fleetd #498: awaitHerdr distinguishes deadline-passed from interrupted, with measured elapsed time

- awaitHerdr now returns a HerdrAwaitOutcome(HerdrWaitResult, elapsedNanos) instead of a bare
  boolean, so 'the wait budget genuinely ran out' and 'the waiting thread was interrupted' are
  two distinct, named states instead of the same false (fleetd #497's shape).
- awaitHerdr takes the clock (LongSupplier) and the per-poll sleep (Runnable) as required
  parameters, with no defaulted overload (fleetd #415), so a test can drive it.
- The startup call site is extracted into logHerdrWaitOutcomeAndShouldReap, since main() itself
  cannot be driven from a unit test; it logs a distinct message per outcome, always printing the
  measured elapsed time next to the configured budget, never the budget alone.
- Adds FleetdAwaitHerdrTest covering the seam (all three outcomes, plus the preserved interrupt
  flag) and the call site (the three distinct log messages), using ListAppender.

.claude/skills/handover/SKILL.md

@@ -0,0 +1,226 @@
+---
+name: handover
+description: Procedure for an outgoing lead to write the handover file that a fresh lead session inherits. Load this when your context is filling up and you are about to be replaced, whether you hand off by hand or fleetd does it for you. The file is the new lead's only inheritance — follow it exactly.
+---
+
+# Handover — write the file the next lead depends on
+
+A lead session fills up its context and has to be replaced by a fresh one. The outgoing lead
+writes a handover file, and the new session reads that file and carries on.
+
+**There are two ways to hand off, and the file is the same either way.**
+
+- **By hand.** You write the file, then tell the operator where it is. The operator starts the new
+  session and points it at the file. This always works.
+- **With `fleet_handover`** (fleetd #480, merged 2026-09-11). You ask fleetd to do the swap: it
+  checks the file, clears your pane, and tells the fresh session to read it. This needs
+  `leadRollover:` in `fleetd.yaml`; without it every action answers a clean refusal naming
+  `NOT_CONFIGURED`, and you fall back to the manual path. Section 11 below is the procedure.
+
+Nothing else in this skill changes between the two. Only who performs the swap changes.
+
+**The new lead's only inheritance is that file.** It does not see your conversation, your plan,
+or your screen. If the file is thin or wrong, the new lead re-derives what you already knew, and
+that wastes hours. Writing a good handover file is real work. It is not paperwork you rush
+through at the end of a session.
+
+This skill is the procedure for writing it. Every rule below earned its place because a past
+handover got it wrong.
+
+## 1. Confirm you are the right session to write this
+
+Run `fleet_whoami` first. It must answer `primary`. Only a primary (lead) session writes a
+handover file. A worker's job ends with its own pull request, not a fleet-wide handoff.
+
+## 2. Every number needs a command, run in this turn
+
+A number is a claim: a count, a commit hash, a process id, a percentage, a queue depth. Before
+you write one, run the command that produces it — now, in this turn, against the live state.
+
+Never take a number from:
+
+- earlier in your own conversation — the state has moved since then,
+- a peer lead's report — that is their measurement, not yours,
+- your own memory of an earlier session.
+
+Put the command, or its real output, next to the number. That lets the next lead re-run it and
+check it still matches. If you cannot measure something yourself, say so instead of guessing:
+"the fleet01 lead reports 91 commits behind; I have not checked this myself."
+
+## 3. Say what you measured and what you did not
+
+Mark every claim as one of two things:
+
+- **"I checked this myself, in the code or on this host, at `<time>`."**
+- **"I did not check this myself; `<who>` reported it."**
+
+Never present someone else's measurement as your own. This matters most for cross-host claims —
+a peer lead's daemon, a worker's report, or something the operator said earlier that you cannot
+re-verify from here.
+
+## 4. Record open decisions, and who owns them
+
+List three things:
+
+- what the operator actually asked for, in their own words where you have them,
+- what is still unanswered,
+- any question you decided yourself instead of asking, with your reason.
+
+Write the decision so it cannot be mistaken for the operator's instruction. Say plainly: "the
+operator never answered X; I decided Y, because Z." Without this, the next lead either silently
+reopens a closed question or assumes the operator chose something they never did.
+
+## 5. Record live hazards
+
+List anything that will break if the next lead does the obvious thing next. This includes:
+
+- unpushed commits or unmerged branches,
+- a build, a spawn, or a redeploy still running,
+- code merged to `main` but not yet redeployed to the live daemon,
+- any trap that looks safe and is not — say what goes wrong and why, not only that something is
+  "tricky."
+
+## 6. Record what is explicitly not owed
+
+List work that is finished, and work that another party has said they do not want touched. Name
+who said so and when. Without this line, the next lead re-does closed work or reopens a question
+a peer already declined to revisit.
+
+## 7. Open the file with three re-measurement commands
+
+The file's own first section must give the next lead three concrete commands to run before
+acting on anything else in the file:
+
+1. confirm role — for example `fleet_whoami`,
+2. confirm the state of the working tree — for example `git status` and
+   `git rev-list origin/main..HEAD`,
+3. read the live fleet — for example `fleet_list`.
+
+Record what each command answered when you wrote the file, and tell the reader to run it again
+rather than trust your answer. The point of this section is that the reader checks live state
+before acting on any claim in the rest of the file, including yours.
+
+## 8. Stamp the file with time and commit
+
+Near the top of the file, write:
+
+- the date and time you wrote it,
+- the commit the tree was on (`git rev-parse HEAD`),
+- whether the tree was clean (`git status`).
+
+Without this, nobody can tell how old the file is, or which code it describes.
+
+## 9. State plainly that the file goes stale fast
+
+Say near the top: **re-measure anything you act on.** The file goes stale the moment anyone
+merges a branch, spawns a member, or restarts the daemon. Everything in the file is a snapshot
+of one moment, not a live fact.
+
+## 10. What to leave out
+
+Do not include:
+
+- narration of how the session felt, or how hard something was,
+- anything the repo already records — code structure, git history, or a rule already written in
+  `CLAUDE.md`. Point at it instead of repeating it,
+- advice that is only true for the session that is ending — a half-open terminal, a local
+  variable, a train of thought with no state behind it.
+
+A handover file is a record of state and decisions. It is not a diary.
+
+## 11. Using `fleet_handover` (only if `leadRollover:` is configured)
+
+**Run the three steps in this order. The order is not a style choice — the wrong order is
+refused.**
+
+1. **`fleet_handover{action: "open", reason: "<why now>"}`.** It returns a `token` and the
+   `handoverPath` you must write to. Nothing has happened to your pane yet.
+
+   **Write to exactly that path, and do not resolve it yourself.** It is always absolute, even when
+   the operator configured a relative `handoverPath`: fleetd resolves a relative one against your
+   own workspace before it hands it to you. The daemon and your pane can run in different
+   directories, so a path you resolve yourself can point at a different file from the one the daemon
+   will check.
+
+   **Check that the path is ignored by git before you write to it (#491).** A relative
+   `handoverPath` resolves inside YOUR workspace, which is usually a repository — and usually not
+   the `fleetd` one, so an ignore rule added to `fleetd` does not protect it. Run
+   `grep -n handover <your workspace>/.gitignore`. No output means the file you are about to write
+   will show up as untracked content in that repo. The file is a snapshot of live state and must
+   never be committed, so tell the operator rather than committing it or silently editing their
+   `.gitignore`.
+2. **Write the handover file at that path**, following sections 1–10 above.
+3. **Ask the operator, then `fleet_handover{action: "confirm", token, operatorConfirmed: true}`.**
+
+Why that order: `confirm` refuses with `HANDOVER_STALE` unless the file was modified **after** the
+`open` request. That check stops a leftover file from an earlier session being accepted as this
+one's handover. So writing the file first and then calling `open` — the obvious order — always
+fails.
+
+`{action: "cancel", token}` drops a pending request without rolling.
+
+**Things that will surprise you:**
+
+- **`accepted` does not mean your pane has been cleared.** It means every gate passed and the roll
+  is scheduled to run once your current turn ends. Say your goodbye in the same turn — you will not
+  get another one.
+- **There is no terminal or session parameter, on purpose.** The pane is always your own, resolved
+  from your connection, so you can only ever roll yourself.
+- **`operatorConfirmed` is your report of what a human told you.** Do not pass `true` because you
+  are confident. Ask, wait for the answer, then pass what they said. `requireOperatorConfirm`
+  defaults to `true` and this is the only thing standing between a judgement call and a wiped
+  session.
+- **The roll can still refuse after `confirm` returns**, and by then there is no caller to tell.
+  Those outcomes are logged only, as `lead-rollover:` lines in the daemon log.
+- **The bootstrap prompt has never yet landed, and the fix is unproven (fleetd #489).** The first
+  real rollover, on 2026-09-12, joined `/clear` and the bootstrap text into one line and Claude Code
+  refused it as `Unknown command: /clearFresh`. The pane was never cleared and no context was lost,
+  so the failure was safe — the roll simply did nothing. PR #490 fixed the cause and is deployed,
+  but no roll has bootstrapped a fresh session end to end yet. **Assume it may still fail, and tell
+  the operator so before you confirm.** The recovery is the same either way: the file is already
+  written, so the operator starts a session and points it at the file. That is why you write the
+  file before you confirm, and never the other way round.
+
+## Writing style
+
+Write in plain English. Use everyday words, one idea per sentence, and active voice. Keep every
+class, method, file, flag, and config key exactly as it appears in the code — replacing a
+precise term with a vague one makes the sentence wrong, not simpler. Explain an abbreviation the
+first time you use it.
+
+If a diagram genuinely helps, put it in the `.md` file as a fenced ` ```mermaid ` block with no
+hardcoded colors, so it stays readable on light and dark backgrounds. Quote any label that has
+brackets, colons, or slashes.
+
+## Template
+
+```markdown
+# Handover — <fleet name> lead session, <date and time>
+
+Written at commit `<output of git rev-parse HEAD>`. Tree was <clean, or dirty: `<git status
+summary>`>. Re-measure anything you act on — this file goes stale the moment anyone merges,
+spawns, or restarts.
+
+## 0. Do these three things first
+
+1. Confirm your role: `fleet_whoami` — must answer `primary`. (Answered `<result>` at `<time>`.)
+2. Confirm tree state: `git status`, `git rev-list origin/main..HEAD`. (`<result>` at `<time>`.)
+3. Read the live fleet: `fleet_list`. (`<result>` at `<time>`.)
+
+## 1. What the operator asked for
+
+<the live instructions, in their words where you have them; what is still open; any decision
+you made yourself, and why>
+
+## 2. Open decisions, and who owns them
+
+<one line per decision: who owns it, what is unanswered>
+
+## 3. Live hazards
+
+<one entry per hazard: what breaks, and why, if the next lead does the obvious thing>
+
+## 4. What is not owed
+
+<finished work, and work another party has declined; name who said so and when>
+```

.claude/skills/redeploy-fleetd/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: redeploy-fleetd
+description: Rebuild and restart the live fleetd daemon after a merge (lead / primary only). Load this before redeploying — it holds the script, the drain step, the permission grant, and the five checks that have each gone wrong here before. Workers must never do this.
+---
+
+### Redeploying the daemon — the lead may do this (primary only)
+
+**A merge is not a deployment.** The running `fleetd` holds the jar it was started with, so a
+feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
+about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
+rather than hand the job back to the operator.
+
+Workers must never do this. A worker has no business restarting the daemon it is talking through,
+and stopping it kills the worker's own channel mid-turn.
+
+**Use the script — do not hand-roll the steps.**
+
+```bash
+scripts/redeploy-fleetd.sh --check   # report state, change nothing
+scripts/redeploy-fleetd.sh           # build, confirm drain, restart, verify
+scripts/redeploy-fleetd.sh --yes     # skip the drain prompt (fleet already checked)
+scripts/redeploy-fleetd.sh --no-build # restart the jar already on disk
+```
+
+`--no-build` skips the build and restarts whatever jar is at `fleetd/target/fleetd.jar`. Use it only
+when you just built and nothing changed since. It gives up the protection in the next paragraph: no
+build runs, so a stale or missing jar is not caught early. The script still checks the file is there
+and dies with `no jar at … — run without --no-build` if it is not, but it cannot tell you the jar is
+old. A `mvn clean` in the tree deletes that jar while the daemon keeps running on it, and nothing
+degrades until the next restart. Run `--check` first: it prints the jar's hash and its modification
+time, so you can see for yourself whether the jar is missing or older than the code you mean to ship.
+
+It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
+old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a
+line marker taken before the restart, so old errors cannot be misread as new ones. Run `--check`
+first — it is read-only and reports whether the forge token resolves, which nothing else tells you.
+
+The script encodes the five things below, each of which has gone wrong here before. Read them anyway:
+if the script is unavailable or a step fails, this is what it was protecting you from.
+
+1. **Login shell, or workers silently lose their forge token.** The daemon inherits
+   `WORKER_GITEA_TOKEN` from the shell that starts it, and that comes from
+   `${SHARED_ENV}/tools/secrets.sh`. Start it from a non-login shell and the variable is empty, the
+   daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
+   logs this at startup — the script's `--check` is the only thing that reports it, and it checks
+   whether the name resolves without ever printing the value.
+2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
+   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
+   rendezvous, and a member's report is not recoverable once its ticket is gone.
+3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
+   it. The startup log names which keys it accepted and which it deferred — read those lines rather
+   than assuming.
+4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
+   lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
+   demoted to worker, which refuses every orchestration call.
+5. **Prove the new jar is the one running.** Confirm a *fresh* `fleetd listening` line at the end of
+   `fleetd/fleetd.out`, dated after the restart. An old daemon that never died looks identical from
+   the outside.
+
+**Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
+refuses a bare `kill` on the daemon whatever this file says. The script is the seam that fixes that:
+it is one auditable command, so the operator allow-lists it once instead of approving a stop and a
+start every time. The rule lives in the operator's Claude Code settings:
+
+```json
+{ "permissions": { "allow": ["Bash(scripts/redeploy-fleetd.sh:*)"] } }
+```
+
+Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
+running the stop and start as separate commands — that is exactly the approval the script replaced.
+Say what you were going to run and why, and let the operator decide.
+

.gitignore

@@ -19,3 +19,9 @@
 fleetd.out
 fleetd/fleetd.out
 logs/
+
+# fleetd #480: the lead rollover handover file. `leadRollover.handoverPath` points here, and the
+# outgoing lead rewrites it on every rollover. It is a snapshot of one moment's live state —
+# unpushed branches, running builds, open questions — so it is stale the moment it is written and
+# has no business in git history.
+.handover/

CLAUDE.md

@@ -142,6 +142,7 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 | Read your own held lead-to-lead mail (no ack) | `fleet_poll{coordId: <your own coord-id, from fleet_list's coordinator.selfId>}` — primary-only; never acks, so `fleet_list`'s `held[]` still shows it after. `fleet_list`'s `held[]` gives only a truncated preview — this is the only way to read the full body |
 | Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
 | Tear down a member | `fleet_stop{paneId}` |
+| Replace your OWN lead session when its context is full | `fleet_handover{action:"open", reason?}` → write the handover file it names → `fleet_handover{action:"confirm", token, operatorConfirmed}`. Primary-only. **In that order**: the file must be modified *after* `open`, or `confirm` refuses it as stale. There is no terminal parameter — the pane is always your own, so you can never roll another lead. `{action:"cancel", token}` drops a pending request |
 
 ### Lead ↔ lead — coordinate, never delegate
 
@@ -257,8 +258,11 @@ must obey belongs in the charter, not here.
   already cost three workers' turns: each wrote a good report to its terminal and ended the turn
   with no `fleet_reply`, and the scrape returned the tail of the brief instead.
 - **Primary-side skills** (not delegation playbooks — a worker cannot use them):
-  `port-to-opencode` (make an OpenCode session a participant in this workspace) and
-  `fleets-status` (report every fleet that shares one LavinMQ instance).
+  `port-to-opencode` (make an OpenCode session a participant in this workspace),
+  `fleets-status` (report every fleet that shares one LavinMQ instance),
+  `redeploy-fleetd` (rebuild and restart the live daemon after a merge) and
+  `handover` (write the file a fresh lead session inherits when the outgoing one hands off,
+  fleetd #480).
 - **This repo is also a Claude Code marketplace, and ships a plugin.** `.claude-plugin/marketplace.json`
   points at `plugin/`, which carries the MCP mount and the `setup` skill
   (`/claude-bridge:setup` — make any project bridge-ready). It was added in CB-527 and then went
@@ -292,60 +296,14 @@ must obey belongs in the charter, not here.
 ### Redeploying the daemon — the lead may do this (primary only)
 
 **A merge is not a deployment.** The running `fleetd` holds the jar it was started with, so a
-feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
-about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
-rather than hand the job back to the operator.
+feature merged to `main` does nothing until the daemon is rebuilt and restarted. The lead **may and
+should** redeploy rather than hand the job back to the operator. **Workers must never do this** — a
+worker has no business restarting the daemon it is talking through, and stopping it kills the
+worker's own channel mid-turn.
 
