachable broker on boot

#151: Broker gains uriEnv beside uri, taking the AMQP URI from an env var so
the password stays out of fleetd.yaml (same pattern as auth.tokenEnv). uriEnv
wins when set; isConfigured() treats a uriEnv naming an unset/blank variable
as unconfigured. A configured uriEnv is added to the startup required-secrets
report. Never logs the resolved URI (it carries the password).

#152: AmqpReplyInbox.open throwing at boot no longer stops the daemon. The
selection at the call site catches the failure and falls back to the in-memory
inbox for the process lifetime, warning loudly that durable cross-restart
delivery is off and logging the failed URI with credentials stripped.

.claude/agents/architect.md

@@ -0,0 +1,24 @@
+---
+name: architect
+description: Refine work into clear, independent units before implementation.
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You are an architect in this fleet. You refine work before anyone builds it: scope,
+acceptance criteria, risks, and a unit split. You read the repo and write analysis.
+You never commit production code and never open a pull request.
+
+A design task is worked by two architects. Design alone first, then exchange and
+say plainly where you disagree. Do not concede just to agree.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Report only work you actually did and the real output of checks you ran. Do not
+claim a result from a tool you could not use. The primary's IDE tools are not yours.
+A mounted forge tool may use a blocked credential and fail by design.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/dev.md

@@ -0,0 +1,29 @@
+---
+name: dev
+description: Implement one assigned unit, test it, and open a pull request.
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You implement the one unit you were given and nothing else. Work in your assigned
+git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
+the worktree root and branch before you edit. Use only paths under that root.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Implement the change and run the full required build in your worktree. Read the
+complete output and report its real result. Do not hide failures with a pipe. State
+only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
+tool may use a blocked credential and fail by design.
+
+Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
+`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
+own pull request against `main`. Never merge.
+
+Your handoff must name the pull request or why it was not created, the branch, the
+files changed, the build result, and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/reviewer.md

@@ -0,0 +1,34 @@
+---
+name: reviewer
+description: Review one assigned scope and report the most important real issue.
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You review the diff you were given. Report bugs, risks, and missing tests. You do
+not change code.
+
+Read the whole assigned scope before judging it. Review only that scope. If you see
+something outside it, note it in one line and do not investigate it further. Do not
+run the build. The owner makes changes and runs checks.
+
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
+unclear requirement or two defensible fixes. Do not ask about something you can
+decide by reading more code.
+
+Report the single most important real issue in this form:
+
+```
+1. <path>:<line>
+2. issue: <one sentence: what is wrong and why it matters>
+3. fix: <one line: the concrete change>
+4. severity: high | medium | low
+```
+
+If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
+is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
+or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
+risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
+with no current failure.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/skills/implementer/SKILL.md

@@ -5,7 +5,7 @@ description: Implementer-role procedure for a bridged worker — verify your wor
 
 # Implementer worker — procedure
 
-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge, never commit `.mcp.json` or `wiki/`) is in **`CLAUDE.md` → Bridge communication →
 Worker** and already applies. This skill is only the *implement-and-hand-off procedure*.
 
@@ -85,7 +85,7 @@ host (`GITEA_HOST`) into your env for exactly this — the token can create a PR
 merge**.
 
 ```bash
-API="${GITEA_HOST%/}/api/v1/repos/lms/claude-bridge/pulls"
+API="${GITEA_HOST%/}/api/v1/repos/fleet/fleetd/pulls"
 BRANCH="$(git branch --show-current)"
 curl -sS -X POST "$API" \
   -H "Authorization: token ${GITEA_TOKEN}" \
@@ -103,7 +103,7 @@ fix it if the cause is yours (e.g. branch not pushed yet), and report the failur
 inventing a URL. If `GITEA_TOKEN` is unset your profile was not granted PR-create: push the branch
 and report its name so the lead opens the PR.
 
-## 6. Hand off — what goes in `bridge_reply`
+## 6. Hand off — what goes in `fleet_reply`
 
 The reply is the entire handoff; the lead cannot see your terminal.
 
@@ -130,7 +130,7 @@ sequenceDiagram
     I->>G: git push -u origin HEAD
     I->>G: POST /pulls (GITEA_TOKEN) — open PR to main
     G-->>I: html_url
-    I->>L: bridge_reply(PR url, branch, files, tests)
+    I->>L: fleet_reply(PR url, branch, files, tests)
     Note over L,G: the lead reviews the PR and merges on green — you never merge
 ```
 

.claude/skills/port-to-opencode/SKILL.md

@@ -53,7 +53,7 @@ Map each entry from `.mcp.json`:
   "$schema": "https://opencode.ai/config.json",
   "instructions": ["CLAUDE.md"],
   "mcp": {
-    "bridged":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
+    "fleetd":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
     "context7": { "type": "remote", "url": "https://example.dev/mcp", "enabled": true,
                   "headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" } },
     "gitea":    { "type": "local", "command": ["gitea-mcp", "-t", "stdio"], "enabled": true,

.claude/skills/reviewer/SKILL.md

@@ -5,7 +5,7 @@ description: Reviewer-role procedure for a bridged worker — how to work a revi
 
 # Reviewer worker — procedure
 
-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies. This
 skill is only the *review procedure*: how to work the scope, and the exact shape of what you
 send back.
@@ -24,13 +24,13 @@ wrong.
   covers what it was given.
 - Do **not** edit files or run the build. You review; the owner acts.
 
-## 3. Reach for `bridge_ask` only for a genuine fork
+## 3. Reach for `fleet_ask` only for a genuine fork
 
 Ambiguous requirement, a missing acceptance criterion, "intended or a bug?", or two defensible
 fixes with different consequences — those are the lead's call, and guessing produces a
 confident-but-wrong finding. Anything you could settle by reading more code is yours to settle.
 
-## 4. The finding — what goes in `bridge_reply`
+## 4. The finding — what goes in `fleet_reply`
 
 Report the **single most important** real issue in the scope, in these four lines, under
 ~90 words:

.gitea/workflows/ci.yml

@@ -69,8 +69,6 @@ jobs:
         env:
           RABBITMQ_DEFAULT_USER: guest
           RABBITMQ_DEFAULT_PASS: guest
-        ports:
-          - 5672:5672
     env:
       # Service containers are reachable from the job by their network alias on their internal port.
       AMQP_URI: amqp://guest:guest@rabbitmq:5672

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "wiki"]
 	path = wiki
-	url = ssh://git@git.ltms.dev:2224/lms/claude-bridge.wiki.git
+	url = ssh://git@git.ltms.dev:2224/fleet/fleetd.wiki.git

.opencode/agent/architect.md

@@ -0,0 +1,24 @@
+---
+description: Refine work into clear, independent units before implementation.
+mode: primary
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You are an architect in this fleet. You refine work before anyone builds it: scope,
+acceptance criteria, risks, and a unit split. You read the repo and write analysis.
+You never commit production code and never open a pull request.
+
+A design task is worked by two architects. Design alone first, then exchange and
+say plainly where you disagree. Do not concede just to agree.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Report only work you actually did and the real output of checks you ran. Do not
+claim a result from a tool you could not use. The primary's IDE tools are not yours.
+A mounted forge tool may use a blocked credential and fail by design.
+
+The launcher provides the required bridge reply instructions for every member.

.opencode/agent/dev.md

@@ -0,0 +1,29 @@
+---
+description: Implement one assigned unit, test it, and open a pull request.
+mode: primary
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You implement the one unit you were given and nothing else. Work in your assigned
+git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
+the worktree root and branch before you edit. Use only paths under that root.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Implement the change and run the full required build in your worktree. Read the
+complete output and report its real result. Do not hide failures with a pipe. State
+only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
+tool may use a blocked credential and fail by design.
+
+Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
+`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
+own pull request against `main`. Never merge.
+
+Your handoff must name the pull request or why it was not created, the branch, the
+files changed, the build result, and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.opencode/agent/reviewer.md

@@ -0,0 +1,34 @@
+---
+description: Review one assigned scope and report the most important real issue.
+mode: primary
+---
+
+<!-- CB-617: The model comes from bridged.yaml because the launch flag overrides model here on both backends. -->
+
+You review the diff you were given. Report bugs, risks, and missing tests. You do
+not change code.
+
+Read the whole assigned scope before judging it. Review only that scope. If you see
+something outside it, note it in one line and do not investigate it further. Do not
+run the build. The owner makes changes and runs checks.
+
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
+unclear requirement or two defensible fixes. Do not ask about something you can
+decide by reading more code.
+
+Report the single most important real issue in this form:
+
+```
+1. <path>:<line>
+2. issue: <one sentence: what is wrong and why it matters>
+3. fix: <one line: the concrete change>
+4. severity: high | medium | low
+```
+
+If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
+is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
+or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
+risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
+with no current failure.
+
+The launcher provides the required bridge reply instructions for every member.

CLAUDE.md

@@ -4,35 +4,35 @@
 
 > **Canonical block.** Everything down to §Layering is the portable bridge charter, copied verbatim
 > into every project that mounts the bridge MCP. Keep it byte-identical with the template in the
-> wiki ([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable
+> wiki ([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable
 > CLAUDE.md block*); improvements go to the template first, then out to each project. Anything
 > specific to *this* repo lives under §Project addendum below, never inline above it.
 
-If no `bridge_*` MCP tools are mounted in this session, this section does not apply — skip it.
+If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.
 
 `bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
 **primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
-through its `bridge_*` tools. No session addresses a peer, a broker, or the network directly.
+through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.
 
 ### Which role am I? — settle this before acting
 
 **Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.
 
-**Call `bridge_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
+**Call `fleet_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
 your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
 carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
 was bound to. Don't infer what you can ask.
 
 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
-fires: the reply charter in your system prompt (*"You are an off-subscription worker in the
-claude-bridge fleet"*) ⇒ **spawned member**; bridge tools prefixed `mcp__bridge__*` ⇒ **spawned
+fires: the reply charter in your system prompt (*"You are a spawned member in the
+claude-bridge fleet"*) ⇒ **spawned member**; fleet tools prefixed `mcp__fleet__*` ⇒ **spawned
 member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
-`.mcp.json`, so it varies); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
+`.mcp.json`, so it varies — and a member spawned before CB-632 still says `mcp__bridge__*`); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
 on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
-only `bridge_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+only `fleet_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
 two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
-loud and self-correcting — while a member acting as the primary ends its turn with no `bridge_reply`,
+loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
 and the sender silently receives nothing. Fail toward the recoverable error.
 
 ### Invariants — both roles, no exceptions
@@ -41,7 +41,7 @@ and the sender silently receives nothing. Fail toward the recoverable error.
    stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
    never move a session across that boundary.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
-   side cannot see your screen. An answer that isn't in a `bridge_*` call is silently discarded.
+   side cannot see your screen. An answer that isn't in a `fleet_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
    cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
    reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
@@ -57,10 +57,10 @@ and the sender silently receives nothing. Fail toward the recoverable error.
 
 **Delegate by default — that is the job.** With the bridge mounted you are an orchestrator on a
 metered subscription, and workers are cheap, parallel, and disposable. The default answer to "who
-does this?" is **a worker**, not you. Reach for `bridge_send` before you reach for `Edit`. The steps
+does this?" is **a worker**, not you. Reach for `fleet_send` before you reach for `Edit`. The steps
 below are the procedure — run them in order, every task, not only the big ones.
 
-0. **Know your role** — `bridge_whoami`, once per session, before anything else.
+0. **Know your role** — `fleet_whoami`, once per session, before anything else.
 1. **Split.** Write the unit list. Every unit carries: scope · the files or PR in question ·
    acceptance criteria · exactly what to report back. A unit with no acceptance criteria is not
    ready to delegate — refine it or keep it.
@@ -70,17 +70,17 @@ below are the procedure — run them in order, every task, not only the big ones
    delegate. The keep-list is closed: the conversation with the user, decomposition and planning,
    the final judgment call, verification, merges, and anything that depends on context only you
    hold. Nothing else is yours by default.
-3. **Spawn every delegated unit first** — `bridge_spawn{profile, worktree:true, ticket}`, one per
+3. **Spawn every delegated unit first** — `fleet_spawn{profile, worktree:true, ticket}`, one per
    unit, *before* sending any. Pass `profile` explicitly: profiles differ in model and cost, not in
    tier, so the default is rarely what you want.
-4. **Then send them all** — `bridge_send{sessionId, content, wait:false}`. Line 1 of every brief is
+4. **Then send them all** — `fleet_send{sessionId, content, wait:false}`. Line 1 of every brief is
    `Load the <name> skill.` naming the worker's playbook; those skills are opt-in and that line is
    what makes them reliable. Where the project ships no such skill, spell the procedure out in the
    brief instead. The brief is self-contained — the worker sees your message and the repo, nothing
    of your context, your plan, or your screen.
-5. **Collect** — `bridge_poll{ticket}` → `bridge_ack{target, msgId}`. Answer a worker's `bridge_ask`
-   with `bridge_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
-   `bridge_status`, never by reading its terminal; it also reports an open question and the `turnId`
+5. **Collect** — `fleet_poll{ticket}` → `fleet_ack{target, msgId}`. Answer a worker's `fleet_ask`
+   with `fleet_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
+   `fleet_status`, never by reading its terminal; it also reports an open question and the `turnId`
    that answers it. **A worker's ask waits ~55 seconds, and no nudge makes that longer** — so never
    brief a worker to "ask me". Decide before you delegate, or give it an explicit default.
 6. **Verify yourself.** Re-run the build and the checks. A worker cannot run your IDE tooling, any
@@ -93,11 +93,11 @@ below are the procedure — run them in order, every task, not only the big ones
    read it yourself.
 8. **Adjudicate, merge, tear down — yours alone.** Read the diff yourself: fully if it is small,
    targeted at the reported findings and the risky paths if it is large. Reviewer findings direct
-   your attention; they never substitute for it. Then merge, then `bridge_stop{paneId}`.
+   your attention; they never substitute for it. Then merge, then `fleet_stop{paneId}`.
 
 **Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
 silently becomes serial, and it is the most common way this layer is wasted. For the same reason,
-prefer `wait:false` + `bridge_poll` for anything non-trivial: a blocking `bridge_send` is capped by
+prefer `wait:false` + `fleet_poll` for anything non-trivial: a blocking `fleet_send` is capped by
 *your own* MCP client call timeout (~60s), well below the task's real runtime.
 
 **Delegating does not delegate responsibility.** Workers open PRs; you are the gate. Never delegate
@@ -105,21 +105,21 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 
 | Intent | Tool |
 |---|---|
-| Confirm your own role | `bridge_whoami` |
-| See backends available | `bridge_profiles` |
-| Start a member | `bridge_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
-| See the fleet | `bridge_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `bridge_status{sessionId}` |
-| Delegate (blocking) | `bridge_send{sessionId, content}` |
-| Delegate (long task) | `bridge_send{sessionId, content, wait:false}` → ticket → `bridge_poll{ticket}` |
-| Answer a member's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
-| Message a **peer lead** | `bridge_send{sessionId: <their terminal>, content}` — `bridge_list` → `leads` reports it. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `bridge_reply{content}` — the one case a lead replies |
-| Collect a held reply | `bridge_poll{target}` · then `bridge_ack{target, msgId}` |
-| Tear down a member | `bridge_stop{paneId}` |
+| Confirm your own role | `fleet_whoami` |
+| See backends available | `fleet_profiles` |
+| Start a member | `fleet_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
+| See the fleet | `fleet_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `fleet_status{sessionId}` |
+| Delegate (blocking) | `fleet_send{sessionId, content}` |
+| Delegate (long task) | `fleet_send{sessionId, content, wait:false}` → ticket → `fleet_poll{ticket}` |
+| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
+| Message a **peer lead** | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
+| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
+| Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
+| Tear down a member | `fleet_stop{paneId}` |
 
 ### Lead ↔ lead — coordinate, never delegate
 
-`bridge_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
+`fleet_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
 is a peer — an orchestrator with its own context, its own members, and its own judgment. An empty
 `members` array means no members are spawned; it says nothing about peers.
 
@@ -140,7 +140,7 @@ The traffic between leads is coordination and nothing else:
    against the code, and re-run the build. A peer's correction gets the same treatment — right or
    wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
 
-Being messaged by a peer does not make you its worker: answer with `bridge_reply`, and push back on
+Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
 the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
 you.
 
@@ -148,11 +148,11 @@ you.
 
 1. **Load the playbook skill the lead named** before doing anything else.
 2. **Do the assigned scope only.** Note anything you spot outside it in one line; don't go hunt it.
-3. **`bridge_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
+3. **`fleet_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
    defensible fixes, "bug or intended?"). It blocks and you resume the *same* turn with the answer.
    Don't ask what you could decide yourself.
-4. **End the turn with exactly one `bridge_reply{content}`**, carrying your complete answer. This is
-   the whole handoff. No `bridge_reply` ⇒ the sender gets nothing and the exchange stalls.
+4. **End the turn with exactly one `fleet_reply{content}`**, carrying your complete answer. This is
+   the whole handoff. No `fleet_reply` ⇒ the sender gets nothing and the exchange stalls.
    Do **not** lean on the completion fallback to carry your answer for you: when you end a turn
    without replying, the bridge scrapes your pane, and it can return only the last 4000 characters.
    A clipped scrape is marked as partial, but the missing text is gone — your report reaches the
@@ -171,19 +171,21 @@ you.
 
 | Layer | Scope | Reaches |
 |---|---|---|
-| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `bridge_reply`* | every spawned member, at launch, every peer kind — never a lead |
+| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `fleet_reply`* | every spawned member, at launch, every peer kind — never a lead |
 | **this section** | protocol + orchestration policy | primary **and** every member that reads the repo — tracked in git, so worktrees inherit it |
+| role agent definition files | role contract and per-job procedure | a member whose launcher binds its role to the matching file in its worktree |
 | role playbook skills | per-job procedure (commit/PR recipe, finding format) | a member told to load one |
 | the bridge's own docs | design detail, flows, error model | on demand |
 
-A rule belongs in **exactly one** layer — the outermost one that must obey it. Peers that don't read
-`CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they* must obey belongs in the
-charter, not here.
+A rule belongs in **exactly one** layer — the outermost one that must obey it. A member without a
+repo checkout still gets the launcher's reply charter, which is why that one rule stays there.
+Peers that don't read `CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they*
+must obey belongs in the charter, not here.
 
 ## Project addendum — claude-bridge (not part of the canonical block)
 
 - **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
-  and the code behind the rules above is `mcp/BridgeMcp` (tools), `auth/Authz` (the role table),
+  and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
   `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
 - **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
   `reviewer` (scoped review → one structured finding). Name one in every delegation.
@@ -191,7 +193,7 @@ charter, not here.
   `port-to-opencode` (make an OpenCode session a participant in this workspace).
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
   (a submodule with its own remote).
-- **Flows and the error model** — rendezvous, `bridge_ask`, detached delivery, turn-done fallback —
+- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, turn-done fallback —
   are diagrammed in `docs/MCP-Contract.md` **§6 only**. The rest of that page is a pre-build design
   doc whose tool names, parameter names and REST paths never caught up with the code, so do not use
   it as the tool reference (CB-609). Section 6 is kept out of this file because this file loads into
@@ -229,13 +231,13 @@ if the script is unavailable or a step fails, this is what it was protecting you
    daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
    logs this at startup — the script's `--check` is the only thing that reports it, and it checks
    whether the name resolves without ever printing the value.
-2. **Drain live members first.** `bridge_list`, then `bridge_stop` each member, and collect anything
-   you still want with `bridge_poll` before you kill anything. A restart drops in-flight tickets and
+2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
+   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
    rendezvous, and a member's report is not recoverable once its ticket is gone.
 3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
    it. The startup log names which keys it accepted and which it deferred — read those lines rather
    than assuming.
-4. **Re-check identity afterwards.** Call `bridge_whoami` and confirm it still answers `primary`. The
+4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
    lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
    demoted to worker, which refuses every orchestration call.
 5. **Prove the new jar is the one running.** Confirm a *fresh* `bridged listening` line at the end of
@@ -266,10 +268,10 @@ Before you call any work done, check the row that matches what you touched:
 
 | You changed… | Re-read and update… |
 |---|---|
-| a `bridge_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
+| a `fleet_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
 | `Authz` / the role table | invariant 3, and the primary-only vs worker-only claims |
-| `ConnectionIdentity` / how a caller is resolved | the `bridge_whoami` paragraph and the fallback ladder |
-| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__bridge__*`), and the layering table's top row |
+| `ConnectionIdentity` / how a caller is resolved | the `fleet_whoami` paragraph and the fallback ladder |
+| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__fleet__*`), and the layering table's top row |
 | the injector / status gating | invariant 4 |
 | worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
 | `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
@@ -285,7 +287,7 @@ is a Roadmap line. A change that touches none of the three earns no entry, and t
 outcome rather than an omission.
 
 Then **propagate**: the block in this file and the template in the wiki
-([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
+([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
 block*) must stay byte-identical, and other projects carrying the block need the same edit. Verify
 rather than trust:
 

README.md

@@ -9,23 +9,23 @@ Sibling of [`crush-bridge`](https://git.ltms.dev/systems/vms) (which drives a he
 process*, so it inherits `CLAUDE.md`, hooks, skills, and MCP — just pointed at a
 cheaper/local model.
 
-## Leading approach — herdr-centric message server (`bridged`)
+## Leading approach — herdr-centric message server (`fleetd`)
 
-A small always-on message server, **`bridged`**, controls
+A small always-on message server, **`fleetd`**, controls
 [herdr](https://herdr.dev) (an agent multiplexer) over its Unix-socket API and exposes a
 clean 2-way messaging API as an **MCP server that both the primary and the workers mount** —
 one unified Claude setup and the **sole communication gateway** (REST/SSE stays for non-Claude
-clients; any broker is `bridged`-internal, below the gateway).
-herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `bridged` owns
+clients; any broker is `fleetd`-internal, below the gateway).
+herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `fleetd` owns
 policy (subscription boundary, session lifecycle, status-gated delivery) and the client
 contract. A Claude member launches with `ANTHROPIC_BASE_URL` pointed at the gateway,
 `https://llm.ltms.dev/anthropic`, plus a bearer token; the lead stays env-clean and calls
-`bridged`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.
+`fleetd`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.
 
 ```mermaid
 flowchart LR
     OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["bridged — standalone daemon (not a claude process)"]
+    subgraph BD["fleetd — standalone daemon (not a claude process)"]
         SRV["SERVER face<br/>MCP · REST/SSE · policy"]
         CLI["CLIENT face<br/>status-gated injector · herdr socket"]
         SRV --> CLI
@@ -34,8 +34,8 @@ flowchart LR
     W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
     M["llm.ltms.dev<br/>(the one gateway)"]
 
-    OPUS -->|"MCP bridge_send (blocks)"| SRV
-    W -.->|"MCP bridge_reply"| SRV
+    OPUS -->|"MCP fleet_send (blocks)"| SRV
+    W -.->|"MCP fleet_reply"| SRV
     CLI -->|"Unix socket<br/>send_text · events.subscribe"| HERDR
     HERDR -->|"drives PTY"| W
     W -->|"inference"| M
@@ -47,24 +47,27 @@ flowchart LR
 ```
 
 - **Subscription boundary:** the *primary* never sets `ANTHROPIC_BASE_URL` (stays on
-  Pro/Max). Only the *secondary* process is off-subscription — and `bridged` itself is a
+  Pro/Max). Only the *secondary* process is off-subscription — and `fleetd` itself is a
   plain daemon (no Anthropic quota), so it may poll/subscribe freely.
-- **One gateway (unified MCP setup):** `bridged` is the **sole communication path** for every
+- **One gateway (unified MCP setup):** `fleetd` is the **sole communication path** for every
   Claude session. Primary and workers each mount it as an MCP server (one `claude mcp add`
-  line, same on both) and talk over MCP tools — `bridge_send` / `bridge_reply` /
-  `bridge_status` (with `bridge_ask` planned for the blocked-worker path). **No Claude session
-  ever addresses a broker, a peer, or the network
-  directly**; any queue is `bridged`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
-  mounting the bridge is subscription-safe by construction.
-- **How the primary consumes a reply:** a single **blocking MCP call** (`bridge_send`);
-  `bridged` holds it open until the worker calls `bridge_reply` or its turn hits
+   line, same on both) and talk over MCP tools — `fleet_send` / `fleet_reply` /
+   `fleet_status` (with `fleet_ask` planned for the blocked-worker path). **No Claude session
+   ever addresses a broker, a peer, or the network
+   directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
+   mounting the bridge is subscription-safe by construction.
+   **Tool naming:** the tools were renamed from `bridge_*` to `fleet_*` (CB-622). The daemon
+   still answers the old `bridge_*` names for one release, but they are deprecated — use the
+   `fleet_*` names.
+- **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
+  `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
   `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so
   no quota burn. SSE is an optional side-channel for humans/dashboards watching status.
-- **Worker → primary** rides `bridged`'s **MCP rendezvous** — the reply resolves the primary's
-  blocking call (or, for detached work, `bridged` **injects the primary's idle pane** when it's
+- **Worker → primary** rides `fleetd`'s **MCP rendezvous** — the reply resolves the primary's
+  blocking call (or, for detached work, `fleetd` **injects the primary's idle pane** when it's
   ready), so *no keystroke-into-primary and no broker are involved, even single-host*. The one
   exception: a split-host primary that isn't a herdr pane wakes via its own `Stop`-hook, which
-  polls **`bridged`** (never a broker). See the wiki for the two topologies.
+  polls **`fleetd`** (never a broker). See the wiki for the two topologies.
 - **Different model per process** sidesteps Claude Code's lack of per-subagent provider
   routing — the worker isn't a subagent, it's its own configured process.
 - **AgentAPI** ([`coder/agentapi`](https://github.com/coder/agentapi)) is retained only as a
@@ -73,11 +76,11 @@ flowchart LR
 
 ## Docs
 
-Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/lms/claude-bridge/wiki)**,
+Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/fleet/fleetd/wiki)**,
 vendored here as a submodule under [`wiki/`](./wiki):
 
 ```bash
-git clone --recurse-submodules ssh://git@git.ltms.dev:2224/lms/claude-bridge.git
+git clone --recurse-submodules ssh://git@git.ltms.dev:2224/fleet/fleetd.git
 # or, after a plain clone:
 git submodule update --init
 ```
@@ -87,7 +90,7 @@ Gitea wiki.
 
 ## Status
 
-🟢 **Implemented & dogfooded** — the herdr-centric **`bridged`** message server is built and in
+🟢 **Implemented & dogfooded** — the herdr-centric **`fleetd`** message server is built and in
 real use: an Opus primary delegates tasks to off-subscription workers that reply through the
 bridge (code reviews delegated this way have produced committed bug fixes). Selected as the
 primary approach 2026-07-11, superseding the AgentAPI plan (2026-07-08); AgentAPI retained as a
@@ -98,9 +101,9 @@ tests run separately via `mvn test -Pcontract`):
 
 - **Core gateway** — herdr socket client (contract-tested vs live 0.7.0); guard-checked worker
   spawn with `ANTHROPIC_BASE_URL` injected only into the worker's env; status-gated injector;
-  blocking `bridge_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
-- **MCP tools** — `bridge_send` / `bridge_reply` / `bridge_status` (messaging) and `bridge_spawn`
-  / `bridge_list` / `bridge_stop` / `bridge_profiles` / `bridge_poll` (fleet). Caller identity is
+  blocking `fleet_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
+- **MCP tools** — `fleet_send` / `fleet_reply` / `fleet_status` (messaging) and `fleet_spawn`
+  / `fleet_list` / `fleet_stop` / `fleet_profiles` / `fleet_poll` (fleet). Caller identity is
   connection-based (loopback peer PID → herdr pane), so the same mount serves primary and workers.
 - **Delivery reliability** — completion fallback (a confirmed `working→idle` turn resolves a
   send); async fire-and-poll (beats the caller's MCP call timeout for long tasks); and failure
@@ -108,7 +111,7 @@ tests run separately via `mvn test -Pcontract`):
 - **Fleet** — multiple worker profiles, each with an independent base_url guard check; workers
   inherit the primary's working directory (never `$HOME`); a readiness gate holds delivery until
   a worker's Claude has connected the bridge MCP (no paste lost into its boot window).
-- **Blocked-worker path** — `bridge_ask` reverse rendezvous: a worker pauses its delegated turn to
+- **Blocked-worker path** — `fleet_ask` reverse rendezvous: a worker pauses its delegated turn to
   ask the primary and resumes the *same* turn with the answer (CB-205).
 - **Session lifecycle** — session manager with spawn/reuse/recycle, `idle_ttl` reaper, `context_cap`,
   and graceful drain on shutdown (CB-301/CB-303); per-worker git worktrees on their own branch with

bridged/.gitignore

@@ -2,7 +2,9 @@
 target/
 dependency-reduced-pom.xml
 
-# Local runtime config (copy from bridged.example.yaml)
+# Local runtime config (copy from fleetd.example.yaml). Both names: the live file is still
+# bridged.yaml until the cutover, and Fleetd reads either one.
+fleetd.yaml
 bridged.yaml
 
 # CB-505 audit trail + daemon stdout/stderr — runtime records, never source

bridged/docs/CB-307-Push-Loop.md

@@ -5,10 +5,10 @@
 
 ## Why this exists
 
-Stage 2 gave a worker→primary reply a **durable place to wait** when no `bridge_send` is
+Stage 2 gave a worker→primary reply a **durable place to wait** when no `fleet_send` is
 open: it lands in `agent.<target>.inbox` on the broker and survives a daemon bounce. But
 delivery is still **pull** — the primary only sees the reply if it happens to call
-`bridge_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
+`fleet_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
 the primary works on something else.
 
 This layer makes delivery **active**: the bridge *pushes* a nudge to the primary the moment
@@ -26,11 +26,11 @@ pointed at the primary's pane instead.
 
 ```mermaid
 flowchart LR
-    W["worker"] -->|"bridge_reply (no open send)"| MS["MessageService.reply"]
+    W["worker"] -->|"fleet_reply (no open send)"| MS["MessageService.reply"]
     MS -->|"inbox.publish"| INBOX[("agent.&lt;target&gt;.inbox<br/>(durable, LavinMQ)")]
     MS -->|"notify"| LOOP["ReplyPushLoop"]
     LOOP -->|"status-gated inject"| PANE["primary's herdr pane"]
-    PANE -->|"primary drains"| DRAIN["bridge_poll(target)<br/>= peek + ack"]
+    PANE -->|"primary drains"| DRAIN["fleet_poll(target)<br/>= peek + ack"]
     DRAIN -->|"inbox now empty"| LOOP
     LOOP -.->|"still non-empty →<br/>re-inject on backoff"| PANE
     classDef store fill:#2c5282,stroke:#1a365d,color:#ffffff;
@@ -51,13 +51,13 @@ the caller runs in a herdr pane on this host. Today it's discarded for the prima
 (`presence.markPresent` is a no-op on it).
 
 **Plan:** a single-slot `PrimaryRegistry` (thread-safe) holding the primary's `terminal_id`.
-Populate it from the **orchestration-side** MCP tools — `bridge_send`, `bridge_spawn`,
-`bridge_poll`, `bridge_list`, `bridge_status`, `bridge_profiles` — capturing
+Populate it from the **orchestration-side** MCP tools — `fleet_send`, `fleet_spawn`,
+`fleet_poll`, `fleet_list`, `fleet_status`, `fleet_profiles` — capturing
 `callerTerminal(exchange)` when it is (a) non-null and (b) **not** a registered worker
 session in `SessionManager`. That caller is, by construction, the primary. Worker-side tools
-(`bridge_reply`, `bridge_ask`) never set it.
+(`fleet_reply`, `fleet_ask`) never set it.
 
-- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `BridgedConfig`
+- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `FleetConfig`
   (nested record, same shape as `Broker`). Lets an operator pin it, or supply it when
   derivation can't (see degrade case).
 - **Degrade:** if the primary is off-host or in a non-herdr terminal, `terminalForPid`
@@ -71,13 +71,13 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
 (`MessageService.reply` → the `inbox.publish` branch, `MessageService.java:192`).
 
 - **Inject a nudge, not the payload.** The injected turn tells the primary *to drain*
-  (e.g. "Worker `<target>` returned a reply — run `bridge_poll(target=<target>)` to collect
+  (e.g. "Worker `<target>` returned a reply — run `fleet_poll(target=<target>)` to collect
   it"), it does **not** carry the reply text. Rationale: replies can be large/multiline and
   terminal injection would mangle them; the drain response is the clean transport. Keeps the
   push idempotent — re-nudging is harmless.
 - **Ack = drain.** The primary draining (`drainReplies` = peek + ack) is the acknowledgement.
   The loop's **stop condition is `inbox.peek(target).isEmpty()`** — the reply is gone from the
-  inbox because it was acked. No new `bridge_ack` tool needed for v1 (see Increment 3).
+  inbox because it was acked. No new `fleet_ack` tool needed for v1 (see Increment 3).
 - **Status-gated injection (mechanism (b), chosen).** A dedicated lightweight scheduled loop,
   **not** the worker `Injector`. It injects via `AgentControl.send(primaryTerminal, nudge)`
   (the same herdr `agent.send` = `pane send-text` + submit that delivers to workers) only when
@@ -93,10 +93,10 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
   the reply remains in the durable inbox and the next natural poll (or a later worker reply's
   nudge) still surfaces it. Bounded so the bridge never spams the primary.
 
-### Increment 3 — optional per-`msgId` `bridge_ack` tool (deferred)
+### Increment 3 — optional per-`msgId` `fleet_ack` tool (deferred)
 
 Drain-as-ack is coarse: it clears *all* pending replies for a target at once. If finer
-control is ever needed (ack one reply, leave others held), add a `bridge_ack(msgId)` tool
+control is ever needed (ack one reply, leave others held), add a `fleet_ack(msgId)` tool
 mapping to `inbox.ack(target, msgId)` — the port already supports per-`msgId` ack. Not built
 in v1; the stop-on-empty loop is sufficient.
 
@@ -106,7 +106,7 @@ in v1; the stop-on-empty loop is sufficient.
    resolved terminal is non-null **and not a registered worker session**, seen on an
    orchestration-side tool. This never mislabels a worker (workers are in `SessionManager`)
    and needs no new env var or argument (identity stays connection-derived, per the existing
-   `BridgeMcp` invariant).
+   `FleetMcp` invariant).
 
 2. **Readiness-gate mismatch → dedicated loop.** The existing `Injector` gates delivery on
    `ready.test(target)` = `WorkerPresence` (the *worker's* MCP connected). The primary is not
@@ -132,7 +132,7 @@ boundary**. The bridge is signalling the primary that it has mail — not drivin
   non-null terminal AND not a registered session" predicate; the loop's stop-on-empty and
   bounded-reminder logic with an injected clock + a fake injector (no real herdr).
 - **Live dogfood (primary-side):** with the daemon on the broker jar + a real worker,
-  delegate a task, let the worker reply after the `bridge_send` window closes, and observe the
+  delegate a task, let the worker reply after the `fleet_send` window closes, and observe the
   bridge inject a drain nudge into *this* primary pane; confirm draining stops the reminders;
   confirm an unreachable primary (registry empty) degrades to pull with no loss.
 

bridged/fleetd.example.yaml

@@ -35,7 +35,7 @@ bind:
 # a caller whose connection maps to this pane resolves as the primary (no credential needed —
 # the pane mapping is as unforgeable as a worker's), and reply nudges are pushed to it.
 # REQUIRED when the primary runs inside a herdr pane — without it the pane match reads the
-# primary as a worker and refuses spawn/send/stop. Get the id from bridge_whoami; re-pin if
+# primary as a worker and refuses spawn/send/stop. Get the id from fleet_whoami; re-pin if
 # the primary moves panes.
 # primary:
 #   terminal: term_0123456789abcd
@@ -49,12 +49,12 @@ bind:
 #
 #   tab → the ONLY field identity depends on (CB-579); the exact label of the tab hosting the lead.
 #         Label the tab yourself, or let bridged label one it launches — see `fleet.leaders:` below.
-#   kind/model → descriptive; they document what runs in the pane and are echoed by bridge_whoami
+#   kind/model → descriptive; they document what runs in the pane and are echoed by fleet_whoami
 #
 # A lead's tab must already carry its label (or be launched by bridged, which labels it) — there is
 # no terminal id to paste in and nothing to re-pin when the session restarts: the tab survives, so
 # the same label resolves the same lead again on the next scan.
-# `bridge_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
+# `fleet_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
 # IS a primary for authorization, so nothing that keys on the role breaks.
 #
 # KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
@@ -69,7 +69,7 @@ bind:
 # never a capability: what a pane may do is decided by the role the daemon resolves for it.
 
 # CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
-# idle (no open bridge_send driving it) past the quiet period. The fleet is one lead + architects +
+# idle (no open fleet_send driving it) past the quiet period. The fleet is one lead + architects +
 # workers, so a lead that stalls is a single point of failure; the ReplyPushLoop only nudges when a
 # reply lands, and this timer catches the gap where nothing lands and the lead just sits idle.
 #
@@ -99,7 +99,7 @@ bind:
 #                      them changes nothing right now, and no minimum is enforced on either, because
 #                      nothing reads them to enforce one. They exist so a later build can start
 #                      honouring them without another config-shape change.
-#   notifications.mode → "webhook" flips what bridge_list REPORTS (healthCoverage: "full" instead
+#   notifications.mode → "webhook" flips what fleet_list REPORTS (healthCoverage: "full" instead
 #                      of "detection-only") — it does NOT make bridged send any webhook call; no
 #                      delivery mechanism is implemented yet. Any other value, or omitting the
 #                      block, reports "detection-only".
@@ -152,7 +152,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
 #                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
 #   exhaustedPattern → regex matched against a completion-fallback scrape (CB-578 stage A) to
-#                      classify a turn that ended with no bridge_reply as the backend having
+#                      classify a turn that ended with no fleet_reply as the backend having
 #                      refused on a subscription usage limit, rather than a real answer. Opt-in —
 #                      omit and this profile's completion fallback behaves exactly as before.
 #                      Every backend words its refusal differently, so this is config, never a
@@ -179,7 +179,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
 #                      only to override that or add more (JAVA_HOME, …). Since the default is the
 #                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
-#                      lines in deploy/dev.ltms.bridged.plist and deploy/bridged.service.
+#                      lines in deploy/dev.ltms.fleet.plist and deploy/bridged.service.
 #
 #                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
 #                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
@@ -200,12 +200,12 @@ profiles:
     # weight: relative selection weight for automatic placement (weighted, round-robin, and
     # fixed's fallback walk). Absent defaults to 1.0. An explicit 0 or negative value means
     # "never auto-select this profile" (CB-554) — it stays reachable via an explicit
-    # `bridge_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
+    # `fleet_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
     # selection skips it.
     weight: 0.5
     # maxLoad: max live workers on this profile. Omit for unlimited. An explicit 0 (CB-585) caps
     # the profile at zero live members — it is excluded from automatic placement and an explicit
-    # `bridge_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
+    # `fleet_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
     # is named directly. Negative is refused at config load — there is no sane meaning for it.
     maxLoad: 2
     # subscription: true
@@ -224,7 +224,7 @@ profiles:
     #   subscription path no guard would vet the URL, so allowing both would be a way around the
     #   guard rather than a configuration.
     #
-    #   GOTCHA 1 — it is invisible to the startup secret check. `Bridged.reportRequiredSecrets`
+    #   GOTCHA 1 — it is invisible to the startup secret check. `Fleetd.reportRequiredSecrets`
     #   skips subscription profiles on purpose (they need no token), so a boot log that reports
     #   every secret as fine says nothing about these profiles.
     #
@@ -259,8 +259,8 @@ profiles:
   # The bridge MCP + reply charter mount via a generated OPENCODE_CONFIG file, and the model is a
   # `provider/model` selector. Placement, tabs, cwd, and the readiness gate are shared with Claude.
   #
-  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → bridge_send →
-  # structured bridge_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
+  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → fleet_send →
+  # structured fleet_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
   # and need NO credentials — check `opencode models` for the current free list, since the names
   # change. That also makes the worker off-subscription by construction.
   #   opencode-free:
@@ -342,7 +342,7 @@ placement: weighted
 #               / credentialId. Those are hot because the placement policy (and, for credentialId,
 #               the CB-578 stage B quarantine check) reads them through a supplier — being config is
 #               not by itself enough to make a key hot.
-#               EXCEPT `fleet.leaders`: Bridged.main reads it once at startup to build the lead tab
+#               EXCEPT `fleet.leaders`: Fleetd.main reads it once at startup to build the lead tab
 #               scanner and launcher, and neither is rebuilt on reload. A changed/added/removed
 #               `fleet.leaders` entry is silently accepted — the reload reports "config reloaded"
 #               with nothing in the deferred list — but has NO effect until you restart. Treat it
@@ -447,7 +447,7 @@ fleet:
   #                                  # MUST NOT be a member workspace — those are excluded from the
   #                                  # scan, so a lead placed in one is never found again.
   #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
-  #     kind: claude                 # descriptive; reported by bridge_whoami
+  #     kind: claude                 # descriptive; reported by fleet_whoami
   #   gpt-sol-5.6:
   #     tab: "lead: gpt-sol-5.6"
   #     kind: opencode
@@ -505,20 +505,51 @@ guard:
 # through either: the daemon logs a WARN naming any credential-shaped env var it finds on neither
 # list (never its value), so a secret added to the store later does not go unnoticed forever.
 #
-#   policy → only "deny-by-default" exists today (an operator-authored deny-list was deliberately
-#            rejected — see above). An unrecognized value refuses to start, naming it.
-#   allow  → credential names a member legitimately needs. Left OUT of the pane's env overlay
-#            entirely, so the value the pane's own (login) shell exports passes through untouched.
-#   known  → every credential name the operator's store is known to export. Every name here NOT
-#            also in `allow` is overlaid with a non-secret sentinel value before the pane's login
-#            shell runs — real protection only for names the login shell does not itself re-export
-#            (see the ROUND-2 CORRECTION note above for the ones it does).
+#   policy → "deny-by-default" (the default; also accepted spelled "deny-list") overlays each
+#            known-but-not-allowed name BEFORE the pane's login shell runs — real protection only
+#            where that shell does not re-export the name (see ROUND-2 CORRECTION above). An
+#            unrecognized value refuses to start, naming it.
+#   policy → "allow-list" (CB-633) moves the control to a per-spawn ZDOTDIR directory the daemon
+#            generates and passes through tab.create's env map. Each generated startup file sources
+#            its ~/ counterpart FIRST and then runs the scrub, so the scrub happens after the
+#            operator's whole chain and no sourced file can undo it.
+#            The scrub is sourced from BOTH the generated .zshrc and the generated .zlogin, because
+#            herdr does not open the same kind of shell everywhere: macOS panes run a LOGIN zsh (so
+#            .zlogin runs), Linux panes run a plain interactive zsh (so .zlogin never runs at all).
+#            A scrub in .zlogin alone would be a control that silently does nothing on Linux.
+#            The allow-list is DERIVED, never typed:
+#            every profile's tokenEnv/gitTokenEnv/gitHostEnv values and env-map keys, plus an
+#            infrastructure set (PATH HOME SHELL TERM LANG LC_* TMPDIR USER LOGNAME PWD SHLVL EDITOR
+#            PAGER JAVA_HOME XDG_* ZDOTDIR), plus whatever keys this spawn's own env overlay carries.
+#            Adding a profile can therefore only widen the list, never break another spawn's scrub.
+#            Under this policy `known`/`allow` below become REPORTING ONLY — they feed the gap WARN,
+#            they are no longer a control. If the member's login shell is NOT zsh, the daemon logs a
+#            loud WARN saying protection is off and falls back to deny-by-default's overlay.
+#            Each pane writes a scrub-report.txt naming how many variables it kept of how many it
+#            saw; the daemon logs that "allowed N of M" line when the pane stops. If the report is
+#            MISSING the daemon logs a WARN instead — the scrub cannot then be confirmed to have
+#            run, and a silently-dead control is exactly what this policy exists to prevent.
+#   allow  → credential names a member legitimately needs. Under deny-by-default, left OUT of the
+#            pane's env overlay entirely, so the value the pane's own (login) shell exports passes
+#            through untouched. Under allow-list: reporting only.
+#   known  → every credential name the operator's store is known to export. Under deny-by-default,
+#            every name here NOT also in `allow` is overlaid with a non-secret sentinel value before
+#            the pane's login shell runs — real protection only for names that shell does not itself
+#            re-export (see the ROUND-2 CORRECTION note above). Under allow-list: reporting only.
+#   sshAuthSock → whether SSH_AUTH_SOCK may pass through under allow-list ("allow") or must be
+#            blanked like any other non-derived name ("block", the default). This is a decision you
+#            have to make explicitly: SSH_AUTH_SOCK is a handle to YOUR ssh-agent, and a member
+#            holding it can sign with your keys — it sits in no secret file and looks like no
+#            credential, which is why it slipped past three earlier tickets (gitea #110). Blocking
+#            it breaks git over SSH inside members (push/fetch authenticate as you); use HTTPS
+#            remotes or scoped deploy keys instead of allowing it lightly.
 #
 # HOT-RELOADABLE the same way `fleet:` is (CB-559): read fresh on every spawn, so editing this list
 # and reloading config (or restarting) changes what the NEXT spawn inherits; already-running members
 # are unaffected either way.
 # memberCredentials:
-#   policy: deny-by-default
+#   policy: deny-by-default        # or "deny-list", or "allow-list" (CB-633) — see above
+#   sshAuthSock: block             # allow-list only; see the sshAuthSock note above
 #   allow:
 #     - AI_GATEWAY_TOKEN     # named in a profile's tokenEnv (local/gx) — a member reaching the
 #                            # gateway is by design, not a leak
@@ -593,14 +624,19 @@ guard:
 # RabbitMQ speaks the same AMQP 0-9-1, so it is a URI-only swap.
 #   uri      → AMQP connection URI. No trailing slash ⇒ the default vhost "/"; an empty path ("/")
 #              is vhost "" and will NOT connect. Encode a named vhost as .../%2Fmyvhost.
+#   uriEnv   → CB-151: name of a host env var holding the AMQP URI, preferred over `uri` (wins
+#              whenever set). The URI carries `user:pass@` inline, so naming a variable keeps the
+#              password out of fleetd.yaml — same pattern as auth.tokenEnv/Profile.tokenEnv. A
+#              uriEnv that resolves to an unset or blank variable is treated as NOT configured and
+#              the daemon falls back to the in-memory inbox, warning loudly.
 #   prefetch → CB-527: consumer basicQos, capping how many unacked messages the inbox holds
 #              in-heap per owned target (the rest sits on the broker's durable queue instead of
 #              growing the JVM heap). Default 32 when omitted.
 # broker:
-#   uri: amqp://guest:guest@127.0.0.1:5672
+#   uriEnv: LAVINMQ_URI
 #   prefetch: 32
 
-# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open bridge_send,
+# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open fleet_send,
 # the ReplyPushLoop injects a *drain nudge* (never the payload) into the primary's own herdr
 # pane — status-gated (only when injectable, never mid-turn) and bounded. Ack = drain: the loop
 # stops as soon as the primary's inbox is empty.
@@ -615,7 +651,7 @@ guard:
 #                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
 #                    self-locking: the learned terminal is populated by the very orchestration
 #                    calls being refused, so only this pinned value can break the cycle. Read the
-#                    id off bridge_whoami (it reports the current terminal even while
+#                    id off fleet_whoami (it reports the current terminal even while
 #                    misclassified) and re-pin whenever the primary moves panes.
 #   pushReminders  → max nudges before giving up (default 5)
 #   pushBackoffMs  → delay between nudges in ms (default 15000)

bridged/pom.xml

@@ -5,17 +5,17 @@
     <modelVersion>4.0.0</modelVersion>
 
     <groupId>dev.ltms</groupId>
-    <artifactId>bridged</artifactId>
+    <artifactId>fleetd</artifactId>
     <version>1.0.0</version>
     <packaging>jar</packaging>
 
-    <name>bridged</name>
-    <description>claude-bridge message server: sole gateway between primary/worker Claude sessions and herdr</description>
+    <name>fleetd</name>
+    <description>fleet message server: sole gateway between a lead session, its members, and herdr</description>
 
     <properties>
         <maven.compiler.release>25</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <mainClass>dev.ltms.bridged.Bridged</mainClass>
+        <mainClass>dev.ltms.fleet.Fleetd</mainClass>
 
         <jackson.version>2.19.0</jackson.version>
         <javalin.version>6.7.0</javalin.version>
@@ -161,6 +161,9 @@
     </dependencies>
 
     <build>
+        <!-- CB-632: stays 'bridged' until the cutover renames the module dir and the launchd
+         plist together. The installed plist names bridged/target/bridged.jar and
+         KeepAlive is armed, so renaming the jar alone strands a restart. -->
         <finalName>bridged</finalName>
         <plugins>
             <plugin>

bridged/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -1,56 +1,57 @@
-package dev.ltms.bridged;
+package dev.ltms.fleet;
 
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.config.ConfigRef;
-import dev.ltms.bridged.config.ConfigWatcher;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.LeadTabScanner;
-import dev.ltms.bridged.lead.LeadLauncher;
-import dev.ltms.bridged.herdr.PaneLocator;
-import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.ExhaustedPatternLookup;
-import dev.ltms.bridged.inject.ExhaustionSink;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.inject.StatusPoller;
-import dev.ltms.bridged.inject.TurnListener;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.auth.MemberRegistry;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.mcp.BridgeMcp;
-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.health.FleetHealthMonitor;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.mcp.LsofPeerPidLookup;
-import dev.ltms.bridged.mcp.LsofProcessCwdLookup;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.msg.LeadHeartbeatLoop;
-import dev.ltms.bridged.msg.ReplyPushLoop;
-import dev.ltms.bridged.rest.BridgedApp;
-import dev.ltms.bridged.session.GitWorktrees;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.session.SessionReaper;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.member.CompositePeerLauncher;
-import dev.ltms.bridged.member.HerdrPeerLauncher;
-import dev.ltms.bridged.member.OpenCodeLauncher;
-import dev.ltms.bridged.placement.BackendQuarantine;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.ConfigWatcher;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.lead.LeadLauncher;
+import dev.ltms.fleet.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.UnixSocketHerdrClient;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.CompletionResolver;
+import dev.ltms.fleet.inject.ExhaustedPatternLookup;
+import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.StatusPoller;
+import dev.ltms.fleet.inject.TurnListener;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.health.FleetHealthMonitor;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.mcp.LsofPeerPidLookup;
+import dev.ltms.fleet.mcp.LsofProcessCwdLookup;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.msg.LeadHeartbeatLoop;
+import dev.ltms.fleet.msg.ReplyPushLoop;
+import dev.ltms.fleet.rest.FleetApp;
+import dev.ltms.fleet.session.GitWorktrees;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.session.SessionReaper;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.member.HerdrPeerLauncher;
+import dev.ltms.fleet.member.OpenCodeLauncher;
+import dev.ltms.fleet.placement.BackendQuarantine;
 import io.javalin.Javalin;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -72,17 +73,33 @@ import java.util.stream.Collectors;
  * starts listening. Before anything else it asserts its own environment is clean —
  * {@code bridged} is not a Claude process and must never carry a base_url.
  */
-public final class Bridged {
+public final class Fleetd {
 
-    private static final Logger log = LoggerFactory.getLogger(Bridged.class);
+    private static final Logger log = LoggerFactory.getLogger(Fleetd.class);
 
     /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
     private static final long HERDR_WAIT_SECONDS = 30;
     private static final long HERDR_WAIT_POLL_MILLIS = 500;
 
+    /**
+     * CB-632: prefer {@code fleetd.yaml} in {@code dir}; fall back to {@code bridged.yaml} when
+     * the new name is not there. The operator's live file is still named {@code bridged.yaml},
+     * so the old name keeps working until that file moves.
+     */
+    static Path chooseDefaultConfigFile(Path dir) {
+        Path fleetd = dir.resolve("fleetd.yaml");
+        if (Files.exists(fleetd)) {
+            return fleetd;
+        }
+        return dir.resolve("bridged.yaml");
+    }
+
     static void main(String[] args) {
-        Path configPath = Path.of(args.length > 0 ? args[0] : "bridged.yaml");
-        BridgedConfig cfg = BridgedConfig.load(configPath);
+        Path configPath = args.length > 0 ? Path.of(args[0]) : chooseDefaultConfigFile(Path.of(""));
+        // CB-632: the config file is being renamed bridged.yaml -> fleetd.yaml. Name the file we
+        // actually loaded, whichever of the two names it carries.
+        log.info("Using configuration file {}", configPath);
+        FleetConfig cfg = FleetConfig.load(configPath);
         // CB-594: report which secret env vars the config actually needs, by name, before anything
         // else can fail on a silently-empty one. A daemon started without a login shell (launchd)
         // boots fine either way — this is the only thing that says so out loud.
@@ -127,8 +144,8 @@ public final class Bridged {
         // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
         // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
         // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
-        Map<String, BridgedConfig.Profile> claudeProfiles = new LinkedHashMap<>();
-        Map<String, BridgedConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> claudeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
         cfg.profiles().forEach((name, w) -> {
             if (w.isOpenCode()) {
                 opencodeProfiles.put(name, w);
@@ -157,7 +174,7 @@ public final class Bridged {
         AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
         // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
         // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
-        // The cooldown is deferred (see BridgedConfig#quarantineCooldownSeconds): it is read once
+        // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
         // here, at startup, and a config reload only changes it for a daemon restart.
         BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
                 TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
@@ -227,7 +244,7 @@ public final class Bridged {
         var leaders = cfg.fleet().leaders();
         if (!leaders.isEmpty()) {
             Set<String> memberSpaces = cfg.profiles().values().stream()
-                    .map(BridgedConfig.Profile::workspace)
+                    .map(FleetConfig.Profile::workspace)
                     .filter(Objects::nonNull)
                     .collect(Collectors.toSet());
             Map<String, String> tabToName = new LinkedHashMap<>();
@@ -332,7 +349,7 @@ public final class Bridged {
             }
 
             @Override
-            public void onDelivered(String target, dev.ltms.bridged.msg.TurnToken token) {
+            public void onDelivered(String target, dev.ltms.fleet.msg.TurnToken token) {
                 completion.onDelivered(target, token);
                 sessions.onDelivered(target, token);
             }
@@ -354,18 +371,10 @@ public final class Bridged {
         StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
         poller.start();
 
-        // CB-307: reply inbox. A broker: block (with a uri) selects the AMQP-backed durable adapter;
-        // absent, bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
+        // CB-307: reply inbox. A broker: block selects the AMQP-backed durable adapter; absent (or
+        // unusable), bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
         // connection, so keep the reference to close it in the ordered shutdown hook.
-        final ReplyInbox replyInbox;
-        if (cfg.broker() != null && cfg.broker().isConfigured()) {
-            replyInbox = AmqpReplyInbox.open(cfg.broker().uri(), cfg.broker().prefetchOrDefault());
-            log.info("reply inbox: AMQP broker (durable) at {} (prefetch={})",
-                    cfg.broker().uri(), cfg.broker().prefetchOrDefault());
-        } else {
-            replyInbox = new InMemoryReplyInbox();
-            log.info("reply inbox: in-memory (soft-state)");
-        }
+        final ReplyInbox replyInbox = selectReplyInbox(cfg.broker(), System.getenv(), AmqpReplyInbox::open);
         // CB-307: learn the primary's terminal from orchestration tool calls (or pin from config).
         // The pin also feeds CallerResolver below: a primary running inside a herdr pane would
         // otherwise resolve as a worker and be refused every orchestration tool.
@@ -381,7 +390,7 @@ public final class Bridged {
                     + "has lost the delegation map. Its pushReminders/pushBackoffMs stay valid.");
         }
         // CB-307: active push-to-primary loop — nudge the primary when replies land without an
-        // open bridge_send. Uses its own lightweight scheduled executor, separate from the injector.
+        // open fleet_send. Uses its own lightweight scheduled executor, separate from the injector.
         int maxReminders = cfg.primary() != null ? cfg.primary().remindersOrDefault() : 5;
         long backoffMs = cfg.primary() != null ? cfg.primary().backoffMsOrDefault() : 15_000L;
         var pushScheduler = Executors.newSingleThreadScheduledExecutor(r ->
@@ -389,7 +398,7 @@ public final class Bridged {
         // CB-502: the registry is built before the service and the push loop so send/reply outcomes
         // are counted at their single funnel rather than at each of the two caller-facing surfaces.
         // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
-        Metrics metrics = BridgedMetrics.create(sessions, replyInbox);
+        Metrics metrics = FleetMetrics.create(sessions, replyInbox);
         var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
                 pushScheduler, maxReminders, backoffMs, metrics);
         // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
@@ -458,7 +467,7 @@ public final class Bridged {
             primaryRegistry.forgetDelegation(detail.terminalId()); // CB-532: don't leak the lead binding
         });
 
-        // MCP server face (CB-105): bridge_send/bridge_reply/bridge_status, mounted at /mcp.
+        // MCP server face (CB-105): fleet_send/fleet_reply/fleet_status, mounted at /mcp.
         // Caller identity is resolved from the connection (peer PID → herdr pane), not arguments.
         ConnectionIdentity identity = new ConnectionIdentity(
                 new PaneLocator(herdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
@@ -480,18 +489,18 @@ public final class Bridged {
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 
-        BridgeMcp mcp = new BridgeMcp(messages, workers, sessions, identity, presence,
-                primaryRegistry, callers, metrics, new BridgeMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
+        FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
+                primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
                 profile -> {
                     var configured = config.get().profiles().get(profile);
                     return configured == null ? null : configured.maxLoad();
                 }, () -> config.get().profiles().keySet(), System::nanoTime),
-                new BridgeMcp.HealthCoverageSource(() -> {
+                new FleetMcp.HealthCoverageSource(() -> {
                     var health = config.get().health();
                     return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
                             health != null && health.notifications() != null && health.notifications().configured());
                 }),
-                new BridgeMcp.QuarantineSource(profile -> {
+                new FleetMcp.QuarantineSource(profile -> {
                     var configured = config.get().profiles().get(profile);
                     return configured == null ? null : configured.effectiveCredentialId();
                 }, quarantine));
@@ -530,7 +539,7 @@ public final class Bridged {
             herdr.close();
         }));
 
-        Javalin app = new BridgedApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
+        Javalin app = new FleetApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
                 callers, metrics).build();
         app.start(cfg.bind().host(), cfg.bind().port());
         log.info("bridged listening on {}:{}, herdr socket {}",
@@ -546,7 +555,7 @@ public final class Bridged {
      * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
      * (or labelled its tab) only once it was up, so there is no boot window to guard.
      *
-     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code BridgeMcp} marks presence
+     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code FleetMcp} marks presence
      * for every spawned member (worker and architect), deliberately, since that map doubles as the
      * member roster's availability signal and a lead counted there would show up as an available
      * member. So without the second disjunct a lead is permanently un-deliverable: every
@@ -560,22 +569,109 @@ public final class Bridged {
         return target -> presence.isPresent(target) || leads.get().containsKey(target);
     }
 
+    /** Injection seam for {@link #selectReplyInbox}: production binds {@link AmqpReplyInbox#open}. */
+    @FunctionalInterface
+    interface AmqpOpener {
+        ReplyInbox open(String uri, int prefetch);
+    }
+
+    /**
+     * CB-151/152: pick the reply inbox. A usable broker — a literal {@code uri}, or a {@code
+     * uriEnv} whose variable resolves (both read from {@code env}) — selects the durable AMQP inbox.
+     * Everything else falls back to the in-memory inbox: no broker block, a blank {@code uri}, a
+     * {@code uriEnv} whose variable is unset or blank, or a broker unreachable at boot. The two
+     * lossy paths warn <em>loudly</em> — never silently — because what is lost is durable,
+     * cross-restart reply delivery. Package-private and env-injected so the selection is testable
+     * without a real broker or a mutable process environment.
+     */
+    static ReplyInbox selectReplyInbox(FleetConfig.Broker broker, Map<String, String> env, AmqpOpener amqp) {
+        if (broker == null) {
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+        if (broker.hasUriEnv()) {
+            // uriEnv is authoritative whenever set (CB-151): the operator moved off clear text, so
+            // it must not quietly fall back onto a stale literal uri.
+            if (broker.uri() != null && !broker.uri().isBlank()) {
+                log.info("broker.uri is ignored because broker.uriEnv={} is set", broker.uriEnv());
+            }
+            String effectiveUri = broker.effectiveUri(env);
+            if (effectiveUri == null) {
+                log.warn("broker.uriEnv={} is unset or blank — durable AMQP reply inbox DISABLED. "
+                                + "Replies are soft-state and will not survive a restart. Set {} in the "
+                                + "daemon's environment (see scripts/redeploy-bridged.sh) and restart to "
+                                + "use the durable broker inbox.",
+                        broker.uriEnv(), broker.uriEnv());
+                log.info("reply inbox: in-memory (soft-state)");
+                return new InMemoryReplyInbox();
+            }
+            log.info("reply inbox: AMQP broker (durable) via env var {} (prefetch={})",
+                    broker.uriEnv(), broker.prefetchOrDefault());
+            return openAmqpOrFallback(effectiveUri, broker.prefetchOrDefault(), "uriEnv " + broker.uriEnv(), amqp);
+        }
+        // No uriEnv: the literal uri path (existing behaviour).
+        if (broker.effectiveUri(env) == null) {
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+        log.info("reply inbox: AMQP broker (durable) (prefetch={})", broker.prefetchOrDefault());
+        return openAmqpOrFallback(broker.uri(), broker.prefetchOrDefault(), "uri", amqp);
+    }
+
+    /**
+     * Open the AMQP inbox, falling back to the in-memory inbox for this process lifetime if the
+     * broker cannot be reached at boot (CB-152). Not silent: the warning says durable delivery is
+     * off, replies are soft-state and will not survive a restart, plus the source that failed and
+     * the URI <em>with credentials stripped</em>. Never retries in the background — a broker that
+     * drops <em>after</em> startup already self-heals via the connection factory's automatic
+     * recovery; only the boot path is changed here.
+     */
+    private static ReplyInbox openAmqpOrFallback(String effectiveUri, int prefetch, String source,
+                                                 AmqpOpener amqp) {
+        try {
+            return amqp.open(effectiveUri, prefetch);
+        } catch (IllegalStateException e) {
+            log.warn("cannot reach AMQP broker ({}, {}) — falling back to the in-memory reply inbox "
+                            + "for this process lifetime. Durable, cross-restart reply delivery is OFF; "
+                            + "replies are soft-state and will not survive a restart. Reason: {}",
+                    source, stripCredentials(effectiveUri), reasonOf(e));
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+    }
+
+    /** An AMQP URI carries {@code user:pass@} inline — show the host/port, never the credentials. */
+    static String stripCredentials(String uri) {
+        return uri == null ? null : uri.replaceAll("://[^@/]*@", "://");
+    }
+
+    /** The deepest cause's class and message — the outermost {@code IllegalStateException} echoes the URI (with password). */
+    private static String reasonOf(Throwable e) {
+        Throwable t = e;
+        while (t.getCause() != null && t.getCause() != t) {
+            t = t.getCause();
+        }
+        String msg = t.getMessage();
+        return t.getClass().getSimpleName() + (msg == null || msg.isBlank() ? "" : ": " + msg);
+    }
+
     /**
      * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
      * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
-     * {@link BridgedConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
-     * where set (opt-in). Derived from the config, not hard-coded, so a new profile is covered for
-     * free. A var required by more than one profile is one entry naming every profile that needs
-     * it. Deliberately excludes {@code auth.tokenEnv}: that one is already enforced loudly, by a
-     * startup throw in {@code main()} — about 370 lines <em>below</em> this method's call site
-     * ({@link #reportRequiredSecrets(BridgedConfig)}), not a few lines above it. That throw only
+     * {@link FleetConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
+     * where set (opt-in), plus a configured {@code broker.uriEnv} (CB-151). Derived from the
+     * config, not hard-coded, so a new profile is covered for free. A var required by more than one
+     * profile is one entry naming every profile that needs it. Deliberately excludes {@code
+     * auth.tokenEnv}: that one is already enforced loudly, by a startup throw in {@code main()} —
+     * about 370 lines <em>below</em> this method's call site
+     * ({@link #reportRequiredSecrets(FleetConfig)}), not a few lines above it. That throw only
      * fires when {@code auth.mode: token} is configured; under the default loopback-trust mode it
      * never runs, and {@code auth.tokenEnv} is simply not required.
      *
      * <p>Package-private and pure (no I/O, no logging) so the derivation is unit-testable without
-     * capturing log output; {@link #reportRequiredSecrets(BridgedConfig)} is the logging caller.
+     * capturing log output; {@link #reportRequiredSecrets(FleetConfig)} is the logging caller.
      */