-Workers must never do this. A worker has no business restarting the daemon it is talking through,
-and stopping it kills the worker's own channel mid-turn.
-
-**Use the script — do not hand-roll the steps.**
-
-```bash
-scripts/redeploy-fleetd.sh --check   # report state, change nothing
-scripts/redeploy-fleetd.sh           # build, confirm drain, restart, verify
-scripts/redeploy-fleetd.sh --yes     # skip the drain prompt (fleet already checked)
-```
-
-It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
-old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a
-line marker taken before the restart, so old errors cannot be misread as new ones. Run `--check`
-first — it is read-only and reports whether the forge token resolves, which nothing else tells you.
-
-The script encodes the five things below, each of which has gone wrong here before. Read them anyway:
-if the script is unavailable or a step fails, this is what it was protecting you from.
-
-1. **Login shell, or workers silently lose their forge token.** The daemon inherits
-   `WORKER_GITEA_TOKEN` from the shell that starts it, and that comes from
-   `${SHARED_ENV}/tools/secrets.sh`. Start it from a non-login shell and the variable is empty, the
-   daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
-   logs this at startup — the script's `--check` is the only thing that reports it, and it checks
-   whether the name resolves without ever printing the value.
-2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
-   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
-   rendezvous, and a member's report is not recoverable once its ticket is gone.
-3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
-   it. The startup log names which keys it accepted and which it deferred — read those lines rather
-   than assuming.
-4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
-   lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
-   demoted to worker, which refuses every orchestration call.
-5. **Prove the new jar is the one running.** Confirm a *fresh* `fleetd listening` line at the end of
-   `fleetd/fleetd.out`, dated after the restart. An old daemon that never died looks identical from
-   the outside.
-
-**Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
-refuses a bare `kill` on the daemon whatever this file says. The script is the seam that fixes that:
-it is one auditable command, so the operator allow-lists it once instead of approving a stop and a
-start every time. The rule lives in the operator's Claude Code settings:
-
-```json
-{ "permissions": { "allow": ["Bash(scripts/redeploy-fleetd.sh:*)"] } }
-```
-
-Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
-running the stop and start as separate commands — that is exactly the approval the script replaced.
-Say what you were going to run and why, and let the operator decide.
+**Load the `redeploy-fleetd` skill before you redeploy.** It holds `scripts/redeploy-fleetd.sh`
+and its flags, the drain step, the operator's permission grant, and the five checks that have each
+gone wrong here before. Do not hand-roll the steps from memory.
 
 ### The prompt is part of the product — update it with the code (mandatory)
 

fleetd/fleetd.example.yaml

@@ -88,6 +88,47 @@ bind:
 #   backoffMs: 60000
 #   quietNudgeCap: 3
 
+# Lead rollover (fleetd #480): replace a lead session that has decided it is ready to be replaced,
+# without an operator doing it by hand. A lead writes a handover file, then asks fleetd to clear its
+# own pane and bootstrap a fresh session against that file.
+#
+# Opt-in on purpose — it clears the lead's own pane on request, so upgrading the daemon must never
+# acquire that ability for you. Absent block = feature off, and nothing is constructed at all. Even
+# once present, nothing but an explicit confirm() call — one that passes every check — can ever
+# cause a /clear: there is no recurring timer, heartbeat or scheduler anywhere in this feature that
+# fires one on its own initiative. confirm() itself is called FROM the calling lead's own turn, so
+# it cannot clear the pane inline (that pane is still WORKING); instead it schedules a one-shot
+# continuation that waits for the SAME confirm() call's turn to end, then does the actual work. See
+# dev.ltms.fleet.lead.LeadRollover's class javadoc for the exact order (fleetd #480 correction).
+#
+# handoverPath: REQUIRED when this block is present — where the handover file a fresh lead session
+#               reads must live. No default (an operator-specific path); a present block with no
+#               handoverPath refuses to start. May be relative: it then resolves against the
+#               CALLING lead's own fleet.leaders.<name>.cwd (falling back to the daemon's own
+#               working directory when that lead has none configured) — never against whatever
+#               directory the daemon process happens to have been started in. An absolute path is
+#               used unchanged. Prefer an absolute path if the daemon and the lead's pane might not
+#               share a working directory (fleetd #480 follow-up).
+# requireOperatorConfirm: true    # default true — confirm() refuses unless the caller also passes
+#                                 # operatorConfirmed: true
+# maxDocAgeSeconds: 3600          # default 3600 — refuse a handover file older than this
+# turnSettleSeconds: 20           # default 20 — how long the deferred roll waits for the CALLING
+#                                 # lead's own turn to end (its pane to report injectable again)
+#                                 # before sending /clear at all. If this elapses, /clear is NEVER
+#                                 # sent — a lead that never goes idle is still doing real work.
+# clearSettleSeconds: 20          # default 20 — how long to wait for the pane to become injectable
+#                                 # again AFTER /clear before giving up (never sends bootstrapText
+#                                 # if this elapses). A separate, second wait from turnSettleSeconds.
+# bootstrapText: "..."            # default names the RESOLVED (absolute) handoverPath — sent to
+#                                 # the lead once its pane settles after /clear
+# leadRollover:
+#   handoverPath: /path/to/handover.md
+#   requireOperatorConfirm: true
+#   maxDocAgeSeconds: 3600
+#   turnSettleSeconds: 20
+#   clearSettleSeconds: 20
+#   bootstrapText: "Fresh lead session: read the handover file and carry on."
+
 # Fleet health detection is dormant unless enabled (CB-573). It reads one whole-fleet agent list
 # per tick.
 #   intervalSeconds → how often a tick runs (default 30). ENFORCED floor of 15: the code computes
@@ -452,6 +493,15 @@ placement: weighted
 # seconds, before a spawn may land on it again. Applies to every profile's effective credential
 # (its own name, or its credentialId if set above) — there is no per-profile override. Default
 # 1800 (30 minutes) when omitted or non-positive.
+#
+# fleetd #466: this is now only the BASE of an escalating backoff, not a flat retry rate. A
+# credential quarantined again within one base cooldown of the previous quarantine ending (still
+# reporting exhausted — e.g. a weekly subscription limit that hasn't reset) backs off further:
+# cooldown doubles each such time, capped at 12x this value (~6 hours at the 1800s default). A
+# quarantine that starts after a base-cooldown's worth of quiet resets back to this value. Not
+# configurable per se — the multiplier and ceiling are constants in BackendQuarantine, not new
+# YAML keys; see its class doc for the exact formula and why there is no automatic probe to clear
+# it early (the operator's own design constraint — a probe spends the quota it's measuring).
 # DEFERRED: baked once into the BackendQuarantine built at startup — a running quarantine keeps
 # its original cooldown regardless; a new value only applies to a quarantine that starts after a
 # restart. Editing this needs a daemon restart to take effect.

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -10,6 +10,7 @@ import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.herdr.HerdrRouter;
 import dev.ltms.fleet.herdr.LeadTabScanner;
 import dev.ltms.fleet.lead.LeadLauncher;
+import dev.ltms.fleet.lead.LeadRollover;
 import dev.ltms.fleet.herdr.PaneLocator;
 import dev.ltms.fleet.herdr.UnixSocketHerdrClient;
 import dev.ltms.fleet.herdr.WorkspaceControl;
@@ -26,6 +27,7 @@ import dev.ltms.fleet.inject.MemberPresence;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.mcp.CharterToolSurface;
 import dev.ltms.fleet.mcp.ConnectionIdentity;
 import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
@@ -78,6 +80,7 @@ import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
+import java.util.function.LongSupplier;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
 import java.util.regex.Pattern;
@@ -147,7 +150,10 @@ public final class Fleetd {
         // wiring below reads it, and must, because those decisions cannot be unmade. `config` is the
         // live reference the hot paths read per use. Which keys can actually move is ConfigRef's
         // contract; adding a reader here does not make a key reloadable by itself.
-        ConfigRef config = new ConfigRef(configPath, cfg);
+        // fleetd #474: pass the charter/tool-surface check in as ConfigRef's extraValidation, so
+        // ConfigRef#reload() runs the same gate main() runs below, without dev.ltms.fleet.config
+        // gaining a dependency on dev.ltms.fleet.mcp — Fleetd is the seam that already holds both.
+        ConfigRef config = new ConfigRef(configPath, cfg, Fleetd::assertChartersNameOnlyRegisteredTools);
 
         // The primary/host env that launched fleetd must not be tainted.
         SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
@@ -163,6 +169,17 @@ public final class Fleetd {
         // and the Fleetd-startup tests actually pin — see FleetConfig#validateAll's javadoc for
         // why a name-by-name list here would have the same defect it replaces.
         cfg.validateAll();
+        // fleetd #469, follow-up to #464: validateAll() (and validateCharters() inside it) only
+        // checks that a charter's KEY is a role wire name and its text is non-blank — it never
+        // looks at what the text actually names. This is the separate check that does: it asks
+        // dev.ltms.fleet.mcp.FleetTool (the canonical registered-tool set) whether every fleet_*/
+        // bridge_* token a charter names is a tool this server actually registers. It cannot live
+        // inside FleetConfig#validateCharters() — config loads before the MCP server exists, and
+        // must not gain a dependency on the mcp package — so it runs here instead, at the one seam
+        // that already holds both a loaded FleetConfig and the mcp package, before anything below
+        // opens a socket or spawns a member. fleetd #474: the same check is also wired into `config`
+        // above as ConfigRef's extraValidation, so a reload refuses what this line refuses at startup.
+        assertChartersNameOnlyRegisteredTools(cfg);
 
         Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
                 ? Path.of(cfg.herdrSocket())
@@ -222,7 +239,13 @@ public final class Fleetd {
         // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
         // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
         // here, at startup, and a config reload only changes it for a daemon restart.
-        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
+        // fleetd #466: escalating, not flat — a credential that keeps reporting exhaustion (e.g. a
+        // weekly subscription limit, which would otherwise be retried on every ~30-minute cooldown,
+        // about 336 times across the week) backs off further each consecutive time, capped at
+        // BackendQuarantine.DEFAULT_MAX_COOLDOWN_MULTIPLE x the base cooldown. See BackendQuarantine's
+        // class doc for the mechanism, why this never fires on cooling-off (a separate, unescalated
+        // mechanism — BackendOutagePolicy below), and the reset.
+        BackendQuarantine quarantine = BackendQuarantine.withEscalation(System::nanoTime,
                 TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
         // fleetd #201 Unit 5: one outage-cool-off tracker for the whole daemon, shared between the
         // launcher (checked at spawn, like `quarantine` above) and the backend-error sink wired in
@@ -248,15 +271,12 @@ public final class Fleetd {
         // the first thing that actually talks to herdr, so without this wait a boot-order race
         // would crash the daemon into a restart loop. Wait, then degrade rather than die: serving
         // with /healthz reporting "degraded" is strictly more useful than exiting.
-        boolean herdrUp = awaitHerdr(herdr);
+        HerdrAwaitOutcome herdrOutcome = awaitHerdr(herdr, System::nanoTime, Fleetd::sleepHerdrPoll);
+        boolean herdrUp = logHerdrWaitOutcomeAndShouldReap(herdrOutcome);
         if (herdrUp) {
             // CB-117: herdr keeps worker panes alive across a daemon restart, and their ids died
             // with the previous process — reap those leaked orphans now, before we start serving.
             workers.reapOrphanWorkers();
-        } else {
-            log.warn("herdr did not answer within {}s — starting anyway; /healthz will report "
-                    + "degraded until it comes up. Orphaned worker panes (if any) were NOT reaped.",
-                    HERDR_WAIT_SECONDS);
         }
 
         // CB-301: authoritative session registry + lifecycle FSM on top of ClaudeCodeLauncher.
@@ -569,6 +589,16 @@ public final class Fleetd {
             heartbeat = null;
             heartbeatScheduler.shutdownNow();
         }
+        // fleetd #480: lead rollover. Opt-in; absent `leadRollover:` this is never constructed, so
+        // an upgraded daemon cannot silently acquire the ability to clear the lead's own pane.
+        // Unlike heartbeat above, this has no recurring scheduler of its own — nothing but an
+        // explicit confirm() call (wired to an MCP tool by a later ticket; nothing calls it yet)
+        // that passes every gate can ever schedule a roll. It does not take primaryRegistry: the
+        // lead terminal to roll comes from the caller of open()/confirm() (resolved by the MCP
+        // layer from the connection, the same way auth/CallerResolver#resolve builds a
+        // Principal.leader(...)), never from a single-slot lookup — see LeadRollover's class
+        // javadoc, fleetd #480 correction 2.
+        LeadRollover leadRollover = leadRollover(cfg, router.leadAgents(), config, leads);
         MessageService messages = new MessageService(router, injector, rendezvous, replyInbox,
                 pushLoop, metrics);
 
@@ -679,7 +709,10 @@ public final class Fleetd {
                 // reach. Read from the SAME snapshot leadMailbox itself opened from (cfg.coordinator()),
                 // not the live config.get() — coordinator wiring is already boot-time-fixed (see
                 // leadMailbox above), so peers follows the same rule rather than half hot-reloading.
-                cfg.coordinator() == null ? List.of() : cfg.coordinator().peers());
+                cfg.coordinator() == null ? List.of() : cfg.coordinator().peers(),
+                // fleetd #480 Unit C: the executor behind fleet_handover — null whenever
+                // leadRollover: is not configured (see the leadRollover local above).
+                leadRollover);
 
         // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
         // coordinator (or an unreachable one) there is nothing to deliver, so no scheduler is
@@ -1032,6 +1065,68 @@ public final class Fleetd {
                 .orElse(null);
     }
 
+    /**
+     * fleetd #480: construct the {@link LeadRollover} executor only when {@code leadRollover:} is
+     * present at startup — the same presence gate {@code leadHeartbeat:} uses just above this
+     * call site in {@code main}. Extracted to its own factory, the same reason
+     * {@link #worktreeBranchLookup} and {@link #exhaustionSink} are: a unit test can call this
+     * directly with a fabricated {@link FleetConfig} (absent block ⇒ {@code null}, present block ⇒
+     * constructed) without needing the whole of {@code main}, and a source-text test on the real
+     * call site proves {@code main} still calls this factory rather than inlining a copy that could
+     * silently diverge.
+     *
+     * <p>The returned object reads every {@code leadRollover:} field fresh on each {@code open()}/
+     * {@code confirm()} call through {@code () -> config.get().leadRollover()} — see {@code
+     * ConfigRef}'s class doc Hot bullet and {@link FleetConfig.LeadRollover}'s javadoc for why that
+     * makes the block's fields HOT despite this presence gate being evaluated once, at startup.
+     *
+     * <p>Deliberately does NOT take {@link PrimaryRegistry}: fleetd #480 correction 2 found that a
+     * single-slot lookup lets one lead's {@code confirm()} clear a DIFFERENT lead's pane on a
+     * daemon with more than one labelled lead tab. The lead terminal to roll instead comes from
+     * whoever calls {@code open()}/{@code confirm()} — the later MCP-tool unit must resolve it from
+     * the connection and pass it in, never take it as a request field. See {@link LeadRollover}'s
+     * class javadoc.
+     *
+     * <p><strong>fleetd #480 follow-up:</strong> also builds the terminal → lead-workspace lookup
+     * {@link LeadRollover#open} needs to resolve a relative {@code handoverPath} against the
+     * CALLING lead's own {@code cwd} rather than the daemon's — the daemon and a lead's pane can
+     * have different working directories (this repo nests {@code fleetd/} inside its own root, so
+     * they already differ on this host). The lookup is terminal → lead name (via {@code
+     * liveLeadTerminals}) → that lead's {@code cwd} (via {@code config.get().fleet().leaders()}),
+     * and both hops are read LIVE on every call, never off a snapshot taken here: leads are
+     * discovered by a live tab scan ({@code LeadTabScanner}), so a map captured at construction
+     * time could be empty (no lead has been scanned yet) or stale (a lead added since).
+     *
+     * @param cfg               the startup config snapshot — read ONCE here, only to decide whether
+     *                          to construct the object at all, exactly like {@code
+     *                          cfg.leadHeartbeat()}
+     * @param leadAgents        the {@link AgentControl} instance that reaches the LEAD's pane (not
+     *                          {@code memberAgents}), normally {@code router.leadAgents()}
+     * @param config            the live {@link ConfigRef}, captured only inside the returned
+     *                          supplier and the workspace lookup — never dereferenced here
+     * @param liveLeadTerminals terminal id → lead NAME for every CURRENTLY recognised lead, normally
+     *                          the same {@code leads} supplier {@code main} already builds for
+     *                          {@code HerdrRouter}/{@link #leadSeatLookup} — never a value snapshot
+     * @return a constructed {@link LeadRollover}, or {@code null} when {@code leadRollover:} is
+     *         absent from the startup config
+     */
+    static LeadRollover leadRollover(FleetConfig cfg, AgentControl leadAgents, ConfigRef config,
+            Supplier<Map<String, String>> liveLeadTerminals) {
+        if (cfg.leadRollover() == null) {
+            return null;
+        }
+        Function<String, String> leadWorkspace = terminal -> {
+            String leadName = liveLeadTerminals.get().get(terminal);
+            if (leadName == null) {
+                return null;
+            }
+            FleetConfig.Fleet fleet = config.get().fleet();
+            FleetConfig.Leader leader = fleet == null ? null : fleet.leaders().get(leadName);
+            return leader == null ? null : leader.cwd();
+        };
+        return new LeadRollover(leadAgents, () -> config.get().leadRollover(), leadWorkspace);
+    }
+
     /**
      * fleetd #176: per-profile factory for {@link FleetMcp.LeadSeatSource} — how many seats a
      * profile's own live LEAD session(s) hold on the same Claude subscription.
@@ -1577,12 +1672,92 @@ public final class Fleetd {
     }
 
     /**
-     * Poll herdr's {@code ping} until it answers or {@link #HERDR_WAIT_SECONDS} elapses (CB-504).
+     * fleetd #474: the one place both the startup call (right after {@code cfg.validateAll()} in
+     * {@link #main}) and the reload call (wired into {@code config}'s {@code extraValidation} above,
+     * via a method reference to this method) go through, so the two can never drift into checking
+     * different things. Extracted only to give {@link ConfigRef}'s {@code Consumer<FleetConfig>}
+     * hook a {@code FleetConfig -> void} shape to bind to — {@link CharterToolSurface} itself still
+     * takes the raw charter map and knows nothing about {@code ConfigRef} or {@code Fleetd}.
      *
-     * @return true if herdr answered, false if it never did
+     * <p>Package-private so a test can call it directly the same way the other startup-report
+     * helpers above are tested, without needing to drive {@link #main} for a unit-level check;
+     * {@code FleetdStartupValidationTest} proves the startup call site, and {@code
+     * FleetdConfigRefCharterToolSurfaceWiringTest} — by constructing {@code ConfigRef} with this
+     * exact method reference, the same way {@code main} does above — proves the reload call site.
+     * {@code dev.ltms.fleet.config.ConfigRefTest} pins the same reload behaviour too, through an
+     * equivalent {@code Consumer<FleetConfig>} it builds locally (it cannot see this package-private
+     * method from {@code dev.ltms.fleet.config}).
      */
-    private static boolean awaitHerdr(HerdrClient herdr) {
-        long deadline = System.nanoTime() + HERDR_WAIT_SECONDS * 1_000_000_000L;
+    static void assertChartersNameOnlyRegisteredTools(FleetConfig cfg) {
+        CharterToolSurface.assertChartersNameOnlyRegisteredTools(
+                cfg.fleet() == null ? Map.of() : cfg.fleet().charters());
+    }
+
+    /**
+     * How {@link #awaitHerdr} ended (fleetd #498). The old code returned a bare {@code boolean},
+     * which collapsed two different facts onto the same {@code false}: the configured wait budget
+     * genuinely running out, and the waiting thread being interrupted possibly milliseconds in.
+     * Those need different operator messages — see {@link #logHerdrWaitOutcomeAndShouldReap} — so
+     * this is a third state, not a better number (the same shape fleetd #497 named). Never treat
+     * {@link #INTERRUPTED} as if it were {@link #DEADLINE_PASSED}: only the latter means herdr was
+     * actually given the full {@link #HERDR_WAIT_SECONDS} and still failed to answer.
+     */
+    enum HerdrWaitResult {
+        /** herdr answered {@code ping} before the deadline. */
+        ANSWERED,
+        /** the configured {@link #HERDR_WAIT_SECONDS} budget elapsed with no answer. */
+        DEADLINE_PASSED,
+        /**
+         * the waiting thread was interrupted before the budget ran out — a different event from
+         * {@link #DEADLINE_PASSED} and must never be reported as "did not answer within Ns".
+         */
+        INTERRUPTED
+    }
+
+    /**
+     * The outcome of one {@link #awaitHerdr} call, carrying the MEASURED elapsed wait time
+     * alongside {@link #result}. {@code elapsedNanos} is always measured against the {@code nanos}
+     * supplier passed to {@link #awaitHerdr} — never assume it equals the configured budget, the
+     * same defect fleetd #494 already fixed once in {@code LeadRollover}.
+     */
+    record HerdrAwaitOutcome(HerdrWaitResult result, long elapsedNanos) {}
+
+    /**
+     * The real per-poll wait {@link #main} passes to {@link #awaitHerdr}: sleep
+     * {@link #HERDR_WAIT_POLL_MILLIS}, and on interruption re-set the thread's interrupt flag
+     * rather than throwing — {@link #awaitHerdr} detects an interruption by checking {@link
+     * Thread#isInterrupted()} right after this returns, so a poller that swallowed the flag
+     * instead of restoring it would make that check silently miss the interruption.
+     */
+    private static void sleepHerdrPoll() {
+        try {
+            Thread.sleep(HERDR_WAIT_POLL_MILLIS);
+        } catch (InterruptedException ie) {
+            Thread.currentThread().interrupt();
+        }
+    }
+
+    /**
+     * Poll herdr's {@code ping} until it answers, the configured {@link #HERDR_WAIT_SECONDS}
+     * budget elapses, or the waiting thread is interrupted (CB-504, fleetd #498).
+     *
+     * <p>{@code nanos} and {@code poller} are required parameters with no defaulted overload
+     * (fleetd #415's shape: a defaulted overload is a silent survivor a green suite would vouch
+     * for) — the previous version read {@link System#nanoTime()} and called {@link Thread#sleep}
+     * directly, so nothing could drive it from a test. The one production call site in {@link
+     * #main} passes {@code System::nanoTime} and {@link #sleepHerdrPoll}.
+     *
+     * @param nanos  a monotonic elapsed-time clock, e.g. {@code System::nanoTime} — never a
+     *               wall-clock source, since only elapsed time (not a timestamp) is measured here
+     * @param poller called once per failed ping while the budget remains; must, on an
+     *               {@link InterruptedException}, re-set the thread's interrupt flag rather than
+     *               throw or swallow it — this method's interruption check reads that flag right
+     *               after {@code poller.run()} returns
+     * @return the outcome and the measured elapsed wait time — see {@link HerdrAwaitOutcome}
+     */
+    static HerdrAwaitOutcome awaitHerdr(HerdrClient herdr, LongSupplier nanos, Runnable poller) {
+        long start = nanos.getAsLong();
+        long deadline = start + HERDR_WAIT_SECONDS * 1_000_000_000L;
         boolean waited = false;
         while (true) {
             try {
@@ -1590,25 +1765,57 @@ public final class Fleetd {
                 if (waited) {
                     log.info("herdr is up");
                 }
-                return true;
+                return new HerdrAwaitOutcome(HerdrWaitResult.ANSWERED, nanos.getAsLong() - start);
             } catch (HerdrException e) {
-                if (System.nanoTime() >= deadline) {
-                    return false;
+                if (nanos.getAsLong() >= deadline) {
+                    return new HerdrAwaitOutcome(HerdrWaitResult.DEADLINE_PASSED, nanos.getAsLong() - start);
                 }
                 if (!waited) {
                     log.info("waiting up to {}s for the herdr socket…", HERDR_WAIT_SECONDS);
                     waited = true;
                 }
-                try {
-                    Thread.sleep(HERDR_WAIT_POLL_MILLIS);
-                } catch (InterruptedException ie) {
-                    Thread.currentThread().interrupt();
-                    return false;
+                poller.run();
+                if (Thread.currentThread().isInterrupted()) {
+                    return new HerdrAwaitOutcome(HerdrWaitResult.INTERRUPTED, nanos.getAsLong() - start);
                 }
             }
         }
     }
 
+    /**
+     * Log the right message for {@code outcome} — never the configured {@link #HERDR_WAIT_SECONDS}
+     * budget alone, always the measured elapsed time next to it — and say whether {@link #main}
+     * should now reap orphan worker panes (fleetd #498).
+     *
+     * <p>Extracted out of {@link #main} so this decision is drivable from a test: {@link #main}
+     * boots the whole daemon and cannot itself be run in a unit test, but this is the exact,
+     * unmodified code {@link #main} calls for the decision, not a re-derivation of it.
+     *
+     * @return true only for {@link HerdrWaitResult#ANSWERED} — orphan workers are reaped only
+     *         then, exactly as before this ticket
+     */
+    static boolean logHerdrWaitOutcomeAndShouldReap(HerdrAwaitOutcome outcome) {
+        long elapsedMillis = TimeUnit.NANOSECONDS.toMillis(outcome.elapsedNanos());
+        if (outcome.result() == HerdrWaitResult.ANSWERED) {
+            return true;
+        }
+        if (outcome.result() == HerdrWaitResult.DEADLINE_PASSED) {
+            log.warn("herdr did not answer within the configured wait (configured={}s elapsed={}ms) "
+                    + "— starting anyway; /healthz will report degraded until it comes up. Orphaned "
+                    + "worker panes (if any) were NOT reaped.",
+                    HERDR_WAIT_SECONDS, elapsedMillis);
+            return false;
+        }
+        // HerdrWaitResult.INTERRUPTED — a different fact from DEADLINE_PASSED (fleetd #498): the
+        // wait was cut short, not exhausted, and must never be reported as "did not answer within
+        // Ns" — that claim would be false and would send an operator to debug herdr for nothing.
+        log.warn("herdr wait was interrupted before the configured wait ran out (configured={}s "
+                + "elapsed={}ms) — starting anyway; /healthz will report degraded until it comes "
+                + "up. Orphaned worker panes (if any) were NOT reaped.",
+                HERDR_WAIT_SECONDS, elapsedMillis);
+        return false;
+    }
+
     private Fleetd() {
     }
 }

fleetd/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -41,7 +41,16 @@ public final class Authz {
          */
         COORD_READ,
         /** Scrape the metrics endpoint. */
-        METRICS
+        METRICS,
+        /**
+         * Drive the lead-rollover executor ({@code fleet_handover}: open/confirm/cancel a
+         * self-replace, fleetd #480 Unit C). Primary-only, same as {@link #SPAWN}/{@link #STOP}/
+         * {@link #DRAIN} — and, unlike those, the terminal it acts on is never even an argument:
+         * {@code LeadRollover#open}/{@code #confirm} are always called with the CALLER's own
+         * connection-resolved terminal (see {@code dev.ltms.fleet.lead.LeadRollover}'s class
+         * javadoc, fleetd #480 correction 2), so a primary can only ever roll itself.
+         */
+        HANDOVER
     }
 
     /**
@@ -60,7 +69,7 @@ public final class Authz {
             // deliberately does NOT get these (CB-548), so it cannot tear down or stand up workers
             // even though it coordinates them; and a worker driving any of these would be a worker
             // escalating into the orchestrator role.
-            case SPAWN, STOP, DRAIN -> caller.isPrimary();
+            case SPAWN, STOP, DRAIN, HANDOVER -> caller.isPrimary();
 
             // Delivering a turn is open to the primary and the architect: an architect delegates
             // to workers (that is the role's point) but still has no lifecycle rights. A worker is

fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -11,6 +11,7 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Consumer;
 import java.util.function.Supplier;
 