-    static Map<String, List<String>> requiredSecretEnvVars(BridgedConfig cfg) {
+    static Map<String, List<String>> requiredSecretEnvVars(FleetConfig cfg) {
         Map<String, List<String>> requiredBy = new LinkedHashMap<>();
         cfg.profiles().forEach((name, profile) -> {
             if (!profile.isSubscription()) {
@@ -587,6 +683,11 @@ public final class Bridged {
                         .add("profile '" + name + "' gitTokenEnv");
             }
         });
+        FleetConfig.Broker broker = cfg.broker();
+        if (broker != null && broker.hasUriEnv()) {
+            requiredBy.computeIfAbsent(broker.uriEnv(), _ -> new ArrayList<>())
+                    .add("broker uriEnv");
+        }
         return requiredBy;
     }
 
@@ -599,7 +700,7 @@ public final class Bridged {
      * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
      * what is wrong is strictly more useful than one that will not boot at all.
      */
-    private static void reportRequiredSecrets(BridgedConfig cfg) {
+    private static void reportRequiredSecrets(FleetConfig cfg) {
         Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
         if (requiredBy.isEmpty()) {
             log.info("startup secrets: no profile references a token env var — nothing to check");
@@ -622,7 +723,7 @@ public final class Bridged {
 
     /**
      * CB-596: {@code known:} empty (block absent entirely, or present but empty) means {@link
-     * BridgedConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
+     * FleetConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
      * operator's whole secret store, unblocked, exactly the defect this ticket fixes. Unlike a
      * missing token ({@link #reportRequiredSecrets}), there is no name to point at: the point is
      * that the block itself is missing. Warn once at startup and say what to add; never refuse to
@@ -632,17 +733,21 @@ public final class Bridged {
      * <p>Package-private so the test can capture the log directly, the same way {@link
      * #requiredSecretEnvVars} is exposed for {@link #reportRequiredSecrets}'s own test.
      */
-    static void reportMemberCredentialsGap(BridgedConfig cfg) {
-        BridgedConfig.MemberCredentials creds = cfg.memberCredentials();
+    static void reportMemberCredentialsGap(FleetConfig cfg) {
+        FleetConfig.MemberCredentials creds = cfg.memberCredentials();
         if (creds != null && !creds.known().isEmpty()) {
-            log.info("memberCredentials: {} known name(s), {} allowed — blocking {} on every spawn",
-                    creds.known().size(), creds.allow().size(), creds.blockedSet().size());
+            log.info("memberCredentials: policy={}, {} known name(s), {} allowed — blocking {} on "
+                            + "every spawn{}",
+                    creds.policy(), creds.known().size(), creds.allow().size(), creds.blockedSet().size(),
+                    creds.isAllowList()
+                            ? " (allow-list: known/allow are reporting only — the control is the derived ZDOTDIR scrub)"
+                            : "");
             return;
         }
         log.warn("memberCredentials: absent or empty — the daemon will start anyway, and every "
                 + "member pane inherits the operator's WHOLE secret store, unblocked (CB-592's "
                 + "protection is lost). Add a memberCredentials: block (policy/allow/known) to "
-                + "bridged.yaml — see bridged.example.yaml — and restart.");
+                + "bridged.yaml — see fleetd.example.yaml — and restart.");
     }
 
     /**
@@ -678,6 +783,6 @@ public final class Bridged {
         }
     }
 
-    private Bridged() {
+    private Fleetd() {
     }
 }

bridged/src/main/java/dev/ltms/fleet/auth/AuditLog.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

bridged/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -1,9 +1,9 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
 /**
  * The authorization table (CB-505), stated once and enforced on both entry paths.
  *
- * <p>Most of these rules are already true de facto — {@code BridgeMcp} derives a worker's identity
+ * <p>Most of these rules are already true de facto — {@code FleetMcp} derives a worker's identity
  * from the connection rather than reading it from an argument, so a worker has never been able to
  * reply <em>as</em> another worker over MCP. What was missing is that the REST surface trusted the
  * session id in the URL path, and neither surface checked role at all. This class makes the

bridged/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.peer.MemberRole;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -12,7 +12,7 @@ import java.util.function.Supplier;
 /**
  * Resolves every caller to a {@link Principal}, for both entry paths into the core (CB-501).
  *
- * <p>There are two of them and they are not layered the way the docs suggest: {@code BridgeMcp}
+ * <p>There are two of them and they are not layered the way the docs suggest: {@code FleetMcp}
  * calls the service layer directly and is mounted as a raw servlet (so it never passes through a
  * Javalin filter), while the REST routes historically resolved no identity at all. Both now
  * delegate here, so the authorization rules are stated once instead of drifting apart.
@@ -59,7 +59,7 @@ public final class CallerResolver {
      * <p>Like {@link #leadTerminals}, a supplier rather than a fixed map, so a binding injected
      * after startup — when the later spawn lifecycle establishes a live architect session, or an
      * operator pins one — takes effect without a restart. Consulted per resolve; today's wiring
-     * in {@code Bridged} reads a constant from config, which is the degenerate live case.
+     * in {@code Fleetd} reads a constant from config, which is the degenerate live case.
      */
     private final Supplier<Map<String, String>> architectTerminals;
     private final Function<String, MemberRole> memberSlotRoles;
@@ -235,7 +235,7 @@ public final class CallerResolver {
 
         // loopback-trust: same-host callers that are not workers are the primary. A non-loopback
         // caller is anonymous even here — and startup refuses that combination anyway
-        // (BridgedConfig.validateAuthExposure), so this is defence in depth, not the control.
+        // (FleetConfig.validateAuthExposure), so this is defence in depth, not the control.
         return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
     }
 

bridged/src/main/java/dev/ltms/fleet/auth/MemberLifecycle.java

@@ -1,6 +1,6 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.peer.MemberRole;
 
 /** Optional session lifecycle hook for live member-slot bindings. */
 public interface MemberLifecycle {

bridged/src/main/java/dev/ltms/fleet/auth/MemberRegistry.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.peer.MemberRole;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -59,7 +59,7 @@ public final class MemberRegistry implements MemberLifecycle {
     private final Map<String, String> terminalToSlot = new HashMap<>();
 
     /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
-    public MemberRegistry(BridgedConfig.Fleet fleet) {
+    public MemberRegistry(FleetConfig.Fleet fleet) {
         Map<String, Entry> flat = new LinkedHashMap<>();
         if (fleet != null) {
             for (MemberRole role : MemberRole.values()) {
@@ -94,7 +94,7 @@ public final class MemberRegistry implements MemberLifecycle {
      * An immutable copy of the live {@code terminal_id → slot name} bindings.
      *
      * <p>Passed to {@link CallerResolver} as the source of architect identity, and what
-     * {@code bridge_whoami}/the roster will read to say which slot a pane hosts. Empty until the
+     * {@code fleet_whoami}/the roster will read to say which slot a pane hosts. Empty until the
      * spawn lifecycle binds a slot.
      */
     public Map<String, String> snapshot() {

bridged/src/main/java/dev/ltms/fleet/auth/Principal.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
 /**
  * A resolved caller: its {@link Role}, and — for a worker — the herdr {@code terminal_id} that
@@ -39,14 +39,14 @@ public record Principal(Role role, String terminal, long pid, String name) {
      *
      * <p>Carries {@link Role#PRIMARY}: a lead <em>is</em> a primary as far as authorization goes,
      * so every existing {@code isPrimary()} gate keeps working unchanged and the role table needed
-     * no new entry. The name is reporting only — it lets {@code bridge_whoami} say <em>which</em>
+     * no new entry. The name is reporting only — it lets {@code fleet_whoami} say <em>which</em>
      * lead is asking once more than one is configured.
      *
      * <p><strong>CB-532: a lead now carries the terminal it was matched by.</strong> Under CB-530 it
      * deliberately did not, because {@code terminal} meant "which worker pane" everywhere and a
      * non-null one would have enrolled the lead in the worker presence map. That reading was what
      * made a lead unaddressable: {@link #ownsSession} could never be true for it, so
-     * {@code bridge_reply} was refused and one lead could send to another but never be answered.
+     * {@code fleet_reply} was refused and one lead could send to another but never be answered.
      * The terminal now means "which pane is this caller", the presence map keys on
      * {@link #isSpawnedMember()} instead, and a lead is a peer that can both send and receive.
      */
@@ -63,7 +63,7 @@ public record Principal(Role role, String terminal, long pid, String name) {
      * An architect (CB-548), identified by the slot it occupies and the pane bound to it.
      *
      * <p>Carries {@link Role#ARCHITECT}. {@code slotName} is reporting only — it lets
-     * {@code bridge_whoami} say <em>which</em> architect slot is asking, and it is the key the
+     * {@code fleet_whoami} say <em>which</em> architect slot is asking, and it is the key the
      * (future) spawn lifecycle reads a profile back from. Identity is the {@code terminal}: like a
      * worker's it comes from the connection and the live terminal→slot binding, so
      * {@code ownsSession} works exactly as it does for a worker — an architect acts as its own

bridged/src/main/java/dev/ltms/fleet/auth/Role.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
 /**
  * What a caller is allowed to be on the bus (CB-501).

bridged/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -16,7 +16,7 @@ import java.util.function.Supplier;
 /**
  * The daemon's live configuration, re-readable without a restart (CB-559).
  *
- * <p>Consumers hold this, not a {@link BridgedConfig}, and read through {@link #get()} at the point
+ * <p>Consumers hold this, not a {@link FleetConfig}, and read through {@link #get()} at the point
  * of use. A component that captures {@code ref.get()} into a field at construction has opted out of
  * reload — which is sometimes right (see <em>deferred</em> below), but it must then be a deliberate
  * choice rather than an accident of where the field was initialised.
@@ -31,7 +31,7 @@ import java.util.function.Supplier;
  *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those
  *       three are read through a supplier on {@code CompositePeerLauncher}, which is what makes
  *       them hot — not the fact that they are config. <strong>This does NOT include
- *       {@code fleet.leaders}</strong>: {@code Bridged.main} reads {@code cfg.fleet().leaders()}
+ *       {@code fleet.leaders}</strong>: {@code Fleetd.main} reads {@code cfg.fleet().leaders()}
  *       once at startup to build the {@code LeadTabScanner} and the {@code LeadLauncher}, and
  *       neither is reconstructed on reload — so a lead added, removed, or re-{@code tab}'d under
  *       {@code fleet.leaders} needs a restart, the same as any deferred key below.</li>
@@ -42,7 +42,7 @@ import java.util.function.Supplier;
  *       {@code guard:}, {@code worktreeRoot:}, adding or removing a profile (a new backend needs its own launcher,
  *       which is constructed once), <em>and an existing profile's launch settings</em> —
  *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
- *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Bridged.main}'s
+ *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
  *       pattern map at startup), and the rest. {@code credentialId} (CB-578 stage B) is NOT on
  *       this list — it is read live off the config supplier at every quarantine check and
  *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
@@ -65,7 +65,7 @@ import java.util.function.Supplier;
  * running. A config file being edited is normally read once mid-save; degrading a working daemon
  * because it caught a half-written file would be a bad trade.
  */
-public final class ConfigRef implements Supplier<BridgedConfig> {
+public final class ConfigRef implements Supplier<FleetConfig> {
 
     private static final Logger log = LoggerFactory.getLogger(ConfigRef.class);
 
@@ -74,21 +74,21 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
             Set.of("bind", "herdrSocket", "broker", "auth");
 
     private final Path path;
-    private final AtomicReference<BridgedConfig> current;
+    private final AtomicReference<FleetConfig> current;
 
-    public ConfigRef(Path path, BridgedConfig initial) {
+    public ConfigRef(Path path, FleetConfig initial) {
         this.path = path;
         this.current = new AtomicReference<>(Objects.requireNonNull(initial, "initial config"));
     }
 
     /** A fixed reference that never reloads — for tests and for wiring built from a config in code. */
-    public static ConfigRef fixed(BridgedConfig cfg) {
+    public static ConfigRef fixed(FleetConfig cfg) {
         return new ConfigRef(null, cfg);
     }
 
     /** The live configuration. Read this per use; do not cache it in a field. */
     @Override
-    public BridgedConfig get() {
+    public FleetConfig get() {
         return current.get();
     }
 
@@ -149,10 +149,10 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
         if (path == null) {
             return Outcome.failed("this config was built in code and has no file to reload from");
         }
-        BridgedConfig old = current.get();
-        BridgedConfig fresh;
+        FleetConfig old = current.get();
+        FleetConfig fresh;
         try {
-            fresh = BridgedConfig.load(path);
+            fresh = FleetConfig.load(path);
             // The same gate startup runs. A config that would have refused to boot must not be able
             // to slip in through a reload — that is how a daemon ends up in a state it could never
             // have started in, which is the hardest kind to debug.
@@ -182,7 +182,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
     }
 
     /** Cold keys whose value differs between the running config and the candidate. */
-    private static List<String> changedColdKeys(BridgedConfig old, BridgedConfig fresh) {
+    private static List<String> changedColdKeys(FleetConfig old, FleetConfig fresh) {
         List<String> changed = new ArrayList<>();
         if (!Objects.equals(old.bind(), fresh.bind())) {
             changed.add("bind");
@@ -202,7 +202,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
     }
 
     /** Changed keys that were accepted but whose effect waits for a restart. */
-    private static List<String> changedDeferredKeys(BridgedConfig old, BridgedConfig fresh) {
+    private static List<String> changedDeferredKeys(FleetConfig old, FleetConfig fresh) {
         List<String> changed = new ArrayList<>();
         if (!Objects.equals(old.lifecycle(), fresh.lifecycle())) {
             changed.add("lifecycle");
@@ -226,9 +226,9 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
         if (!Objects.equals(old.quarantineCooldownSeconds(), fresh.quarantineCooldownSeconds())) {
             changed.add("quarantineCooldownSeconds");
         }
-        Map<String, BridgedConfig.Profile> before =
+        Map<String, FleetConfig.Profile> before =
                 old.profiles() == null ? Map.of() : old.profiles();
-        Map<String, BridgedConfig.Profile> after =
+        Map<String, FleetConfig.Profile> after =
                 fresh.profiles() == null ? Map.of() : fresh.profiles();
         // Adding or removing a profile is deferred: a new backend needs its own launcher, and
         // launchers are built once at startup.
@@ -247,7 +247,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
         // a reload can produce, because the operator has no reason to doubt it.
         List<String> relaunch = new ArrayList<>();
         before.forEach((name, was) -> {
-            BridgedConfig.Profile now = after.get(name);
+            FleetConfig.Profile now = after.get(name);
             if (now != null && !sameLaunchSettings(was, now)) {
                 relaunch.add(name);
             }
@@ -266,7 +266,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
      * {@code CompositePeerLauncher}/the CB-578 stage B exhaustion sink) and really do take effect on
      * the next spawn.
      */
-    private static boolean sameLaunchSettings(BridgedConfig.Profile a, BridgedConfig.Profile b) {
+    private static boolean sameLaunchSettings(FleetConfig.Profile a, FleetConfig.Profile b) {
         return Objects.equals(a.baseUrl(), b.baseUrl())
                 && Objects.equals(a.model(), b.model())
                 && Objects.equals(a.configDir(), b.configDir())
@@ -283,7 +283,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
                 && Objects.equals(a.kind(), b.kind())
                 && Objects.equals(a.env(), b.env())
                 && Objects.equals(a.subscription(), b.subscription())
-                // CB-578 stage B: exhaustedPattern is compiled once into Bridged.main's pattern map
+                // CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map
                 // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
                 // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
                 && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern());

bridged/src/main/java/dev/ltms/fleet/config/ConfigWatcher.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

bridged/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -1,13 +1,13 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonToken;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.placement.PlacementPolicies;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.placement.PlacementPolicies;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -26,7 +26,7 @@ import java.util.Set;
 
 /**
  * {@code bridged} configuration, loaded from a YAML file (see
- * {@code bridged.example.yaml}). Unknown keys are ignored so config can grow ahead
+ * {@code fleetd.example.yaml}). Unknown keys are ignored so config can grow ahead
  * of the code — but an unknown <em>top-level</em> key is logged as a WARN at load (CB-530), because
  * silently dropping a whole block is indistinguishable from honouring it.
  *
@@ -71,7 +71,7 @@ import java.util.Set;
  *                      omitted) blocks nothing — see {@link MemberCredentials}.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
-public record BridgedConfig(
+public record FleetConfig(
         Bind bind,
         String herdrSocket,
         Map<String, Profile> profiles,
@@ -92,7 +92,7 @@ public record BridgedConfig(
         MemberCredentials memberCredentials) {
 
     /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
@@ -106,7 +106,7 @@ public record BridgedConfig(
     public static final int DEFAULT_QUARANTINE_COOLDOWN_SECONDS = 1800;
 
     /** Back-compat 14-arg form — no {@code configReload:} block, so file watching stays off. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, String placement, Auth auth) {
@@ -115,7 +115,7 @@ public record BridgedConfig(
     }
 
     /** Back-compat form before the optional {@code health:} block was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, String placement, Auth auth, ConfigReload configReload) {
@@ -124,7 +124,7 @@ public record BridgedConfig(
     }
 
     /** Back-compat form before the CB-578 stage B {@code quarantineCooldownSeconds} field was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
@@ -147,7 +147,7 @@ public record BridgedConfig(
      * {@code WeightedRoundRobinPolicy}), so losing it makes equal-weight placement
      * non-reproducible across restarts. Unmodifiable-wrap instead of copy-and-scramble.
      */
-    public BridgedConfig {
+    public FleetConfig {
         if (profiles != null && !profiles.isEmpty()) {
             Map<String, Profile> normalized = new LinkedHashMap<>();
             profiles.forEach((name, p) -> normalized.put(name,
@@ -184,7 +184,7 @@ public record BridgedConfig(
      *                  and {@code {n}} (per-worker number, to keep sibling tabs distinct)
      *                  are substituted (default {@code "worker: {profile} #{n}"})
      * @param mcpUrl         bridge MCP URL to provision into the worker's {@code configDir} so it
-     *                       can call {@code bridge_reply} ({@code null}/blank → no provisioning; the
+     *                       can call {@code fleet_reply} ({@code null}/blank → no provisioning; the
      *                       worker won't reply, only the fallback/timeout resolves the send)
      * @param cwd            fixed working directory for this profile's workers (CB-112 "told otherwise");
      *                       {@code null}/blank → inherit the primary's cwd, else the daemon's
@@ -224,7 +224,7 @@ public record BridgedConfig(
      *                       auto-select this profile": it is excluded from every automatic policy's
      *                       pool the same way a quarantined candidate is (see
      *                       {@code PlacementPolicyUtil}). This does not make the profile
-     *                       unreachable — an explicit {@code bridge_spawn{profile:"..."}} bypasses
+     *                       unreachable — an explicit {@code fleet_spawn{profile:"..."}} bypasses
      *                       placement entirely and still resolves it. Weights among the remaining
      *                       (non-excluded) candidates need not sum to 1.0; only their ratios matter.
      * @param maxLoad         max live workers allowed on this profile at one time. Absent
@@ -234,7 +234,7 @@ public record BridgedConfig(
      *                       the same way a {@code weight <= 0} profile is (see
      *                       {@code PlacementPolicyUtil.available()}, which already treats "at cap"
      *                       and "excluded" alike), and an explicit
-     *                       {@code bridge_spawn{profile:"..."}} against it is refused too (see
+     *                       {@code fleet_spawn{profile:"..."}} against it is refused too (see
      *                       {@code CompositePeerLauncher.enforceMaxLoad}) — a cap is a capacity
      *                       statement that does not stop being true just because the profile was
      *                       named directly. A negative value has no sane meaning (there is no
@@ -242,7 +242,7 @@ public record BridgedConfig(
      *                       instead, naming the profile and the key. Live means any session the
      *                       registry still owns (acquired and not yet released), in any state.
      * @param kind           which peer launcher spawns this profile: {@code "claude-code"} (default —
-     *                       the {@link dev.ltms.bridged.member.ClaudeCodeLauncher}) or {@code "opencode"}.
+     *                       the {@link dev.ltms.fleet.member.ClaudeCodeLauncher}) or {@code "opencode"}.
      *                       The {@code CompositePeerLauncher} routes {@code spawn}/reap by this value, so
      *                       each adapter drives only its own kind. Normalised to lower-case; blank ⇒ the
      *                       default. It selects the adapter, not the transport — placement, tabs, cwd, and
@@ -259,7 +259,7 @@ public record BridgedConfig(
      *                       {@code ANTHROPIC_BASE_URL} or {@code ANTHROPIC_AUTH_TOKEN} is refused at
      *                       config load (CB-542): on the subscription path no guard would vet it.
      * @param exhaustedPattern  regex matched against a completion-fallback scrape (CB-578 stage A) to
-     *                       classify a turn that ended with no {@code bridge_reply} as the backend
+     *                       classify a turn that ended with no {@code fleet_reply} as the backend
      *                       having refused on a subscription usage limit, rather than a real answer.
      *                       {@code null}/blank ⇒ the classification never fires for this profile and
      *                       today's completion-fallback behaviour is unchanged. Every backend words
@@ -291,7 +291,7 @@ public record BridgedConfig(
                          String exhaustedPattern,
                          String credentialId) {
 
-        /** Peer kind spawned by {@link dev.ltms.bridged.member.ClaudeCodeLauncher} (the default). */
+        /** Peer kind spawned by {@link dev.ltms.fleet.member.ClaudeCodeLauncher} (the default). */
         public static final String KIND_CLAUDE_CODE = "claude-code";
         /** Peer kind spawned by the opencode adapter (CB-402). */
         public static final String KIND_OPENCODE = "opencode";
@@ -472,7 +472,7 @@ public record BridgedConfig(
          * {@code ANTHROPIC_AUTH_TOKEN} is injected from {@code tokenEnv}. An {@code env:} entry for
          * either is a bypass vector — it is what the subscription path would otherwise let survive
          * unguarded — so it is rejected at config load (see
-         * {@link BridgedConfig#validateSubscriptionProfiles()}).
+         * {@link FleetConfig#validateSubscriptionProfiles()}).
          */
         public boolean envCarriesAnthropicBinding() {
             return env != null
@@ -551,16 +551,52 @@ public record BridgedConfig(
      *
      * @param uri      AMQP connection URI, e.g. {@code amqp://guest:guest@127.0.0.1:5672/}. Blank/
      *                 {@code null} ⇒ the broker block is treated as absent (in-memory adapter).
+     *                 Ignored when {@code uriEnv} is set.
+     * @param uriEnv   name of a host env var holding the AMQP URI (CB-151). The URI carries its
+     *                 credentials inline, so giving the variable <em>name</em> keeps the password
+     *                 out of the config file, same as {@code auth.tokenEnv}/{@code Profile.tokenEnv}.
+     *                 Wins over {@code uri} whenever set. Blank/{@code null} ⇒ ignored.
      * @param prefetch CB-527: the consumer's {@code basicQos} prefetch count, bounding how many
      *                 unacked messages the AMQP inbox holds in-heap per owned target. {@code null}/
      *                 non-positive ⇒ {@link AmqpReplyInbox#DEFAULT_PREFETCH}.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Broker(String uri, Integer prefetch) {
+    public record Broker(String uri, String uriEnv, Integer prefetch) {
 
-        /** True when a usable broker URI is configured (an empty block does not enable AMQP). */
+        /** True when a {@code uriEnv} is configured by name, whether or not its variable resolves. */
+        public boolean hasUriEnv() {
+            return uriEnv != null && !uriEnv.isBlank();
+        }
+
+        /**
+         * True when a usable broker URI is configured (an empty block does not enable AMQP).
+         * Honors {@code uriEnv} first: if it names a variable that is unset or blank, the broker is
+         * <em>not</em> configured (the daemon falls back to the in-memory inbox) — a bare {@code uri}
+         * is only consulted when no {@code uriEnv} is set. Env lookup makes this process-dependent;
+         * callers already reading {@link System#getenv} are the right ones to invoke it.
+         */
         public boolean isConfigured() {
-            return uri != null && !uri.isBlank();
+            return effectiveUri() != null;
+        }
+
+        /**
+         * The effective AMQP URI to connect with. {@code uriEnv} wins when set (both over {@code uri}
+         * and alone). When {@code uriEnv} names a variable that is unset or blank, returns {@code
+         * null} rather than falling back to {@code uri} — an operator who moved to the secret store
+         * must not silently drop back onto a stale clear-text URI. Returns the literal {@code uri}
+         * when no {@code uriEnv} is configured.
+         */
+        public String effectiveUri() {
+            return effectiveUri(System.getenv());
+        }
+
+        /** As {@link #effectiveUri()}, reading the variable value from {@code env} (the injection seam). */
+        public String effectiveUri(Map<String, String> env) {
+            if (hasUriEnv()) {
+                String value = env.get(uriEnv);
+                return (value != null && !value.isBlank()) ? value : null;
+            }
+            return (uri != null && !uri.isBlank()) ? uri : null;
         }
 
         /** The prefetch to use, defaulting to {@link AmqpReplyInbox#DEFAULT_PREFETCH} when unset. */
@@ -605,7 +641,7 @@ public record BridgedConfig(
      * work as peers — the second is silently demoted and refused every orchestration call.
      *
      * <p>{@code kind} and {@code model} are descriptive only: they document what runs in the pane
-     * and are reported back by {@code bridge_whoami}.
+     * and are reported back by {@code fleet_whoami}.
      *
      * <p><b>A lead is now also creatable (CB-557).</b> Before, nothing spawned one — a lead
      * pre-existed, which is why it had to be recognised by configuration rather than created. With
@@ -811,7 +847,7 @@ public record BridgedConfig(
 
     /**
      * Opt-in idle-lead heartbeat (CB-551): when the single lead has been continuously idle past
-     * {@code idleAfterSeconds} with no open {@code bridge_send} driving it, nudge it back to work.
+     * {@code idleAfterSeconds} with no open {@code fleet_send} driving it, nudge it back to work.
      *
      * <p>Deliberately opt-in ({@code null} ⇒ off, exactly like {@code leadScan:}). The heartbeat
      * spends the operator's model subscription on its own initiative — it prompts the lead to start
@@ -893,7 +929,7 @@ public record BridgedConfig(
      *
      * <p>Member identity never depends on this block: a loopback peer PID that maps to a herdr
      * pane is unforgeable and is always honoured (see
-     * {@link dev.ltms.bridged.mcp.ConnectionIdentity}). This only decides what happens for
+     * {@link dev.ltms.fleet.mcp.ConnectionIdentity}). This only decides what happens for
      * <em>everyone else</em>.
      *
      * @param mode     {@code "loopback-trust"} (default) — any loopback caller that is not a known
@@ -957,27 +993,86 @@ public record BridgedConfig(
      * UNLESS it is also in {@link #allow}. A name that shows up in neither list is not silently
      * allowed — see {@code HerdrPeerLauncher}'s gap detector, which logs it.
      *
-     * @param policy how the block is computed. Only {@link #POLICY_DENY_BY_DEFAULT} is understood
-     *               today; {@code null}/blank defaults to it. An operator's own deny-list is
-     *               deliberately not supported — see above.
+     * <p><b>CB-633: allow-list.</b> Deny-by-default's overlay is applied BEFORE the pane's login
+     * shell runs, so any file that chain sources can re-export over it — and did. The allow-list
+     * policy moves the control to a generated ZDOTDIR whose startup files run the scrub LAST, after
+     * the whole operator chain, and blank every exported variable not on an allow-list DERIVED from
+     * what the launcher itself injects (profiles' tokenEnv/gitTokenEnv/gitHostEnv/env keys plus an
+     * infrastructure set) — never hand-typed, so adding a profile cannot break a spawn. Under this
+     * policy {@link #allow} and {@link #known} stop being a control and become reporting only.
+     *
+     * @param policy how the block is computed. {@link #POLICY_DENY_BY_DEFAULT} (the default; also
+     *               accepted as {@link #POLICY_DENY_LIST}) shadows each {@code known}-but-not-allowed
+     *               name in the pane-creation env overlay — which a login shell that re-exports the
+     *               name defeats (see CB-596's round-2 correction). {@link #POLICY_ALLOW_LIST}
+     *               (CB-633) replaces the overlay with a per-spawn ZDOTDIR scrub that runs AFTER the
+     *               pane's login shell has finished sourcing everything, blanking every variable not
+     *               on the DERIVED allow-list (derived from what the launcher itself injects — never
+     *               hand-typed). Under {@code allow-list}, {@link #allow} and {@link #known} are
+     *               REPORTING ONLY: they feed the gap WARN, they are no longer a control.
      * @param allow  credential names a member legitimately needs (e.g. the gateway token it reaches
-     *               the LLM through, the repo-scoped forge token it opens its own PR with). Every
-     *               name here is left unmentioned in the pane's env overlay, so the value the pane's
-     *               own (login) shell exports passes through untouched.
-     * @param known  every credential name the operator's store is known to export. Every name here
-     *               that is NOT also in {@link #allow} is overlaid with a non-secret sentinel value,
-     *               shadowing whatever the pane's login shell would otherwise export for it.
+     *               the LLM through, the repo-scoped forge token it opens its own PR with). Under
+     *               deny-list/deny-by-default every name here is left unmentioned in the pane's env
+     *               overlay; under allow-list this list is reporting only — the control is derived,
+     *               not configured.
+     * @param known  every credential name the operator's store is known to export. Under
+     *               deny-list/deny-by-default every name here that is NOT also in {@link #allow} is
+     *               overlaid with a non-secret sentinel value. Under allow-list this list is
+     *               reporting only.
+     * @param sshAuthSock whether the member may inherit {@code SSH_AUTH_SOCK} under the allow-list
+     *               policy ({@code "allow"}) or must have it blanked ({@code "block"}, the default).
+     *               This is a DECISION, never a default: {@code SSH_AUTH_SOCK} is a handle to the
+     *               operator's ssh-agent, and a member holding it can sign with the operator's own
+     *               keys — but it appears in no secret file and is credential-shaped like nothing on
+     *               any list, which is why three earlier tickets missed it (gitea #110 / CB-607).
+     *               Blocking it breaks git over SSH inside the member; allow it only when members do
+     *               not need to authenticate as the operator over SSH. Ignored under deny-list /
+     *               deny-by-default, which never touch the name.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
-    public record MemberCredentials(String policy, List<String> allow, List<String> known) {
+    public record MemberCredentials(String policy, List<String> allow, List<String> known,
+                                    String sshAuthSock) {
 
-        /** The only policy this build understands: block every {@code known} name not in {@code allow}. */
+        /** Default policy: block every {@code known} name not in {@code allow}, via the env overlay. */
         public static final String POLICY_DENY_BY_DEFAULT = "deny-by-default";
 
+        /** Alias of {@link #POLICY_DENY_BY_DEFAULT}, spelled the way CB-633 names the two policies. */
+        public static final String POLICY_DENY_LIST = "deny-list";
+
+        /**
+         * CB-633: derive the kept-name set from what the launcher itself injects, generate a
+         * per-spawn ZDOTDIR whose startup files blank every exported variable not on it AFTER the
+         * pane's shell has finished sourcing the operator's chain. The scrub is sourced from both
+         * the generated {@code .zshrc} and {@code .zlogin}, because herdr opens a LOGIN zsh on macOS
+         * and a plain interactive one on Linux — see {@code EnvAllowListScrub}.
+         */
+        public static final String POLICY_ALLOW_LIST = "allow-list";
+
+        /** The pre-CB-633 three-field form — {@code sshAuthSock} defaults to blocked. */
+        public MemberCredentials(String policy, List<String> allow, List<String> known) {
+            this(policy, allow, known, null);
+        }
+
         public MemberCredentials {
-            policy = (policy == null || policy.isBlank()) ? POLICY_DENY_BY_DEFAULT : policy.toLowerCase();
+            String normalizedPolicy = (policy == null || policy.isBlank())
+                    ? POLICY_DENY_BY_DEFAULT : policy.toLowerCase(java.util.Locale.ROOT);
+            // deny-list is an alias of deny-by-default, not a third behaviour — normalize to one
+            // spelling so every isDenyList()-style check has one value to compare against.
+            policy = POLICY_DENY_LIST.equals(normalizedPolicy) ? POLICY_DENY_BY_DEFAULT : normalizedPolicy;
             allow = allow == null ? List.of() : List.copyOf(allow);
             known = known == null ? List.of() : List.copyOf(known);
+            sshAuthSock = (sshAuthSock != null && "allow".equalsIgnoreCase(sshAuthSock.trim()))
+                    ? "allow" : "block";
+        }
+
+        /** True when this block selects the CB-633 derived-allow-list policy. */
+        public boolean isAllowList() {
+            return POLICY_ALLOW_LIST.equals(policy);
+        }
+
+        /** True when {@code SSH_AUTH_SOCK} may pass through under the allow-list policy. Default: no. */
+        public boolean sshAuthSockAllowed() {
+            return "allow".equals(sshAuthSock);
         }
 
         /** {@link #allow} as a set, for membership checks. */
@@ -1028,7 +1123,7 @@ public record BridgedConfig(
         return defaultProfileFor(MemberRole.DEV);
     }
 
-    private static final Logger log = LoggerFactory.getLogger(BridgedConfig.class);
+    private static final Logger log = LoggerFactory.getLogger(FleetConfig.class);
 
     private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());
 
@@ -1037,7 +1132,7 @@ public record BridgedConfig(
      * {@link #warnUnknownTopLevelKeys}. Keep in step with the record components.
      *
      * <p>Package-private (not {@code private}) so a test can assert every key here is documented in
-     * {@code bridged.example.yaml} — the only committed description of the config schema, since
+     * {@code fleetd.example.yaml} — the only committed description of the config schema, since
      * {@code bridged.yaml} itself is gitignored.
      */
     static final Set<String> KNOWN_TOP_LEVEL_KEYS = Set.of(
@@ -1047,7 +1142,7 @@ public record BridgedConfig(
             "memberCredentials");
 
     /** Load and validate config from {@code path}. */
-    public static BridgedConfig load(Path path) {
+    public static FleetConfig load(Path path) {
         try {
             String yaml = Files.readString(path);
             rejectRenamedTopLevelKeys(yaml);
@@ -1059,7 +1154,7 @@ public record BridgedConfig(
             rejectUnknownAuthMode(yaml);
             rejectUnknownPlacement(yaml);
             rejectUnknownMemberCredentialsPolicy(yaml);
-            BridgedConfig cfg = YAML.readValue(yaml, BridgedConfig.class);
+            FleetConfig cfg = YAML.readValue(yaml, FleetConfig.class);
             // CB-606: validated here, eagerly, using PlacementPolicies.fromName as the single source
             // of truth — not lazily at first spawn (see CompositePeerLauncher's placementPolicy
             // Supplier), where a bad name would still start a daemon that looks healthy.
@@ -1366,7 +1461,7 @@ public record BridgedConfig(
      *
      * <p>{@link Profile}'s compact constructor only lower-cases {@code kind} and compares it against
      * {@code KIND_OPENCODE} — anything else, including a typo like {@code opencod}, silently falls
-     * into the claude-code bucket ({@link dev.ltms.bridged.member.CompositePeerLauncher} routes by
+     * into the claude-code bucket ({@link dev.ltms.fleet.member.CompositePeerLauncher} routes by
      * exact adapter claim, not by membership in a known set). With {@code argv:} also unset, the argv
      * default special-cases only the exact string {@code "claude-code"}, so the launch command falls
      * back to {@code List.of(kind)} — the daemon then tries to run a program literally named after the
@@ -1487,9 +1582,15 @@ public record BridgedConfig(
         }
     }
 
-    /** The member-credential policies this build understands — {@link MemberCredentials#policy()}'s only valid value. */
+    /**
+     * The member-credential policies this build understands — {@link MemberCredentials#policy()}'s
+     * only valid values. Checked against the RAW yaml text (before {@link MemberCredentials}'s