 /**
@@ -61,7 +62,22 @@ import java.util.function.Supplier;
  *       both read, so a reload that arms or disarms a profile's usage-limit detection takes effect
  *       on the next check with no restart. {@code errorPattern}, {@code exhaustedPattern}'s sibling
  *       key for backend-error (not usage-limit) classification, was deliberately left OUT of this
- *       fleetd #446 change and stays deferred below — the ticket scoped it out explicitly.</li>
+ *       fleetd #446 change and stays deferred below — the ticket scoped it out explicitly.
+ *       {@code leadRollover:} (fleetd #480) joined this class whole, the same shape as
+ *       {@code models:} above: {@code dev.ltms.fleet.lead.LeadRollover} holds a
+ *       {@code Supplier<FleetConfig.LeadRollover>} (the same {@code () -> config.get().x()} shape)
+ *       and reads {@code handoverPath}/{@code requireOperatorConfirm}/{@code maxDocAgeSeconds}/
+ *       {@code turnSettleSeconds}/{@code clearSettleSeconds}/{@code bootstrapText} fresh on every
+ *       {@code open()}/{@code confirm()} call (and on the deferred post-{@code confirm()}
+ *       continuation fleetd #480's correction added — see {@code LeadRollover}'s class doc) rather
+ *       than capturing them into fields at construction — unlike its closest
+ *       structural cousin {@code leadHeartbeat:}, whose {@code LeadHeartbeatLoop} bakes
+ *       {@code idleAfterNanos}/{@code backoffMs}/{@code quietNudgeCap} into final fields. The one
+ *       restart-only edge is structural, not a stale value: {@code Fleetd.java} decides whether to
+ *       construct the {@code LeadRollover} object at all off the startup snapshot (the same
+ *       presence gate {@code leadHeartbeat:} uses), so a block ADDED where it was absent at boot
+ *       needs a restart before anything exists to call — the same fact already true of adding a
+ *       brand-new {@code profiles:} entry.</li>
  *   <li><strong>Deferred</strong> — accepted into the new snapshot, but the wiring built at startup
  *       keeps the old value until a restart: {@code lifecycle:}, {@code leadHeartbeat:},
  *       {@code idleSleepGuard:} ({@code Fleetd.java} reads it once, at startup, to decide whether
@@ -165,17 +181,20 @@ import java.util.function.Supplier;
  *
  * <p><strong>The denominator, measured on 2026-09-04 (fleetd #330; recounted for fleetd #333);
  * recounted again for fleetd #362, again after {@code idleSleepGuard:} was added, again after
- * {@code models:} was added as deferred, and again for fleetd #422, which moved {@code models:}
- * from deferred to hot-excluded once its on/off half was read live everywhere.</strong>
- * {@code FleetConfig} has 25 top-level record components: 5 cold, 13 deferred, 3 split, 4
- * hot-excluded. Four of them are named nowhere in this file, and the reason is the same for all
- * four: {@code placement}, {@code memberCredentials}, {@code memberLoginShell} and {@code models}
- * are <strong>hot</strong> and correctly absent — all four are read live off {@code config.get()}
- * (placement through the {@code CompositePeerLauncher} supplier the Hot bullet names;
- * {@code memberCredentials}/{@code memberLoginShell} at spawn time, {@code Fleetd.java:198, 205, 729}
- * and {@code HerdrPeerLauncher#configuredMemberLoginShell}; {@code models} the same way, through the
- * Hot bullet's {@code models:} paragraph), so a reload takes effect on the next spawn (or, for
- * {@code models}, the next reported status) with no entry needed here.
+ * {@code models:} was added as deferred, again for fleetd #422, which moved {@code models:}
+ * from deferred to hot-excluded once its on/off half was read live everywhere, and again after
+ * {@code leadRollover:} was added (fleetd #480).</strong>
+ * {@code FleetConfig} has 26 top-level record components: 5 cold, 13 deferred, 3 split, 5
+ * hot-excluded. Five of them are named nowhere in this file, and the reason is the same for all
+ * five: {@code placement}, {@code memberCredentials}, {@code memberLoginShell}, {@code models} and
+ * {@code leadRollover} are <strong>hot</strong> and correctly absent — all five are read live off
+ * {@code config.get()} (placement through the {@code CompositePeerLauncher} supplier the Hot bullet
+ * names; {@code memberCredentials}/{@code memberLoginShell} at spawn time, {@code Fleetd.java:198,
+ * 205, 729} and {@code HerdrPeerLauncher#configuredMemberLoginShell}; {@code models} the same way,
+ * through the Hot bullet's {@code models:} paragraph; {@code leadRollover} through the Hot bullet's
+ * {@code leadRollover:} paragraph), so a reload takes effect on the next spawn (or, for
+ * {@code models}, the next reported status; for {@code leadRollover}, the next {@code open()}/
+ * {@code confirm()} call) with no entry needed here.
  * {@code health} and {@code coordinator} used to be a third kind — <strong>undecided</strong>, not
  * hot — until fleetd #330 added the <strong>split</strong> class above and gave them a home. A
  * reload touching either used to report a bare "config reloaded", which under-claimed; now it names
@@ -211,6 +230,24 @@ import java.util.function.Supplier;
  * <p>A reload that fails to parse or fails validation is also refused, and the previous config keeps
  * running. A config file being edited is normally read once mid-save; degrading a working daemon
  * because it caught a half-written file would be a bad trade.
+ *
+ * <p><strong>fleetd #474</strong> — {@link FleetConfig#validateAll()} is not the only gate startup
+ * runs before a config takes effect: {@code Fleetd.main} also calls {@code
+ * dev.ltms.fleet.mcp.CharterToolSurface#assertChartersNameOnlyRegisteredTools}, right after {@code
+ * cfg.validateAll()}, to refuse a charter that names an MCP tool the server does not register. That
+ * check cannot live inside {@link FleetConfig} — {@code CharterToolSurface} lives in the {@code mcp}
+ * package because the canonical tool set ({@code FleetTool}) does, and config is loaded before the
+ * MCP server exists, so {@code FleetConfig} must not gain a dependency on {@code mcp}. {@link
+ * #reload} cannot import {@code mcp} either, for the same reason applied one layer up: {@code
+ * dev.ltms.fleet.config} is loaded before {@code dev.ltms.fleet.mcp} exists, same as {@code
+ * FleetConfig}. So this class accepts the check as a {@code Consumer<FleetConfig>} —
+ * {@link #extraValidation} — supplied by whichever caller already sits at the seam that holds both
+ * a loaded {@code FleetConfig} and the {@code mcp} package: {@code Fleetd.main}. It is invoked
+ * inside the same try/catch as {@code fresh.validateAll()}, so a charter that would have refused to
+ * boot refuses a reload too, and keeps the running config exactly like any other {@code
+ * validateAll()} failure. A ref built through the two-argument constructor (every test fixture that
+ * does not care about this check, and {@link #fixed}) gets a no-op consumer, so nothing outside
+ * {@code Fleetd.main} needs to know this hook exists.
  */
 public final class ConfigRef implements Supplier<FleetConfig> {
 
@@ -255,10 +292,27 @@ public final class ConfigRef implements Supplier<FleetConfig> {
 
     private final Path path;
     private final AtomicReference<FleetConfig> current;
+    private final Consumer<FleetConfig> extraValidation;
 
+    /** Equivalent to the three-argument constructor with a no-op {@code extraValidation}. */
     public ConfigRef(Path path, FleetConfig initial) {
+        this(path, initial, cfg -> { });
+    }
+
+    /**
+     * @param extraValidation run on every {@link #reload} candidate, inside the same try/catch as
+     *                        {@code fresh.validateAll()} — see the class doc's fleetd #474 note.
+     *                        {@code Fleetd.main} passes {@code
+     *                        Fleetd::assertChartersNameOnlyRegisteredTools} (a package-private
+     *                        {@code FleetConfig -> void} adapter over {@code
+     *                        CharterToolSurface#assertChartersNameOnlyRegisteredTools}), so a reload
+     *                        runs the same gate startup does without this class depending on the
+     *                        {@code mcp} package.
+     */
+    public ConfigRef(Path path, FleetConfig initial, Consumer<FleetConfig> extraValidation) {
         this.path = path;
         this.current = new AtomicReference<>(Objects.requireNonNull(initial, "initial config"));
+        this.extraValidation = Objects.requireNonNull(extraValidation, "extraValidation");
     }
 
     /** A fixed reference that never reloads — for tests and for wiring built from a config in code. */
@@ -360,6 +414,12 @@ public final class ConfigRef implements Supplier<FleetConfig> {
             // at all — see FleetConfig#validateAll's javadoc for why the fix is one reflective call,
             // not a longer hand-maintained list.
             fresh.validateAll();
+            // fleetd #474: validateAll() does not cover everything startup refuses on — the charter
+            // tool-surface check (Fleetd.main, right after cfg.validateAll()) lives outside
+            // FleetConfig on purpose (see this class's doc) and is supplied here as extraValidation.
+            // Same try/catch as validateAll() above, on purpose: either failure must refuse the whole
+            // reload and keep the running config the same way.
+            extraValidation.accept(fresh);
         } catch (RuntimeException e) {
             String msg = e.getMessage() == null ? e.toString() : e.getMessage();
             log.warn("config reload from {} refused, keeping the running config: {}", path, msg);

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -70,12 +70,14 @@ import java.util.regex.PatternSyntaxException;
  *                      {@code fixed} (default), {@code round-robin}, or {@code weighted}
  * @param auth          API authentication mode ({@code null} → {@code loopback-trust}, the
  *                      historical behaviour), CB-501
- * @param quarantineCooldownSeconds  how long a credential stays quarantined after a
+ * @param quarantineCooldownSeconds  the BASE cooldown a credential is quarantined for after a
  *                      {@code BACKEND_EXHAUSTED} classification (CB-578 stage B); {@code null}/{@code
- *                      <=0} → {@link #DEFAULT_QUARANTINE_COOLDOWN_SECONDS}. Baked once into the
- *                      {@code BackendQuarantine} built at startup, so it is DEFERRED: changing it
- *                      needs a restart, and a quarantine already running keeps whatever cooldown was
- *                      live when it started.
+ *                      <=0} → {@link #DEFAULT_QUARANTINE_COOLDOWN_SECONDS}. Since fleetd #466 this is
+ *                      only the first occurrence's length — a credential quarantined again shortly
+ *                      after this cooldown ends backs off further, up to a ceiling; see {@code
+ *                      BackendQuarantine}'s class doc. Baked once into the {@code BackendQuarantine}
+ *                      built at startup, so it is DEFERRED: changing it needs a restart, and a
+ *                      quarantine already running keeps whatever cooldown was live when it started.
  * @param memberCredentials deny-by-default policy (CB-596) for which of the operator's own host
  *                      credentials a spawned member's pane inherits. {@code null} (the block
  *                      omitted) blocks nothing — see {@link MemberCredentials}.
@@ -137,6 +139,9 @@ import java.util.regex.PatternSyntaxException;
  *                      fleetd #422 added the separate on/off question — whether a configured model
  *                      may be spawned onto RIGHT NOW ({@link Models.ModelEntry#enabled}) — enforced
  *                      live at spawn by {@code CompositePeerLauncher}, not here. See {@link Models}.
+ * @param leadRollover  opt-in lead rollover (fleetd #480): {@code null} ⇒ off, and no
+ *                      {@code dev.ltms.fleet.lead.LeadRollover} is constructed at all — an upgraded
+ *                      daemon never clears a lead's pane on its own initiative. See {@link LeadRollover}.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record FleetConfig(
@@ -164,7 +169,23 @@ public record FleetConfig(
         String memberLoginShell,
         String memberSkills,
         IdleSleepGuard idleSleepGuard,
-        Models models) {
+        Models models,
+        LeadRollover leadRollover) {
+
+    /** Back-compat form before the {@code leadRollover:} block was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup,
+                         String memberLoginShell, String memberSkills, IdleSleepGuard idleSleepGuard,
+                         Models models) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup,
+                memberLoginShell, memberSkills, idleSleepGuard, models, null);
+    }
 
     /** Back-compat form before the {@code models:} block was added. */
     public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
@@ -1308,6 +1329,104 @@ public record FleetConfig(
         }
     }
 
+    /**
+     * Opt-in lead rollover (fleetd #480): a lead that decides it is ready to be replaced writes a
+     * handover file, then asks fleetd to clear its own pane and bootstrap a fresh session against
+     * that file. Config + a pure decision/verification layer only — see
+     * {@code dev.ltms.fleet.lead.LeadRollover} for the executor this block feeds, and
+     * {@code fleet_*} tool wiring is a later ticket.
+     *
+     * <p>Deliberately opt-in ({@code null} ⇒ off, exactly like {@code leadHeartbeat:}): absent this
+     * block, {@code Fleetd.java} never constructs a {@code LeadRollover} object at all, so an
+     * upgraded daemon cannot silently acquire the ability to clear the lead's own pane. Even once
+     * present, nothing but an explicit {@code confirm()} call can ever roll a pane — there is no
+     * timer, heartbeat or timeout anywhere in this feature that fires one on its own; see that
+     * class's javadoc.
+     *
+     * <p><strong>Hot, not deferred</strong> (see {@code ConfigRef}'s class doc): every field below
+     * is read live, through a {@code Supplier<LeadRollover>} the same {@code () -> config.get().x()}
+     * shape {@code fleet}/{@code placement}/{@code models} already use, so an edit to any of the
+     * six fields takes effect on the very next {@code open()}/{@code confirm()} call once the block
+     * has been present since startup — nothing here is captured into a frozen field the way {@code
+     * leadHeartbeat}'s {@code idleAfterNanos}/{@code backoffMs}/{@code quietNudgeCap} are. The one
+     * restart-only edge left is structural, not a stale value: {@code Fleetd.java} decides whether
+     * to construct the {@code LeadRollover} object at all off the startup snapshot, the same gate
+     * {@code leadHeartbeat:} uses, so a block ADDED where it was absent at boot needs a restart
+     * before anything exists to call — the same fact already true of adding a brand-new
+     * {@code profiles:} entry.
+     *
+     * <p><strong>{@code turnSettleSeconds} (fleetd #480 correction):</strong> {@code confirm()} is
+     * called FROM the calling lead's own turn, so its pane is still {@code WORKING} the instant
+     * {@code confirm()} validates every gate and schedules the roll. {@code
+     * dev.ltms.fleet.lead.LeadRollover}'s deferred continuation waits up to this many seconds for
+     * that SAME pane to report an injectable state again — i.e. for the calling turn to actually
+     * end — before it sends {@code /clear} at all. If that wait times out, no {@code /clear} is
+     * ever sent: a lead that never goes idle is still doing real work, and clearing it would
+     * destroy live context. This is a separate wait from {@code clearSettleSeconds} below, which
+     * bounds the SECOND wait, for the pane to re-settle AFTER {@code /clear} has already gone out.
+     *
+     * @param handoverPath required when this block is present — where the handover file a fresh
+     *                     lead session reads must live. There is no sane non-null default for an
+     *                     operator-specific path, so a present block with a {@code null}/blank
+     *                     {@code handoverPath} is refused at config load; see
+     *                     {@link #validateLeadRollover()}. May be relative: {@code
+     *                     dev.ltms.fleet.lead.LeadRollover#open} resolves a relative path against
+     *                     the CALLING lead's configured {@code fleet.leaders.<name>.cwd}, falling
+     *                     back to the daemon's own working directory ({@code
+     *                     System.getProperty("user.dir")}) when that lead has none configured —
+     *                     never against whatever directory the daemon process happens to have been
+     *                     started in for its own sake. An absolute path is used unchanged.
+     * @param requireOperatorConfirm default {@code true} — {@code confirm()} refuses unless the
+     *                     caller also passes {@code operatorConfirmed: true}. Set {@code false} to
+     *                     let the three handover-file checks alone gate the roll.
+     * @param maxDocAgeSeconds default 3600 — refuse a handover file whose modified time is older
+     *                     than this many seconds, so a stale leftover from an earlier rollover
+     *                     attempt can never be mistaken for a fresh one.
+     * @param turnSettleSeconds default 20 — bound on how long the deferred roll waits for the
+     *                     CALLING lead's own turn to end (its pane to report injectable again)
+     *                     before sending {@code /clear} at all. See the paragraph above.
+     * @param clearSettleSeconds default 20 — bound on how long to wait for the lead's pane to
+     *                     report an injectable state again after {@code /clear} before giving up. A
+     *                     roll that times out here never sends {@code bootstrapText}.
+     * @param bootstrapText default a sentence naming the RESOLVED handover path — sent to the
+     *                     lead's pane once it settles after {@code /clear}, telling the fresh
+     *                     session where to read the handover and carry on. Left {@code null} here
+     *                     when the operator configures none: the default sentence cannot be built
+     *                     at construction time because it must name the path AFTER {@code
+     *                     dev.ltms.fleet.lead.LeadRollover#open} has resolved a relative {@code
+     *                     handoverPath} against the calling lead's workspace, which this record has
+     *                     no way to know — see {@link #bootstrapTextFor(String)}.
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record LeadRollover(String handoverPath, Boolean requireOperatorConfirm,
+                                Integer maxDocAgeSeconds, Integer turnSettleSeconds,
+                                Integer clearSettleSeconds, String bootstrapText) {
+        public LeadRollover {
+            requireOperatorConfirm = requireOperatorConfirm == null || requireOperatorConfirm;
+            maxDocAgeSeconds = (maxDocAgeSeconds == null || maxDocAgeSeconds <= 0) ? 3600 : maxDocAgeSeconds;
+            turnSettleSeconds = (turnSettleSeconds == null || turnSettleSeconds <= 0) ? 20 : turnSettleSeconds;
+            clearSettleSeconds = (clearSettleSeconds == null || clearSettleSeconds <= 0) ? 20 : clearSettleSeconds;
+            bootstrapText = (bootstrapText == null || bootstrapText.isBlank()) ? null : bootstrapText;
+        }
+
+        /**
+         * The text actually sent to the lead's pane once it settles after {@code /clear}: the
+         * operator's configured {@link #bootstrapText} when one is set, otherwise the default
+         * sentence built from {@code resolvedHandoverPath}.
+         *
+         * @param resolvedHandoverPath the ABSOLUTE path {@code dev.ltms.fleet.lead.LeadRollover
+         *                              #open} already resolved — never the raw configured {@link
+         *                              #handoverPath}, which may still be relative and would name a
+         *                              directory the fresh lead session's own pane cannot resolve
+         */
+        public String bootstrapTextFor(String resolvedHandoverPath) {
+            return bootstrapText != null
+                    ? bootstrapText
+                    : "Fresh lead session: read the handover file at " + resolvedHandoverPath
+                        + " and carry on from there.";
+        }
+    }
+
     /**
      * Watch {@code fleetd.yaml} and re-read it when it changes (CB-559).
      *
@@ -1723,7 +1842,7 @@ public record FleetConfig(
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
             "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
             "memberCredentials", "coordinator", "worktreeGroup", "memberLoginShell", "memberSkills",
-            "idleSleepGuard", "models");
+            "idleSleepGuard", "models", "leadRollover");
 
     /** Load and validate config from {@code path}. */
     public static FleetConfig load(Path path) {
@@ -2413,10 +2532,14 @@ public record FleetConfig(
         // empty Models would be a no-op for validateModels() either way, since an empty allow-list
         // already means "check nothing", so there is nothing to gain and one more null check to
         // avoid by leaving it exactly as configured.
+        // leadRollover is left as-is, like leadHeartbeat above: null is "off", and LeadRollover's
+        // own compact constructor defaults the fields of a block that IS present. Defaulting it
+        // here would construct a LeadRollover object (via Fleetd.java's presence gate) for every
+        // config that never mentioned it.
         return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
                 quarantineCooldown, mc, coordinator, worktreeGroup, memberLoginShell, memberSkills,
-                idleSleepGuard, models);
+                idleSleepGuard, models, leadRollover);
     }
 
     /**
@@ -2499,6 +2622,26 @@ public record FleetConfig(
                 + "lead tabs cannot be confused.");
     }
 
+    /**
+     * Reject a present {@code leadRollover:} block with no (or a blank) {@code handoverPath}
+     * (fleetd #480). There is no sane non-null default for an operator-specific file path, unlike
+     * every other field on {@link LeadRollover}, which {@link LeadRollover}'s own compact
+     * constructor already defaults — so this is the one field that must be refused at load rather
+     * than silently defaulted to something that would never match a real handover file.
+     *
+     * @throws IllegalStateException when {@code leadRollover} is present but {@code handoverPath}
+     *                               is {@code null} or blank
+     */
+    public void validateLeadRollover() {
+        if (leadRollover == null) {
+            return;
+        }
+        if (leadRollover.handoverPath() == null || leadRollover.handoverPath().isBlank()) {
+            throw new IllegalStateException("refusing to start: leadRollover.handoverPath is "
+                    + "required when leadRollover: is present.");
+        }
+    }
+
     /** Case-insensitive prefix test that tolerates a null/blank label. */
     private static boolean startsWithIgnoreCase(String label, String prefix) {
         if (label == null || prefix == null || prefix.isBlank()) {