+     * compact constructor normalizes {@code deny-list} onto {@code deny-by-default}), so the alias
+     * is listed explicitly.
+     */
     private static final Set<String> KNOWN_MEMBER_CREDENTIALS_POLICIES =
-            Set.of(MemberCredentials.POLICY_DENY_BY_DEFAULT);
+            Set.of(MemberCredentials.POLICY_DENY_BY_DEFAULT, MemberCredentials.POLICY_DENY_LIST,
+                    MemberCredentials.POLICY_ALLOW_LIST);
 
     /**
      * Reject a {@code memberCredentials.policy} that is not {@link #KNOWN_MEMBER_CREDENTIALS_POLICIES}
@@ -1570,7 +1671,7 @@ public record BridgedConfig(
     }
 
     /** Fill in nested defaults so callers never see nulls for structural fields. */
-    public BridgedConfig withDefaults() {
+    public FleetConfig withDefaults() {
         Bind b = bind != null ? bind : new Bind(null, 0);
         Guard g = guard != null ? guard : new Guard(List.of());
         Lifecycle l = lifecycle != null ? lifecycle : new Lifecycle(null, null, null, false);
@@ -1601,10 +1702,13 @@ public record BridgedConfig(
         // guard/lifecycle, an absent block is not a safe "feature off" default here, it is a gap. It
         // is deliberately not pre-populated with a Java-side name list (that would just reintroduce
         // the hardcoded-list defect this record replaces); the block must be configured in
-        // bridged.yaml to protect anything. See bridged.example.yaml's memberCredentials: comment.
+        // bridged.yaml to protect anything. See fleetd.example.yaml's memberCredentials: comment.
+        // CB-633: policy stays deny-by-default here — the allow-list scrub is opt-in, because it is
+        // stricter than today's behaviour (it blanks every non-derived name, not just known ones)
+        // and an upgrade must not change what a running deployment's members inherit.
         MemberCredentials mc = memberCredentials != null ? memberCredentials
                 : new MemberCredentials(null, List.of(), List.of());
-        return new BridgedConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
+        return new FleetConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
                 quarantineCooldown, mc);
     }
@@ -1639,8 +1743,8 @@ public record BridgedConfig(
      * <p>The scan reads a tab label and concludes "a lead lives here". bridged also <em>writes</em>
      * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
      * a member template matches and the daemon starts labelling its own members as leads, promoting
-     * the entire fleet to {@link dev.ltms.bridged.auth.Role#PRIMARY} with no message and no diff.
-     * The member-space exclusion in {@link dev.ltms.bridged.herdr.LeadTabScanner} already blocks the
+     * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
+     * The member-space exclusion in {@link dev.ltms.fleet.herdr.LeadTabScanner} already blocks the
      * realistic path, but defence that depends on one workspace label holding is not defence enough
      * for a privilege boundary.
      *

bridged/src/main/java/dev/ltms/fleet/guard/GuardException.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;
 
 /** Thrown when the subscription boundary would be violated. Never swallow this. */
 public class GuardException extends RuntimeException {

bridged/src/main/java/dev/ltms/fleet/guard/SubscriptionGuard.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;
 
 import java.net.URI;
 import java.net.URISyntaxException;

bridged/src/main/java/dev/ltms/fleet/health/FleetHealth.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;
 
 /**
  * Pure classifier. Collection and repair are deliberately outside this package.

bridged/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -1,10 +1,10 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.session.MemberSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -44,7 +44,7 @@ public final class FleetHealthMonitor {
      *                   invoked once when a member transitions into a terminal health state. Required —
      *                   there is deliberately no defaulting overload; a caller that does not want the
      *                   fail-tickets-on-terminal-health behavior must pass an explicit inert value (see
-     *                   {@code TestTurnTokens.inert} / {@code BridgeMcp.CapacitySource.none()} for the pattern).
+     *                   {@code TestTurnTokens.inert} / {@code FleetMcp.CapacitySource.none()} for the pattern).
      */
     public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
                               ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,

bridged/src/main/java/dev/ltms/fleet/health/HealthDecision.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
 /** Classification plus the private fact that the next pure decision needs. */
 public record HealthDecision(HealthState state, HealthPrior prior) { }

bridged/src/main/java/dev/ltms/fleet/health/HealthPrior.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
 /** Private cross-tick observation. It is deliberately not a reported health value. */
 public record HealthPrior(boolean busyButDone) {

bridged/src/main/java/dev/ltms/fleet/health/HealthSnapshot.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;
 
 /** Read-only facts from one fleet collection tick. */
 public record HealthSnapshot(MemberSession.State sessionState, AgentStatus liveStatus,

bridged/src/main/java/dev/ltms/fleet/health/HealthState.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
 /** Health classifications reported for a member. */
 public enum HealthState {

bridged/src/main/java/dev/ltms/fleet/health/MuteCounter.java

@@ -1,12 +1,12 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
-import dev.ltms.bridged.msg.Rendezvous;
+import dev.ltms.fleet.msg.Rendezvous;
 
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
 /**
- * Counts turns that ended via the completion fallback instead of {@code bridge_reply}.
+ * Counts turns that ended via the completion fallback instead of {@code fleet_reply}.
  * MUTE is an observation by target and profile, not a classifier state and never suppresses faults.
  */
 public final class MuteCounter {

bridged/src/main/java/dev/ltms/fleet/health/PaneBudget.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
 import java.util.ArrayList;
 import java.util.HashMap;

bridged/src/main/java/dev/ltms/fleet/herdr/Agent.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

bridged/src/main/java/dev/ltms/fleet/herdr/AgentControl.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

bridged/src/main/java/dev/ltms/fleet/herdr/AgentStatus.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 /**
  * A herdr agent's lifecycle state, as reported by {@code agent_status}. Drives the

bridged/src/main/java/dev/ltms/fleet/herdr/HerdrClient.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

bridged/src/main/java/dev/ltms/fleet/herdr/HerdrCodec.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;

bridged/src/main/java/dev/ltms/fleet/herdr/HerdrException.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 /**
  * Raised when a herdr call fails: transport error, or an {@code error} envelope

bridged/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
@@ -14,7 +14,7 @@ import java.util.function.Supplier;
 
 /**
  * Discovers which panes host a lead by scanning herdr for tabs the operator labelled by convention
- * (CB-531), and hands {@link dev.ltms.bridged.auth.CallerResolver} the resulting
+ * (CB-531), and hands {@link dev.ltms.fleet.auth.CallerResolver} the resulting
  * {@code terminal_id → lead name} map.
  *
  * <p><strong>Why scan at all.</strong> A lead is never spawned — a human opens a tab and starts an
@@ -49,7 +49,7 @@ import java.util.function.Supplier;
  * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
  * that bridged never renames a lead tab, so the label was always the human's own writing and there
  * was no round-trip from the daemon's rename back into its next decision.
- * {@code dev.ltms.bridged.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
+ * {@code dev.ltms.fleet.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
  * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
  * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
  * real: a label left behind by a session that has since died would read as a live lead forever.
@@ -58,7 +58,7 @@ import java.util.function.Supplier;
  * ever make a decision that <em>removes</em> something based on this map, add the same check.
  * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
  * happens to start with the same prefix would promote the whole fleet — and that is refused at
- * startup by {@code BridgedConfig.validateLeadTabPrefixes} rather than documented here.
+ * startup by {@code FleetConfig.validateLeadTabPrefixes} rather than documented here.
  *
  * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
  * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps

bridged/src/main/java/dev/ltms/fleet/herdr/PaneLocator.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

bridged/src/main/java/dev/ltms/fleet/herdr/Tab.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

bridged/src/main/java/dev/ltms/fleet/herdr/UnixSocketHerdrClient.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;

bridged/src/main/java/dev/ltms/fleet/herdr/Workspace.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

bridged/src/main/java/dev/ltms/fleet/herdr/WorkspaceControl.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;

bridged/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -16,14 +16,14 @@ import java.util.regex.Pattern;
 
 /**
  * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
- * {@link Rendezvous} so a blocking {@code bridge_send} resolves even when the worker finishes its
- * task without ever calling {@code bridge_reply} — the common case for a real delegated coding task.
+ * {@link Rendezvous} so a blocking {@code fleet_send} resolves even when the worker finishes its
+ * task without ever calling {@code fleet_reply} — the common case for a real delegated coding task.
  *
  * <p>On a confirmed {@code working → idle} boundary it scrapes the worker's recent transcript and
  * resolves the awaiting send with that tail (a {@link Rendezvous.Kind#COMPLETION} resolution, so the
  * caller can tell a scrape from a structured reply). It scrapes only when a send is actually waiting
  * — a fleet worker's own turns, or a send that already timed out, cost no herdr traffic. An explicit
- * {@code bridge_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
+ * {@code fleet_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
  *
  * <p>It also handles the CB-109 stall signal ({@link #onTurnFailed}): a worker that ran a turn then
  * wedged in an {@code unknown} state resolves the send as a failure (with the error screen as
@@ -38,7 +38,7 @@ import java.util.regex.Pattern;
  * <p><strong>Waiter-specific resolution (CB-116).</strong> On delivery we also capture the exact
  * {@link Rendezvous} waiter this turn belongs to, and the completion/failure fallbacks resolve
  * <em>that</em> waiter — never "whatever send is waiting now". A completion fallback runs on a virtual
- * thread and can land after the worker's {@code bridge_reply} already resolved the turn and the
+ * thread and can land after the worker's {@code fleet_reply} already resolved the turn and the
  * <em>next</em> send opened its own waiter on the same session; resolving the current waiter would
  * then deliver turn N's stale scrape as turn N+1's answer. Targeting the captured waiter makes a late
  * completion a harmless no-op (its waiter is already done) instead of a cross-turn stale reply.
@@ -62,7 +62,7 @@ public final class CompletionResolver implements TurnListener {
     static final int MAX_SCRAPE_CHARS = 4000;
 
     private static final String CLIPPED_PANE_TAIL_MARKER =
-            "[Pane tail clipped: member did not call bridge_reply.]";
+            "[Pane tail clipped: member did not call fleet_reply.]";
 
     private final AgentControl agents;
     private final Rendezvous rendezvous;
@@ -171,7 +171,7 @@ public final class CompletionResolver implements TurnListener {
     void resolve(String target, InFlight turn) {
         CompletableFuture<Rendezvous.Resolution> waiter = turn == null ? null : turn.waiter();
         if (waiter == null || waiter.isDone()) {
-            // Nobody is blocked on THIS turn (it had no send, or its bridge_reply already won). Skip
+            // Nobody is blocked on THIS turn (it had no send, or its fleet_reply already won). Skip
             // the scrape; resolving the current waiter here would be the CB-116 cross-turn stale reply.
             inFlight.remove(target, turn);
             return;
@@ -197,7 +197,7 @@ public final class CompletionResolver implements TurnListener {
         // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
         // delivery, this turn produced no new output — the boundary belongs to the previous turn's
         // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
-        // a stale answer; the real bridge_reply (or a later genuine completion) resolves it instead.
+        // a stale answer; the real fleet_reply (or a later genuine completion) resolves it instead.
         // A scrape that failed to read is exempt — an empty tail there is "couldn't see", not "no change".
         String baseline = turn.baseline();
         if (!scrapeFailed && baseline != null && baseline.equals(tail)) {
@@ -205,7 +205,7 @@ public final class CompletionResolver implements TurnListener {
                     target);
             return; // keep the in-flight record: a later genuine completion still needs it
         }
-        // CB-578 stage A: a turn that ended with no bridge_reply AND whose scrape matches the
+        // CB-578 stage A: a turn that ended with no fleet_reply AND whose scrape matches the
         // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
         // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
         if (!scrapeFailed) {
@@ -215,7 +215,7 @@ public final class CompletionResolver implements TurnListener {
                 String reason = "backend exhausted (usage limit): " + matchedLine;
                 if (rendezvous.resolveExhausted(waiter, reason)) {
                     inFlight.remove(target, turn);
-                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no bridge_reply; scrape "
+                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no fleet_reply; scrape "
                             + "matched the profile's exhausted pattern): {}", target, reason);
                     // CB-578 stage B: only on the resolution that actually won the race — a late
                     // duplicate must never quarantine a credential twice for one refusal.
@@ -229,7 +229,7 @@ public final class CompletionResolver implements TurnListener {
             inFlight.remove(target, turn);
             if (clipped) {
                 log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
-                                + "member did not call bridge_reply, so the pane tail is partial",
+                                + "member did not call fleet_reply, so the pane tail is partial",
                         target, originalLength, MAX_SCRAPE_CHARS);
             }
             log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
@@ -289,7 +289,7 @@ public final class CompletionResolver implements TurnListener {
 
     /**
      * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
-     * the way {@link dev.ltms.bridged.health.FleetHealthMonitor#coverage} is — so an operator can
+     * the way {@link dev.ltms.fleet.health.FleetHealthMonitor#coverage} is — so an operator can
      * see whether the classification is on, and for which profiles, without reading every
      * profile's config by hand.
      *

bridged/src/main/java/dev/ltms/fleet/inject/ExhaustedPatternLookup.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
 import java.util.regex.Pattern;
 

bridged/src/main/java/dev/ltms/fleet/inject/ExhaustionSink.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
 /**
  * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
@@ -8,7 +8,7 @@ package dev.ltms.bridged.inject;
  *
  * <p>{@link CompletionResolver} knows only {@code target} (a herdr terminal id); it has no notion of
  * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
- * the sink's job — see {@code Bridged.main}'s wiring, which resolves target → session → profile →
+ * the sink's job — see {@code Fleetd.main}'s wiring, which resolves target → session → profile →
  * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
  */
 @FunctionalInterface

bridged/src/main/java/dev/ltms/fleet/inject/Injector.java

@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -81,7 +81,7 @@ public final class Injector {
 
     /**
      * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
-     * {@link #onStatus} at. {@code Bridged} passes this to every {@link StatusPoller} it constructs,
+     * {@link #onStatus} at. {@code Fleetd} passes this to every {@link StatusPoller} it constructs,
      * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
      * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
      * that claims a grace duration.

bridged/src/main/java/dev/ltms/fleet/inject/MemberPresence.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.Set;

bridged/src/main/java/dev/ltms/fleet/inject/StatusPoller.java

@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 

bridged/src/main/java/dev/ltms/fleet/inject/StatusRefiner.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 

bridged/src/main/java/dev/ltms/fleet/inject/TurnListener.java

@@ -1,12 +1,12 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.msg.TurnToken;
 
 /**
  * Notified when a worker's delegated turn is observed to complete — a confirmed
  * {@code WORKING → IDLE} transition after a delivery. This is the CB-106 completion signal the
  * {@code CompletionResolver} uses to resolve a blocked send whose worker never called
- * {@code bridge_reply}. Kept as a seam so the {@link Injector} needs no dependency on the message
+ * {@code fleet_reply}. Kept as a seam so the {@link Injector} needs no dependency on the message
  * layer and stays unit-testable with a capturing fake.
  */
 @FunctionalInterface

bridged/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -1,12 +1,12 @@
-package dev.ltms.bridged.lead;
+package dev.ltms.fleet.lead;
 
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.Tab;
+import dev.ltms.fleet.herdr.Workspace;
+import dev.ltms.fleet.herdr.WorkspaceControl;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -17,6 +17,7 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
 import java.util.stream.Collectors;
+import dev.ltms.fleet.peer.PeerLauncher;
 
 /**
  * Starts the leads {@code fleet.leaders:} declares, when none is already running (CB-558).
@@ -26,7 +27,7 @@ import java.util.stream.Collectors;
  * must never receive:
  * <ol>
  *   <li>it appends the <em>reply charter</em> — "you are an off-subscription worker … end every turn
- *       with {@code bridge_reply}". A lead is the orchestrator; telling it that it is a worker is
+ *       with {@code fleet_reply}". A lead is the orchestrator; telling it that it is a worker is
  *       exactly backwards.</li>
  *   <li>it registers the session with {@code SessionManager}, which subjects it to the idle reaper,
  *       the context cap and the shutdown drain. An idle lead is the normal state of a lead, so the
@@ -54,14 +55,14 @@ public final class LeadLauncher {
 
     private final AgentControl agents;
     private final WorkspaceControl spaces;
-    private final BridgedConfig cfg;
+    private final FleetConfig cfg;
 
     /**
      * @param agents herdr agent control (start, list)
      * @param spaces workspace / tab control (ensure, create, label, list)
      * @param cfg    the loaded config — {@code fleet.leaders}, {@code profiles} and each lead's tab
      */
-    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, BridgedConfig cfg) {
+    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, FleetConfig cfg) {
         this.agents = agents;
         this.spaces = spaces;
         this.cfg = cfg;
@@ -75,7 +76,7 @@ public final class LeadLauncher {
      * the remaining leads are still attempted.
      */
     public int ensureLeads() {
-        Map<String, BridgedConfig.Leader> leaders = cfg.fleet().leaders();
+        Map<String, FleetConfig.Leader> leaders = cfg.fleet().leaders();
         if (leaders.isEmpty()) {
             return 0;
         }
@@ -91,9 +92,9 @@ public final class LeadLauncher {
         }
 
         int started = 0;
-        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
+        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
             String name = e.getKey();
-            BridgedConfig.Leader lead = e.getValue();
+            FleetConfig.Leader lead = e.getValue();
             int running = live.getOrDefault(name, 0);
             int wanted = lead.instances();
 
@@ -110,7 +111,7 @@ public final class LeadLauncher {
                 continue;
             }
 
-            BridgedConfig.Profile profile = cfg.profiles().get(lead.profile());
+            FleetConfig.Profile profile = cfg.profiles().get(lead.profile());
             if (profile == null) {
                 log.warn("lead '{}' names profile '{}', which is not configured — not launching",
                         name, lead.profile());
@@ -138,9 +139,9 @@ public final class LeadLauncher {
      * already carries {@link Agent#tabId()} directly, so a hand-opened lead is found the same way an
      * auto-launched one is — by labelling its tab to match.
      */
-    private Map<String, Integer> liveLeads(Map<String, BridgedConfig.Leader> leaders) {
+    private Map<String, Integer> liveLeads(Map<String, FleetConfig.Leader> leaders) {
         Set<String> memberSpaces = cfg.profiles().values().stream()
-                .map(BridgedConfig.Profile::workspace)
+                .map(FleetConfig.Profile::workspace)
                 .filter(w -> w != null && !w.isBlank())
                 .collect(Collectors.toSet());
 
@@ -174,12 +175,12 @@ public final class LeadLauncher {
      * <p>Matched exactly (case-insensitively) against each lead's configured {@code tab}, so an
      * operator's {@code "lead: something-else"} tab is not mistaken for a configured lead.
      */
-    private String leadNameOf(String label, Map<String, BridgedConfig.Leader> leaders) {
+    private String leadNameOf(String label, Map<String, FleetConfig.Leader> leaders) {
         if (label == null) {
             return null;
         }
         String l = label.strip();
-        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
+        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
             String tab = e.getValue().tabLabel();
             if (tab != null && l.equalsIgnoreCase(tab.strip())) {
                 return e.getKey();
@@ -189,7 +190,7 @@ public final class LeadLauncher {
     }
 
     /** Start one lead. Returns false (having logged) rather than throwing on any failure. */
-    private boolean launch(String name, BridgedConfig.Leader lead, BridgedConfig.Profile profile) {
+    private boolean launch(String name, FleetConfig.Leader lead, FleetConfig.Profile profile) {
         String label = lead.tabLabel();
         String cwd = (lead.cwd() == null || lead.cwd().isBlank())
                 ? System.getProperty("user.dir") : lead.cwd();
@@ -236,7 +237,7 @@ public final class LeadLauncher {
      * The herdr agent kind for this profile — the same value the matching member adapter passes, so
      * herdr resolves the same executable for a lead as it does for a member on that backend.
      */
-    private static String herdrKind(BridgedConfig.Profile profile) {
+    private static String herdrKind(FleetConfig.Profile profile) {
         return profile.isOpenCode() ? "opencode" : "claude";
     }
 
@@ -248,11 +249,12 @@ public final class LeadLauncher {
      * any other primary. This is the single most important difference from the member launchers;
      * do not "unify" it back.
      */
-    private List<String> leadArgv(BridgedConfig.Profile profile) {
+    private List<String> leadArgv(FleetConfig.Profile profile) {
         List<String> argv = new ArrayList<>(profile.argv());
         if (profile.hasMcp()) {
             argv.add("--mcp-config");
-            argv.add("{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
+            argv.add("{\"mcpServers\":{\"" + PeerLauncher.MCP_MOUNT_NAME
+                    + "\":{\"type\":\"http\",\"url\":\""
                     + profile.mcpUrl() + "\"}}}");
         }
         // Appended last, for the same reason the member launcher does it (CB-533): the argv is
@@ -274,7 +276,7 @@ public final class LeadLauncher {
      * definition, so there is no configuration under which pointing it elsewhere is correct, and a
      * profile that carries them (a member profile reused as a lead's backend) must not leak them in.
      */
-    private Map<String, String> leadEnv(BridgedConfig.Profile profile) {
+    private Map<String, String> leadEnv(FleetConfig.Profile profile) {
         Map<String, String> out = new LinkedHashMap<>();
         if (profile.env() != null) {
             out.putAll(profile.env());

bridged/src/main/java/dev/ltms/fleet/logging/McpCancelledNotificationFilter.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.logging;
+package dev.ltms.fleet.logging;
 
 import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.Logger;

bridged/src/main/java/dev/ltms/fleet/mcp/ConnectionIdentity.java

@@ -1,6 +1,6 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;
 
-import dev.ltms.bridged.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.PaneLocator;
 
 /**
  * Resolves <em>who is calling</em> an MCP tool from the connection alone — the anti-spoofing

bridged/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -1,26 +1,26 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;
 
-import dev.ltms.bridged.auth.AuditLog;
-import dev.ltms.bridged.auth.Authz;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.Principal;
-import dev.ltms.bridged.auth.Role;
-import dev.ltms.bridged.guard.GuardException;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.placement.BackendQuarantine;
-import dev.ltms.bridged.placement.PlacementException;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.fleet.auth.AuditLog;
+import dev.ltms.fleet.auth.Authz;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.auth.Role;
+import dev.ltms.fleet.guard.GuardException;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementException;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.WorktreeRequest;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerLauncher;
 import io.modelcontextprotocol.common.McpTransportContext;
 import io.modelcontextprotocol.json.McpJsonMapper;
 import io.modelcontextprotocol.json.jackson3.JacksonMcpJsonMapperSupplier;
@@ -37,35 +37,50 @@ import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.BiFunction;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 /**
  * The MCP SERVER face (CB-105): a Streamable-HTTP MCP server whose tools are <em>thin adapters</em>
  * over the same {@link MessageService}/{@link Rendezvous} the REST routes use — so the two are
- * validated by parity, not by re-implementing behaviour. The primary Opus calls {@code bridge_send}
- * / {@code bridge_status}; the worker calls {@code bridge_reply}.
+ * validated by parity, not by re-implementing behaviour. The primary Opus calls {@code fleet_send}
+ * / {@code fleet_status}; the worker calls {@code fleet_reply}.
  *
- * <p>Beyond delegation the primary also manages the fleet here (CB-108): {@code bridge_spawn} /
- * {@code bridge_list} / {@code bridge_stop} drive the {@link PeerLauncher} SPI so a worker's whole
+ * <p>Beyond delegation the primary also manages the fleet here (CB-108): {@code fleet_spawn} /
+ * {@code fleet_list} / {@code fleet_stop} drive the {@link PeerLauncher} SPI so a worker's whole
  * lifecycle is managed through MCP, with each adapter's subscription boundary enforced inside it.
  *
  * <p>The tool <em>logic</em> lives in package-private static methods returning a
  * {@link McpSchema.CallToolResult}, so it is unit-testable without standing up the HTTP transport;
  * the SDK owns the wire protocol. Mount {@link #servlet()} at {@code /mcp} on the daemon's Jetty.
  */
-public final class BridgeMcp {
+public final class FleetMcp {
+
+    private static final Logger log = LoggerFactory.getLogger(FleetMcp.class);
 
     private static final long DEFAULT_TIMEOUT_MS = 25_000;
     private static final long MAX_TIMEOUT_MS = 120_000;
-    // bridge_ask blocks the WORKER's own MCP call, which its client caps near 60s — default under
+    // fleet_ask blocks the WORKER's own MCP call, which its client caps near 60s — default under
     // that so the bridge returns a clean timeout before the client severs the call (CB-205).
     private static final long ASK_DEFAULT_TIMEOUT_MS = 55_000;
     private static final long ASK_MAX_TIMEOUT_MS = 115_000;
     private static final ObjectMapper MAPPER = new ObjectMapper(); // worker-view JSON projections
 
+    /**
+     * CB-622: the product is renaming {@code bridge_*} tools to {@code fleet_*}. Both names reach
+     * the same handler (registered below); this set makes the "old name used" WARN fire once per
+     * old name for the life of the process, not once per call — a per-name flag, not a numeric
+     * sentinel, so it survives concurrent callers cleanly and reads unambiguously in a log.
+     */
+    private static final Set<String> WARNED_DEPRECATED_NAMES = ConcurrentHashMap.newKeySet();
+
     /** Transport-context key under which the extractor stashes the resolved caller identity. */
     static final String CALLER_TERMINAL = "callerTerminal";
     /** Transport-context key under which the extractor stashes the caller's PID (for cwd inherit). */
@@ -83,7 +98,7 @@ public final class BridgeMcp {
     private final HealthCoverageSource healthCoverage;
     private final QuarantineSource quarantine;
 
-    /** Capacity facts used by {@code bridge_list}; production must supply the placement live count. */
+    /** Capacity facts used by {@code fleet_list}; production must supply the placement live count. */
     public record CapacitySource(Function<String, Integer> liveCount, Function<String, Integer> maxLoad,
                                  Supplier<Set<String>> configuredProfiles, LongSupplier clock) {
         /** Inert test-only source. It omits capacity rather than inventing zero live counts. */
@@ -95,7 +110,7 @@ public final class BridgeMcp {
     public record HealthCoverageSource(Supplier<String> value) { }
 
     /**
-     * CB-578 stage B quarantine facts used by {@code bridge_profiles}: a profile → credential id
+     * CB-578 stage B quarantine facts used by {@code fleet_profiles}: a profile → credential id
      * lookup, plus the shared {@link BackendQuarantine} to read remaining cooldowns off.
      */
     public record QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine) {
@@ -109,10 +124,10 @@ public final class BridgeMcp {
      *                Jetty's context handler and never passes through Javalin's {@code before}
      *                filter, so the REST guard does not cover it.
      * @param metrics registry for auth-failure counting; may be {@code null}
-     * @param quarantine CB-578 stage B facts for {@code bridge_profiles}; required — pass
+     * @param quarantine CB-578 stage B facts for {@code fleet_profiles}; required — pass
      *                   {@link QuarantineSource#none()} for a caller that does not want the feature
      */
-    public BridgeMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
+    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
                      ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine) {
@@ -124,7 +139,7 @@ public final class BridgeMcp {
                 .jsonMapper(json)
                 .mcpEndpoint("/mcp")
                 // Resolve the caller from the connection (peer PID → herdr pane) in one lookup: the
-                // worker terminal for bridge_reply (no spoofable arg), and the PID so bridge_spawn can
+                // worker terminal for fleet_reply (no spoofable arg), and the PID so fleet_spawn can
                 // inherit the primary's cwd (CB-112). Any contact from a worker marks it available
                 // (CB-113) — its MCP initialize is the reliable "the agent is up" signal.
                 .contextExtractor(req -> {
@@ -145,10 +160,10 @@ public final class BridgeMcp {
                             CALLER_NAME, orEmpty(p.name())));
                 })
                 .build();
-        this.server = McpServer.sync(transport)
-                .serverInfo("bridge", "0.1.0")
-                .capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
-                .toolCall(sendTool(), (exchange, req) -> {
+        // CB-622: each handler is built once and reused for BOTH its fleet_* tool and its
+        // deprecated bridge_* twin (registered below), so the two names can never drift apart.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> sendHandler =
+                (exchange, req) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SEND,
                             str(req.arguments(), "sessionId"));
                     if (denied != null) return denied;
@@ -163,7 +178,7 @@ public final class BridgeMcp {
                     String content = str(a, "content");
                     String turnId = str(a, "turnId");
                     if (turnId != null && !turnId.isBlank()) {
-                        // Answering a worker's bridge_ask (CB-205): resolve its blocked question and
+                        // Answering a worker's fleet_ask (CB-205): resolve its blocked question and
                         // block for the worker's reply as it resumes the same turn. This is the same
                         // delegation, so ownership is left untouched (CB-548) — never re-recorded.
                         return answer(messages, turnId, content, timeoutMs(a));
@@ -178,43 +193,49 @@ public final class BridgeMcp {
                     return Boolean.FALSE.equals(a.get("wait"))
                             ? sendAsync(messages, target, content, onAccepted, workers.profiles())
                             : send(messages, target, content, timeoutMs(a), onAccepted, workers.profiles());
-                })
-                // bridge_reply's identity is the CONNECTION, never an argument — so the authz check
-                // is "is this caller a worker at all", and it can only ever reply as itself.
-                .toolCall(replyTool(), (exchange, req) -> {
+                };
+        // fleet_reply's identity is the CONNECTION, never an argument — so the authz check
+        // is "is this caller a worker at all", and it can only ever reply as itself.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> replyHandler =
+                (exchange, req) -> {
                     String self = callerTerminal(exchange);
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.REPLY, self);
                     if (denied != null) return denied;
                     return reply(messages, self, str(req.arguments(), "content"));
-                })
-                // bridge_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
-                .toolCall(askTool(), (exchange, req) -> {
+                };
+        // fleet_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> askHandler =
+                (exchange, req) -> {
                     String self = callerTerminal(exchange);
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.ASK, self);
                     if (denied != null) return denied;
                     return ask(messages, self, str(req.arguments(), "question"), timeoutMs(req.arguments()));
-                })
-                .toolCall(statusTool(), (exchange, req) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> statusHandler =
+                (exchange, req) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return status(messages, str(req.arguments(), "sessionId"));
-                })
-                .toolCall(pollTool(), (exchange, req) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> pollHandler =
+                (exchange, req) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     Map<String, Object> a = req.arguments();
                     return poll(messages, str(a, "ticket"), str(a, "target"));
-                })
-                // CB-307 Increment 3: per-msgId ack (not needed in v1 but supported by the inbox).
-                // Acking removes a reply from the inbox, so it is a drain, not a read.
-                .toolCall(ackTool(), (exchange, req) -> {
+                };
+        // CB-307 Increment 3: per-msgId ack (not needed in v1 but supported by the inbox).
+        // Acking removes a reply from the inbox, so it is a drain, not a read.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> ackHandler =
+                (exchange, req) -> {
                     Map<String, Object> a = req.arguments();
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.DRAIN, str(a, "target"));
                     if (denied != null) return denied;
                     return ack(messages, str(a, "target"), str(a, "msgId"));
-                })
-                // Fleet management (CB-108): spawn/list/stop over ClaudeCodeLauncher.
-                .toolCall(spawnTool(), (exchange, req) -> {
+                };
+        // Fleet management (CB-108): spawn/list/stop over ClaudeCodeLauncher.
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> spawnHandler =
+                (exchange, req) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SPAWN, null);
                     if (denied != null) return denied;
                     String caller = callerTerminal(exchange);
@@ -229,30 +250,72 @@ public final class BridgeMcp {
                     return spawn(sessions, str(a, "profile"), str(a, "role"), str(a, "cwd"), callerCwd,
                             callerTerminal(exchange), worktreeRequest(a),
                             str(a, "sessionName"), str(a, "resumeSessionId"));
-                })
-                .toolCall(listTool(), (exchange, _) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> listHandler =
+                (exchange, _) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine,
                             callers == null ? Map.of() : callers.leads(),
                             callerTerminal(exchange));
-                })
-                .toolCall(stopTool(), (exchange, req) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> stopHandler =
+                (exchange, req) -> {
                     String paneId = str(req.arguments(), "paneId");
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.STOP, paneId);
                     if (denied != null) return denied;
                     return stop(sessions, paneId);
-                })
-                .toolCall(profilesTool(), (exchange, _) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> profilesHandler =
+                (exchange, _) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return profiles(workers, quarantine);
-                })
-                .toolCall(whoamiTool(), (exchange, _) -> {
+                };
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> whoamiHandler =
+                (exchange, _) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return whoami(principal(exchange), sessions);
-                })
+                };
+
+        McpSchema.Tool fleetSend = sendTool();
+        McpSchema.Tool fleetReply = replyTool();
+        McpSchema.Tool fleetAsk = askTool();
+        McpSchema.Tool fleetStatus = statusTool();
+        McpSchema.Tool fleetPoll = pollTool();
+        McpSchema.Tool fleetAck = ackTool();
+        McpSchema.Tool fleetSpawn = spawnTool();
+        McpSchema.Tool fleetList = listTool();
+        McpSchema.Tool fleetStop = stopTool();
+        McpSchema.Tool fleetProfiles = profilesTool();
+        McpSchema.Tool fleetWhoami = whoamiTool();
+
+        this.server = McpServer.sync(transport)
+                .serverInfo("bridge", "0.1.0")
+                .capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
+                .toolCall(fleetSend, sendHandler)
+                .toolCall(deprecatedTwin(fleetSend, "bridge_send"), deprecatedHandler(fleetSend, "bridge_send", sendHandler))
+                .toolCall(fleetReply, replyHandler)
+                .toolCall(deprecatedTwin(fleetReply, "bridge_reply"), deprecatedHandler(fleetReply, "bridge_reply", replyHandler))
+                .toolCall(fleetAsk, askHandler)
+                .toolCall(deprecatedTwin(fleetAsk, "bridge_ask"), deprecatedHandler(fleetAsk, "bridge_ask", askHandler))
+                .toolCall(fleetStatus, statusHandler)
+                .toolCall(deprecatedTwin(fleetStatus, "bridge_status"), deprecatedHandler(fleetStatus, "bridge_status", statusHandler))