fleetd/src/main/java/dev/ltms/fleet/lead/LeadRollover.java

@@ -0,0 +1,588 @@
+package dev.ltms.fleet.lead;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.TimeUnit;
+import java.util.function.Consumer;
+import java.util.function.Function;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/**
+ * fleetd #480: replace a lead session that has decided it is ready to be rolled over, without an
+ * operator doing it by hand. A lead writes a handover file, calls {@link #open}, and then — once
+ * every gate ({@link #confirm}'s own checks) has passed — a deferred, single-shot continuation
+ * clears the lead's own pane and bootstraps a fresh session against that file.
+ *
+ * <p>This is the executor only. Nothing in this ticket wires an MCP tool onto {@link #open}/
+ * {@link #confirm}/{@link #cancel} — that is a separate, later unit; until it lands, nothing calls
+ * this class at all.
+ *
+ * <p><strong>{@code confirm()} cannot roll inline — a fleetd #480 correction.</strong> The first
+ * version of this class called {@code agents.send(lead, "/clear")} directly from inside {@code
+ * confirm()}, then polled for the pane to become injectable again. That is wrong, because {@code
+ * confirm()} is called BY the lead, FROM the lead's own turn: the lead's pane is {@code WORKING}
+ * for the whole duration of that call and cannot possibly report injectable until {@code confirm()}
+ * itself returns. The poll always timed out — but only after the {@code /clear} had already been
+ * sent and queued in the pane, where it fired the instant the turn ended anyway. The result was the
+ * worst outcome this feature can produce: a silently destroyed lead context with no fresh session
+ * ever started, and a refusal return value that claimed nothing had happened.
+ *
+ * <p>The fix: {@link #confirm} validates every gate, then does no I/O against the lead's own pane
+ * at all — it only records that the request is approved and hands a one-shot continuation to
+ * {@code continuationRunner} before returning. That continuation is what actually touches the pane,
+ * once the calling turn has ended, in this order:
+ * <ol>
+ *   <li>wait for the lead's own pane to report a real turn boundary — {@code IDLE} or {@code
+ *       DONE}, never merely {@code BLOCKED} — i.e. wait for the very {@code confirm()} call that
+ *       approved this roll to finish its turn — bounded by {@code turnSettleSeconds}. <strong>If
+ *       this never happens, nothing else in this list runs: no {@code /clear} is ever sent.</strong>
+ *       A lead that never goes idle is a lead still doing real work, and clearing it would throw
+ *       away live context — exactly the failure this correction exists to prevent.</li>
+ *   <li>{@code agents.send(lead, "/clear")}</li>
+ *   <li>wait for {@code /clear} to be picked up and settle, bounded by {@code clearSettleSeconds}
+ *       (fleetd #489: no longer a plain re-check of the same boundary — {@code /clear} starts no
+ *       turn of its own, so this instead nudges the submit keystroke while no pickup has been seen,
+ *       then waits for a real {@code WORKING} → {@code IDLE}/{@code DONE} boundary once one has;
+ *       see {@link #waitForClearPickupAndSettle})</li>
+ *   <li>{@code agents.send(lead, cfg.bootstrapTextFor(p.handoverPath()))}</li>
+ * </ol>
+ * A {@link #confirm} that returns {@link RollDecision#approved()} therefore means <em>"every gate
+ * passed and the roll is scheduled"</em>, never <em>"the pane has been cleared"</em> — the pane may
+ * still be mid-turn, possibly for a long time, when the caller gets that answer back.
+ *
+ * <p><strong>The safety invariant survives this change, restated precisely.</strong> The ticket
+ * that first defined this class required "no timer, no scheduler, no background thread" so that
+ * nothing but an explicit {@link #confirm} call could ever cause a {@code /clear}. That invariant
+ * is about INITIATIVE, not about synchronicity, and this correction keeps it: {@code
+ * continuationRunner} launches a single-shot task that exists only because one specific,
+ * already-approved {@link #confirm} call created it — it is not recurring, it is not started at
+ * construction time or on any schedule, and no two invocations of it ever share state. A recurring
+ * heartbeat or timer that could decide on its own initiative to roll a pane is still, and will
+ * always be, absent from this class. <strong>Nothing but an explicit {@link #confirm} call that
+ * passes every gate can ever cause a {@code /clear} — that call may simply finish its own work
+ * slightly later than the method return, as a continuation of the same approved request, rather
+ * than entirely inside the method body.</strong>
+ *
+ * <p><strong>Identity is resolved by the caller, never looked up here — a second fleetd #480
+ * correction.</strong> The first version resolved the pane to clear via {@code
+ * PrimaryRegistry#primaryTerminal()}. That is correct for a background loop with no caller (see
+ * {@code dev.ltms.fleet.msg.LeadHeartbeatLoop}), but wrong here and a violation of this project's
+ * own charter invariant 3 — "identity comes from the connection, never an argument." This daemon
+ * can hold more than one labelled lead tab (see {@code LeadLauncher}'s fleetd #359 two-reading
+ * dead-tab cleanup), so a single-slot lookup lets lead X's {@link #confirm} clear lead Y's pane: an
+ * unrecoverable loss of someone else's context, and a different lead's context at that. Both
+ * {@link #open} and {@link #confirm} now take the lead's terminal id as a parameter instead —
+ * {@link #open} stores it on the {@link PendingRollover}, and {@link #confirm} refuses with {@link
+ * RefusalReason#NOT_YOUR_ROLLOVER} unless the caller's terminal matches the one {@link #open}
+ * recorded. <strong>The terminal id passed to both methods must come from the MCP layer's own
+ * connection-based caller resolution — the same source {@code auth/CallerResolver#resolve} uses to
+ * build a {@code Principal.leader(...)} (see its use of {@code ConnectionIdentity.Caller#terminal})
+ * — never a value the client supplies or chooses.</strong> The later MCP-tool unit that wires
+ * {@link #open}/{@link #confirm} must pass the resolved caller terminal, not a request field.
+ *
+ * <p><strong>A relative {@code handoverPath} resolves against the CALLING lead's workspace, never
+ * the daemon's own cwd — a fleetd #480 follow-up.</strong> The daemon and a lead's own pane can
+ * have different working directories (this repo nests {@code fleetd/} inside its own root, so the
+ * daemon's cwd and {@code fleet.leaders.<name>.cwd} already differ on this host). {@link #open}
+ * resolves {@code cfg.handoverPath()} to an ABSOLUTE path exactly once — against {@code
+ * leadWorkspace.apply(leadTerminal)} when that lookup returns a non-null, non-blank workspace, and
+ * against {@code System.getProperty("user.dir")} otherwise (the same fallback {@code
+ * LeadLauncher#launch} already uses for a lead with no configured {@code cwd}) — and stores only
+ * that absolute path on {@link PendingRollover}. Every later read of {@code
+ * PendingRollover#handoverPath()} (the freshness/exists/empty checks in {@link #checkHandover},
+ * the value {@code FleetMcp} hands back to the lead in the {@code open} response so it knows where
+ * to WRITE the file, and {@link FleetConfig.LeadRollover#bootstrapTextFor} which names it in the
+ * text typed into the fresh session) therefore already sees the resolved absolute form and never
+ * needs to resolve anything itself.
+ */
+public final class LeadRollover {
+
+    private static final Logger log = LoggerFactory.getLogger(LeadRollover.class);
+
+    /** Poll interval while waiting for the lead's pane to settle after {@code /clear}. */
+    static final long SETTLE_POLL_MS = 250;
+
+    /**
+     * How many consecutive not-yet-picked-up polls {@link #waitForClearPickupAndSettle} allows
+     * before releasing rather than wedging the roll — the same constant and the same
+     * release-not-wedge choice {@link dev.ltms.fleet.inject.Injector} already makes for its own
+     * post-turn {@code /clear} housekeeping (fleetd #306). <strong>This bounds the number of
+     * consecutive polls, not the number of nudges:</strong> the first {@code PICKUP_GRACE_POLLS - 1}
+     * of those polls each send a nudge, and the {@code PICKUP_GRACE_POLLS}th releases instead of
+     * nudging again — so 8 polls produce 7 nudges, not 8.
+     */
+    static final int PICKUP_GRACE_POLLS = 8;
+
+    /**
+     * One request opened by {@link #open}, pending its {@link #confirm} (or {@link #cancel}).
+     *
+     * @param leadTerminal the lead pane that opened this request — the only terminal that may
+     *                     later {@link #confirm} it (see {@link RefusalReason#NOT_YOUR_ROLLOVER})
+     * @param handoverPath the ABSOLUTE, resolved handover path — never the raw configured value,
+     *                     which may have been relative. {@link #open} resolves it once, against the
+     *                     calling lead's workspace, before storing it here; see this class's
+     *                     javadoc. This is the value the MCP layer hands back to the lead as
+     *                     "write your file here", so callers may rely on it always being absolute.
+     */
+    public record PendingRollover(String token, String leadTerminal, String handoverPath,
+                                   long requestedAtMillis) {}
+
+    /** Which check refused a {@link #confirm} call, named so a caller can act on it. */
+    public enum RefusalReason {
+        /** {@code leadRollover:} is not configured — absent at construction, or removed since. */
+        NOT_CONFIGURED,
+        /** {@code token} names no pending request: never opened, already confirmed, or cancelled. */
+        UNKNOWN_TOKEN,
+        /**
+         * The caller's terminal does not match the terminal that {@link #open} recorded for this
+         * token. Only the lead that opened a request may confirm it (fleetd #480 correction 2).
+         */
+        NOT_YOUR_ROLLOVER,
+        /** {@code requireOperatorConfirm: true} and the caller passed {@code operatorConfirmed: false}. */
+        OPERATOR_NOT_CONFIRMED,
+        /** The handover file does not exist. */
+        HANDOVER_MISSING,
+        /** The handover file exists but is empty. */
+        HANDOVER_EMPTY,
+        /**
+         * The handover file's modified time is not after {@link #open}'s request timestamp, or is
+         * older than {@code maxDocAgeSeconds}.
+         */
+        HANDOVER_STALE
+    }
+
+    /**
+     * The outcome of a {@link #confirm} call. {@link #approved()} means every gate passed and the
+     * roll has been handed to a one-shot continuation — <strong>not</strong> that the pane has been
+     * cleared; the continuation may still be waiting for the calling turn to end when this returns.
+     * Whether the deferred roll itself later goes on to clear the pane, refuse for never going
+     * idle, or refuse for never re-settling after {@code /clear} is logged only (see this class's
+     * javadoc) — there is deliberately no synchronous caller left by that point to hand a result to.
+     */
+    public record RollDecision(boolean accepted, RefusalReason reason, String detail) {
+        static RollDecision approved() {
+            return new RollDecision(true, null, "confirmed; the roll will run once the calling turn ends");
+        }
+
+        static RollDecision refused(RefusalReason reason, String detail) {
+            return new RollDecision(false, reason, detail);
+        }
+    }
+
+    private final AgentControl agents;
+    private final Supplier<FleetConfig.LeadRollover> configSupplier;
+    /**
+     * Terminal id → that lead's configured workspace directory (their {@code
+     * fleet.leaders.<name>.cwd}), or {@code null} when the terminal names no currently-recognised
+     * lead. {@link #open} calls this to resolve a relative {@code handoverPath} — see this class's
+     * javadoc. Required: there is no sane default that would not silently reintroduce the
+     * daemon-cwd bug this parameter exists to fix.
+     */
+    private final Function<String, String> leadWorkspace;
+    private final LongSupplier nowMillis;
+    private final Runnable settleSleeper;
+    /**
+     * Launches the post-{@code confirm()} continuation. Production uses a single unstarted virtual
+     * thread per confirmed request — see this class's javadoc for why that is a single-shot task,
+     * not a background scheduler. Tests inject {@code Runnable::run} to make the continuation run
+     * synchronously and deterministically on the calling thread.
+     */
+    private final Consumer<Runnable> continuationRunner;
+    private final Map<String, PendingRollover> pending = new ConcurrentHashMap<>();
+
+    /** Production constructor — wall clock, real sleep between settle polls, a real virtual thread. */
+    public LeadRollover(AgentControl agents, Supplier<FleetConfig.LeadRollover> configSupplier,
+                         Function<String, String> leadWorkspace) {
+        this(agents, configSupplier, leadWorkspace, System::currentTimeMillis,
+                () -> sleepUninterruptibly(SETTLE_POLL_MS),
+                r -> Thread.ofVirtual().name("lead-rollover-continuation-").start(r));
+    }
+
+    /**
+     * Full constructor — an injectable wall-clock supplier, settle-poll sleeper, and continuation
+     * runner, for tests. {@code nowMillis} MUST be a wall-clock source (e.g. {@code
+     * System.currentTimeMillis()}), never {@code System.nanoTime()}: the freshness check compares
+     * against a file's modified time, which only a wall clock is comparable to, and {@code
+     * nanoTime} freezes while the host sleeps (fleetd #386).
+     */
+    LeadRollover(AgentControl agents, Supplier<FleetConfig.LeadRollover> configSupplier,
+                 Function<String, String> leadWorkspace, LongSupplier nowMillis,
+                 Runnable settleSleeper, Consumer<Runnable> continuationRunner) {
+        this.agents = agents;
+        this.configSupplier = configSupplier;
+        this.leadWorkspace = leadWorkspace;
+        this.nowMillis = nowMillis;
+        this.settleSleeper = settleSleeper;
+        this.continuationRunner = continuationRunner;
+    }
+
+    private static void sleepUninterruptibly(long ms) {
+        try {
+            Thread.sleep(ms);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            // preserve the interrupt flag but continue — this poll loop should not be aborted by an
+            // interrupt that was not meant for it.
+        }
+    }
+
+    /**
+     * The lead says it is ready to be replaced. Generates a token and records the resolved
+     * handover path, this moment's wall-clock timestamp (the baseline {@link #confirm} checks the
+     * handover file's modified time against), and {@code leadTerminal} — only that exact terminal
+     * may later {@link #confirm} this token.
+     *
+     * @param leadTerminal the calling lead's terminal id, resolved by the MCP layer from the
+     *                     connection (see this class's javadoc) — never a client-supplied value
+     * @param reason       free-text audit note (logged only; not otherwise interpreted or stored)
+     * @throws IllegalStateException   if {@code leadRollover:} is not configured
+     * @throws IllegalArgumentException if {@code leadTerminal} is null or blank
+     */
+    public PendingRollover open(String leadTerminal, String reason) {
+        FleetConfig.LeadRollover cfg = configSupplier.get();
+        if (cfg == null) {
+            throw new IllegalStateException("leadRollover: is not configured");
+        }
+        if (leadTerminal == null || leadTerminal.isBlank()) {
+            throw new IllegalArgumentException("leadTerminal is required — it must be resolved from "
+                    + "the caller's connection, never accepted as a client-chosen argument");
+        }
+        String token = UUID.randomUUID().toString();
+        long requestedAt = nowMillis.getAsLong();
+        String resolvedPath = resolveHandoverPath(cfg.handoverPath(), leadTerminal);
+        PendingRollover p = new PendingRollover(token, leadTerminal, resolvedPath, requestedAt);
+        pending.put(token, p);
+        if (resolvedPath.equals(cfg.handoverPath())) {
+            log.info("lead-rollover: open token={} lead={} handoverPath={} reason={}",
+                    token, leadTerminal, resolvedPath, reason);
+        } else {
+            // The configured value was relative (or merely un-normalized) and resolved to a
+            // different string — log both, so an operator reading this line can see which
+            // directory the daemon actually looked in, not just the value it was given.
+            log.info("lead-rollover: open token={} lead={} configuredHandoverPath={} "
+                            + "resolvedHandoverPath={} reason={}",
+                    token, leadTerminal, cfg.handoverPath(), resolvedPath, reason);
+        }
+        return p;
+    }
+
+    /**
+     * Resolve {@code configured} to an absolute path exactly once, here, so nothing downstream
+     * ({@link #checkHandover}, the MCP layer's {@code open} response, {@link
+     * FleetConfig.LeadRollover#bootstrapTextFor}) ever has to resolve — or worse, silently
+     * mis-resolve — a relative path again.
+     *
+     * <p><strong>The return value is GUARANTEED absolute, not merely usually absolute.</strong>
+     * {@code leadWorkspace.apply(leadTerminal)} returns an operator-configured {@code
+     * fleet.leaders.<name>.cwd} string, and nothing forces an operator to write an absolute one —
+     * a relative {@code cwd} resolved with plain {@link Path#resolve} would still yield a relative
+     * result, silently reopening the exact bug this class exists to fix (every later reader back to
+     * interpreting an ambiguous string against ITS OWN working directory). {@link
+     * Path#toAbsolutePath()} closes that: it resolves any remaining relative path against {@code
+     * user.dir} (the JVM's own cwd), which is the correct base for an operator-written path the
+     * daemon process itself is meant to interpret, exactly like the {@code user.dir} fallback used
+     * below. Applying it unconditionally on both branches means the ALREADY-absolute branch stays a
+     * no-op (an absolute path is unaffected by {@code toAbsolutePath()}) while the relative-{@code
+     * cwd} branch above is closed the same way.
+     *
+     * <ul>
+     *   <li>already absolute → returned unchanged (normalized)</li>
+     *   <li>relative → resolved against {@code leadWorkspace.apply(leadTerminal)} when that is
+     *       non-null and non-blank; otherwise against {@code System.getProperty("user.dir")} — the
+     *       same fallback {@code LeadLauncher#launch} uses for a lead with no configured {@code
+     *       cwd}. If {@code leadWorkspace}'s own answer is itself relative (an operator wrote a
+     *       relative {@code cwd:}), the result is finished off against the daemon's own
+     *       {@code user.dir} — see the paragraph above.</li>
+     * </ul>
+     */
+    private String resolveHandoverPath(String configured, String leadTerminal) {
+        Path path = Path.of(configured);
+        if (path.isAbsolute()) {
+            // toAbsolutePath() is a no-op for an already-absolute path — kept here anyway so both
+            // branches call the exact same guarantee, rather than one branch relying on
+            // isAbsolute() alone to already imply what toAbsolutePath() enforces.
+            return path.toAbsolutePath().normalize().toString();
+        }
+        String workspace = leadWorkspace.apply(leadTerminal);
+        Path base = (workspace == null || workspace.isBlank())
+                ? Path.of(System.getProperty("user.dir"))
+                : Path.of(workspace);
+        return base.resolve(path).toAbsolutePath().normalize().toString();
+    }
+
+    /**
+     * Validate every gate, then — if and only if all of them pass — hand a one-shot continuation
+     * that performs the actual roll to {@code continuationRunner} and return. <strong>This method
+     * never itself sends anything to the lead's pane</strong> — see this class's javadoc for why
+     * (it is called FROM the lead's own turn, so the pane cannot possibly be injectable yet).
+     *
+     * <p>Order: token lookup, then ownership ({@code callerTerminal} must match the terminal
+     * {@link #open} recorded — {@link RefusalReason#NOT_YOUR_ROLLOVER}), then the
+     * operator-confirmation gate, then the three handover-file checks (exists, not empty, fresh —
+     * see {@link #checkHandover}). The first failing check is returned and {@code token} stays
+     * pending (so a caller can fix the problem — e.g. rewrite the handover file — and retry with
+     * the same token); it is consumed only once every gate passes and the continuation is launched.
+     *
+     * @param callerTerminal    the CALLING lead's terminal id, resolved by the MCP layer from the
+     *                          connection — never a client-supplied value (see this class's javadoc)
+     * @param token             the token {@link #open} returned
+     * @param operatorConfirmed the caller's answer to "has an operator confirmed this roll" —
+     *                          consulted only when the live config's {@code requireOperatorConfirm}
+     *                          is true
+     */
+    public RollDecision confirm(String callerTerminal, String token, boolean operatorConfirmed) {
+        FleetConfig.LeadRollover cfg = configSupplier.get();
+        if (cfg == null) {
+            return RollDecision.refused(RefusalReason.NOT_CONFIGURED, "leadRollover: is not configured");
+        }
+        PendingRollover p = pending.get(token);
+        if (p == null) {
+            return RollDecision.refused(RefusalReason.UNKNOWN_TOKEN,
+                    "token " + token + " names no pending rollover request");
+        }
+        if (!p.leadTerminal().equals(callerTerminal)) {
+            return RollDecision.refused(RefusalReason.NOT_YOUR_ROLLOVER,
+                    "token " + token + " was opened by a different lead terminal");
+        }
+        if (cfg.requireOperatorConfirm() && !operatorConfirmed) {
+            return RollDecision.refused(RefusalReason.OPERATOR_NOT_CONFIRMED,
+                    "requireOperatorConfirm is true and operatorConfirmed was false");
+        }
+
+        RollDecision docCheck = checkHandover(p, cfg);
+        if (docCheck != null) {
+            return docCheck;
+        }
+
+        pending.remove(token);
+        log.info("lead-rollover: confirmed token={} lead={} — roll scheduled once the calling turn ends",
+                token, callerTerminal);
+        continuationRunner.accept(() -> runRollover(p, cfg));
+        return RollDecision.approved();
+    }
+
+    /**
+     * The single-shot continuation {@link #confirm} hands to {@code continuationRunner}. Runs
+     * entirely after {@link #confirm} has returned to its caller — see this class's javadoc for the
+     * four-step order. There is no result to return to by this point, so every outcome is logged
+     * only.
+     */
+    private void runRollover(PendingRollover p, FleetConfig.LeadRollover cfg) {
+        String lead = p.leadTerminal();
+        boolean turnSettled = waitUntilAtTurnBoundary(lead, cfg.turnSettleSeconds());
+        if (!turnSettled) {
+            log.warn("lead-rollover: pane {} did not reach a turn boundary (IDLE or DONE) within {}s "
+                            + "after confirm() — refusing to send /clear at all; the calling lead's "
+                            + "own turn is still live and clearing it now would destroy live context "
+                            + "(token={})",
+                    lead, cfg.turnSettleSeconds(), p.token());
+            return;
+        }
+
+        // This deliberately bypasses Injector, exactly like ClaudeCodeLauncher#clearContext:
+        // /clear is housekeeping, not a delegated turn, and routing it through Injector wedges the
+        // pane forever (see this class's javadoc).
+        agents.send(lead, "/clear");
+        boolean clearSettled = waitForClearPickupAndSettle(lead, cfg.clearSettleSeconds());
+        if (!clearSettled) {
+            log.warn("lead-rollover: pane {} did not reach a turn boundary (IDLE or DONE) within {}s "
+                            + "after /clear — NOT sending bootstrapText (token={})",
+                    lead, cfg.clearSettleSeconds(), p.token());
+            return;
+        }
+        agents.send(lead, cfg.bootstrapTextFor(p.handoverPath()));
+        log.info("lead-rollover: rolled token={} lead={}", p.token(), lead);
+    }
+
+    /** Drop a pending request without rolling. @return whether a pending request existed for {@code token} */
+    public boolean cancel(String token) {
+        return pending.remove(token) != null;
+    }
+
+    /**
+     * The three handover-file checks, in order: exists, not empty, fresh (modified after
+     * {@link #open}'s timestamp and not older than {@code maxDocAgeSeconds}). Stats {@code
+     * p.handoverPath()} directly — {@link #open} already resolved it to an absolute path, so this
+     * never has to guess which directory it means.
+     *
+     * @return the first failing check's refusal, or {@code null} when all three pass
+     */
+    private RollDecision checkHandover(PendingRollover p, FleetConfig.LeadRollover cfg) {
+        Path path = Path.of(p.handoverPath());
+        if (!Files.exists(path)) {
+            return RollDecision.refused(RefusalReason.HANDOVER_MISSING,
+                    "handover file " + p.handoverPath() + " does not exist");
+        }
+        long size;
+        long mtimeMillis;
+        try {
+            size = Files.size(path);
+            mtimeMillis = Files.getLastModifiedTime(path).toMillis();
+        } catch (IOException e) {
+            throw new UncheckedIOException("failed to stat handover file " + p.handoverPath(), e);
+        }
+        if (size == 0) {
+            return RollDecision.refused(RefusalReason.HANDOVER_EMPTY,
+                    "handover file " + p.handoverPath() + " is empty");
+        }
+        if (mtimeMillis <= p.requestedAtMillis()) {
+            return RollDecision.refused(RefusalReason.HANDOVER_STALE,
+                    "handover file " + p.handoverPath() + " was not modified after the open() "
+                            + "request (mtime=" + mtimeMillis + "ms, requestedAt=" + p.requestedAtMillis() + "ms)");
+        }
+        long ageMillis = nowMillis.getAsLong() - mtimeMillis;
+        long maxAgeMillis = TimeUnit.SECONDS.toMillis(cfg.maxDocAgeSeconds());
+        if (ageMillis > maxAgeMillis) {
+            return RollDecision.refused(RefusalReason.HANDOVER_STALE,
+                    "handover file " + p.handoverPath() + " is " + TimeUnit.MILLISECONDS.toSeconds(ageMillis)
+                            + "s old, older than maxDocAgeSeconds=" + cfg.maxDocAgeSeconds());
+        }
+        return null;
+    }
+
+    /**
+     * Poll {@link AgentControl#status} until {@code target} reports a real turn boundary — {@link
+     * AgentStatus#IDLE} or {@link AgentStatus#DONE} — bounded by {@code settleSeconds}. Used once by
+     * {@link #runRollover}, to wait for the CALLING turn's own pane to settle before {@code /clear}
+     * is ever sent at all — the {@code turnSettleSeconds} gate that makes this correction safe. The
+     * SECOND wait, after {@code /clear}, is {@link #waitForClearPickupAndSettle} instead (fleetd
+     * #489) — a plain boundary check is not enough there, because {@code /clear} starts no turn of
+     * its own, so this method would (wrongly) report "settled" on its very first poll whether or not
+     * {@code /clear} was actually picked up. A failed status read degrades to "not yet settled" and
+     * is retried on the next poll, the same posture {@code LeadHeartbeatLoop} and {@code
+     * HerdrPeerLauncher}'s readiness gate already take toward an unreadable status.
+     *
+     * <p><strong>Deliberately not {@link AgentStatus#injectable()}.</strong> {@code injectable()}
+     * answers the {@code Injector}'s question — "may I deliver a message without stepping on a live
+     * turn" — and it accepts {@link AgentStatus#BLOCKED} for that purpose, because a pane paused on
+     * an approval prompt is safe to queue a message behind. This class asks a stricter question —
+     * "has the turn actually ended" — and {@code BLOCKED} answers no: it is a live turn that is
+     * merely paused, not one that has finished. Reusing {@code injectable()} here would let this
+     * wait fire {@code /clear} while the lead's own {@code confirm()}-calling turn is still live and
+     * paused on a prompt — exactly the live-context-destroying failure the {@code turnSettleSeconds}
+     * gate exists to prevent. Do not "simplify" this back to {@code injectable()}. ({@link
+     * #waitForClearPickupAndSettle} keeps the same exclusion of {@code BLOCKED}, for the same
+     * reason, on the second wait.)
+     */
+    private boolean waitUntilAtTurnBoundary(String target, int settleSeconds) {
+        long deadline = nowMillis.getAsLong() + TimeUnit.SECONDS.toMillis(settleSeconds);
+        while (nowMillis.getAsLong() < deadline) {
+            AgentStatus status;
+            try {
+                status = agents.status(target);
+            } catch (RuntimeException e) {
+                log.debug("lead-rollover: status check failed while waiting for {} to settle: {}",
+                        target, e.toString());
+                status = null;
+            }
+            if (status == AgentStatus.IDLE || status == AgentStatus.DONE) {
+                return true;
+            }
+            settleSleeper.run();
+        }
+        return false;
+    }
+
+    /**
+     * The SECOND wait in {@link #runRollover} — after {@code /clear} has been sent, waits for it to
+     * settle, bounded by {@code settleSeconds}. <strong>fleetd #489 — the paste-race fix.</strong>
+     * {@code /clear} does not start a real turn of its own, so a pane with no submit race simply
+     * stays {@link AgentStatus#IDLE} the whole time: {@link #waitUntilAtTurnBoundary} would (wrongly)
+     * call that "settled" on its very first poll, whether or not the {@code /clear} Enter actually
+     * landed. That was Fault 1, measured live on 2026-09-12 — the second gate was a no-op, so a
+     * {@code bootstrapText} send followed immediately, racing Fault 2: {@link AgentControl#submit}'s
+     * own javadoc already records that the submit accompanying a delivery "can race the paste —
+     * especially right as the worker's TUI becomes interactive — leaving the text unsubmitted"
+     * (CB-113). Because {@code runRollover} deliberately bypasses {@code Injector} for {@code
+     * /clear} (see this class's javadoc), it inherited none of {@code Injector}'s nudging — so the
+     * lost {@code /clear} Enter sat in the input box and {@code bootstrapText} was typed right after
+     * it, landing as one concatenated line.
+     *
+     * <p>This method copies the pickup-nudge pattern {@link dev.ltms.fleet.inject.Injector} already
+     * ships for exactly this, on its own post-turn {@code /clear} housekeeping (fleetd #306; see
+     * {@code Injector.java:288-340} and {@code Injector.java:437-442}):
+     * <ul>
+     *   <li>an {@link AgentStatus#WORKING} sample means {@code /clear} was picked up as a real
+     *       turn;</li>
+     *   <li>until that happens, each poll that still reports {@link AgentStatus#IDLE} or {@link
+     *       AgentStatus#DONE} re-sends the submit keystroke ({@link AgentControl#submit}) to nudge
+     *       the raced Enter — for the first {@code PICKUP_GRACE_POLLS - 1} of {@link
+     *       #PICKUP_GRACE_POLLS} consecutive such polls (i.e. {@code PICKUP_GRACE_POLLS - 1}
+     *       nudges: 7, not 8, given {@code PICKUP_GRACE_POLLS = 8}). A second Enter on an empty
+     *       Claude Code prompt is a no-op, so repeating it is safe;</li>
+     *   <li>the {@code PICKUP_GRACE_POLLS}th consecutive such poll, with {@code WORKING} still never
+     *       observed, releases rather than wedges the roll instead of nudging again — the same
+     *       choice {@code Injector} makes — and returns {@code true} anyway, logged at {@code info}
+     *       so an operator can see which path ran;</li>
+     *   <li>once {@code WORKING} has been observed, nudging stops and this instead waits for a real
+     *       {@code working → IDLE/DONE} completion boundary before returning {@code true}.</li>
+     * </ul>
+     *
+     * <p><strong>{@link AgentStatus#BLOCKED} is deliberately excluded from both the nudge and the
+     * boundary check</strong> — the same reasoning as {@link #waitUntilAtTurnBoundary}'s own
+     * javadoc: a paused live turn is not a settled one, and re-sending Enter into an open approval
+     * prompt could wrongly answer it. A {@code BLOCKED} sample (or an unreadable/{@link
+     * AgentStatus#UNKNOWN} one) simply keeps this polling, with no nudge and no release, until either
+     * a real boundary is reached or {@code settleSeconds} runs out.
+     *
+     * <p>{@link AgentControl#submit} can itself throw; a {@link RuntimeException} from it is
+     * swallowed and logged at {@code debug}, exactly like {@code Injector.java:437-442} — a failed
+     * nudge must not abort the roll.
+     *
+     * @return {@code true} once {@code /clear} has settled, or once the nudge budget was exhausted
+     *         with no pickup ever observed (released rather than wedged); {@code false} if {@code
+     *         settleSeconds} elapses first — the caller must NOT send {@code bootstrapText} in that
+     *         case, exactly as before this fix
+     */
+    private boolean waitForClearPickupAndSettle(String target, int settleSeconds) {
+        long deadline = nowMillis.getAsLong() + TimeUnit.SECONDS.toMillis(settleSeconds);
+        boolean pickedUp = false; // a WORKING sample has been observed since /clear was sent
+        int idlePollsAwaitingPickup = 0;
+        while (nowMillis.getAsLong() < deadline) {
+            AgentStatus status;
+            try {
+                status = agents.status(target);
+            } catch (RuntimeException e) {
+                log.debug("lead-rollover: status check failed while waiting for {} to settle after "
+                        + "/clear: {}", target, e.toString());
+                status = null;
+            }
+            if (status == AgentStatus.WORKING) {
+                pickedUp = true;
+            } else if (status == AgentStatus.IDLE || status == AgentStatus.DONE) {
+                if (pickedUp) {
+                    return true; // a real WORKING -> IDLE/DONE completion boundary
+                }
+                if (++idlePollsAwaitingPickup >= PICKUP_GRACE_POLLS) {
+                    log.info("lead-rollover: /clear on {} was never observed as WORKING after {} "
+                                    + "consecutive IDLE/DONE polls ({} of those were nudged) — "
+                                    + "releasing rather than wedging the roll",
+                            target, PICKUP_GRACE_POLLS, PICKUP_GRACE_POLLS - 1);
+                    return true;
+                }
+                try {
+                    agents.submit(target); // nudge a raced Enter (CB-113) so /clear actually submits
+                } catch (RuntimeException e) {
+                    log.debug("lead-rollover: resubmit to {} failed (will retry next poll): {}",
+                            target, e.getMessage());
+                }
+            }
+            // AgentStatus.BLOCKED or UNKNOWN (or an unreadable status, above): neither a pickup
+            // signal nor a boundary — keep polling without nudging or releasing.
+            settleSleeper.run();
+        }
+        return false;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/mcp/CharterToolSurface.java

@@ -0,0 +1,81 @@
+package dev.ltms.fleet.mcp;
+
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * fleetd #469: a launch charter that names an MCP tool the server does not register must stop the
+ * daemon at startup, not wait for a member to discover the gap by calling something that is not
+ * there.
+ *
+ * <p>Deliberately its own class outside {@code dev.ltms.fleet.config}, not a case in {@link
+ * dev.ltms.fleet.config.FleetConfig#validateCharters()}. The canonical tool surface ({@link
+ * FleetTool}) lives in the {@code mcp} package; config is loaded before the MCP server exists and
+ * must not gain a dependency on it. So this check belongs at the seam that already holds both a
+ * loaded {@code FleetConfig} and the {@code mcp} package: {@code Fleetd.main}, called right after
+ * {@code cfg.validateAll()} and before anything opens a socket or spawns a member.
+ *
+ * <p>{@code #464}'s {@code CharterToolSurfaceTest} proved the same comparison against a charter
+ * fixture it wrote itself into a {@code @TempDir}, which meant nothing anyone wrote into the live
+ * {@code fleetd.yaml} could ever fail it. This class is what a real charter is actually checked
+ * against at boot; {@code FleetdStartupValidationTest} exercises it through {@code Fleetd.main}
+ * itself, the same way it proves every other {@code validateXxx()} still runs there.
+ *
+ * <p><strong>fleetd #474</strong> — startup was not the only door: {@code
+ * dev.ltms.fleet.config.ConfigRef#reload()} used to run {@code FleetConfig#validateAll()} alone,
+ * which does not look at what a charter's text names, so a charter naming an unregistered tool
+ * that could not have booted the daemon could still be installed into a running one through a
+ * reload. This class still knows nothing about {@code ConfigRef} — {@code Fleetd.main} wires a
+ * small {@code FleetConfig -> void} adapter over {@link #assertChartersNameOnlyRegisteredTools}
+ * ({@code Fleetd::assertChartersNameOnlyRegisteredTools}) into {@code ConfigRef}'s constructor as
+ * its {@code Consumer<FleetConfig>} {@code extraValidation}, run inside {@code reload()}'s same
+ * try/catch as {@code validateAll()}, so both call sites — {@code Fleetd.main} at startup and
+ * {@code ConfigRef#reload()} afterwards — go through this one method and can never check different
+ * things. {@code dev.ltms.fleet.config.ConfigRefTest} and {@code
+ * FleetdConfigRefCharterToolSurfaceWiringTest} are what prove the reload call site, the same way
+ * {@code FleetdStartupValidationTest} proves the startup one.
+ */
+public final class CharterToolSurface {
+
+    /** A {@code fleet_…} (current) or {@code bridge_…} (pre-CB-634) tool-shaped token in prose. */
+    private static final Pattern TOOL_REFERENCE = Pattern.compile("(fleet_[a-z_]+|bridge_[a-z_]+)");
+
+    private CharterToolSurface() {
+    }
+
+    /**
+     * @param charters the configured {@code fleet.charters:} map (role wire name → charter text);
+     *                 {@code null} or empty is a no-op, same as an absent {@code fleet:} block
+     * @throws IllegalStateException naming the charter key and every tool it names that {@link
+     *                                FleetTool} does not list, when any charter does so
+     */
+    public static void assertChartersNameOnlyRegisteredTools(Map<String, String> charters) {
+        if (charters == null || charters.isEmpty()) {
+            return;
+        }
+        Set<String> registered = FleetTool.wireNames();
+        List<String> bad = new ArrayList<>();
+        charters.forEach((key, text) -> {
+            if (text == null) {
+                return;
+            }
+            Set<String> named = new LinkedHashSet<>();
+            Matcher m = TOOL_REFERENCE.matcher(text);
+            while (m.find()) {
+                named.add(m.group(1));
+            }
+            named.stream()
+                    .filter(t -> !registered.contains(t))
+                    .forEach(unknown -> bad.add("fleet.charters." + key + " names '" + unknown
+                            + "', which the server does not register (registered: " + registered + ")."));
+        });
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
+        }
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -12,6 +12,7 @@ import dev.ltms.fleet.metrics.Metrics;
 import dev.ltms.fleet.inject.MemberPresence;
 import dev.ltms.fleet.inject.CompletionResolver;
 import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.lead.LeadRollover;
 import dev.ltms.fleet.msg.LeadChannel;
 import dev.ltms.fleet.msg.LeadMessage;
 import dev.ltms.fleet.msg.MessageService;
@@ -105,6 +106,13 @@ public final class FleetMcp {
     private final LeadChannel leadChannel;
     /** fleetd #361: {@code coordinator.peers} — see {@link CoordinationSource}. Empty when unset. */
     private final List<String> peers;
+    /**
+     * fleetd #480 Unit C: the executor behind {@code fleet_handover}. {@code null} whenever
+     * {@code leadRollover:} is not configured — {@code fleet_handover} is still registered (see
+     * this class's javadoc on the charter tool-surface gate), and every action then degrades to a
+     * clean {@code NOT_CONFIGURED} refusal rather than throwing. See {@link #handover}.
+     */
+    private final LeadRollover leadRollover;
 
     /** Capacity facts used by {@code fleet_list}; production must supply the placement live count. */
     public record CapacitySource(Function<String, Integer> liveCount, Function<String, Integer> maxLoad,
@@ -243,78 +251,59 @@ public final class FleetMcp {
     }
 
     /**
-     * @param callers resolves each call's {@link Principal}; {@code null} disables authorization.
-     *                This surface needs its own enforcement: {@code /mcp} is a raw servlet on
-     *                Jetty's context handler and never passes through Javalin's {@code before}
-     *                filter, so the REST guard does not cover it.
-     * @param metrics registry for auth-failure counting; may be {@code null}
-     * @param quarantine CB-578 stage B facts for {@code fleet_profiles}; required — pass
-     *                   {@link QuarantineSource#none()} for a caller that does not want the feature
-     */
-    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
-                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
-                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
-                      QuarantineSource quarantine) {
-        this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, null, OutageSource.none(), LeadSeatSource.none());
-    }
-
-    /**
-     * As above, with this daemon's lead-to-lead channel (CB-637). {@code leadChannel} is
-     * {@code null} whenever no {@code coordinator:} block is configured or its broker could not be
-     * reached at boot — cross-daemon lead messaging is simply off, and {@code fleet_send{coordId}}
-     * says so rather than failing obscurely.
-     */
-    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
-                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
-                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
-                      QuarantineSource quarantine, LeadChannel leadChannel) {
-        this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, leadChannel, OutageSource.none(), LeadSeatSource.none());
-    }
-
-    /**
-     * As above, with fleetd #201 Unit 5 cool-off facts for {@code fleet_list}/{@code fleet_profiles}
-     * (see {@link OutageSource}).
+     * The only constructor (fleetd #480 Unit C correction round). Every field below used to have
+     * its own defaulting overload — {@code leadChannel}/{@code outage}/{@code leadSeats}/
+     * {@code peers}/{@code leadRollover} each got a shorter, convenience constructor that silently
+     * filled it in ({@code null}, {@code .none()}, or {@code List.of()}) when a caller did not pass
+     * it. That is exactly how {@code Fleetd.main}'s wiring of {@link LeadRollover} could have gone
+     * silently missing: drop one argument from the real call and it just lands on a shorter
+     * overload instead of failing to compile, and every existing test — none of which exercises
+     * {@code Fleetd.main} itself — stays green while the live daemon quietly answers
+     * {@code NOT_CONFIGURED} to {@code fleet_handover} forever. Collapsing every overload into one
+     * required-everything constructor turns that mistake into a compile error instead: this
+     * project's own antidote for a defaulted parameter surviving as an untested decision (see
+     * {@code FleetdCompletionResolverWiringTest} / {@code FleetdLeadRolloverWiringTest}'s own
+     * javadoc for the same lesson applied to a different seam). A caller that genuinely wants a
+     * feature off must now say so explicitly at the call site — {@code null},
+     * {@link OutageSource#none()}, {@link LeadSeatSource#none()}, {@code List.of()} are all still
+     * perfectly fine values, just never an implicit default reached by omission.
      *
-     * @param outage required — pass {@link OutageSource#none()} for a caller that does not want the
-     *               feature, never a defaulting overload (the same rule {@code quarantine} follows).
-     */
-    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
-                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
-                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
-                      QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage) {
-        this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, leadChannel, outage, LeadSeatSource.none());
-    }
-
-    /**
-     * As above, with fleetd #176 lead-seat facts (see {@link LeadSeatSource}).
+     * @param callers      resolves each call's {@link Principal}; {@code null} disables
+     *                     authorization. This surface needs its own enforcement: {@code /mcp} is a
+     *                     raw servlet on Jetty's context handler and never passes through
+     *                     Javalin's {@code before} filter, so the REST guard does not cover it.
+     * @param metrics      registry for auth-failure counting; may be {@code null}
+     * @param quarantine   CB-578 stage B facts for {@code fleet_profiles}; pass
+     *                     {@link QuarantineSource#none()} for a caller that does not want the
+     *                     feature
+     * @param leadChannel  this daemon's lead-to-lead channel (CB-637); {@code null} whenever no
+     *                     {@code coordinator:} block is configured or its broker could not be
+     *                     reached at boot — cross-daemon lead messaging is simply off, and
+     *                     {@code fleet_send{coordId}} says so rather than failing obscurely
+     * @param outage       fleetd #201 Unit 5 cool-off facts for {@code fleet_list}/
+     *                     {@code fleet_profiles}; pass {@link OutageSource#none()} for a caller
+     *                     that does not want the feature
+     * @param leadSeats    fleetd #176 lead-seat facts (see {@link LeadSeatSource}); pass
+     *                     {@link LeadSeatSource#none()} for a caller that does not want the
+     *                     feature
+     * @param peers        fleetd #361 {@code coordinator.peers} (see {@link CoordinationSource});
+     *                     the coord-ids declared there, or empty when unset or when
+     *                     {@code leadChannel} is {@code null}
+     * @param leadRollover fleetd #480 Unit C: the {@link LeadRollover} executor behind
+     *                     {@code fleet_handover}. {@code null} whenever {@code leadRollover:} is
+     *                     not configured — an upgraded daemon must never silently acquire the
+     *                     ability to clear a lead's own pane (mirrors
+     *                     {@code Fleetd.leadRollover(...)}'s own construction gate).
+     *                     {@code fleet_handover} is registered unconditionally either way — see
+     *                     this class's javadoc and fleetd #474's charter tool-surface gate — and
+     *                     every action degrades to a clean refusal naming {@code NOT_CONFIGURED}
+     *                     instead of throwing. See {@link #handover}.
      */
     public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
                      ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage,
-                      LeadSeatSource leadSeats) {
-        this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, leadChannel, outage, leadSeats, List.of());
-    }
-
-    /**
-     * As above, with fleetd #361 {@code coordinator.peers} (see {@link CoordinationSource}). This is
-     * what {@code Fleetd.main} actually wires up.
-     *
-     * @param leadSeats required — pass {@link LeadSeatSource#none()} for a caller that does not want
-     *                  the feature, never a defaulting overload (the same rule {@code quarantine} and
-     *                  {@code outage} follow).
-     * @param peers     the coord-ids declared under {@code coordinator.peers}; empty when unset or
-     *                  when {@code leadChannel} is {@code null}.
-     */
-    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
-                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
-                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
-                      QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage,
-                      LeadSeatSource leadSeats, List<String> peers) {
+                      LeadSeatSource leadSeats, List<String> peers, LeadRollover leadRollover) {
         this.leadChannel = leadChannel;
         this.peers = peers == null ? List.of() : List.copyOf(peers);
         this.capacity = capacity;
@@ -322,6 +311,7 @@ public final class FleetMcp {
         this.outage = Objects.requireNonNull(outage, "outage");
         this.leadSeats = Objects.requireNonNull(leadSeats, "leadSeats");
         this.healthCoverage = healthCoverage;
+        this.leadRollover = leadRollover;
         McpJsonMapper json = new JacksonMcpJsonMapperSupplier().get();
         this.transport = HttpServletStreamableServerTransportProvider.builder()
                 .jsonMapper(json)
@@ -477,6 +467,15 @@ public final class FleetMcp {
                     if (denied != null) return denied;
                     return whoami(principal(exchange), sessions);
                 };
+        // fleetd #480 Unit C: fleet_handover. No terminal/session argument at all — the lead pane
+        // to roll is ALWAYS the caller's own connection-resolved terminal (never a request field),
+        // per LeadRollover's class javadoc (fleetd #480 correction 2).
+        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> handoverHandler =
+                (exchange, req) -> {
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_handover", req.arguments()), null);
+                    if (denied != null) return denied;
+                    return handover(leadRollover, callerTerminal(exchange), req.arguments());
+                };
 