+                .toolCall(fleetPoll, pollHandler)
+                .toolCall(deprecatedTwin(fleetPoll, "bridge_poll"), deprecatedHandler(fleetPoll, "bridge_poll", pollHandler))
+                .toolCall(fleetAck, ackHandler)
+                .toolCall(deprecatedTwin(fleetAck, "bridge_ack"), deprecatedHandler(fleetAck, "bridge_ack", ackHandler))
+                .toolCall(fleetSpawn, spawnHandler)
+                .toolCall(deprecatedTwin(fleetSpawn, "bridge_spawn"), deprecatedHandler(fleetSpawn, "bridge_spawn", spawnHandler))
+                .toolCall(fleetList, listHandler)
+                .toolCall(deprecatedTwin(fleetList, "bridge_list"), deprecatedHandler(fleetList, "bridge_list", listHandler))
+                .toolCall(fleetStop, stopHandler)
+                .toolCall(deprecatedTwin(fleetStop, "bridge_stop"), deprecatedHandler(fleetStop, "bridge_stop", stopHandler))
+                .toolCall(fleetProfiles, profilesHandler)
+                .toolCall(deprecatedTwin(fleetProfiles, "bridge_profiles"), deprecatedHandler(fleetProfiles, "bridge_profiles", profilesHandler))
+                .toolCall(fleetWhoami, whoamiHandler)
+                .toolCall(deprecatedTwin(fleetWhoami, "bridge_whoami"), deprecatedHandler(fleetWhoami, "bridge_whoami", whoamiHandler))
                 .build();
         this.authz = callers;
         this.metrics = metrics;
@@ -314,7 +377,7 @@ public final class BridgeMcp {
      * without fabricating an SDK {@code McpSyncServerExchange}.
      *
      * <p>This surface exists because the enforcement was previously unreachable from a test: no
-     * test constructs a {@code BridgeMcp}, so the whole MCP-side gate ran zero times in the suite
+     * test constructs a {@code FleetMcp}, so the whole MCP-side gate ran zero times in the suite
      * while the REST-side equivalent had ten tests. A security control nothing exercises is a
      * claim, not a control.
      *
@@ -335,7 +398,7 @@ public final class BridgeMcp {
         String reason = Authz.isUnauthenticated(caller) ? "unauthenticated" : "forbidden";
         AuditLog.denied(caller, action, target, reason);
         if (metrics != null) {
-            metrics.inc(BridgedMetrics.AUTH_FAILURES, "reason", reason);
+            metrics.inc(FleetMetrics.AUTH_FAILURES, "reason", reason);
         }
         return error(reason + ": " + caller.describe() + " may not " + action);
     }
@@ -406,7 +469,7 @@ public final class BridgeMcp {
     // --- tool logic (thin adapters over the services; unit-testable) ---------------------------
 
     /**
-     * {@code bridge_send}: delegate {@code content} to a worker session and block for its reply.
+     * {@code fleet_send}: delegate {@code content} to a worker session and block for its reply.
      * The configured profiles are required so a profile name can never bypass target validation.
      *
      * (CB-548): {@code onAccepted} records delegator ownership the instant the send is accepted, so
@@ -430,8 +493,8 @@ public final class BridgeMcp {
     }
 
     /**
-     * {@code bridge_send} carrying a {@code turnId}: the primary's answer to a worker's
-     * {@code bridge_ask} (CB-205). Resolves the worker's blocked question and blocks for its reply as
+     * {@code fleet_send} carrying a {@code turnId}: the primary's answer to a worker's
+     * {@code fleet_ask} (CB-205). Resolves the worker's blocked question and blocks for its reply as
      * it resumes the same turn — surfaced to the primary identically to a normal send.
      */
     static McpSchema.CallToolResult answer(MessageService messages, String turnId, String content, Long timeoutMs) {
@@ -443,13 +506,13 @@ public final class BridgeMcp {
     }
 
     /**
-     * {@code bridge_ask} (CB-205): a worker pauses its delegated turn to ask the primary, blocking
+     * {@code fleet_ask} (CB-205): a worker pauses its delegated turn to ask the primary, blocking
      * until the primary answers. The worker is identified by its connection ({@code callerTerminal}),
      * never an argument — a {@code null} means the caller is not a known worker.
      */
     static McpSchema.CallToolResult ask(MessageService messages, String callerTerminal, String question, Long timeoutMs) {
         if (callerTerminal == null) {
-            return error("bridge_ask is for workers only — could not identify the calling worker "
+            return error("fleet_ask is for workers only — could not identify the calling worker "
                     + "from the connection");
         }
         if (isBlank(question)) {
@@ -459,10 +522,10 @@ public final class BridgeMcp {
         MessageService.AskResult r = messages.ask(callerTerminal, question, timeout);
         return switch (r.outcome()) {
             case ANSWERED -> text(r.answer());
-            case NO_WAITER -> error("no primary is awaiting this turn — bridge_ask only works while a "
-                    + "bridge_send delegation is open to answer it");
+            case NO_WAITER -> error("no primary is awaiting this turn — fleet_ask only works while a "
+                    + "fleet_send delegation is open to answer it");
             case TIMED_OUT -> text("[no answer within " + timeout + "ms — the primary did not respond; "
-                    + "proceed on your best judgement, then call bridge_reply to end the turn]");
+                    + "proceed on your best judgement, then call fleet_reply to end the turn]");
         };
     }
 
@@ -470,10 +533,10 @@ public final class BridgeMcp {
     private static McpSchema.CallToolResult formatReply(MessageService.Reply r, long timeout) {
         return switch (r.outcome()) {
             case REPLIED -> text(r.text());
-            // The worker's turn finished but it never called bridge_reply — hand back the scraped
+            // The worker's turn finished but it never called fleet_reply — hand back the scraped
             // transcript tail, flagged so the primary knows it isn't a structured reply.
             case COMPLETED_UNREPLIED -> text(
-                    "[worker finished without a structured bridge_reply — transcript tail follows]\n" + r.text());
+                    "[worker finished without a structured fleet_reply — transcript tail follows]\n" + r.text());
             // The worker ran the turn then wedged (CB-109) — surface the error context.
             case WORKER_FAILED -> text("[worker failed — turn ended in an unrecoverable state]\n" + r.text());
             // The backend refused on a subscription usage limit (CB-578 stage A) — the worker's
@@ -483,7 +546,7 @@ public final class BridgeMcp {
                     + "usage limit]\n" + r.text());
             // The worker paused mid-turn to ask (CB-205) — tell the primary how to answer in-turn.
             case QUESTION -> text("[question] the worker paused to ask before it can finish:\n" + r.text()
-                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + r.turnId()
+                    + "\n\nAnswer it by calling fleet_send again with turnId=\"" + r.turnId()
                     + "\" and content set to your answer; the worker resumes the same turn.");
             case STALE_TURN -> error("that question is no longer open — it timed out or was already "
                     + "answered (turnId stale)");
@@ -493,7 +556,7 @@ public final class BridgeMcp {
     }
 
     /**
-     * {@code bridge_send} with {@code wait:false}: delegate {@code content} and return a ticket
+     * {@code fleet_send} with {@code wait:false}: delegate {@code content} and return a ticket
      * immediately (fire-and-poll), so a long task isn't cut off by the caller's MCP call timeout.
      * The configured profiles are required so a profile name can never bypass target validation.
      *
@@ -510,19 +573,19 @@ public final class BridgeMcp {
             return targetError;
         }
         String ticket = messages.sendAsync(sessionId, content, onAccepted);
-        return text("accepted — task delegated. Poll bridge_poll with ticket=" + ticket);
+        return text("accepted — task delegated. Poll fleet_poll with ticket=" + ticket);
     }
 
     /** A configured profile is never a send target; other unknown values may be herdr-owned panes. */
     private static McpSchema.CallToolResult profileTargetError(String sessionId, Set<String> profiles) {
         if (profiles.contains(sessionId)) {
             return error("unknown send target \"" + sessionId + "\": it is a configured profile name, not a "
-                    + "session id. Call bridge_list to find a member or lead sessionId.");
+                    + "session id. Call fleet_list to find a member or lead sessionId.");
         }
         return null;
     }
 
-    /** {@code bridge_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
+    /** {@code fleet_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
     static McpSchema.CallToolResult poll(MessageService messages, String ticket, String target) {
         if (!isBlank(target)) {
             var replies = messages.drainReplies(target);
@@ -540,25 +603,25 @@ public final class BridgeMcp {
         }
         return switch (v.phase()) {
             case DONE -> text(v.replySource() != null && v.replySource().equals("transcript")
-                    ? "[done — worker finished without a structured bridge_reply; transcript tail follows]\n" + v.reply()
+                    ? "[done — worker finished without a structured fleet_reply; transcript tail follows]\n" + v.reply()
                     : v.reply());
             case PENDING -> text("[pending — " + v.detail() + "]");
             case ASKING -> text("[question — worker is waiting for your answer]\n" + v.reply()
-                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + v.turnId()
+                    + "\n\nAnswer it by calling fleet_send again with turnId=\"" + v.turnId()
                     + "\" and content set to your answer; the worker resumes the same turn.");
             case FAILED -> text("[failed — " + v.detail() + "]");
         };
     }
 
     /**
-     * {@code bridge_reply}: the worker returns its structured answer, resolving the awaiting send
+     * {@code fleet_reply}: the worker returns its structured answer, resolving the awaiting send
      * or — when no send is open — queueing the reply in the inbox for later drain (CB-307).
      * {@code callerTerminal} is resolved from the connection (never an argument); a {@code null}
      * means the caller is not a known worker (e.g. the primary called it by mistake).
      */
     static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, String content) {
         if (callerTerminal == null) {
-            return error("bridge_reply is for workers only — could not identify the calling worker "
+            return error("fleet_reply is for workers only — could not identify the calling worker "
                     + "from the connection");
         }
         if (content == null) {
@@ -568,7 +631,7 @@ public final class BridgeMcp {
         return text("delivered");
     }
 
-    /** {@code bridge_ack}: acknowledge (remove) a specific reply from the inbox. */
+    /** {@code fleet_ack}: acknowledge (remove) a specific reply from the inbox. */
     static McpSchema.CallToolResult ack(MessageService messages, String target, String msgId) {
         if (isBlank(target) || isBlank(msgId)) {
             return error("target and msgId are required");
@@ -578,8 +641,8 @@ public final class BridgeMcp {
     }
 
     /**
-     * {@code bridge_status}: the live lifecycle status of a worker session, plus — when the worker
-     * is paused mid-turn in an async {@code bridge_ask} (CB-582) — the open question and how to
+     * {@code fleet_status}: the live lifecycle status of a worker session, plus — when the worker
+     * is paused mid-turn in an async {@code fleet_ask} (CB-582) — the open question and how to
      * answer it, so a lead on its normal poll cadence does not need the ticket to notice.
      */
     static McpSchema.CallToolResult status(MessageService messages, String sessionId) {
@@ -593,7 +656,7 @@ public final class BridgeMcp {
                 return text(base);
             }
             return text(base + "\n\n[question — worker is waiting for your answer]\n" + ask.question()
-                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + ask.turnId()
+                    + "\n\nAnswer it by calling fleet_send again with turnId=\"" + ask.turnId()
                     + "\" and content set to your answer; the worker resumes the same turn."
                     + " (ticket " + ask.ticket() + ")");
         } catch (HerdrException e) {
@@ -602,7 +665,7 @@ public final class BridgeMcp {
     }
 
     /**
-     * {@code bridge_whoami}: the caller's own identity, as the daemon already resolved it.
+     * {@code fleet_whoami}: the caller's own identity, as the daemon already resolved it.
      *
      * <p>Every other tool <em>consumes</em> this identity — the authorization gate, the reply
      * rendezvous, the cwd inherit — but none reported it, so an agent had to infer its own role
@@ -610,7 +673,7 @@ public final class BridgeMcp {
      * name its MCP mount happens to carry, or {@code ANTHROPIC_BASE_URL} (which Claude-model
      * workers do not set). The failure mode of guessing is asymmetric and silent: a primary that
      * mistakes itself for a worker is refused by {@link Authz} and learns immediately, while a
-     * worker that mistakes itself for the primary ends its turn without {@code bridge_reply} and
+     * worker that mistakes itself for the primary ends its turn without {@code fleet_reply} and
      * the sender simply receives nothing. This tool removes the guess.
      *
      * <p>For a worker the session registry adds what it knows about that session. A worker the
@@ -668,13 +731,13 @@ public final class BridgeMcp {
 
     // --- fleet management logic (CB-108 / CB-301) --------------------------------------------
 
-    /** {@code bridge_spawn} without cwd/caller context (default resolution). */
+    /** {@code fleet_spawn} without cwd/caller context (default resolution). */
     static McpSchema.CallToolResult spawn(SessionManager sessions, String profile) {
         return spawn(sessions, profile, null, null, null, null, null, null, null);
     }
 
     /**
-     * {@code bridge_spawn}: launch a guard-checked member for {@code profile} (blank → the default
+     * {@code fleet_spawn}: launch a guard-checked member for {@code profile} (blank → the default
      * profile) under {@code role} (blank → {@code dev}), and return its session id + pane id. The
      * member's cwd is {@code requestedCwd} if given, else the profile's config, else
      * {@code callerCwd} (the primary's directory), else the daemon's.
@@ -682,7 +745,7 @@ public final class BridgeMcp {
      * CB-301-ext: {@code worktreeRequest} non-null provisions an isolated git worktree.
      * CB-584: {@code sessionName}/{@code resumeSessionId} request agent session identity — a resumed
      * conversation requires an explicit {@code profile} whose adapter declares
-     * {@link dev.ltms.bridged.peer.Capability#SESSION_RESUME}, or the spawn is refused rather than
+     * {@link dev.ltms.fleet.peer.Capability#SESSION_RESUME}, or the spawn is refused rather than
      * silently starting a cold session.
      *
      * <p>{@code role} and {@code profile} are independent: the role picks the contract, the profile
@@ -718,7 +781,7 @@ public final class BridgeMcp {
         }
     }
 
-    /** Build a {@link WorktreeRequest} from {@code bridge_spawn}'s optional {@code worktree}/{@code ticket} args. */
+    /** Build a {@link WorktreeRequest} from {@code fleet_spawn}'s optional {@code worktree}/{@code ticket} args. */
     private static WorktreeRequest worktreeRequest(Map<String, Object> a) {
         Object w = a.get("worktree");
         if (w == null || Boolean.FALSE.equals(w)) {
@@ -747,7 +810,7 @@ public final class BridgeMcp {
     }
 
     /**
-     * {@code bridge_profiles}: the configured worker profiles, the default, and — CB-578 stage B —
+     * {@code fleet_profiles}: the configured worker profiles, the default, and — CB-578 stage B —
      * which of them are currently quarantined (backend exhausted) and for how much longer. The
      * {@code quarantined} key is present only when at least one profile is, so a fleet where nothing
      * has ever been quarantined gets exactly the pre-stage-B shape.
@@ -776,7 +839,7 @@ public final class BridgeMcp {
     }
 
     /**
-     * {@code bridge_list}: the whole fleet — {@code leads} and {@code workers} — each merged with
+     * {@code fleet_list}: the whole fleet — {@code leads} and {@code workers} — each merged with
      * live herdr status. CB-519 decoupled the registry key (a host-unique id) from the herdr pane
      * coordinate, so the join is on the terminal id, which both the session and the live agent carry.
      *
@@ -789,10 +852,10 @@ public final class BridgeMcp {
      * <p>Leads are drawn from the resolver rather than from a second registry, so an address listed
      * here is one that would actually resolve as a lead — see {@link CallerResolver#leads()}. The
      * caller's own row is flagged {@code "self": true}: a peer needs to tell its own pane apart from
-     * a peer's, and the alternative is every lead calling {@code bridge_whoami} to subtract itself.
+     * a peer's, and the alternative is every lead calling {@code fleet_whoami} to subtract itself.
      *
      * <p>CB-583: the {@code capacity} rows reuse {@code quarantine} (the same {@link QuarantineSource}
-     * {@code bridge_profiles} reads) so the two surfaces cannot disagree about which profile is
+     * {@code fleet_profiles} reads) so the two surfaces cannot disagree about which profile is
      * quarantined — see {@link #capacityView}.
      *
      * @param leads    terminal_id → lead name, live from the resolver
@@ -856,7 +919,7 @@ public final class BridgeMcp {
      * CB-583: {@code free} alone cannot tell a lead "busy, will free up" from "refusing, and
      * nothing changes for N seconds" — those need different decisions. So a quarantined profile
      * forces {@code free} to 0, whatever its {@code maxLoad}/{@code live} say, and the row carries
-     * the same {@code credentialId}/{@code quarantinedForSeconds} facts {@code bridge_profiles}
+     * the same {@code credentialId}/{@code quarantinedForSeconds} facts {@code fleet_profiles}
      * reports, reusing {@link QuarantineSource} rather than a second lookup. Both new keys are
      * added only when the profile is actually quarantined, so an ordinary fleet's rows are
      * byte-identical to before this change.
@@ -889,7 +952,7 @@ public final class BridgeMcp {
      *
      * <p>{@code status} is herdr's live view, and {@code unknown} when herdr is not tracking that
      * pane as an agent — the honest answer, and the one that matters: a lead whose pane herdr cannot
-     * see is a lead a {@code bridge_send} cannot be typed into. It is reported rather than hidden,
+     * see is a lead a {@code fleet_send} cannot be typed into. It is reported rather than hidden,
      * because a peer that has gone unreachable is exactly what the sender needs to know.
      */
     private static Map<String, Object> leadView(String terminal, String name, Agent live,
@@ -905,7 +968,7 @@ public final class BridgeMcp {
         return m;
     }
 
-    /** {@code bridge_stop}: tear a worker down by its pane id. */
+    /** {@code fleet_stop}: tear a worker down by its pane id. */
     static McpSchema.CallToolResult stop(SessionManager sessions, String paneId) {
         if (isBlank(paneId)) {
             return error("paneId is required");
@@ -948,25 +1011,25 @@ public final class BridgeMcp {
     // --- tool schemas --------------------------------------------------------------------------
 
     private static McpSchema.Tool sendTool() {
-        return tool("bridge_send",
+        return tool("fleet_send",
                 "Delegate a task to a worker session. By default blocks until the worker replies and "
                         + "returns its reply (or a 'still working / queued' note on timeout). Pass wait:false "
-                        + "for a long task to return a ticket immediately, then poll it with bridge_poll. To "
-                        + "answer a worker's bridge_ask, pass its turnId (with content) instead of sessionId.",
+                        + "for a long task to return a ticket immediately, then poll it with fleet_poll. To "
+                        + "answer a worker's fleet_ask, pass its turnId (with content) instead of sessionId.",
                 objectSchema(Map.of(
                         "sessionId", stringProp("The worker session id (herdr terminal_id) to delegate to"),
                         "content", stringProp("The task/message to send to the worker (or your answer, with turnId)"),
                         "timeoutMs", Map.of("type", "integer", "description", "Max ms to wait for a reply (blocking mode)"),
                         "wait", Map.of("type", "boolean",
                                 "description", "Block for the reply (default true); false returns a ticket to poll"),
-                        "turnId", stringProp("When answering a worker's bridge_ask, its question turnId — "
+                        "turnId", stringProp("When answering a worker's fleet_ask, its question turnId — "
                                 + "routes your answer back into the same turn (omit for a normal delegation)")),
                         List.of("content")));
     }
 
     private static McpSchema.Tool askTool() {
         // No target/session arg — the worker's identity is resolved from the connection.
-        return tool("bridge_ask",
+        return tool("fleet_ask",
                 "Pause your current delegated turn to ask the primary a question, blocking until it "
                         + "answers — then resume the same turn with the answer. Use this when only the "
                         + "primary has a decision or detail you need to continue. You do not address the "
@@ -979,19 +1042,19 @@ public final class BridgeMcp {
     }
 
     private static McpSchema.Tool pollTool() {
-        return tool("bridge_poll",
-                "Check an async delegation (a bridge_send with wait:false) by its ticket: "
+        return tool("fleet_poll",
+                "Check an async delegation (a fleet_send with wait:false) by its ticket: "
                         + "pending, done (with the worker's reply), or failed. When target (a worker "
                         + "session id) is present instead of ticket, drain that worker's inbox of "
                         + "replies delivered when no send was open.",
                 objectSchema(Map.of(
-                        "ticket", stringProp("The ticket returned by bridge_send wait:false"),
+                        "ticket", stringProp("The ticket returned by fleet_send wait:false"),
                         "target", stringProp("Worker session id to drain pending replies from (optional)")),
                         List.of()));
     }
 
     private static McpSchema.Tool ackTool() {
-        return tool("bridge_ack",
+        return tool("fleet_ack",
                 "Acknowledge (remove) a specific reply from a worker's inbox. Use when the primary "
                         + "has processed a reply and wants to confirm it, leaving other pending replies "
                         + "in the inbox for later drain.",
@@ -1002,22 +1065,22 @@ public final class BridgeMcp {
     }
 
     private static McpSchema.Tool spawnTool() {
-        return tool("bridge_spawn",
+        return tool("fleet_spawn",
                 "Spawn a new off-subscription member session. A member has two independent attributes: "
                         + "role (what it is for) and profile (which backend it runs on). Pass role to pick "
                         + "the contract — 'dev' implements a unit and opens its own PR, 'reviewer' reviews a "
                         + "diff it did not write, 'architect' refines a ticket before anyone builds it; omit "
-                        + "it for 'dev'. Pass profile (from bridge_profiles) to pick the backend, or omit it "
+                        + "it for 'dev'. Pass profile (from fleet_profiles) to pick the backend, or omit it "
                         + "for the default. The two are independent: a reviewer may run on the same profile "
                         + "as the dev it reviews. The member opens your current directory by default; pass "
                         + "cwd to pin a different one. Pass worktree:true (with ticket) or "
                         + "worktree:<ticket-slug> to provision an isolated git worktree. Pass resumeSessionId "
                         + "to relaunch onto a prior conversation instead of starting cold — this requires an "
-                        + "explicit profile whose backend supports it (bridge_list shows agentSessionId for "
+                        + "explicit profile whose backend supports it (fleet_list shows agentSessionId for "
                         + "resumable members), and is refused otherwise rather than silently starting fresh. "
                         + "sessionName gives the member a display name in its own UI when the backend supports "
-                        + "one. Returns the member's sessionId (use with bridge_send) and paneId (use with "
-                        + "bridge_stop).",
+                        + "one. Returns the member's sessionId (use with fleet_send) and paneId (use with "
+                        + "fleet_stop).",
                 objectSchema(Map.of(
                         "role", stringProp("What the member is for: architect, dev or reviewer (default dev)"),
                         "profile", stringProp("Which backend to run it on (omit for the default profile)"),
@@ -1025,33 +1088,33 @@ public final class BridgeMcp {
                         "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
                         "ticket", stringProp("Ticket slug when worktree:true"),
                         "sessionName", stringProp("Logical display name for the member's own session, when its backend supports one"),
-                        "resumeSessionId", stringProp("A prior member's agentSessionId (from bridge_list) to resume — requires an explicit profile that supports it")),
+                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it")),
                         List.of()));
     }
 
     private static McpSchema.Tool profilesTool() {
-        return tool("bridge_profiles",
-                "List the configured worker profiles (backends) and which one bridge_spawn uses by "
+        return tool("fleet_profiles",
+                "List the configured worker profiles (backends) and which one fleet_spawn uses by "
                         + "default. A 'quarantined' map is present when a backend-exhausted refusal put "
-                        + "a profile's credential on cooldown — bridge_spawn onto it is refused until "
+                        + "a profile's credential on cooldown — fleet_spawn onto it is refused until "
                         + "quarantinedForSeconds elapses; a profile sharing that credential is listed too.",
                 objectSchema(Map.of(), List.of()));
     }
 
     private static McpSchema.Tool listTool() {
-        return tool("bridge_list",
+        return tool("fleet_list",
                 "List the whole fleet the bridge tracks, in two parts. 'leads' are your PEERS — other "
-                        + "orchestrators, each with its sessionId (the address to bridge_send to), "
+                        + "orchestrators, each with its sessionId (the address to fleet_send to), "
                         + "name, live status, and 'self': true on your own row; this is how you "
                         + "discover a peer lead without being told its address. 'members' are the "
                         + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
                         + "reviewer), profile (the backend it runs on), state, optional "
-                        + "worktree/branch/owner/agentSessionId (the id to pass as bridge_spawn's "
+                        + "worktree/branch/owner/agentSessionId (the id to pass as fleet_spawn's "
                         + "resumeSessionId to relaunch onto that same conversation, when the backend "
                         + "supports it), and live herdr status. An empty 'members' "
                         + "means no members are spawned; it says nothing about peers. When capacity "
                         + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
-                        + "a quarantined profile's credential (see bridge_profiles), whatever its "
+                        + "a quarantined profile's credential (see fleet_profiles), whatever its "
                         + "maxLoad/live — with credentialId and quarantinedForSeconds naming the "
                         + "quarantine, so 'free: 0, busy' can be told apart from 'free: 0, refusing "
                         + "for N seconds'.",
@@ -1059,8 +1122,8 @@ public final class BridgeMcp {
     }
 
     private static McpSchema.Tool stopTool() {
-        return tool("bridge_stop",
-                "Tear down a worker session by its paneId (from bridge_spawn or bridge_list).",
+        return tool("fleet_stop",
+                "Tear down a worker session by its paneId (from fleet_spawn or fleet_list).",
                 objectSchema(Map.of(
                         "paneId", stringProp("The worker's paneId to stop")),
                         List.of("paneId")));
@@ -1068,9 +1131,9 @@ public final class BridgeMcp {
 
     private static McpSchema.Tool replyTool() {
         // No session/target arg — the caller's identity is resolved from the connection.
-        return tool("bridge_reply",
+        return tool("fleet_reply",
                 "Return your structured answer for a message you were sent, resolving the sender's "
-                        + "blocked bridge_send. A worker MUST end every delegated turn with exactly "
+                        + "blocked fleet_send. A worker MUST end every delegated turn with exactly "
                         + "one of these. A lead uses it only to answer another lead that messaged "
                         + "it — never to answer a worker, whose turn it is not.",
                 objectSchema(Map.of(
@@ -1079,7 +1142,7 @@ public final class BridgeMcp {
     }
 
     private static McpSchema.Tool statusTool() {
-        return tool("bridge_status",
+        return tool("fleet_status",
                 "Get the live lifecycle status (idle/working/blocked/unknown) of a worker session.",
                 objectSchema(Map.of(
                         "sessionId", stringProp("The worker session id to query")),
@@ -1087,20 +1150,58 @@ public final class BridgeMcp {
     }
 
     private static McpSchema.Tool whoamiTool() {
-        return tool("bridge_whoami",
+        return tool("fleet_whoami",
                 "Report who YOU are on the bridge — your role is resolved from your connection "
                         + "(unforgeable), never from anything you claim. Returns role 'primary' (you "
                         + "orchestrate: spawn/send/stop; reply ONLY to answer a peer lead that "
                         + "messaged you, never to answer a worker), 'architect' (you delegate turns "
                         + "and reply/ask as your own pane, but cannot spawn/stop/drain), or 'worker' "
                         + "(you were delegated to: you must end every turn with exactly one "
-                        + "bridge_reply, and cannot spawn or send), plus 'leader'/'architect' naming "
+                        + "fleet_reply, and cannot spawn or send), plus 'leader'/'architect' naming "
                         + "which one you are, your own sessionId, and profile/worktree/branch when "
                         + "you are a worker. Call this first when following role-conditional "
                         + "instructions rather than guessing.",
                 objectSchema(Map.of(), List.of()));
     }
 
+    // --- CB-622: bridge_* -> fleet_* rename, kept working under both names -------------------
+
+    /**
+     * The deprecated {@code bridge_*} twin of {@code fleetTool}: same name-minus-prefix schema,
+     * with a description that leads with the deprecation notice so a client listing tools sees it
+     * immediately. Reuses {@code fleetTool}'s input schema rather than restating it, so the two
+     * can never drift on parameters.
+     */
+    static McpSchema.Tool deprecatedTwin(McpSchema.Tool fleetTool, String oldName) {
+        return tool(oldName, "DEPRECATED: use " + fleetTool.name() + " instead. " + fleetTool.description(),
+                fleetTool.inputSchema());
+    }
+
+    /**
+     * Wrap {@code handler} so a call under the deprecated {@code oldName} logs one WARN naming
+     * the old and new name, then runs the exact SAME handler {@code fleetTool}'s name uses — no
+     * logic is duplicated between the two registrations.
+     */
+    static BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> deprecatedHandler(
+            McpSchema.Tool fleetTool, String oldName,
+            BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> handler) {
+        return (exchange, req) -> {
+            warnDeprecatedOnce(oldName, fleetTool.name());
+            return handler.apply(exchange, req);
+        };
+    }
+
+    /**
+     * Log one WARN naming {@code oldName} and {@code newName} — once per {@code oldName} for the
+     * life of the process, not once per call. {@link #WARNED_DEPRECATED_NAMES} is a per-name flag
+     * (a {@link Set}), not a call counter, so this never conflates "warned" with any numeric state.
+     */
+    static void warnDeprecatedOnce(String oldName, String newName) {
+        if (WARNED_DEPRECATED_NAMES.add(oldName)) {
+            log.warn("{} is deprecated; use {} instead", oldName, newName);
+        }
+    }
+
     // --- small helpers -------------------------------------------------------------------------
 
     // The SDK 2.0.0 deprecates its own Tool builders without a stable replacement — isolate it here.

bridged/src/main/java/dev/ltms/fleet/mcp/LsofPeerPidLookup.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

bridged/src/main/java/dev/ltms/fleet/mcp/LsofProcessCwdLookup.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

bridged/src/main/java/dev/ltms/fleet/mcp/PeerPidLookup.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;
 
 /**
  * Resolves the OS PID that owns a loopback TCP source port — the OS half of connection-based MCP

bridged/src/main/java/dev/ltms/fleet/mcp/PrimaryRegistry.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -11,7 +11,7 @@ import java.util.concurrent.atomic.AtomicReference;
  * Single-slot, thread-safe registry for the primary's herdr {@code terminal_id}.
  *
  * <p>Populated from the caller terminal of orchestration-side MCP tools
- * ({@code bridge_send}, {@code bridge_spawn}) — tools that only the primary calls.
+ * ({@code fleet_send}, {@code fleet_spawn}) — tools that only the primary calls.
  * A pinned terminal (from config) seeds the registry at construction and makes
  * subsequent {@link #record(String)} calls no-ops.
  *
@@ -29,7 +29,7 @@ public final class PrimaryRegistry {
     /**
      * CB-532: worker terminal → the lead that delegated to it. The single slot above answers "who is
      * THE primary", a question with no correct answer once two leads orchestrate the same fleet:
-     * whichever called {@code bridge_send} first captured every nudge, including nudges for the
+     * whichever called {@code fleet_send} first captured every nudge, including nudges for the
      * other lead's delegations. This map answers the question that actually matters — "who is
      * waiting on THIS worker" — and is what lets {@code primary.terminal} be retired.
      */
@@ -71,7 +71,7 @@ public final class PrimaryRegistry {
      *
      * <p>Called from the {@code MessageService} accepted-delivery hook — only after a send has won
      * the session's send lock and queued delivery — where both halves are known (CB-548). It is
-     * deliberately <em>not</em> called at {@code bridge_send} request time: a concurrent sender that
+     * deliberately <em>not</em> called at {@code fleet_send} request time: a concurrent sender that
      * times out {@code BUSY} must not steal a live delegation's reply routing without ever owning
      * the turn. Last writer wins — if a second lead's later send is accepted, replies follow the
      * lead that most recently delegated to it, which is the one waiting.

bridged/src/main/java/dev/ltms/fleet/mcp/ProcessCwdLookup.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;
 
 /**
  * Resolves a process's current working directory from its PID — the OS half of CB-112's

bridged/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -1,14 +1,19 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;
 
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.PeerLauncher;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.EnumSet;
 import java.util.List;
 import java.util.Map;
@@ -49,7 +54,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * existing deployments and tests keep the legacy non-blocking spawn semantics.
      */
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env) {
         this(agents, spaces, guard, profiles, defaultProfile, env, 0,
                 System::currentTimeMillis, () -> sleepUninterruptibly(300));
@@ -60,7 +65,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
      */
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env,
                               long spawnReadyTimeoutMs, long spawnReadyPollMs) {
         this(agents, spaces, guard, profiles, defaultProfile, env,
@@ -73,10 +78,10 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
      */
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env,
                               long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<BridgedConfig.Fleet> fleet) {
+                              Supplier<FleetConfig.Fleet> fleet) {
         this(agents, spaces, guard, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs,
                 System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
@@ -87,11 +92,11 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
      */
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env,
                               long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
         this(agents, spaces, guard, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs,
                 System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
@@ -116,7 +121,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      *                             (poll ms) is accepted for API symmetry but otherwise unused here
      */
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env,
                               long spawnReadyTimeoutMs,
                               LongSupplier nowMillis, Runnable sleeper) {
@@ -130,11 +135,11 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * @param fleet live fleet config, read once for each spawn
      */
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env,
                               long spawnReadyTimeoutMs,
                               LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet) {
+                              Supplier<FleetConfig.Fleet> fleet) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
         this.guard = guard;
@@ -144,12 +149,12 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
      */
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env,
                               long spawnReadyTimeoutMs,
                               LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
         this.guard = guard;
@@ -161,12 +166,12 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * default (the real {@code System.getenv()} key set) via the constructor above.
      */
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env,
                               long spawnReadyTimeoutMs,
                               LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials,
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials,
                               Supplier<Set<String>> hostEnvNames) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, hostEnvNames);
@@ -183,7 +188,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * applied here — see {@link #applySessionIdentity}.
      */
     @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
         // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
         // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
         // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
@@ -228,9 +233,9 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
         // id via -r and passes no --session-id (the two conflict). Both are injected before the
         // model flag so --model keeps outranking the operator's own argv.
-        // mutableArgv: argvWithBridge may hand back the profile's own (immutable) List.of when it
+        // mutableArgv: argvWithFleet may hand back the profile's own (immutable) List.of when it
         // has neither MCP nor a charter — session flags must be added into a list we own.
-        List<String> argv = mutableArgv(argvWithBridge(cfg, spec.charter()));
+        List<String> argv = mutableArgv(argvWithFleet(cfg, spec));
         String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
         return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
     }
@@ -265,29 +270,80 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     }
 
     /**
-     * The launch argv, plus an inline {@code --mcp-config} when {@code worker.mcpUrl} is set and
-     * {@code --append-system-prompt} when the base composed a charter. Neither touches the profile's
-     * config; both are pure command-line flags. This inline-flag mount is Claude Code specific —
-     * other adapters mount MCP and instructions their own way.
+     * The launch argv, plus an inline {@code --mcp-config} when {@code worker.mcpUrl} is set, the
+     * CB-617 charter flags, and {@code --agent <role>} when the role has an agent-definition file
+     * under the worker's cwd. Neither touches the profile's config; all are pure command-line flags.
+     * This inline-flag mount is Claude Code specific — other adapters mount MCP and instructions
+     * their own way.
+     *
+     * <p>CB-617: the role charter is operator-authored and often multi-line, so it can never be a
+     * single inline argv element — herdr refuses to shell-encode a multi-line argument
+     * ({@code invalid_agent_argument}). It is written to a temp file instead and mounted with
+     * {@code --append-system-prompt-file}, which this host confirms Claude Code accepts for a
+     * multi-line file.
+     *
+     * <p>CB-618: Claude Code refuses to start when BOTH {@code --append-system-prompt} and
+     * {@code --append-system-prompt-file} are on the command line ("Cannot use both ... Please use
+     * only one"), so the two charters can never travel on separate flags. When both are present they
+     * are concatenated into the one file, role charter first and reply charter last — last is where
+     * the reply rule must sit, because it is the rule that must survive. When only the reply charter
+     * is present it keeps its proven inline {@code --append-system-prompt} delivery, which is also
+     * the only form that reaches a member with no repo checkout.
      */
-    private List<String> argvWithBridge(BridgedConfig.Profile cfg, String charter) {
-        if (!cfg.hasMcp() && charter == null) {
+    private List<String> argvWithFleet(FleetConfig.Profile cfg, LaunchSpec spec) {
+        String roleCharter = nonBlank(spec.roleCharter());
+        String replyCharter = nonBlank(spec.replyCharter());
+        Path agentFile = agentDefinitionFile(spec.cwd(), spec.role(), ".claude", "agents");
+        if (!cfg.hasMcp() && roleCharter == null && replyCharter == null && agentFile == null) {
             return cfg.argv();
         }
         List<String> argv = mutableArgv(cfg.argv());
         if (cfg.hasMcp()) {
-            String mcpJson = "{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
+            String mcpJson = "{\"mcpServers\":{\"" + PeerLauncher.MCP_MOUNT_NAME
+                    + "\":{\"type\":\"http\",\"url\":\""
                     + cfg.mcpUrl() + "\"}}}";
             argv.add("--mcp-config");
             argv.add(mcpJson);
         }
-        if (charter != null) {
+        if (roleCharter != null) {
+            String combined = replyCharter == null ? roleCharter : roleCharter + "\n\n" + replyCharter;
+            argv.add("--append-system-prompt-file");
+            argv.add(writeCharterFile(combined).toString());
+        } else if (replyCharter != null) {
             argv.add("--append-system-prompt");
-            argv.add(charter);
+            argv.add(replyCharter);
+        }
+        if (agentFile != null) {
+            argv.add("--agent");
+            argv.add(spec.role().wireName());
         }
         return argv;
     }
 
+    /** {@code s}, or {@code null} when {@code s} is null/blank — the charter-presence test used above. */
+    private static String nonBlank(String s) {
+        return (s == null || s.isBlank()) ? null : s;
+    }
+
+    /**
+     * Write the role charter to a fresh temp file so it can be mounted with
+     * {@code --append-system-prompt-file} instead of riding inline in argv (CB-617). Best-effort
+     * cleaned via {@code deleteOnExit} — the same disposable-worker-config cleanup
+     * {@link OpenCodeLauncher#writeConfig} already uses for its charter file, since the process that
+     * reads this file (the spawned peer) outlives this JVM call and there is no spawn-scoped teardown
+     * hook to delete it synchronously.
+     */
+    private static Path writeCharterFile(String charterText) {
+        try {
+            Path file = Files.createTempFile("bridged-role-charter-", ".md");
+            Files.writeString(file, charterText);
+            file.toFile().deleteOnExit();
+            return file;
+        } catch (IOException e) {
+            throw new UncheckedIOException("cannot write role charter temp file", e);
+        }
+    }
+
     /**
      * Pin the model on the command line as well as in {@code ANTHROPIC_MODEL} (CB-533).
      *
@@ -304,7 +360,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
      * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
      */
-    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+    private static List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
         if (cfg.model() == null || cfg.model().isBlank()) {
             return argv;
         }
@@ -357,7 +413,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
 
     /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
     private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
     }
 
     // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------

bridged/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java

@@ -1,19 +1,19 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;
 
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
-import dev.ltms.bridged.placement.BackendQuarantine;
-import dev.ltms.bridged.placement.PlacementCandidate;
-import dev.ltms.bridged.placement.PlacementContext;
-import dev.ltms.bridged.placement.PlacementException;
-import dev.ltms.bridged.placement.PlacementPolicies;
-import dev.ltms.bridged.placement.PlacementPolicy;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementCandidate;
+import dev.ltms.fleet.placement.PlacementContext;
+import dev.ltms.fleet.placement.PlacementException;
+import dev.ltms.fleet.placement.PlacementPolicies;
+import dev.ltms.fleet.placement.PlacementPolicy;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -78,7 +78,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
      * this way is the set of adapters ({@link #byProfile}), because a new backend needs a launcher
      * and launchers are built once; {@code ConfigRef} classifies that as deferred and says so.
      */
-    private final Supplier<Map<String, BridgedConfig.Profile>> profileConfigs;
+    private final Supplier<Map<String, FleetConfig.Profile>> profileConfigs;
     private final Supplier<PlacementPolicy> placementPolicy;
 
     /** CB-578 stage B: credential cooldown, checked before an explicit spawn and filtered into placement. */
@@ -89,7 +89,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
      * {@code null}, and an empty pool for a role, both fall back to every configured profile — the
      * pre-CB-557 behaviour.
      */
-    private final Supplier<BridgedConfig.Fleet> fleet;
+    private final Supplier<FleetConfig.Fleet> fleet;
 
     /**
      * Backward-compatible constructor: fixed placement, no live-counting. Use this for tests and
@@ -119,7 +119,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
      */
     public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                  String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                  PlacementPolicy placementPolicy,
                                  Function<String, Integer> liveCount) {
         this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, null, BackendQuarantine.none());
@@ -136,27 +136,27 @@ public final class CompositePeerLauncher implements PeerLauncher {
      */
     public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                  String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                  PlacementPolicy placementPolicy,
                                  Function<String, Integer> liveCount,
-                                 BridgedConfig.Fleet fleet) {
+                                 FleetConfig.Fleet fleet) {
         this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, fleet, BackendQuarantine.none());
     }
 
     /**
      * Production constructor with role pools and quarantine (CB-578 stage B). The full-featured
      * non-reloading form; {@link #CompositePeerLauncher(List, String, Supplier, Function, BackendQuarantine)}
-     * is what {@code Bridged.main} actually wires up.
+     * is what {@code Fleetd.main} actually wires up.
      *
      * @param quarantine required — pass {@link BackendQuarantine#none()} for a caller that does not
      *                   want the feature, never a defaulting overload (CB-578 stage B's own rule).
      */
     public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                  String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                  PlacementPolicy placementPolicy,
                                  Function<String, Integer> liveCount,
-                                 BridgedConfig.Fleet fleet,
+                                 FleetConfig.Fleet fleet,
                                  BackendQuarantine quarantine) {
         // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
         // policy breaks exact-weight ties on it, so a salted iteration order would make placement
@@ -175,7 +175,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
      */
     public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                  String defaultProfile,
-                                 Supplier<BridgedConfig> config,
+                                 Supplier<FleetConfig> config,
                                  Function<String, Integer> liveCount,
                                  BackendQuarantine quarantine) {
         this(delegates, defaultProfile,
@@ -189,10 +189,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
     /** The all-suppliers form every other constructor funnels into. */
     private CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                   String defaultProfile,
-                                  Supplier<Map<String, BridgedConfig.Profile>> profileConfigs,
+                                  Supplier<Map<String, FleetConfig.Profile>> profileConfigs,
                                   Supplier<PlacementPolicy> placementPolicy,
                                   Function<String, Integer> liveCount,
-                                  Supplier<BridgedConfig.Fleet> fleet,
+                                  Supplier<FleetConfig.Fleet> fleet,
                                   BackendQuarantine quarantine) {
         this.fleet = fleet;
         this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
@@ -214,7 +214,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
                 }
             }
         }
-        // Order-preserving for the same reason, and because profiles() is user-visible (bridge_profiles).
+        // Order-preserving for the same reason, and because profiles() is user-visible (fleet_profiles).
         this.byProfile = Collections.unmodifiableMap(index);
     }
 
@@ -229,8 +229,8 @@ public final class CompositePeerLauncher implements PeerLauncher {
      * <p>Read fresh on every call so a reload is visible; a caller that needs two consistent reads
      * takes one local, as {@link #poolFor} does.
      */
-    private Map<String, BridgedConfig.Profile> profiles0() {
-        Map<String, BridgedConfig.Profile> m = profileConfigs.get();
+    private Map<String, FleetConfig.Profile> profiles0() {
+        Map<String, FleetConfig.Profile> m = profileConfigs.get();
         return m == null ? Map.of() : m;
     }
 
@@ -254,7 +254,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
         String requestedProfile = req.profileName();
         if (requestedProfile != null && !requestedProfile.isBlank()) {
             // An explicit profile bypasses the placement policy, but not the capacity cap: maxLoad
-            // is documented as an unconditional limit on this profile (BridgedConfig.Profile), and
+            // is documented as an unconditional limit on this profile (FleetConfig.Profile), and
             // the charter makes explicit-profile spawns the normal path — so skipping the check
             // here would leave the cap dead config in real operation.
             HerdrPeerLauncher d = route(requestedProfile);
@@ -267,7 +267,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
 
         // CB-557: an unqualified spawn is placed inside the pool of the role it asked for, not across
         // the whole profile list. An EXPLICIT profile (above) is left alone on purpose — it is the
-        // operator overriding, and refusing it would break `bridge_spawn{profile:"opus"}`, which
+        // operator overriding, and refusing it would break `fleet_spawn{profile:"opus"}`, which
         // carries no role and so would be judged against the dev pool it was never meant for.
         List<PlacementCandidate> candidates = candidates(req.role());
         String roleDefault = defaultProfileFor(req.role());
@@ -317,7 +317,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     /**
      * Refuse an explicit-profile spawn when the profile is at its {@code maxLoad} cap.
      *
-     * <p>maxLoad is a documented, unconditional capacity limit (see {@code BridgedConfig.Profile#maxLoad}),
+     * <p>maxLoad is a documented, unconditional capacity limit (see {@code FleetConfig.Profile#maxLoad}),
      * and the charter makes explicit-profile spawns the normal path — so enforcing it only in placement
      * ({@code PlacementPolicyUtil}, package-private, hence not linked) would leave the cap dead config
      * on every call that names a profile. Same rule as placement: {@code live >= cap} is at capacity.
@@ -359,7 +359,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
 
     /** {@code profile}'s credential group (CB-578 stage B), or the profile's own name if unconfigured. */
     private String credentialIdFor(String profile) {
-        BridgedConfig.Profile cfg = profiles0().get(profile);
+        FleetConfig.Profile cfg = profiles0().get(profile);
         return cfg == null ? profile : cfg.effectiveCredentialId();
     }
 
@@ -377,7 +377,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
         // until CB-585: an explicit `maxLoad: 0` now survives as 0 and is a real cap of zero, so the
         // check below refuses every spawn on that profile, and a negative value is refused at config
         // load rather than normalized away.
-        BridgedConfig.Profile cfg = profiles0().get(profile);
+        FleetConfig.Profile cfg = profiles0().get(profile);
         Integer cap = (cfg == null) ? null : cfg.maxLoad();
         if (cap == null) {
             return;
@@ -398,8 +398,8 @@ public final class CompositePeerLauncher implements PeerLauncher {
      * a pool entry with no profile, so a survivor is a profile this particular composite does not own.
      */
     private List<String> poolFor(MemberRole role) {
-        Map<String, BridgedConfig.Profile> configured = profiles0();
-        BridgedConfig.Fleet f = fleet.get();
+        Map<String, FleetConfig.Profile> configured = profiles0();
+        FleetConfig.Fleet f = fleet.get();
         List<String> pool = (f == null) ? List.of() : f.profilesFor(role);
         List<String> known = pool.stream().filter(configured::containsKey).toList();
         return known.isEmpty() ? List.copyOf(configured.keySet()) : known;
@@ -415,7 +415,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     private List<PlacementCandidate> candidates(MemberRole role) {
         List<PlacementCandidate> out = new ArrayList<>();
         for (String name : poolFor(role)) {
-            BridgedConfig.Profile w = profiles0().get(name);
+            FleetConfig.Profile w = profiles0().get(name);
             if (w != null) {
                 out.add(new PlacementCandidate(name, null, w.weight(), w.maxLoad()));
             }

bridged/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -0,0 +1,276 @@
+package dev.ltms.fleet.member;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Stream;
+
+/**
+ * CB-633: generates the per-spawn {@code ZDOTDIR} directory whose startup files enforce
+ * {@code memberCredentials.policy: allow-list}.
+ *
+ * <p>The seam: zsh reads its startup files from {@code $ZDOTDIR}, and the daemon puts that variable
+ * in the pane-creation env map. The operator's whole chain ({@code ~/.zshrc} → secret store) runs
+ * inside those files, so a scrub appended to the LAST one runs after everything the operator
+ * sourced, and nothing later can re-export over it. This is the property CB-596's env-overlay
+ * control lacked: herdr applies that overlay BEFORE the shell starts, so any sourced file can undo
+ * it — and did.
+ *
+ * <p><b>Which file is last depends on the platform, so the scrub runs from two of them.</b> zsh
+ * reads {@code .zshenv} always, {@code .zprofile} and {@code .zlogin} only for a LOGIN shell, and
+ * {@code .zshrc} only for an INTERACTIVE one. herdr does not open the same kind of shell
+ * everywhere — measured on herdr 0.8.0: macOS panes run {@code -zsh} (login, so {@code .zlogin}
+ * runs), Linux panes run a plain {@code /usr/bin/zsh} (interactive but NOT login, so
+ * {@code .zlogin} never runs at all). A scrub in {@code .zlogin} alone is therefore a control that
+ * silently does nothing on Linux — the exact failure this class exists to remove, one platform
+ * over.
+ *
+ * <p>So both {@code .zshrc} and {@code .zlogin} source the same generated {@code scrub.zsh} after
+ * sourcing their {@code $HOME} counterpart. On Linux only the first fires; on macOS both do, and
+ * the second pass is deliberate rather than merely harmless — it re-scrubs anything the operator's
+ * own {@code ~/.zlogin} exported after {@code .zshrc} had finished. Re-running is idempotent: a
+ * name already blank is blanked again, and the report is rewritten with the same counts.
+ *
+ * <p>Each generated file sources its {@code $HOME} counterpart FIRST, so {@code PATH} and every
+ * toolchain binary still resolve exactly as the operator configured them; only afterwards does
+ * {@code .zlogin} run the scrub: every EXPORTED variable not on the derived allow-list is re-exported
+ * blank. Blank, not credential-shaped-pattern-filtered: a pattern list ({@code *TOKEN*}, …) is an
+ * enumeration and misses what it did not think of — a username is the other half of a credential and
+ * is shaped like none. Credential-SHAPED names among the blanked set go to the WARN log only,
+ * never to the control.
+ *
+ * <p>The scrub also writes {@code scrub-report.txt} into its own directory: one {@code allowed N of
+ * M} line (N = exports left untouched, M = exports present when the scrub ran), then the blanked
+ * NAMES — never values. The launcher reads this back at teardown and logs it, because a blocked
+ * count next to an unknown denominator is not a finding.
+ */
+public final class EnvAllowListScrub {
+
+    private static final Logger log = LoggerFactory.getLogger(EnvAllowListScrub.class);
+
+    /** Name of the report file written into the generated directory by the scrub itself. */
+    static final String REPORT_FILE = "scrub-report.txt";
+
+    /** The scrub body, generated once and sourced from both {@code .zshrc} and {@code .zlogin}. */
+    static final String SCRUB_FILE = "scrub.zsh";
+
+    /** Prefix of every generated directory — also what {@link #reapOrphans} matches on. */
+    static final String DIR_PREFIX = "bridged-zdotdir-";
+
+    /**
+     * How old an orphan must be before {@link #reapOrphans} removes it. Comfortably longer than any
+     * spawn takes, so a directory belonging to a pane that is still starting is never removed.
+     */
+    private static final Duration ORPHAN_AGE = Duration.ofHours(24);
+
+    /** Appended to the two startup files that must run the scrub, after their {@code $HOME} source. */
+    private static final String SOURCE_SCRUB =
+            "source \"$ZDOTDIR/" + SCRUB_FILE + "\"\n";
+
+    private EnvAllowListScrub() {
+    }
+
+    /**
+     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran,
+     * how many were left untouched (allowed), and the NAMES that were blanked. Values never appear.
+     */
+    record ScrubReport(int allowed, int total, List<String> blanked) {
+    }
+
+    /**
+     * Create a fresh ZDOTDIR directory under {@code parentDir} holding the four zsh startup files.
+     * Every file (and the directory) registers {@code deleteOnExit}, next to the existing per-spawn
+     * charter/config temp cleanup; the launcher additionally deletes eagerly at pane release.
+     *
+     * @param allowedNames the DERIVED allow-list — exact variable names that must survive the scrub
+     * @return the directory path (to be passed as the pane's {@code ZDOTDIR})
+     * @throws UncheckedIOException when the directory or any file cannot be written — a spawn whose
+     *                              protection cannot even be materialized must fail loudly rather
+     *                              than start unprotected
+     */
+    public static Path generate(Path parentDir, Set<String> allowedNames) {
+        try {
+            reapOrphans(parentDir);
+            Path dir = Files.createTempDirectory(parentDir, DIR_PREFIX);
+            dir.toFile().deleteOnExit();
+            // The report is written by zsh, after these hooks are registered, so register its path
+            // too — otherwise the directory is non-empty at JVM exit and cannot be removed at all.
+            dir.resolve(REPORT_FILE).toFile().deleteOnExit();
+            write(dir, SCRUB_FILE, scrubScript(allowedNames));
+            write(dir, ".zshenv", homeSourcingFile(".zshenv"));
+            write(dir, ".zprofile", homeSourcingFile(".zprofile"));
+            write(dir, ".zshrc", homeSourcingFile(".zshrc") + SOURCE_SCRUB);
+            write(dir, ".zlogin", homeSourcingFile(".zlogin") + SOURCE_SCRUB);
+            return dir;
+        } catch (IOException e) {
+            throw new UncheckedIOException("cannot generate ZDOTDIR scrub files under " + parentDir, e);
+        }
+    }
+
+    /** One operator-sourcing startup file: source the {@code $HOME} counterpart, change nothing else. */
+    private static String homeSourcingFile(String name) {
+        return """
+                # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
+                # Source the operator's own %s first, so PATH and the agent binaries resolve as usual.
+                [ -r "$HOME/%s" ] && source "$HOME/%s"
+                """.formatted(name, name, name);
+    }
+
+    /**
+     * The generated {@code scrub.zsh} — the scrub body on its own, so the two startup files that
+     * must run it ({@code .zshrc} and {@code .zlogin}) hold one copy between them rather than two
+     * that can drift. Package-private so tests can assert on the exact script handed to zsh — the
+     * artefact here IS a shell file, and a test that checks only the Java string assembly proves
+     * nothing about whether zsh accepts it.
+     */
+    static String scrubScript(Set<String> allowedNames) {
+        StringBuilder names = new StringBuilder();
+        for (String n : allowedNames.stream().sorted().toList()) {
+            if (names.length() > 0) {
+                names.append(' ');
+            }
+            // Names are validated against [A-Za-z_][A-Za-z0-9_]* before they get here; single quotes
+            // keep even a non-conforming name inert rather than executable.
+            names.append('\'').append(n.replace("'", "")).append('\'');
+        }
+        return """
+                # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
+                # Sourced from .zshrc and again from .zlogin, each time AFTER that file has sourced
+                # its $HOME counterpart — so this runs after everything the operator sourced, on a
+                # login shell (macOS panes) and on a plain interactive one (Linux panes) alike.
+                # Running twice is idempotent and deliberate: the second pass catches anything
+                # ~/.zlogin exported after ~/.zshrc had finished.
+
+                typeset -A _cb633_allowed
+                for _cb633_n in %s; do _cb633_allowed[$_cb633_n]=1; done
+
+                # Enumerate EXPORTED variable NAMES from `env` itself. Deliberately NOT the special
+                # `parameters` assoc: its subscript is evaluated arithmetically on this host's zsh
+                # and blows up on some names ("bad math expression"). Names not matching the
+                # identifier pattern (junk from multi-line values) are skipped, never scrubbed.
+                typeset -a _cb633_names
+                _cb633_names=("${(@f)$(command env | command cut -d= -f1)}")
+                typeset -a _cb633_blank
+                _cb633_blank=()
+                integer _cb633_total=0
+                for _cb633_n in "${_cb633_names[@]}"; do
+                  [[ "$_cb633_n" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+                  (( _cb633_total += 1 ))
+                  [[ -n "${_cb633_allowed[$_cb633_n]-}" ]] && continue
+                  case "$_cb633_n" in %s) continue ;; esac
+                  _cb633_blank+=("$_cb633_n")
+                done
+
+                { for _cb633_n in "${_cb633_blank[@]}"; do export "$_cb633_n="; done; } 2>/dev/null
+
+                integer _cb633_kept=$(( _cb633_total - ${#_cb633_blank} ))
+                {
+                  print -r -- "allowed $_cb633_kept of $_cb633_total"
+                  for _cb633_n in "${_cb633_blank[@]}"; do print -r -- "$_cb633_n"; done
+                } > "$ZDOTDIR/%s" 2>/dev/null
+
+                unset _cb633_allowed _cb633_names _cb633_blank _cb633_n _cb633_total _cb633_kept
+                """.formatted(names, MemberEnvAllowList.zshCasePattern(), REPORT_FILE);
+    }
+
+    private static void write(Path dir, String fileName, String content) throws IOException {
+        Path file = dir.resolve(fileName);
+        Files.writeString(file, content);
+        file.toFile().deleteOnExit();
+    }
+
+    /**
+     * Read and parse {@link #REPORT_FILE} out of a generated ZDOTDIR directory. Returns {@code null}
+     * when absent or unreadable (the pane may have been torn down before its login shell ever got to
+     * the scrub) — callers treat that as "no measurement available", never as success.
+     */
+    static ScrubReport readReport(Path zdotdir) {
+        Path report = zdotdir.resolve(REPORT_FILE);
+        if (!Files.isRegularFile(report)) {
+            return null;
+        }
+        try {
+            List<String> lines = Files.readAllLines(report);
+            if (lines.isEmpty() || !lines.getFirst().startsWith("allowed ")) {
+                return null;
+            }
+            String[] parts = lines.getFirst().substring("allowed ".length()).trim().split("\\s+");
+            if (parts.length != 3 || !"of".equals(parts[1])) {
+                return null;
+            }
+            List<String> blanked = new ArrayList<>();
+            for (int i = 1; i < lines.size(); i++) {
+                if (!lines.get(i).isBlank()) {
+                    blanked.add(lines.get(i));
+                }
+            }
+            return new ScrubReport(Integer.parseInt(parts[0]), Integer.parseInt(parts[2]),
+                    List.copyOf(blanked));
+        } catch (IOException | NumberFormatException e) {
+            return null;
+        }
+    }
+
+    /** Best-effort recursive delete; failures are swallowed — JVM-exit cleanup is the backstop. */
+    /**
+     * Remove generated directories left behind by an earlier daemon process.
+     *
+     * <p>{@link #generate} registers each directory for deletion at JVM exit, which covers a clean
+     * shutdown and covers nothing else. A {@code kill -9}, a crash, or a host reboot leaves the
+     * directory in the temp dir for good, and the daemon is restarted often enough that these
+     * accumulate. They hold no secrets — the generated files contain variable NAMES and a report of
+     * names, never a value — but an unbounded pile of them in {@code /tmp} is still our mess to
+     * clear.
+     *
+     * <p>Called from {@link #generate}, so it runs on the path that creates them and needs no
+     * separate wiring or scheduler. Only directories older than {@link #ORPHAN_AGE} are touched,
+     * which keeps it clear of any pane that is merely still starting, including one belonging to a
+     * different daemon instance running right now. Best-effort: every failure is ignored, because
+     * tidying temp files must never be the reason a spawn fails.
+     */
+    static void reapOrphans(Path parentDir) {
+        Instant cutoff = Instant.now().minus(ORPHAN_AGE);
+        try (Stream<Path> entries = Files.list(parentDir)) {
+            entries.filter(d -> d.getFileName().toString().startsWith(DIR_PREFIX))
+                    .filter(Files::isDirectory)
+                    .filter(d -> olderThan(d, cutoff))
+                    .forEach(EnvAllowListScrub::deleteRecursively);
+        } catch (IOException | RuntimeException e) {
+            log.debug("could not scan {} for orphaned ZDOTDIRs: {}", parentDir, e.toString());
+        }
+    }
+
+    private static boolean olderThan(Path dir, Instant cutoff) {
+        try {
+            return Files.getLastModifiedTime(dir).toInstant().isBefore(cutoff);
+        } catch (IOException e) {
+            return false; // unreadable timestamp ⇒ leave it alone
+        }
+    }
+
+    static void deleteRecursively(Path dir) {
+        if (dir == null || !Files.exists(dir)) {
+            return;
+        }
+        try (Stream<Path> walk = Files.walk(dir)) {
+            walk.sorted(java.util.Comparator.reverseOrder()).forEach(p -> {
+                try {
+                    Files.deleteIfExists(p);
+                } catch (IOException ignored) {
+                    // best effort — deleteOnExit retries at JVM shutdown
+                }
+            });
+        } catch (IOException ignored) {
+            // same
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -1,22 +1,24 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;
 
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.Tab;
+import dev.ltms.fleet.herdr.Workspace;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.CharterReceipt;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.peer.SpawnRequest;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -47,7 +49,7 @@ import java.util.regex.Pattern;
  *   <li>{@code namePrefix} (constructor arg) — the label prefix ({@code claude}, {@code opencode})
  *       that drives both unique naming and the orphan-reap pattern, so each adapter reaps only its
  *       own kind of pane and never another's.</li>
- *   <li>{@link #buildLaunch(BridgedConfig.Profile, LaunchSpec)} — the peer-specific env map + argv, including any
+ *   <li>{@link #buildLaunch(FleetConfig.Profile, LaunchSpec)} — the peer-specific env map + argv, including any
  *       subscription/guard check, MCP mount, and instruction injection. The base never sees how the
  *       peer is configured; it only places and starts the returned {@link Launch}.</li>
  * </ul>
@@ -74,7 +76,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     private final String namePrefix;                       // label prefix: naming + reap scheme
     private final AgentControl agents;
     private final WorkspaceControl spaces;
-    private final Map<String, BridgedConfig.Profile> profiles; // profile name → spawn settings
+    private final Map<String, FleetConfig.Profile> profiles; // profile name → spawn settings
     private final String defaultProfile;                      // profile a no-arg spawn uses (nullable)
 
     /** Host env lookup (injectable for tests); adapters read it in {@link #buildLaunch}. */
@@ -89,14 +91,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * <p>CB-559: a supplier rather than a snapshot, so a config reload affects the next launch
      * without a restart. Existing tabs keep the label they were given.
      */
-    private final Supplier<BridgedConfig.Fleet> fleet;
+    private final Supplier<FleetConfig.Fleet> fleet;
 
     /**
      * CB-596: the live {@code memberCredentials:} policy, read once per spawn (same hot-reload shape
      * as {@link #fleet}). {@code null} — either the supplier itself, or what it returns — means no
      * policy is configured and {@link #applyMemberCredentialPolicy} shadows nothing.
      */
-    private final Supplier<BridgedConfig.MemberCredentials> memberCredentials;
+    private final Supplier<FleetConfig.MemberCredentials> memberCredentials;
 
     /**
      * Enumerates the daemon's own process environment variable NAMES ONLY, never values — the CB-596
@@ -115,14 +117,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     /** The final instruction always requires a bridge reply when the bridge MCP is mounted. */
     protected static final String REPLY_CHARTER =
             "You are a spawned member in the claude-bridge fleet. Every message you receive arrives "
-            + "through the bridge, and the ONLY channel back to the sender is the bridge_reply MCP tool. "
+            + "through the bridge, and the ONLY channel back to the sender is the fleet_reply MCP tool. "
             + "Text you write in your terminal is NOT sent anywhere — the sender cannot see your screen, "
             + "so an in-terminal answer is silently discarded. Therefore you MUST end EVERY turn by calling "
-            + "bridge_reply with `content` set to your complete response. This holds for every message without "
+            + "fleet_reply with `content` set to your complete response. This holds for every message without "
             + "exception — tasks, questions, clarifications, acknowledgements, and ordinary back-and-forth "
-            + "conversation. Call bridge_reply exactly once, as the final action of your turn, with your full "
+            + "conversation. Call fleet_reply exactly once, as the final action of your turn, with your full "
             + "answer in `content`; never wait for confirmation first. If you end a turn without calling "
-            + "bridge_reply, the sender receives nothing and the exchange stalls.";
+            + "fleet_reply, the sender receives nothing and the exchange stalls.";
 
     /**
      * Tab numbers, counted per {@code role/profile} pair (CB-557).
@@ -154,6 +156,20 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     private final ConcurrentMap<String, String> paneByAgentId = new ConcurrentHashMap<>();
     private final AtomicBoolean resetUnsupportedLogged = new AtomicBoolean();
 
+    /**
+     * CB-633: the per-spawn ZDOTDIR directory generated for a pane under
+     * {@code memberCredentials.policy: allow-list}, keyed by herdr pane id so every teardown exit
+     * ({@link #stop} is reached from explicit DELETE, orphan reap, and the spawn-readiness gate
+     * timeout alike) can read the scrub's own report and then remove the directory. A pane that
+     * never reaches {@code stop} (spawn failure) leaks its directory only until JVM exit, where the
+     * generator's {@code deleteOnExit} hooks are the backstop — the same cleanup shape the existing
+     * charter/config temp files use.
+     */
+    private final ConcurrentMap<String, Path> zdotdirByPane = new ConcurrentHashMap<>();
+
+    /** Guards {@link #warnNonZsh} to one WARN per launcher instance, not one per spawn. */
+    private final AtomicBoolean nonZshShellWarned = new AtomicBoolean();
+
     /**
      * @param namePrefix          label prefix for this peer kind (drives naming and reap)
      * @param agents              herdr agent control (start, status, close)
@@ -167,7 +183,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      *                            interval is baked into this hook, so the base needs no poll field
      */
     protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                 Function<String, String> env,
                                 long spawnReadyTimeoutMs,
                                 LongSupplier nowMillis, Runnable sleeper) {
@@ -183,11 +199,11 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      *              above, so every existing call site keeps the default without an edit.
      */
     protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                 Function<String, String> env,
                                 long spawnReadyTimeoutMs,
                                 LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet) {
+                                Supplier<FleetConfig.Fleet> fleet) {
         this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                 nowMillis, sleeper, fleet, null);
     }
@@ -201,12 +217,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      *                          existing call site keeps the pre-CB-596 default without an edit.
      */
     protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                 Function<String, String> env,
                                 long spawnReadyTimeoutMs,
                                 LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet,
-                                Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                                Supplier<FleetConfig.Fleet> fleet,
+                                Supplier<FleetConfig.MemberCredentials> memberCredentials) {
         this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                 nowMillis, sleeper, fleet, memberCredentials, null);
     }
@@ -216,12 +232,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * seam only — every production call site leaves this {@code null} and gets the real host env.
      */
     protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                 Function<String, String> env,
                                 long spawnReadyTimeoutMs,
                                 LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet,
-                                Supplier<BridgedConfig.MemberCredentials> memberCredentials,
+                                Supplier<FleetConfig.Fleet> fleet,
+                                Supplier<FleetConfig.MemberCredentials> memberCredentials,
                                 Supplier<Set<String>> hostEnvNames) {
         this.fleet = fleet;
         this.namePrefix = namePrefix;
@@ -244,7 +260,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * Any subscription/guard check, MCP mount, and instruction injection happen here. The env map
      * and argv are adapter-private; the base only places and starts what is returned.
      */
-    protected abstract Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec);
+    protected abstract Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec);
 
     /** Direct transport access for peer-specific, non-turn control operations. */
     protected final AgentControl agents() {
@@ -279,8 +295,35 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         }
     }
 
-    /** All per-spawn values adapters may need, including the base-composed effective charter. */
-    protected record LaunchSpec(String sessionName, String resumeSessionId, MemberRole role, String charter) {
+    /**
+     * All per-spawn values adapters may need.
+     *
+     * <p>{@code charter} is the base-composed effective charter (role charter, then the reply
+     * charter, joined by a blank line) — kept for an adapter that mounts both as one blob (opencode
+     * writes it to a single file) and as the exact input {@link CharterReceipt#compose} fingerprints.
+     * {@code roleCharter} and {@code replyCharter} are the same text split back into its two parts
+     * (CB-617), for an adapter that must deliver them differently: the role charter is
+     * operator-authored and often multi-line, so it cannot travel as an inline argv element (herdr
+     * refuses to shell-encode a multi-line argument); the reply charter is always one line and is
+     * demonstrated to encode, so it may still go inline. {@code cwd} is the spawn's resolved working
+     * directory (CB-112), needed to look up a role's agent-definition file before the peer starts.
+     */
+    protected record LaunchSpec(String sessionName, String resumeSessionId, MemberRole role, String charter,
+                                String roleCharter, String replyCharter, String cwd) {
+    }
+
+    /**
+     * The role's agent-definition file under {@code <cwd>/<dir1>/<dir2>/<role>.md}, or {@code null}
+     * when absent or inapplicable (no role, no cwd, or the file does not exist) — CB-617. A member
+     * whose role has no such file must still spawn, so this is a lookup, never a requirement: the
+     * caller passes {@code --agent <role>} only when the return value is non-null.
+     */
+    protected static Path agentDefinitionFile(String cwd, MemberRole role, String dir1, String dir2) {
+        if (role == null || cwd == null || cwd.isBlank()) {
+            return null;
+        }
+        Path candidate = Path.of(cwd, dir1, dir2, role.wireName() + ".md");
+        return Files.isRegularFile(candidate) ? candidate : null;
     }
 
     // --- profile surface -----------------------------------------------------------------------
@@ -298,7 +341,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         if (name == null || name.isBlank()) {
             return List.of();
         }
-        BridgedConfig.Profile cfg = profiles.get(name);
+        FleetConfig.Profile cfg = profiles.get(name);
         return cfg == null ? List.of() : cfg.parityOverlay();
     }
 
@@ -322,18 +365,18 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     }
 
     /** The configured profiles, for adapter capability decisions (e.g. any git-token grant). */
-    protected Collection<BridgedConfig.Profile> profileConfigs() {
+    protected Collection<FleetConfig.Profile> profileConfigs() {
         return profiles.values();
     }
 
     /** Resolve {@code profileName} (null/blank → default) to its config, or throw with the options. */
-    protected BridgedConfig.Profile requireProfile(String profileName) {
+    protected FleetConfig.Profile requireProfile(String profileName) {
         String name = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
         if (name == null || name.isBlank()) {
             throw new IllegalArgumentException("no default worker profile is configured — "
                     + "pass a profile; configured: " + profiles.keySet());
         }
-        BridgedConfig.Profile cfg = profiles.get(name);
+        FleetConfig.Profile cfg = profiles.get(name);
         if (cfg == null) {
             throw new IllegalArgumentException("unknown worker profile '" + name
                     + "' — configured: " + profiles.keySet());
@@ -370,29 +413,48 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
 
     /**
      * Spawn a peer with session identity (CB-547a). The session values, role, and charter are
-     * threaded from the {@link SpawnRequest} into {@link #buildLaunch(BridgedConfig.Profile,
+     * threaded from the {@link SpawnRequest} into {@link #buildLaunch(FleetConfig.Profile,
      * LaunchSpec)}, and the launch's resolved agent-session id is returned alongside the agent so
      * the caller can put it on the {@link PeerHandle}.
      */
     protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
                                     String sessionName, String resumeSessionId, MemberRole role) {
-        BridgedConfig.Profile cfg = requireProfile(profileName);
-        BridgedConfig.Fleet liveFleet = fleet == null ? null : fleet.get();
+        FleetConfig.Profile cfg = requireProfile(profileName);
+        FleetConfig.Fleet liveFleet = fleet == null ? null : fleet.get();
         String roleCharter = liveFleet == null ? null : liveFleet.charterFor(role);
         String replyCharter = cfg.hasMcp() ? REPLY_CHARTER : null;
         String charter = roleCharter == null ? replyCharter
                 : replyCharter == null ? roleCharter : roleCharter + "\n\n" + replyCharter;
         // CB-571: fingerprint the exact composed charter bytes once, here in the base, before the
         // string leaves for an adapter — so Claude and OpenCode derive the same digest. A failed
-        // start has no bridge_spawn result and no roster row, so the failure log below is the only
+        // start has no fleet_spawn result and no roster row, so the failure log below is the only
         // surface the byte count can appear on. The charter text itself is never logged.
         CharterReceipt receipt = CharterReceipt.compose(role, cfg.profile(), roleCharter, charter);
+        String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
         try {
-            Launch launch = buildLaunch(cfg, new LaunchSpec(sessionName, resumeSessionId, role, charter));
-            String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
-            Agent agent = cfg.tabPlacement()
-                    ? spawnInTab(cfg, launch.env(), launch.argv(), cwd, role, liveFleet)
-                    : spawnAsPane(cfg, launch.env(), launch.argv(), cwd, charter);
+            Launch launch = buildLaunch(cfg, new LaunchSpec(sessionName, resumeSessionId, role, charter,
+                    roleCharter, replyCharter, cwd));
+            // CB-633: applied AFTER buildLaunch so the generated scrub's allow-list can also cover
+            // the exact env-map keys this launch injects (ANTHROPIC_*, OPENCODE_CONFIG, GITEA_TOKEN, …)
+            // — anything the daemon deliberately sets must survive its own control.
+            Path zdotdir = applyEnvironmentAllowListPolicy(cfg, launch);
+            Agent agent;
+            try {
+                agent = cfg.tabPlacement()
+                        ? spawnInTab(cfg, launch.env(), launch.argv(), cwd, role, liveFleet)
+                        : spawnAsPane(cfg, launch.env(), launch.argv(), cwd, charter);
+            } catch (RuntimeException e) {
+                // A failed spawn has no pane id, so nothing would ever key this directory for
+                // teardown and it would sit in the temp dir until the JVM exits cleanly — which,
+                // for a daemon, may be never. Remove it on the way out.
+                if (zdotdir != null) {
+                    EnvAllowListScrub.deleteRecursively(zdotdir);
+                }
+                throw e;
+            }
+            if (zdotdir != null) {
+                zdotdirByPane.put(agent.paneId(), zdotdir);
+            }
             logCharterReceipt(receipt, true);
             return new Spawned(agent, launch.agentSessionId(), receipt);
         } catch (RuntimeException e) {
@@ -477,7 +539,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * guaranteed last resort so a pathological environment with an unset {@code user.dir} still
      * honours the "never assume {@code $HOME}" contract rather than letting herdr default the pane.
      */
-    private static String resolveCwd(String requestedCwd, BridgedConfig.Profile cfg, String callerCwd) {
+    private static String resolveCwd(String requestedCwd, FleetConfig.Profile cfg, String callerCwd) {
         return firstNonBlank(requestedCwd, cfg.cwd(), callerCwd, System.getProperty("user.dir"), ".");
     }
 
@@ -489,8 +551,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     }
 
     /** Dedicated worker space → own tab (carrying cwd+env) → start the peer into the seed pane. */
-    private Agent spawnInTab(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
-                             List<String> argv, String cwd, MemberRole role, BridgedConfig.Fleet liveFleet) {
+    private Agent spawnInTab(FleetConfig.Profile cfg, Map<String, String> workerEnv,
+                             List<String> argv, String cwd, MemberRole role, FleetConfig.Fleet liveFleet) {
         Workspace space = spaces.ensureWorkspace(cfg.workspace());
         Tab.Created tab = spaces.createTab(space.workspaceId(), cwd, workerEnv);
         log.info("spawning {} profile={} space={} tab={} cwd={}",
@@ -548,7 +610,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * composed charter, if any; its argv element is replaced by its digest so the log still shows
      * which args were passed without exposing the charter prose.
      */
-    private Agent spawnAsPane(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
+    private Agent spawnAsPane(FleetConfig.Profile cfg, Map<String, String> workerEnv,
                               List<String> argv, String cwd, String charter) {
         log.info("spawning {} (pane placement) profile={} cwd={} argv={}",
                 namePrefix, cfg.profile(), cwd, redactCharter(argv, charter));
@@ -590,7 +652,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * backstop for the astronomically unlikely nonce+seq clash; the name is a label only — herdr
      * detects kind and status from terminal output, not from it.
      */
-    private Started startUniquelyNamed(BridgedConfig.Profile cfg, List<String> argv, String paneId) {
+    private Started startUniquelyNamed(FleetConfig.Profile cfg, List<String> argv, String paneId) {
         // Protocol 19 resolves the executable from the agent kind (== namePrefix here), so
         // argv[0] — the configured executable — is dropped and only the extra args are passed.
         List<String> args = argv.isEmpty() ? argv : argv.subList(1, argv.size());
@@ -744,11 +806,19 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             log.debug("not closing tab {} — it holds {} panes (not a dedicated peer tab)",
                     loc.tabId(), loc.tabPaneCount());
         }
+        // CB-633: log this pane's allowed-N-of-M scrub report, then remove the generated ZDOTDIR.
+        // Last in, best-effort — a failure here must not mask a real teardown failure above.
+        try {
+            releaseZdotdir(paneId);
+        } catch (RuntimeException e) {
+            log.warn("memberCredentials allow-list: releasing ZDOTDIR for pane {} failed: {}",
+                    paneId, e.getMessage());
+        }
     }
 
     /** Whether any configured profile places peers in their own tab (so tabs may need cleanup). */
     private boolean usesTabPlacement() {
-        return profiles.values().stream().anyMatch(BridgedConfig.Profile::tabPlacement);
+        return profiles.values().stream().anyMatch(FleetConfig.Profile::tabPlacement);
     }
 
     /** True when a herdr error means the target is already gone (safe to treat as done). */
@@ -814,7 +884,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * {@code GITEA_HOST}. Push over SSH is unaffected; the only incremental grant is PR-create.
      * Peer-neutral, so every herdr adapter reuses it unchanged.
      */
-    protected void applyGitToken(Map<String, String> workerEnv, BridgedConfig.Profile cfg) {
+    protected void applyGitToken(Map<String, String> workerEnv, FleetConfig.Profile cfg) {
         if (!cfg.hasGitToken()) {
             return;
         }
@@ -830,7 +900,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * herdr's own login-shell process environment (gitea issue #82, superseding CB-592's single
      * hardcoded {@code GITEA_ACCESS_TOKEN} name — see {@link #applyMemberCredentialPolicy}). herdr
      * spawns a pane from its <em>own</em> process environment and layers our map on top —
-     * {@link dev.ltms.bridged.herdr.WorkspaceControl#createTab} and {@code #splitPane} send only
+     * {@link dev.ltms.fleet.herdr.WorkspaceControl#createTab} and {@code #splitPane} send only
      * the keys we put in that map, so any key we never mention passes straight through from
      * herdr's own shell, admin credentials included.
      *
@@ -892,7 +962,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * <p>Adapter-specific variables are layered on top of this by {@code buildLaunch} and therefore
      * win. That ordering is deliberate and load-bearing: it stops a profile's {@code env:} from
      * overriding {@code ANTHROPIC_BASE_URL} and slipping past {@link
-     * dev.ltms.bridged.guard.SubscriptionGuard}, which is checked against the profile's
+     * dev.ltms.fleet.guard.SubscriptionGuard}, which is checked against the profile's
      * {@code baseUrl} and nothing else.
      *
      * <p>The CB-596 credential shadow and the CB-592 marker are put in <em>last</em>, after the
@@ -901,7 +971,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * place both are applied: every {@code buildLaunch} in every adapter calls this first, so a new
      * profile, and a peer kind not yet written, gets them for free.
      */
-    protected Map<String, String> baseEnv(BridgedConfig.Profile cfg) {
+    protected Map<String, String> baseEnv(FleetConfig.Profile cfg) {
         Map<String, String> workerEnv = new LinkedHashMap<>();
         String path = env.apply("PATH");
         if (path != null && !path.isBlank()) {
@@ -925,18 +995,136 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      *
      * <p>No {@code memberCredentials} configured — the supplier is {@code null}, or it resolves to
      * one whose {@code known} list is empty — shadows nothing. This is a real, config-driven gap
-     * (see {@link BridgedConfig.MemberCredentials}'s javadoc), not a safe default: deny-by-default
+     * (see {@link FleetConfig.MemberCredentials}'s javadoc), not a safe default: deny-by-default
      * only defends names the operator has actually enumerated in {@code known}.
+     *
+     * <p>CB-633: under {@code policy: allow-list} this overlay is NOT the control anymore — it is
+     * applied before the login shell runs and a sourced file can (and did) undo it. The control is
+     * the ZDOTDIR scrub ({@link #applyEnvironmentAllowListPolicy}); {@code known}/{@code allow}
+     * remain as reporting only via {@link #logCredentialGap}.
      */
     private void applyMemberCredentialPolicy(Map<String, String> workerEnv) {
-        BridgedConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
+        FleetConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
         if (creds == null) {
             return;
         }
+        if (!creds.isAllowList()) {
+            overlayBlockedCredentials(workerEnv, creds);
+        }
+        logCredentialGap(creds);
+    }
+
+    /** Put {@link #BLOCKED_CREDENTIAL_SENTINEL} over every blocked name in the pane-creation env map. */
+    private static void overlayBlockedCredentials(Map<String, String> workerEnv,
+                                                  FleetConfig.MemberCredentials creds) {
         for (String name : creds.blockedSet()) {
             workerEnv.put(name, BLOCKED_CREDENTIAL_SENTINEL);
         }
-        logCredentialGap(creds);
+    }
+
+    /**
+     * CB-633: under {@code memberCredentials.policy: allow-list}, generate the per-spawn ZDOTDIR
+     * directory whose startup files blank every exported variable not on the DERIVED allow-list —
+     * running AFTER the pane's shell has finished sourcing the operator's chain, which is what no
+     * pre-shell env overlay can achieve. {@code EnvAllowListScrub} sources the scrub from both the
+     * generated {@code .zshrc} and {@code .zlogin}, since a herdr pane is a login shell on macOS
+     * and a plain interactive one on Linux. Mutates {@code launch.env()} to carry
+     * {@code ZDOTDIR=<dir>}, so both placement paths ({@link #spawnInTab}, {@link #spawnAsPane})
+     * pass it through {@code tab.create}/{@code pane.split}. Returns the directory for teardown
+     * registration, or {@code null} when the policy does not apply.
+     *
+     * <p>The allow-list handed to the generator is the derived profile set ({@link
+     * MemberEnvAllowList#derive}) UNIONed with the exact keys of THIS launch's env map — names the
+     * daemon itself injects must survive its own control. {@code SSH_AUTH_SOCK} is added ONLY when
+     * the config explicitly allows it; by default it is absent, so the scrub blanks it like any
+     * other non-derived name.
+     */
+    private Path applyEnvironmentAllowListPolicy(FleetConfig.Profile cfg, Launch launch) {
+        FleetConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
+        if (creds == null || !creds.isAllowList()) {
+            return null;
+        }
+        String loginShell = resolveEnv("SHELL");
+        boolean zsh = loginShell != null && (loginShell.endsWith("/zsh") || loginShell.equals("zsh"));
+        if (!zsh) {
+            // A non-zsh login shell ignores ZDOTDIR entirely: NO scrub would run, so pretending
+            // otherwise would be worse than saying so. Warn loudly and fall back to the CB-596
+            // sentinel overlay over the enumerated known: names — weaker (a sourced file can undo
+            // it), but strictly better than nothing.
+            warnNonZsh(loginShell);
+            overlayBlockedCredentials(launch.env(), creds);
+            logCredentialGap(creds);
+            return null;
+        }
+        Set<String> allowed = new java.util.TreeSet<>(MemberEnvAllowList.derive(profiles.values()));
+        if (creds.sshAuthSockAllowed()) {
+            allowed.add(SSH_AUTH_SOCK);
+        } // blocked by default: absent from the set ⇒ blanked by the scrub like any other name
+        allowed.addAll(launch.env().keySet());
+        Path dir = EnvAllowListScrub.generate(Path.of(System.getProperty("java.io.tmpdir")), allowed);
+        launch.env().put("ZDOTDIR", dir.toAbsolutePath().toString());
+        log.info("memberCredentials policy=allow-list: profile={} generated ZDOTDIR {} — derived "
+                        + "allow-list holds {} name(s); the pane reports allowed N of M at release",
+                cfg.profile(), dir.getFileName(), allowed.size());
+        return dir;
+    }
+
+    /** The operator ssh-agent handle — kept ONLY by explicit config decision, never by default. */
+    private static final String SSH_AUTH_SOCK = "SSH_AUTH_SOCK";
+
+    /**
+     * CB-633: a non-zsh login shell means the allow-list control CANNOT run — say so once per
+     * launcher instance, naming the shell, instead of failing silently.
+     */
+    private void warnNonZsh(String shell) {
+        if (nonZshShellWarned.compareAndSet(false, true)) {
+            log.warn("memberCredentials policy=allow-list: member login shell '{}' is NOT zsh — "
+                            + "ZDOTDIR scrubbing cannot run, so members' inherited environment is "
+                            + "UNPROTECTED beyond the enumerated known: fallback. Move herdr onto a "
+                            + "zsh account or switch policy back to deny-by-default.",
+                    shell == null ? "<unset>" : shell);
+        }
+    }
+
+    /**
+     * CB-633 teardown half: read the pane's scrub report (the denominator report the generated
+     * scrub wrote) and delete the directory. Called from {@link #stop}, which is the one funnel
+     * every teardown exit already goes through.
+     *
+     * <p><b>A missing report is a WARN, not a debug line.</b> The report is the only evidence that
+     * the scrub ran at all in that pane. Its absence has an innocent reading — the pane died before
+     * its shell finished starting — and a serious one: the shell was not zsh, or it read its
+     * startup files from somewhere other than the directory we generated, in which case the member
+     * ran for its whole life with the operator's full secret store in its environment and nothing
+     * said so. We cannot tell those two apart from here, so the line says what is and is not known
+     * rather than picking one. Logging this at debug is how a control that silently stopped working
+     * stays unnoticed — the failure mode this whole class exists to remove.
+     */
+    private void releaseZdotdir(String paneId) {
+        Path dir = zdotdirByPane.remove(paneId);
+        if (dir == null) {
+            return;
+        }
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(dir);
+        if (report == null) {
+            log.warn("memberCredentials allow-list: pane {} left no scrub report in {} — the "
+                    + "environment scrub cannot be confirmed to have run. Either the pane ended "
+                    + "before its shell finished starting, or its shell never read our generated "
+                    + "startup files, in which case that member saw the full host environment.",
+                    paneId, dir);
+        } else {
+            log.info("memberCredentials allow-list: pane {} allowed {} of {} environment variables",
+                    paneId, report.allowed(), report.total());
+            List<String> shaped = report.blanked().stream()
+                    .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
+                    .toList();
+            if (!shaped.isEmpty()) {
+                log.warn("memberCredentials allow-list: pane {} blanked credential-shaped variable(s) "
+                        + "{} — confirm none of them was something a member legitimately needed",
+                        paneId, shaped);
+            }
+        }
+        EnvAllowListScrub.deleteRecursively(dir);
     }
 
     /** Credential-shaped env var name heuristic for {@link #logCredentialGap} — case-insensitive. */
@@ -954,7 +1142,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * every such NAME, at WARN, at most once per launcher instance — never a value, a prefix of a
      * value, or a hash of a value, so the log itself cannot leak anything.
      */
-    private void logCredentialGap(BridgedConfig.MemberCredentials creds) {
+    private void logCredentialGap(FleetConfig.MemberCredentials creds) {
         Set<String> covered = new HashSet<>(creds.known());
         covered.addAll(creds.allow());
         List<String> gap = hostEnvNames.get().stream()

bridged/src/main/java/dev/ltms/fleet/member/MemberEnvAllowList.java

@@ -0,0 +1,112 @@
+package dev.ltms.fleet.member;
+
+import dev.ltms.fleet.config.FleetConfig;
+
+import java.util.Collection;
+import java.util.Set;
+import java.util.TreeSet;
+
+/**
+ * CB-633: the set of environment variable NAMES a spawned member is allowed to keep under
+ * {@code memberCredentials.policy: allow-list} — DERIVED from what the launcher itself injects,
+ * never hand-typed.
+ *
+ * <p>A hand-typed allow-list is the defect this class exists to prevent: a name an operator forgets
+ * to type is a credential that passes through to every member, and a profile added to config later
+ * would silently break spawns whose scrub did not know its names. Derivation closes both ends. The
+ * kept-name set is the union of:
+ *
+ * <ul>
+ *   <li>every configured {@link FleetConfig.Profile profile}'s {@code gitTokenEnv},
+ *       {@code gitHostEnv}, and {@code tokenEnv} values — these are variable <em>names</em> held in
+ *       config, and the launcher reads their values out of exactly these variables;</li>
+ *   <li>every key of every profile's {@code env:} map — anything the operator routes into a pane on
+ *       purpose;</li>
+ *   <li>{@link #INFRASTRUCTURE_PASSTHROUGH} — names that are not credentials at all but that a shell
+ *       or the agent binary genuinely needs to function.</li>
+ * </ul>
+ *
+ * <p>Because the union spans EVERY profile (not just the one spawning), adding a new profile can
+ * only ever widen the list — it cannot break another spawn's scrub. And because the launcher also
+ * unions in the exact keys of each spawn's own env map at generation time (see {@code
+ * HerdrPeerLauncher}), anything the daemon deliberately injects for THIS spawn survives its own
+ * control.
+ *
+ * <p>{@code SSH_AUTH_SOCK} is deliberately NOT here. It is a handle to the operator's ssh-agent — a
+ * member holding it can sign with the operator's keys — so keeping it is a config decision
+ * ({@code memberCredentials.sshAuthSock: allow}), not a derivation default.
+ */
+public final class MemberEnvAllowList {
+
+    /**
+     * Names that are not credentials and that a login shell or agent binary genuinely needs.
+     *
+     * <p>Every name here is a location or a shell setting, never a credential. That rule is load
+     * bearing, and CB-633's first cut broke it: it also listed {@code ANTHROPIC_AUTH_TOKEN},
+     * {@code GITEA_TOKEN}, {@code GITEA_HOST}, {@code ANTHROPIC_BASE_URL}, {@code ANTHROPIC_MODEL},
+     * {@code CLAUDE_CONFIG_DIR}, {@code OPENCODE_CONFIG} and {@code BRIDGED_MEMBER} "because the
+     * launcher injects them". The launcher does — but only on the spawns where it actually sets
+     * them, and {@code HerdrPeerLauncher} already unions THIS spawn's env-map keys into the
+     * allow-list. So a static entry adds nothing on a spawn that injects the name, and on a spawn
+     * that does not it lets the operator's own value through under exactly the name a member reads.
+     * {@code ANTHROPIC_BASE_URL} is the sharpest case: an inherited one silently moves a member off
+     * the endpoint the profile chose.
+     *
+     * <p>{@code ZDOTDIR} stays because it is this control's own handle — lose it and every later
+     * sub-shell loses the scrub. {@code JAVA_HOME} and the {@code XDG_*} roots are toolchain
+     * locations. Everything else a member needs must arrive via a profile's {@code env:} or the
+     * launcher's own injection, both of which land on the derived set automatically.
+     */
+    public static final Set<String> INFRASTRUCTURE_PASSTHROUGH = Set.of(
+            "PATH", "HOME", "SHELL", "TERM", "LANG", "TMPDIR",
+            "USER", "LOGNAME", "PWD", "SHLVL", "EDITOR", "PAGER",
+            "_",
+            "ZDOTDIR",
+            "JAVA_HOME",
+            "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "XDG_STATE_HOME");
+
+    /** Locale-category prefix kept as infrastructure ({@code LC_ALL}, {@code LC_CTYPE}, …). */
+    private static final String INFRASTRUCTURE_NAME_PREFIX = "LC_";
+
+    private MemberEnvAllowList() {
+    }
+
+    /**
+     * Derive the allowed NAME set from the given profiles plus {@link #INFRASTRUCTURE_PASSTHROUGH}.
+     * Deterministic (sorted) so generated scrub files are diffable run-to-run.
+     */
+    public static Set<String> derive(Collection<FleetConfig.Profile> profiles) {
+        Set<String> derived = new TreeSet<>(INFRASTRUCTURE_PASSTHROUGH);
+        if (profiles != null) {
+            for (FleetConfig.Profile p : profiles) {
+                addIfPresent(derived, p.gitTokenEnv());
+                addIfPresent(derived, p.gitHostEnv());
+                addIfPresent(derived, p.tokenEnv());
+                if (p.env() != null) {
+                    derived.addAll(p.env().keySet());
+                }
+            }
+        }
+        return Set.copyOf(derived);
+    }
+
+    /**
+     * Whether {@code name} survives the scrub when {@code allowedNames} is the derived set: an exact
+     * match, or an infrastructure-prefixed name ({@code LC_*}). Prefix rules live ONLY here and in
+     * the generated script's {@code case} pattern, which is written from this constant's value.
+     */
+    public static boolean keeps(Set<String> allowedNames, String name) {
+        return allowedNames.contains(name) || name.startsWith(INFRASTRUCTURE_NAME_PREFIX);
+    }
+
+    /** The prefix rule as a zsh {@code case} pattern, so the script and Java cannot drift apart. */
+    public static String zshCasePattern() {
+        return INFRASTRUCTURE_NAME_PREFIX + "*";
+    }
+
+    private static void addIfPresent(Set<String> into, String name) {
+        if (name != null && !name.isBlank()) {
+            into.add(name);
+        }
+    }
+}

bridged/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -1,15 +1,16 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.SpawnRequest;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.CharterReceipt;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.SpawnRequest;
 
 import java.io.IOException;
 import java.io.UncheckedIOException;
@@ -33,7 +34,7 @@ import java.util.function.Supplier;
  * <p>The divergences from {@link ClaudeCodeLauncher}, all confined to {@link #buildLaunch}:
  * <ul>
  *   <li><strong>No subscription boundary.</strong> opencode carries no {@code ANTHROPIC_BASE_URL}
- *       and there is no {@link dev.ltms.bridged.guard.SubscriptionGuard} — the guard is a
+ *       and there is no {@link dev.ltms.fleet.guard.SubscriptionGuard} — the guard is a
  *       Claude-private concern, not part of the SPI. opencode reads the operator's own provider
  *       credentials from its global {@code auth.json}; the bridge injects none.</li>
  *   <li><strong>File-based MCP mount + instructions.</strong> opencode has no inline
@@ -70,7 +71,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
      */
     public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                             Function<String, String> env) {
         this(agents, spaces, profiles, defaultProfile, env, 0,
                 System::currentTimeMillis, () -> sleepUninterruptibly(300),
@@ -82,7 +83,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
      */
     public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                             Function<String, String> env,
                             long spawnReadyTimeoutMs, long spawnReadyPollMs) {
         this(agents, spaces, profiles, defaultProfile, env,
@@ -95,10 +96,10 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
      */
     public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                             Function<String, String> env,
                             long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                            Supplier<BridgedConfig.Fleet> fleet) {
+                            Supplier<FleetConfig.Fleet> fleet) {
         this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                 System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
                 defaultConfigRoot(), defaultDiscoveryRoot(), fleet);
@@ -108,11 +109,11 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
      */
     public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                             Function<String, String> env,
                             long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                            Supplier<BridgedConfig.Fleet> fleet,
-                            Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
         this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                 System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
                 defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials);
@@ -138,7 +139,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      *                            {@link OpenCodeSessionDiscovery})
      */
     public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                             Function<String, String> env,
                             long spawnReadyTimeoutMs,
                             LongSupplier nowMillis, Runnable sleeper,
@@ -153,12 +154,12 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * @param fleet live fleet config, read once for each spawn
      */
     public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                             Function<String, String> env,
                             long spawnReadyTimeoutMs,
                             LongSupplier nowMillis, Runnable sleeper,
                             Path configRoot, Path discoveryRoot,
-                            Supplier<BridgedConfig.Fleet> fleet) {
+                            Supplier<FleetConfig.Fleet> fleet) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
         this.configRoot = configRoot;
@@ -169,13 +170,13 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
      */
     public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                             Function<String, String> env,
                             long spawnReadyTimeoutMs,
                             LongSupplier nowMillis, Runnable sleeper,
                             Path configRoot, Path discoveryRoot,
-                            Supplier<BridgedConfig.Fleet> fleet,
-                            Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
         this.configRoot = configRoot;
@@ -201,15 +202,31 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * grant; and select the model with {@code -m}.
      */
     @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
         Map<String, String> workerEnv = baseEnv(cfg);
         // A config file is needed for the bridge MCP mount, a member charter, or a pinned endpoint (CB-508).
         if (cfg.hasMcp() || spec.charter() != null || hasCustomProvider(cfg)) {
             workerEnv.put("OPENCODE_CONFIG", writeConfig(cfg, spec.charter()).toString());
         }
         applyGitToken(workerEnv, cfg);
-        return new Launch(workerEnv,
-                argvWithResume(argvWithModel(argvWithAuto(cfg), cfg), spec.resumeSessionId()));
+        List<String> argv = argvWithResume(argvWithModel(argvWithAuto(cfg), cfg), spec.resumeSessionId());
+        return new Launch(workerEnv, argvWithAgent(argv, spec));
+    }
+
+    /**
+     * The launch argv plus, when the role has an agent-definition file under the worker's cwd,
+     * opencode's {@code --agent <role>} flag (CB-617). A role with no such file gets nothing added —
+     * the member must still spawn.
+     */
+    private List<String> argvWithAgent(List<String> argv, LaunchSpec spec) {
+        Path agentFile = agentDefinitionFile(spec.cwd(), spec.role(), ".opencode", "agent");
+        if (agentFile == null) {
+            return argv;
+        }
+        List<String> withAgent = mutableArgv(argv);
+        withAgent.add("--agent");
+        withAgent.add(spec.role().wireName());
+        return withAgent;
     }
 
     /**
@@ -222,7 +239,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * primary's Anthropic subscription, and an opencode process has no Anthropic credential path
      * at all. Pointing it at a local vLLM cannot leak the subscription.
      */
-    private static boolean hasCustomProvider(BridgedConfig.Profile cfg) {
+    private static boolean hasCustomProvider(FleetConfig.Profile cfg) {
         return cfg.baseUrl() != null && !cfg.baseUrl().isBlank();
     }
 
@@ -231,12 +248,12 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * permissions opencode does not explicitly deny. It is unconditional, not a preference: a
      * spawned peer has no human at its pane — the bridge spawned it — so one that stops at an
      * approval prompt is a wedged agent, indistinguishable from a legitimate mid-turn wait and
-     * unable to end its turn with {@code bridge_reply}. opencode's own help calls this
+     * unable to end its turn with {@code fleet_reply}. opencode's own help calls this
      * "dangerous!", but the blast radius here is already bounded by design: a worker runs in its
      * own git worktree on its own branch, is off-subscription, and cannot merge — the lead is the
      * gate.
      */
-    private List<String> argvWithAuto(BridgedConfig.Profile cfg) {
+    private List<String> argvWithAuto(FleetConfig.Profile cfg) {
         List<String> argv = mutableArgv(cfg.argv());
         argv.add("--auto");
         return argv;
@@ -259,7 +276,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     }
 
     /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
-    private List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+    private List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
         if (cfg.model() != null && !cfg.model().isBlank()) {
             argv.add("-m");
             argv.add(cfg.model());
@@ -273,7 +290,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * {@code OPENCODE_CONFIG}. The dir is unique per spawn so concurrent workers never race on it;
      * it is best-effort cleaned on JVM exit (worker config is disposable — regenerated every spawn).
      */
-    private Path writeConfig(BridgedConfig.Profile cfg, String charterText) {
+    private Path writeConfig(FleetConfig.Profile cfg, String charterText) {
         try {
             Path dir = Files.createTempDirectory(configRoot, "bridged-opencode-");
             dir.toFile().deleteOnExit();
@@ -305,10 +322,10 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             }
 
             if (cfg.hasMcp()) {
-                ObjectNode bridge = root.putObject("mcp").putObject("bridge");
-                bridge.put("type", "remote");
-                bridge.put("url", cfg.mcpUrl());
-                bridge.put("enabled", true);
+                ObjectNode mount = root.putObject("mcp").putObject(PeerLauncher.MCP_MOUNT_NAME);
+                mount.put("type", "remote");
+                mount.put("url", cfg.mcpUrl());
+                mount.put("enabled", true);
             }
             if (hasCustomProvider(cfg)) {
                 addCustomProvider(root, cfg);
@@ -333,7 +350,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * <p>The provider id comes from the {@code provider/model} selector in {@code model:}, so one
      * field drives both the declaration and the {@code -m} flag and they cannot drift apart.
      */
-    private void addCustomProvider(ObjectNode root, BridgedConfig.Profile cfg) {
+    private void addCustomProvider(ObjectNode root, FleetConfig.Profile cfg) {
         String[] parts = splitModelSelector(cfg);
         String providerId = parts[0];
         String modelId = parts[1];
@@ -346,7 +363,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         options.put("baseURL", openAiBaseUrl(cfg.baseUrl()));
         // vLLM and friends usually ignore the key, but the AI SDK still requires a non-empty one.
         String token = resolveEnv(cfg.tokenEnv());
-        options.put("apiKey", (token == null || token.isBlank()) ? "bridged-local-noauth" : token);
+        options.put("apiKey", (token == null || token.isBlank()) ? "fleetd-local-noauth" : token);
 
         provider.putObject("models").putObject(modelId).put("name", modelId);
     }
@@ -356,7 +373,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * needs both, so a bare model name is rejected loudly rather than silently falling back to the
      * default gateway — a worker quietly talking to the wrong endpoint is the failure this avoids.
      */
-    private static String[] splitModelSelector(BridgedConfig.Profile cfg) {
+    private static String[] splitModelSelector(FleetConfig.Profile cfg) {
         String model = cfg.model();
         int slash = model == null ? -1 : model.indexOf('/');
         if (model == null || model.isBlank() || slash <= 0 || slash == model.length() - 1) {
@@ -480,7 +497,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
 
     /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
     private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
     }
 
     // --- CB-117 reap predicate (opencode prefix), kept for direct unit testing -----------------

bridged/src/main/java/dev/ltms/fleet/member/OpenCodeSessionDiscovery.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;

bridged/src/main/java/dev/ltms/fleet/metrics/FleetMetrics.java

@@ -1,8 +1,8 @@
-package dev.ltms.bridged.metrics;
+package dev.ltms.fleet.metrics;
 
-import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.MemberSession;
 
 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -13,33 +13,33 @@ import java.util.Map;
  *
  * <p>The set is deliberately small: each series maps to a failure mode this project has actually
  * hit, not to whatever was easy to count. The two worth watching in practice are
- * {@code bridged_sends_total{outcome="completion_fallback"}} — a rising share means turn detection
+ * {@code fleet_sends_total{outcome="completion_fallback"}} — a rising share means turn detection
  * is degrading, the CB-115/116/118 failure family — and
- * {@code bridged_push_nudges_total{outcome="exhausted"}}, which means the primary stopped draining
+ * {@code fleet_push_nudges_total{outcome="exhausted"}}, which means the primary stopped draining
  * its inbox and CB-307's active push gave up.
  */
-public final class BridgedMetrics {
+public final class FleetMetrics {
 
     /** Counter: delegated sends by terminal outcome. */
-    public static final String SENDS = "bridged_sends_total";
+    public static final String SENDS = "fleet_sends_total";
     /** Counter: worker replies by the path that carried them (rendezvous vs stranded-to-inbox). */
-    public static final String REPLIES = "bridged_replies_total";
+    public static final String REPLIES = "fleet_replies_total";
     /** Counter: push-loop nudges to the primary, by outcome. */
-    public static final String PUSH_NUDGES = "bridged_push_nudges_total";
+    public static final String PUSH_NUDGES = "fleet_push_nudges_total";
     /** Counter: idle-lead heartbeat nudges to the lead, by outcome (CB-551). */
-    public static final String HEARTBEAT_NUDGES = "bridged_lead_heartbeat_nudges_total";
+    public static final String HEARTBEAT_NUDGES = "fleet_lead_heartbeat_nudges_total";
     /** Counter: spawn attempts by peer kind and outcome. */
-    public static final String SPAWNS = "bridged_spawns_total";
+    public static final String SPAWNS = "fleet_spawns_total";
     /** Counter: herdr socket calls by method and outcome. */
-    public static final String HERDR_CALLS = "bridged_herdr_calls_total";
+    public static final String HERDR_CALLS = "fleet_herdr_calls_total";
     /** Counter: rejected requests by reason (CB-501). */
-    public static final String AUTH_FAILURES = "bridged_auth_failures_total";
+    public static final String AUTH_FAILURES = "fleet_auth_failures_total";
     /** Gauge: session census by lifecycle state. */
-    public static final String SESSIONS = "bridged_sessions";
+    public static final String SESSIONS = "fleet_sessions";
     /** Gauge: undrained replies held per target. */
-    public static final String INBOX_DEPTH = "bridged_inbox_depth";
+    public static final String INBOX_DEPTH = "fleet_inbox_depth";
 
-    private BridgedMetrics() {
+    private FleetMetrics() {
     }
 
     /**

bridged/src/main/java/dev/ltms/fleet/metrics/Metrics.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.metrics;
+package dev.ltms.fleet.metrics;
 
 import java.util.Map;
 import java.util.NavigableMap;

bridged/src/main/java/dev/ltms/fleet/msg/AmqpReplyInbox.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
 import com.rabbitmq.client.AMQP;
 import com.rabbitmq.client.Channel;

bridged/src/main/java/dev/ltms/fleet/msg/InMemoryReplyInbox.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
 import java.util.LinkedHashMap;
 import java.util.List;

bridged/src/main/java/dev/ltms/fleet/msg/LeadHeartbeatLoop.java

@@ -1,11 +1,11 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.session.MemberSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -18,7 +18,7 @@ import java.util.function.Supplier;
 
 /**
  * CB-551: an opt-in heartbeat that nudges the single idle lead back to work once it has been
- * continuously idle past a quiet period with no open {@code bridge_send} driving it.
+ * continuously idle past a quiet period with no open {@code fleet_send} driving it.
  *
  * <p>Why this exists: the fleet is ONE lead + architects + workers, so an idle, stalled lead is a
  * single point of failure for the fleet's progress. {@link ReplyPushLoop} nudges the lead only when
@@ -99,7 +99,7 @@ public final class LeadHeartbeatLoop {
     /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
     private void countNudge(String outcome) {
         if (metrics != null) {
-            metrics.inc(BridgedMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
+            metrics.inc(FleetMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
         }
     }
 
@@ -290,7 +290,7 @@ public final class LeadHeartbeatLoop {
         /** The nudge body, phrased for the two cases the heartbeat distinguishes. */
         String nudgeText() {
             StringBuilder sb = new StringBuilder(
-                    "Heartbeat: you are idle and no bridge_send is waiting on you.");
+                    "Heartbeat: you are idle and no fleet_send is waiting on you.");
             if (hasPending()) {
                 sb.append(" The fleet has state to collect: ").append(pendingDetail());
             } else {
@@ -309,10 +309,10 @@ public final class LeadHeartbeatLoop {
                     .append(" pending collection");
             if (!replyTargets.isEmpty()) {
                 // Render each as the exact command so the lead can act without parsing: the nearest
-                // analogue to ReplyPushLoop's bridge_poll(target=...) nudge.
+                // analogue to ReplyPushLoop's fleet_poll(target=...) nudge.
                 sb.append(" (")
                         .append(String.join(", ",
-                                replyTargets.stream().map(t -> "bridge_poll(target=" + t + ")").toList()))
+                                replyTargets.stream().map(t -> "fleet_poll(target=" + t + ")").toList()))
                         .append(")");
             }
             sb.append(", ").append(doneSessions).append(" DONE session").append(doneSessions == 1 ? "" : "s")

bridged/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -1,10 +1,10 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -24,7 +24,7 @@ import java.util.function.LongSupplier;
 
 /**
  * The blocking delegation feature (CB-104): deliver {@code content} into a worker and block until
- * the worker returns a <em>structured reply</em> via {@code bridge_reply} (the {@link Rendezvous}),
+ * the worker returns a <em>structured reply</em> via {@code fleet_reply} (the {@link Rendezvous}),
  * then hand that reply back. Delivery is the {@link Injector}'s job (the background poller sends it
  * when the worker is injectable); this service never drives the injector or scrapes the terminal —
  * completion is the worker's explicit reply, not a guess about {@code agent_status}.
@@ -62,10 +62,10 @@ public final class MessageService {
 
     /** Outcome of a blocking send. */
     public enum Outcome {
-        /** The worker called {@code bridge_reply}; {@code text} holds the structured answer. */
+        /** The worker called {@code fleet_reply}; {@code text} holds the structured answer. */
         REPLIED,
         /**
-         * The worker's delegated turn finished without a {@code bridge_reply} (CB-106 fallback);
+         * The worker's delegated turn finished without a {@code fleet_reply} (CB-106 fallback);
          * {@code text} is the scraped transcript tail rather than a structured answer.
          */
         COMPLETED_UNREPLIED,
@@ -75,7 +75,7 @@ public final class MessageService {
          */
         WORKER_FAILED,
         /**
-         * The turn finished without a {@code bridge_reply} and the scrape matched the backend's
+         * The turn finished without a {@code fleet_reply} and the scrape matched the backend's
          * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
          * carrying the matched line. The worker's pane is healthy — only its account is refusing —
          * so this is never reported as a completed reply, and is kept distinct from
@@ -96,14 +96,14 @@ public final class MessageService {
         BUSY,
         /**
          * An answer ({@link #answer(String, String, long)}) referenced a {@code turnId} that is no
-         * longer open — the worker's {@code bridge_ask} already timed out or was answered.
+         * longer open — the worker's {@code fleet_ask} already timed out or was answered.
          */
         STALE_TURN
     }
 
     /**
      * @param outcome how the send ended (or paused)
-     * @param text    the worker's answer when {@link #completed()} (a structured {@code bridge_reply}
+     * @param text    the worker's answer when {@link #completed()} (a structured {@code fleet_reply}
      *                for {@link Outcome#REPLIED}, a scraped transcript tail for
      *                {@link Outcome#COMPLETED_UNREPLIED}), or the question for {@link Outcome#QUESTION},
      *                else {@code null}
@@ -122,7 +122,7 @@ public final class MessageService {
         }
     }
 
-    /** How a worker's {@code bridge_ask} (CB-205) resolved. */
+    /** How a worker's {@code fleet_ask} (CB-205) resolved. */
     public enum AskOutcome {
         /** The primary answered; {@link AskResult#answer} carries it. */
         ANSWERED,
@@ -132,7 +132,7 @@ public final class MessageService {
         TIMED_OUT
     }
 
-    /** The outcome of a worker's {@code bridge_ask}: how it resolved and (if answered) the answer. */
+    /** The outcome of a worker's {@code fleet_ask}: how it resolved and (if answered) the answer. */
     public record AskResult(AskOutcome outcome, String answer) {
     }
 
@@ -140,7 +140,7 @@ public final class MessageService {
     public enum Phase {
         /** Delegated and in flight — queued for the worker or being worked. */
         PENDING,
-        /** The worker is paused in {@code bridge_ask}; {@link TaskView#reply} and {@link TaskView#turnId} identify it. */
+        /** The worker is paused in {@code fleet_ask}; {@link TaskView#reply} and {@link TaskView#turnId} identify it. */
         ASKING,
         /** The worker's turn finished; {@link TaskView#reply} holds the answer. */
         DONE,
@@ -153,7 +153,7 @@ public final class MessageService {
      *
      * @param reply       the answer when {@link #phase} is {@link Phase#DONE}, or the question when
      *                    {@link #phase} is {@link Phase#ASKING}; otherwise {@code null}
-     * @param replySource {@code "reply"} (structured {@code bridge_reply}) or {@code "transcript"}
+     * @param replySource {@code "reply"} (structured {@code fleet_reply}) or {@code "transcript"}
      *                    (completion scrape) when {@link Phase#DONE}, else {@code null}
      * @param detail      a human note (live worker status while pending, ask state, or failure reason)
      * @param turnId      correlation id for an {@link Phase#ASKING} ticket, else {@code null}
@@ -179,11 +179,11 @@ public final class MessageService {
     }
 
     /**
-     * A worker session's currently-open {@code bridge_ask} question, surfaced so {@code bridge_status}
+     * A worker session's currently-open {@code fleet_ask} question, surfaced so {@code fleet_status}
      * can show it without the caller needing the ticket first (CB-582). Only covers async
      * (fire-and-poll) delegations, which track the question on their {@link Task}; a blocking
      * ({@code wait:true}) send already hands the question straight back to its own caller, so there is
-     * nothing hidden left for {@code bridge_status} to surface in that case.
+     * nothing hidden left for {@code fleet_status} to surface in that case.
      */
     public record PendingAsk(String ticket, String question, String turnId) {
     }
@@ -202,7 +202,7 @@ public final class MessageService {
     /** Async task that owns each exact forward rendezvous waiter. */
     private final ConcurrentHashMap<CompletableFuture<Rendezvous.Resolution>, Task> asyncTasksByWaiter =
             new ConcurrentHashMap<>();
-    /** Async tickets paused on a specific {@code bridge_ask} turn. */
+    /** Async tickets paused on a specific {@code fleet_ask} turn. */
     private final ConcurrentHashMap<String, Task> asyncTasksByTurn = new ConcurrentHashMap<>();
     private final AtomicLong ticketSeq = new AtomicLong();
     private final ExecutorService asyncExecutor = Executors.newThreadPerTaskExecutor(
@@ -216,7 +216,7 @@ public final class MessageService {
      *                 (CB-588) whenever an async ticket started by {@link #sendAsync} reaches a
      *                 terminal phase, whenever {@link #poll} hands a terminal ticket to its caller,
      *                 and (CB-582) whenever an async ticket's worker pauses mid-turn in
-     *                 {@code bridge_ask} or that pause ends (answered or lapsed)
+     *                 {@code fleet_ask} or that pause ends (answered or lapsed)
      */
     public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
                           ReplyInbox inbox, ReplyPushLoop pushLoop) {
@@ -272,11 +272,11 @@ public final class MessageService {
     }
 
     /**
-     * Route a worker's explicit {@code bridge_reply}: resolve an open send, or queue it in the
+     * Route a worker's explicit {@code fleet_reply}: resolve an open send, or queue it in the
      * inbox if no send is currently open. Unlike the bare {@link Rendezvous#resolve}, a no-waiter
      * result is <em>not</em> a failure — the reply is held for later drain.
      *
-     * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code bridge_ask} /
+     * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code fleet_ask} /
      * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
      * are interactive and must never be queued.
      *
@@ -284,13 +284,13 @@ public final class MessageService {
      */
     public boolean reply(String session, String content) {
         if (rendezvous.resolve(session, content)) {
-            count(BridgedMetrics.REPLIES, "path", "rendezvous");
+            count(FleetMetrics.REPLIES, "path", "rendezvous");
             return true;                       // a live send took it — unchanged fast path
         }
         inbox.publish(session, UUID.randomUUID().toString(), content);
         // A rising inbox share is the signal CB-307 exists to make visible: the worker finished but
         // nobody was waiting, so delivery now depends on the push loop and a drain.
-        count(BridgedMetrics.REPLIES, "path", "inbox");
+        count(FleetMetrics.REPLIES, "path", "inbox");
         if (pushLoop != null) {
             pushLoop.onReplyQueued(session);
         }
@@ -308,7 +308,7 @@ public final class MessageService {
     private Reply recorded(Reply r) {
         String label = sendOutcomeLabel(r.outcome());
         if (label != null) {
-            count(BridgedMetrics.SENDS, "outcome", label);
+            count(FleetMetrics.SENDS, "outcome", label);
         }
         return r;
     }
@@ -329,7 +329,7 @@ public final class MessageService {
      * Abandon any send still waiting on {@code target} because its session has gone away (CB-516).
      *
      * <p>Without this, tearing a worker down left its rendezvous waiter open: a blocking
-     * {@code bridge_send} kept blocking, and an async one kept reporting {@code PENDING} until
+     * {@code fleet_send} kept blocking, and an async one kept reporting {@code PENDING} until
      * {@link #ASYNC_TIMEOUT_MS} — thirty minutes — even though the worker provably no longer
      * existed and the delegation could never complete. Worse, {@code poll} already had the evidence
      * (it calls {@code liveStatus} to build its detail string and gets back {@code "unknown"}) and
@@ -484,7 +484,7 @@ public final class MessageService {
 
     /**
      * A worker's mid-turn question (CB-205 reverse rendezvous): surface {@code question} to the
-     * primary by resolving its open blocking {@code bridge_send}, then block this (worker) call until
+     * primary by resolving its open blocking {@code fleet_send}, then block this (worker) call until
      * the primary answers via {@link #answer} or {@code timeoutMillis} elapses. Identity is the
      * worker's own session — it does not address the primary.
      *
@@ -509,10 +509,10 @@ public final class MessageService {
                 rendezvous.closeAsk(ticket.turnId());
                 return new AskResult(AskOutcome.NO_WAITER, null); // no primary is blocked on this worker
             }
-            // CB-582: the question just became visible via bridge_poll (Phase.ASKING) for an async
+            // CB-582: the question just became visible via fleet_poll (Phase.ASKING) for an async
             // (wait:false) delegation — nudge the lead's own pane the same way a terminal ticket does
             // (CB-588), since the lead's normal poll cadence is minutes away and the reverse-rendezvous
-            // window (~55s, see BridgeMcp/BridgedApp) is far shorter. A blocking (wait:true) send has
+            // window (~55s, see FleetMcp/FleetApp) is far shorter. A blocking (wait:true) send has
             // no Task and gets the question directly in its own reply, so task == null there — nothing
             // to nudge.
             if (task != null && pushLoop != null) {
@@ -523,7 +523,7 @@ public final class MessageService {
             String answer = ticket.answer().get(timeoutMillis, TimeUnit.MILLISECONDS);
             return new AskResult(AskOutcome.ANSWERED, answer);
         } catch (TimeoutException e) {
-            log.debug("bridge_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
+            log.debug("fleet_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
             clearAsyncQuestion(ticket.turnId(), true);
             return new AskResult(AskOutcome.TIMED_OUT, null);
         } catch (ExecutionException e) {
@@ -549,13 +549,13 @@ public final class MessageService {
     }
 
     /**
-     * The primary's answer to a worker's {@code bridge_ask} (CB-205): resolve the worker's blocked
+     * The primary's answer to a worker's {@code fleet_ask} (CB-205): resolve the worker's blocked
      * question identified by {@code turnId}, then — like a fresh {@link #send} — block for the worker's
-     * eventual {@code bridge_reply} as it finishes the resumed turn. The worker session is derived from
+     * eventual {@code fleet_reply} as it finishes the resumed turn. The worker session is derived from
      * {@code turnId}, never a caller argument.
      *
      * <p>Unlike {@link #send} this does not re-inject through the {@link Injector}: the worker is
-     * mid-turn (already picked up), so the answer flows back through its own open {@code bridge_ask}
+     * mid-turn (already picked up), so the answer flows back through its own open {@code fleet_ask}
      * call, not a new status-gated delivery. The forward waiter is opened <em>before</em> the worker
      * is unblocked so a reply that lands the instant it resumes is not lost.
      */
@@ -624,9 +624,9 @@ public final class MessageService {
         tasks.put(ticket, task);
         if (pushLoop != null) {
             // CB-588: task.future only ever completes on a terminal phase (DONE or a failure) — a
-            // worker paused in bridge_ask leaves it running, per finishAsyncTask's own contract — so
+            // worker paused in fleet_ask leaves it running, per finishAsyncTask's own contract — so
             // this fires exactly once, from whichever path completes it: finishAsyncTask(task, result)
-            // below on any non-QUESTION outcome of send() — a worker's bridge_reply, the CB-106
+            // below on any non-QUESTION outcome of send() — a worker's fleet_reply, the CB-106
             // completion fallback, a CB-109 wedge, TIMED_OUT, BUSY, or BACKEND_EXHAUSTED — the same
             // finishAsyncTask reached via answer()'s finishAsyncTask(turnId, result) once a QUESTION
             // is resolved, completeExceptionally(t) just below when send() itself throws, or a CB-516
@@ -719,7 +719,7 @@ public final class MessageService {
      * too, its own {@code pendingTickets} entry would outlive the ticket it names: an unpolled ticket
      * (or one the reminder cap already gave up on) is pruned here but never collected there, so it
      * lingers in {@code pendingTickets} forever and rides along on every later nudge to the same lead
-     * — naming a ticket {@code bridge_poll} can no longer find (CB-588 follow-up).
+     * — naming a ticket {@code fleet_poll} can no longer find (CB-588 follow-up).
      */
     private void pruneTerminalTickets() {
         long cutoff = nowNanos.getAsLong() - TICKET_TTL_NANOS;
@@ -784,10 +784,10 @@ public final class MessageService {
     }
 
     /**
-     * The question {@code workerSession} is currently paused on via {@code bridge_ask}, if any
-     * (CB-582) — {@code bridge_status} uses this to show a pending question without the caller
+     * The question {@code workerSession} is currently paused on via {@code fleet_ask}, if any
+     * (CB-582) — {@code fleet_status} uses this to show a pending question without the caller
      * needing the ticket. {@code null} when the session has no open async question (including a
-     * session mid a <em>blocking</em> {@code bridge_ask}, which has no {@link Task} to look up — see
+     * session mid a <em>blocking</em> {@code fleet_ask}, which has no {@link Task} to look up — see
      * {@link PendingAsk}).
      */
     public PendingAsk pendingAsk(String workerSession) {

bridged/src/main/java/dev/ltms/fleet/msg/Rendezvous.java

@@ -1,13 +1,13 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicLong;
 
 /**
- * The reply rendezvous: where a blocking {@code bridge_send} awaits how the worker's delegated turn
+ * The reply rendezvous: where a blocking {@code fleet_send} awaits how the worker's delegated turn
  * ends. The sending (primary) request thread {@link #open}s a waiter; it is resolved either by the
- * worker's explicit {@code bridge_reply} ({@link #resolve}, arriving on a different thread via
+ * worker's explicit {@code fleet_reply} ({@link #resolve}, arriving on a different thread via
  * {@code POST /sessions/{id}/reply}) or — the CB-106 fallback — by the injector observing the
  * worker's delegated turn return to idle without a reply ({@link #resolveCompletion}).
  *
@@ -27,14 +27,14 @@ public final class Rendezvous {
 
     /** How a delegated turn ended (or paused). */
     public enum Kind {
-        /** The worker called {@code bridge_reply} with a structured answer. */
+        /** The worker called {@code fleet_reply} with a structured answer. */
         REPLY,
-        /** The worker's turn finished without a {@code bridge_reply}; {@code text} is a scrape. */
+        /** The worker's turn finished without a {@code fleet_reply}; {@code text} is a scrape. */
         COMPLETION,
         /** The worker ran the turn then wedged (CB-109); {@code text} is the failure context. */
         FAILED,
         /**
-         * The turn finished without a {@code bridge_reply}, and the scrape matched the backend's
+         * The turn finished without a {@code fleet_reply}, and the scrape matched the backend's
          * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
          * carrying the matched line. The pane is healthy — only the account is refusing — so this
          * is kept separate from a session simply going {@code GONE}.
@@ -43,7 +43,7 @@ public final class Rendezvous {
         /**
          * The worker paused mid-turn to ask the primary a question (CB-205 reverse rendezvous);
          * {@code text} is the question and {@code turnId} correlates the primary's answer back to
-         * the worker's blocked {@code bridge_ask}. Not terminal — the turn resumes after the answer.
+         * the worker's blocked {@code fleet_ask}. Not terminal — the turn resumes after the answer.
          */
         QUESTION
     }
@@ -75,7 +75,7 @@ public final class Rendezvous {
     /** Reverse rendezvous (CB-205): worker questions awaiting the primary's answer, keyed by {@code turnId}. */
     private final ConcurrentHashMap<String, AskWaiter> asks = new ConcurrentHashMap<>();
     private final AtomicLong askSeq = new AtomicLong();
-    /** Per-session index of the currently-open ask, so duplicate bridge_ask calls coalesce onto one turn. */
+    /** Per-session index of the currently-open ask, so duplicate fleet_ask calls coalesce onto one turn. */
     private final ConcurrentHashMap<String, String> openAsksBySession = new ConcurrentHashMap<>();
 
     /**
@@ -132,7 +132,7 @@ public final class Rendezvous {
         return complete(session, new Resolution(Kind.REPLY, content));
     }
 
-    // --- reverse rendezvous (CB-205 bridge_ask) ------------------------------------------------
+    // --- reverse rendezvous (CB-205 fleet_ask) ------------------------------------------------
 
     /**
      * Open a reverse-rendezvous waiter for a worker's mid-turn question. If {@code session} already has
@@ -166,7 +166,7 @@ public final class Rendezvous {
     }
 
     /**
-     * Surface a worker's mid-turn {@code question} by resolving the primary's open {@code bridge_send}
+     * Surface a worker's mid-turn {@code question} by resolving the primary's open {@code fleet_send}
      * with a {@link Kind#QUESTION} carrying {@code turnId}. Same session-keyed semantics as
      * {@link #resolve}: the one outstanding send for {@code session} unblocks with the question.
      *
@@ -184,7 +184,7 @@ public final class Rendezvous {
     }
 
     /**
-     * Resolve a worker's blocked {@code bridge_ask} with the primary's {@code answer}, unblocking it
+     * Resolve a worker's blocked {@code fleet_ask} with the primary's {@code answer}, unblocking it
      * to resume its turn.
      *
      * @return {@code true} if the ask was still open and got the answer; {@code false} if the
@@ -195,7 +195,7 @@ public final class Rendezvous {
         return w != null && w.answer().complete(answer);
     }
 
-    /** Drop a reverse-rendezvous turn once its {@code bridge_ask} has resolved (answered or lapsed). */
+    /** Drop a reverse-rendezvous turn once its {@code fleet_ask} has resolved (answered or lapsed). */
     public void closeAsk(String turnId) {
         AskWaiter w = asks.get(turnId);
         if (w == null) {
@@ -209,9 +209,9 @@ public final class Rendezvous {
 
     /**
      * Resolve a specific captured {@code waiter} as a completion (the delegated turn finished with no
-     * {@code bridge_reply}); {@code text} is the scraped transcript tail. The waiter is the one
+     * {@code fleet_reply}); {@code text} is the scraped transcript tail. The waiter is the one
      * captured when this turn was delivered, so a late completion for turn N cannot land on turn N+1's
-     * send (CB-116). A no-op if that waiter was already resolved — a raced {@code bridge_reply} wins.
+     * send (CB-116). A no-op if that waiter was already resolved — a raced {@code fleet_reply} wins.
      *
      * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
      */
@@ -233,7 +233,7 @@ public final class Rendezvous {
 
     /**
      * Resolve a specific captured {@code waiter} as {@link Kind#BACKEND_EXHAUSTED} (CB-578 stage A):
-     * the turn finished with no {@code bridge_reply} and the scrape matched the backend's configured
+     * the turn finished with no {@code fleet_reply} and the scrape matched the backend's configured
      * usage-limit pattern; {@code reason} carries the matched line. Like
      * {@link #resolveCompletion(CompletableFuture, String)} it targets the exact captured send
      * (CB-116). A no-op if that waiter was already resolved — first resolution wins.

bridged/src/main/java/dev/ltms/fleet/msg/ReplyInbox.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
 import java.util.List;
 

bridged/src/main/java/dev/ltms/fleet/msg/ReplyPushLoop.java

@@ -1,10 +1,10 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -19,9 +19,9 @@ import java.util.stream.Collectors;
 
 /**
  * A status-gated push loop that nudges a lead's own herdr pane when it has uncollected work
- * waiting: a worker reply queued with no live {@code bridge_send} to resolve it (CB-307), an
- * async delegation ticket ({@code bridge_send(wait:false)}) that reached a terminal phase
- * (CB-588), or an async ticket's worker pausing mid-turn in {@code bridge_ask} to await an answer
+ * waiting: a worker reply queued with no live {@code fleet_send} to resolve it (CB-307), an
+ * async delegation ticket ({@code fleet_send(wait:false)}) that reached a terminal phase
+ * (CB-588), or an async ticket's worker pausing mid-turn in {@code fleet_ask} to await an answer
  * (CB-582).
  *
  * <p><strong>CB-590: one schedule per lead.</strong> All three kinds of work are triggered
@@ -50,24 +50,24 @@ import java.util.stream.Collectors;
 public final class ReplyPushLoop {
 
     private static final Logger log = LoggerFactory.getLogger(ReplyPushLoop.class);
-    static final String NUDGE_FORMAT = "Worker %s returned a reply — run bridge_poll(target=%s) to collect it";
+    static final String NUDGE_FORMAT = "Worker %s returned a reply — run fleet_poll(target=%s) to collect it";
     /** Coalesced form, several uncollected replies for the same lead. */
     static final String REPLIES_NUDGE_FORMAT =
-            "%d workers returned replies — run bridge_poll(target=...) for each to collect them: %s";
+            "%d workers returned replies — run fleet_poll(target=...) for each to collect them: %s";
     /** Singular form, one uncollected ticket. */
     static final String TICKET_NUDGE_FORMAT =
-            "Ticket %s finished%s — run bridge_poll(ticket=%s) to collect it";
+            "Ticket %s finished%s — run fleet_poll(ticket=%s) to collect it";
     /** Coalesced form, several uncollected tickets for the same lead. */
     static final String TICKETS_NUDGE_FORMAT =
-            "%d tickets finished%s — run bridge_poll(ticket=...) for each to collect them: %s";
-    /** Singular form, one worker paused mid-turn in bridge_ask (CB-582) — names the answer call directly. */
+            "%d tickets finished%s — run fleet_poll(ticket=...) for each to collect them: %s";
+    /** Singular form, one worker paused mid-turn in fleet_ask (CB-582) — names the answer call directly. */
     static final String QUESTION_NUDGE_FORMAT =
-            "Worker %s asked a question (ticket %s) — answer it with bridge_send(turnId=\"%s\", "
+            "Worker %s asked a question (ticket %s) — answer it with fleet_send(turnId=\"%s\", "
                     + "content=...) to resume its turn:\n%s";
     /** Coalesced form, several open questions for the same lead. */
     static final String QUESTIONS_NUDGE_FORMAT =
-            "%d workers are paused on a question — run bridge_poll(ticket=...) for each, then answer "
-                    + "with bridge_send(turnId=..., content=...): %s";
+            "%d workers are paused on a question — run fleet_poll(ticket=...) for each, then answer "
+                    + "with fleet_send(turnId=..., content=...): %s";
 
     private final PrimaryRegistry primaryRegistry;
     private final AgentControl agents;
@@ -87,7 +87,7 @@ public final class ReplyPushLoop {
     /** Tickets that have gone terminal but not yet been polled, keyed by ticket. */
     private final ConcurrentHashMap<String, PendingTicket> pendingTickets = new ConcurrentHashMap<>();
     /**
-     * Open {@code bridge_ask} questions not yet answered or lapsed, keyed by {@code turnId}
+     * Open {@code fleet_ask} questions not yet answered or lapsed, keyed by {@code turnId}
      * (CB-582). A question's own nudge count is tracked the same per-item way as
      * {@link #pendingTickets} (CB-598): a fresh question keeps its source eligible regardless of
      * how depleted an older, still-open question's count is.
@@ -118,7 +118,7 @@ public final class ReplyPushLoop {
     /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
     private void countNudge(String outcome) {
         if (metrics != null) {
-            metrics.inc(BridgedMetrics.PUSH_NUDGES, "outcome", outcome);
+            metrics.inc(FleetMetrics.PUSH_NUDGES, "outcome", outcome);
         }
     }
 
@@ -130,7 +130,7 @@ public final class ReplyPushLoop {
     /**
      * Reply targets still pending for {@code lead} — registered via {@link #onReplyQueued} and
      * whose inbox still holds an unacked message. A target whose inbox has since drained (acked,
-     * or collected via a live {@code bridge_send} rendezvous instead) is dropped from
+     * or collected via a live {@code fleet_send} rendezvous instead) is dropped from
      * {@link #pendingReplies} here rather than lingering forever; there is no explicit "reply
      * collected" callback the way {@link #ticketCollected} exists for tickets, so the inbox itself
      * is the only signal.
@@ -323,7 +323,7 @@ public final class ReplyPushLoop {
     }
 
     /**
-     * Called when an async delegation ticket ({@code bridge_send(wait:false)}, CB-107) reaches a
+     * Called when an async delegation ticket ({@code fleet_send(wait:false)}, CB-107) reaches a
      * terminal phase — DONE or a failure. Unlike {@link #onReplyQueued}, which nudges about the
      * durable-inbox no-waiter path, this covers the path {@code MessageService.reply} takes when a
      * fire-and-poll send's own rendezvous waiter resolves the reply directly: that path returns
@@ -352,7 +352,7 @@ public final class ReplyPushLoop {
     }
 
     /**
-     * Called when a ticket's terminal state has been collected via {@code bridge_poll}. Removes it
+     * Called when a ticket's terminal state has been collected via {@code fleet_poll}. Removes it
      * from the pending set so a scheduled tick — and any nudge it sends — never names a ticket the
      * lead already has. A ticket that was never pending (unknown ticket, or one nudged with no push
      * loop configured) is a no-op.
@@ -362,16 +362,16 @@ public final class ReplyPushLoop {
     }
 
     /**
-     * Called when an async ticket's worker pauses mid-turn in {@code bridge_ask} (CB-582): the
-     * question is now visible via {@code bridge_poll} (Phase.ASKING), but the reverse-rendezvous
-     * window it opened with (~55s default, see {@code BridgeMcp}/{@code BridgedApp}) is far shorter
+     * Called when an async ticket's worker pauses mid-turn in {@code fleet_ask} (CB-582): the
+     * question is now visible via {@code fleet_poll} (Phase.ASKING), but the reverse-rendezvous
+     * window it opened with (~55s default, see {@code FleetMcp}/{@code FleetApp}) is far shorter
      * than a lead's normal minutes-long poll cadence — exactly the gap this closes. Resolves the
      * delegating lead the same way {@link #onTicketTerminal} does and coalesces onto the same
      * per-lead schedule (CB-590).
      *
-     * @param ticket   the async ticket the question belongs to (for {@code bridge_poll})
+     * @param ticket   the async ticket the question belongs to (for {@code fleet_poll})
      * @param target   the worker session that asked
-     * @param turnId   correlation id the lead answers with ({@code bridge_send turnId=...})
+     * @param turnId   correlation id the lead answers with ({@code fleet_send turnId=...})
      * @param question the question text
      */
     public void onQuestionOpened(String ticket, String target, String turnId, String question) {
@@ -386,7 +386,7 @@ public final class ReplyPushLoop {
     }
 
     /**
-     * Called when a worker's {@code bridge_ask} resolves — answered or lapsed unanswered — so a
+     * Called when a worker's {@code fleet_ask} resolves — answered or lapsed unanswered — so a
      * scheduled tick never nudges about a question the lead already handled. A {@code turnId} that
      * was never pending (never nudged, or already closed) is a no-op.
      */

bridged/src/main/java/dev/ltms/fleet/msg/TurnToken.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
 import java.util.concurrent.CompletableFuture;
 

bridged/src/main/java/dev/ltms/fleet/peer/Capability.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;
 
 /**
  * Declared capabilities of a {@link PeerLauncher}. The protocol is the union across all
@@ -9,7 +9,7 @@ package dev.ltms.bridged.peer;
 public enum Capability {
 
     /**
-     * The peer supports {@code bridge_ask} rendezvous — pausing its delegated turn to ask
+     * The peer supports {@code fleet_ask} rendezvous — pausing its delegated turn to ask
      * the primary a question, then resuming once answered. All Claude Code peers support this.
      */
     MID_TURN_ASK,

bridged/src/main/java/dev/ltms/fleet/peer/CharterReceipt.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;

bridged/src/main/java/dev/ltms/fleet/peer/MemberRole.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;
 
 import java.util.Locale;
 

bridged/src/main/java/dev/ltms/fleet/peer/PeerHandle.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;
 
 /**
  * An opaque handle returned by {@link PeerLauncher#spawn(SpawnRequest)}. The core routes on

bridged/src/main/java/dev/ltms/fleet/peer/PeerLauncher.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;
 
 import java.util.List;
 import java.util.Set;
@@ -13,11 +13,23 @@ import java.util.Set;
  * and naming conventions are all adapter-private — the core sees only the returned
  * {@link PeerHandle} whose {@code id()} is the registry/routing key.
  *
- * <p>The interface is a superset of what {@code SessionManager} and {@code Bridged.main} call
+ * <p>The interface is a superset of what {@code SessionManager} and {@code Fleetd.main} call
  * on the concrete launcher today.
  */
 public interface PeerLauncher {
 
+    /**
+     * The name every launcher gives the bridge's MCP server in the config it writes for its peer.
+     * The peer's tools are addressed as {@code mcp__<this>__fleet_*}, and {@code CLAUDE.md}'s
+     * role-detection ladder names that prefix, so the two must agree.
+     *
+     * <p>It is a constant because three launchers write it — {@code ClaudeCodeLauncher} and
+     * {@code LeadLauncher} into a {@code --mcp-config} literal, {@code OpenCodeLauncher} into an
+     * {@code opencode.json} node. Three hand-written copies of one name is how a rename lands in
+     * two of them (CB-632).
+     */
+    String MCP_MOUNT_NAME = "fleet";
+
     /**
      * The set of {@link Capability capabilities} this launcher declares. A peer whose profile
      * opts into a git-forge token should include {@link Capability#SELF_PR}; the base set for

bridged/src/main/java/dev/ltms/fleet/peer/PeerUnreachableException.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;
 
 /**
  * Thrown when a {@link PeerLauncher} starts a peer process but the peer

bridged/src/main/java/dev/ltms/fleet/peer/SpawnRequest.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;
 
 /**
  * What a caller asks for when spawning a peer.

bridged/src/main/java/dev/ltms/fleet/placement/BackendQuarantine.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -8,7 +8,7 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.LongSupplier;
 
 /**
- * Where a credential (not a profile — see {@code BridgedConfig.Profile#effectiveCredentialId()})
+ * Where a credential (not a profile — see {@code FleetConfig.Profile#effectiveCredentialId()})
  * sits out a cooldown after a {@code BACKEND_EXHAUSTED} classification (CB-578 stage B), so a fresh
  * spawn does not walk straight back onto the account that just refused on a usage limit.
  *
@@ -16,7 +16,7 @@ import java.util.function.LongSupplier;
  * models on the same OpenAI account) share one quarantine — {@link #quarantine} one credential id
  * and every profile whose {@code effectiveCredentialId()} equals it is quarantined too, without this
  * class knowing anything about profiles at all. That mapping is the caller's job (see
- * {@code CompositePeerLauncher} and {@code dev.ltms.bridged.inject.ExhaustionSink}).
+ * {@code CompositePeerLauncher} and {@code dev.ltms.fleet.inject.ExhaustionSink}).
  *
  * <p>The clock is injected ({@link LongSupplier}, conventionally {@code System::nanoTime} like
  * {@code FleetHealthMonitor}), never read inline, so a quarantine's expiry is testable without a

bridged/src/main/java/dev/ltms/fleet/placement/FixedPlacementPolicy.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 /**
  * Backward-compatible placement: an unqualified spawn always resolves to the configured default
@@ -11,7 +11,7 @@ package dev.ltms.bridged.placement;
  *       a usage limit, not a transient capacity or reachability concern.
  *   <li>Weight 0 (CB-554): {@code fixed} is still automatic selection, so a profile the operator
  *       marked "never auto-select me" ({@code weight <= 0}) must be skipped here exactly as
- *       {@code weighted}/{@code round-robin} skip it — an explicit {@code bridge_spawn} naming
+ *       {@code weighted}/{@code round-robin} skip it — an explicit {@code fleet_spawn} naming
  *       the profile is unaffected, only this automatic fallback walk.
  * </ul>
  * A fleet where nothing is ever quarantined or weight-0 never exercises either path, so today's

bridged/src/main/java/dev/ltms/fleet/placement/PlacementCandidate.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 /**
  * A profile (and, in CB-308, a host) that can be chosen by a {@link PlacementPolicy}.
@@ -21,12 +21,12 @@ public record PlacementCandidate(String profile, String host, float weight, Inte
     /**
      * True when this candidate carries an explicit {@code weight <= 0} (CB-554) and must be
      * skipped by every automatic policy — the same way a quarantined or unreachable candidate is
-     * skipped. {@code BridgedConfig.Profile}'s compact constructor already normalises "absent" to
+     * skipped. {@code FleetConfig.Profile}'s compact constructor already normalises "absent" to
      * {@code 1.0} and "negative" to {@code 0.0}, so this is a plain threshold check here; it does
      * not need to distinguish "explicit 0" from "absent" itself.
      *
      * <p>Exclusion is about <em>automatic</em> selection only — an explicit
-     * {@code bridge_spawn{profile:"..."}} bypasses placement entirely and is unaffected.
+     * {@code fleet_spawn{profile:"..."}} bypasses placement entirely and is unaffected.
      */
     public boolean excluded() {
         return weight <= 0.0f;

bridged/src/main/java/dev/ltms/fleet/placement/PlacementContext.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 import java.util.List;
 import java.util.Set;

bridged/src/main/java/dev/ltms/fleet/placement/PlacementException.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 /**
  * Thrown when a {@link PlacementPolicy} has no candidate available. Kept as a distinct type so

bridged/src/main/java/dev/ltms/fleet/placement/PlacementPolicies.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 /**
  * Factory for the built-in placement policies.

bridged/src/main/java/dev/ltms/fleet/placement/PlacementPolicy.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 /**
  * How {@code bridged} chooses a worker profile when a spawn names none. Implementations are

bridged/src/main/java/dev/ltms/fleet/placement/PlacementPolicyUtil.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 import java.util.ArrayList;
 import java.util.List;

bridged/src/main/java/dev/ltms/fleet/placement/RoundRobinPlacementPolicy.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;
 
 import java.util.List;
 import java.util.concurrent.atomic.AtomicInteger;