         McpSchema.Tool fleetSend = sendTool();
         McpSchema.Tool fleetReply = replyTool();
@@ -489,6 +488,23 @@ public final class FleetMcp {
         McpSchema.Tool fleetStop = stopTool();
         McpSchema.Tool fleetProfiles = profilesTool();
         McpSchema.Tool fleetWhoami = whoamiTool();
+        McpSchema.Tool fleetHandover = handoverTool();
+
+        // fleetd #469: the tool schemas above are already named from FleetTool.wireName(), but
+        // this is the check that a schema was not accidentally dropped, duplicated, or added
+        // under a name FleetTool does not list. It runs once, at construction (startup), rather
+        // than being left to CharterToolSurface or a test to discover later — a canonical entry
+        // this server never registers, or a registration with no canonical entry backing it, is a
+        // startup failure, not a silent gap.
+        Set<String> registeredToolNames = Set.of(fleetSend.name(), fleetReply.name(), fleetAsk.name(),
+                fleetStatus.name(), fleetPoll.name(), fleetAck.name(), fleetSpawn.name(),
+                fleetList.name(), fleetStop.name(), fleetProfiles.name(), fleetWhoami.name(),
+                fleetHandover.name());
+        if (!registeredToolNames.equals(FleetTool.wireNames())) {
+            throw new IllegalStateException("fleetd #469: registered MCP tools " + registeredToolNames
+                    + " do not match the canonical tool set " + FleetTool.wireNames()
+                    + " -- FleetTool is the single source of truth for what this server registers");
+        }
 
         this.server = McpServer.sync(transport)
                 .serverInfo("fleet", "0.1.0")
@@ -504,6 +520,7 @@ public final class FleetMcp {
                 .toolCall(fleetStop, stopHandler)
                 .toolCall(fleetProfiles, profilesHandler)
                 .toolCall(fleetWhoami, whoamiHandler)
+                .toolCall(fleetHandover, handoverHandler)
                 .build();
         this.authz = callers;
         this.metrics = metrics;
@@ -668,6 +685,19 @@ public final class FleetMcp {
         server.closeGracefully();
     }
 
+    /**
+     * The tools this server has actually registered with the MCP SDK, wire schema included.
+     *
+     * <p>Package-private, for tests that must check the REGISTERED schema rather than this
+     * class's own source text — e.g. proving {@code fleet_handover}'s input schema carries no
+     * caller-terminal parameter (fleetd #480 Unit C acceptance criterion 4). A source-text scrape
+     * cannot tell "the schema builder omits this key" apart from "a typo means it never runs" the
+     * way asking the constructed server itself can.
+     */
+    List<McpSchema.Tool> registeredTools() {
+        return server.listTools();
+    }
+
     // --- tool logic (thin adapters over the services; unit-testable) ---------------------------
 
     /**
@@ -897,20 +927,35 @@ public final class FleetMcp {
 
     /**
      * The action a registered tool handler actually hands to the authorization gate.
-     * Keeping this choice beside the registered-tool inventory makes a new tool fail the coverage
-     * test until its action is pinned.
+     *
+     * <p>{@code toolName} is a raw string off the wire (an MCP call names its tool by string, and a
+     * malformed or stale client can send anything), so resolving it against {@link FleetTool} first
+     * — and throwing on a miss — is still a run-time check by necessity. What moved to compile time
+     * is the second step: {@link #authzAction(FleetTool, Map)} switches on the resolved {@link
+     * FleetTool} itself with no {@code default}, so a new {@link FleetTool} constant with no pinned
+     * action fails {@code mvn compile}, not just {@code FleetMcpAuthzTest} at run time.
      */
     static Authz.Action toolAction(String toolName, Map<String, Object> arguments) {
-        return switch (toolName) {
-            case "fleet_send" -> Authz.Action.SEND;
-            case "fleet_reply" -> Authz.Action.REPLY;
-            case "fleet_ask" -> Authz.Action.ASK;
-            case "fleet_status", "fleet_list", "fleet_profiles", "fleet_whoami" -> Authz.Action.READ;
-            case "fleet_poll" -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
-            case "fleet_ack" -> Authz.Action.DRAIN;
-            case "fleet_spawn" -> Authz.Action.SPAWN;
-            case "fleet_stop" -> Authz.Action.STOP;
-            default -> throw new IllegalArgumentException("unregistered tool: " + toolName);
+        FleetTool tool = FleetTool.byWireName(toolName)
+                .orElseThrow(() -> new IllegalArgumentException("unregistered tool: " + toolName));
+        return authzAction(tool, arguments);
+    }
+
+    /**
+     * Exhaustive over {@link FleetTool} on purpose — no {@code default}. Adding a tool to {@link
+     * FleetTool} without adding its case here is a compile error (fleetd #469).
+     */
+    private static Authz.Action authzAction(FleetTool tool, Map<String, Object> arguments) {
+        return switch (tool) {
+            case SEND -> Authz.Action.SEND;
+            case REPLY -> Authz.Action.REPLY;
+            case ASK -> Authz.Action.ASK;
+            case STATUS, LIST, PROFILES, WHOAMI -> Authz.Action.READ;
+            case POLL -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
+            case ACK -> Authz.Action.DRAIN;
+            case SPAWN -> Authz.Action.SPAWN;
+            case STOP -> Authz.Action.STOP;
+            case HANDOVER -> Authz.Action.HANDOVER;
         };
     }
 
@@ -1135,6 +1180,119 @@ public final class FleetMcp {
         return text(json(m));
     }
 
+    /**
+     * {@code fleet_handover} (fleetd #480 Unit C): drive {@link LeadRollover#open}/
+     * {@link LeadRollover#confirm}/{@link LeadRollover#cancel} from a tool call.
+     *
+     * <p>{@code callerTerminal} is the CALLING lead's terminal id, resolved by the MCP layer from
+     * the connection (see {@link #callerTerminal(McpSyncServerExchange)}) — never a request field.
+     * This is why this tool's input schema ({@link #handoverTool}) carries no terminal/session/
+     * leadTerminal parameter of any kind: a lead can only ever open or confirm a rollover of its
+     * OWN pane (see {@code LeadRollover}'s class javadoc, fleetd #480 correction 2).
+     *
+     * <p>{@code leadRollover} is {@code null} whenever {@code leadRollover:} is not configured.
+     * This tool is registered unconditionally regardless (see this class's javadoc on the fleetd
+     * #474 charter tool-surface gate), so every action here must degrade to a clean, structured
+     * refusal naming {@code NOT_CONFIGURED} rather than ever throwing.
+     */
+    static McpSchema.CallToolResult handover(LeadRollover leadRollover, String callerTerminal,
+                                              Map<String, Object> args) {
+        String action = str(args, "action");
+        if (isBlank(action)) {
+            return error("action is required: \"open\", \"confirm\" or \"cancel\"");
+        }
+        return switch (action) {
+            case "open" -> handoverOpen(leadRollover, callerTerminal, str(args, "reason"));
+            case "confirm" -> handoverConfirm(leadRollover, callerTerminal, str(args, "token"),
+                    truthy(args, "operatorConfirmed"));
+            case "cancel" -> handoverCancel(leadRollover, str(args, "token"));
+            default -> error("unknown action \"" + action + "\" — must be \"open\", \"confirm\" or \"cancel\"");
+        };
+    }
+
+    /**
+     * {@code action: "open"}. On the null-{@code leadRollover} path (not configured) and on the
+     * config-removed-since-construction path ({@link LeadRollover#open} itself throws {@link
+     * IllegalStateException} for that), both degrade to the same clean {@code NOT_CONFIGURED}
+     * refusal — never an escaping exception.
+     */
+    private static McpSchema.CallToolResult handoverOpen(LeadRollover leadRollover, String callerTerminal,
+                                                          String reason) {
+        if (leadRollover == null) {
+            return notConfigured();
+        }
+        if (isBlank(callerTerminal)) {
+            // An unnamed primary (token/loopback path, no resolved pane) has nowhere for the
+            // eventual /clear + bootstrap to land — LeadRollover#open would throw
+            // IllegalArgumentException for the same reason; refuse cleanly here instead.
+            return error("fleet_handover requires a named lead pane (a resolved connection terminal) "
+                    + "to open a rollover request against — an unnamed primary has none");
+        }
+        try {
+            LeadRollover.PendingRollover p = leadRollover.open(callerTerminal, reason);
+            Map<String, Object> m = new LinkedHashMap<>();
+            m.put("token", p.token());
+            m.put("handoverPath", p.handoverPath());
+            m.put("requestedAtMillis", p.requestedAtMillis());
+            return text(json(m));
+        } catch (IllegalStateException e) {
+            // leadRollover: was removed from config by a hot reload since this FleetMcp was
+            // constructed — same clean refusal as the null-at-construction case above.
+            return notConfigured();
+        }
+    }
+
+    /** {@code action: "confirm"}. Surfaces every {@link LeadRollover.RefusalReason} verbatim. */
+    private static McpSchema.CallToolResult handoverConfirm(LeadRollover leadRollover, String callerTerminal,
+                                                             String token, boolean operatorConfirmed) {
+        if (leadRollover == null) {
+            return refusalJson(false, "NOT_CONFIGURED", "leadRollover: is not configured");
+        }
+        if (isBlank(token)) {
+            return error("token is required for action \"confirm\"");
+        }
+        LeadRollover.RollDecision d = leadRollover.confirm(callerTerminal, token, operatorConfirmed);
+        return refusalJson(d.accepted(), d.reason() == null ? null : d.reason().name(), d.detail());
+    }
+
+    /** {@code action: "cancel"}. An unknown token is a clean "no pending request", never an error. */
+    private static McpSchema.CallToolResult handoverCancel(LeadRollover leadRollover, String token) {
+        if (leadRollover == null) {
+            Map<String, Object> m = new LinkedHashMap<>();
+            m.put("cancelled", false);
+            m.put("reason", "NOT_CONFIGURED");
+            m.put("detail", "leadRollover: is not configured");
+            return text(json(m));
+        }
+        if (isBlank(token)) {
+            return error("token is required for action \"cancel\"");
+        }
+        boolean existed = leadRollover.cancel(token);
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("cancelled", existed);
+        if (!existed) {
+            m.put("detail", "no pending request for token " + token);
+        }
+        return text(json(m));
+    }
+
+    /** The one shared {@code NOT_CONFIGURED} refusal shape for {@code open}/{@code confirm}. */
+    private static McpSchema.CallToolResult notConfigured() {
+        return refusalJson(false, "NOT_CONFIGURED", "leadRollover: is not configured");
+    }
+
+    private static McpSchema.CallToolResult refusalJson(boolean accepted, String reason, String detail) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("accepted", accepted);
+        if (reason != null) {
+            m.put("reason", reason);
+        }
+        if (detail != null) {
+            m.put("detail", detail);
+        }
+        return text(json(m));
+    }
+
     // --- fleet management logic (CB-108 / CB-301) --------------------------------------------
 
     /** {@code fleet_spawn} without cwd/caller context (default resolution). */
@@ -1269,6 +1427,13 @@ public final class FleetMcp {
      * (the backend text that triggered the most recent quarantine of that credential, omitted when
      * none is known) — so a lead can see WHICH model to turn off and WHY, without reading the
      * daemon log.
+     *
+     * <p>fleetd #466 scope item 2: each {@code quarantined} row also names {@code
+     * quarantineAttempt} — 1 for a first-time exhaustion, 2 for the second in a row, and so on — so
+     * an operator sees "this is the 5th time" instead of inferring it from {@code
+     * quarantinedForSeconds} alone. Read off {@link BackendQuarantine#status(String)}, the same
+     * one-call accessor {@code quarantinedForSeconds} itself comes from here (see its doc) — never a
+     * separately derived count.
      */
     public static Map<String, Object> profilesView(PeerLauncher workers, QuarantineSource quarantine, OutageSource outage) {
         Map<String, Object> result = new LinkedHashMap<>();
@@ -1281,10 +1446,14 @@ public final class FleetMcp {
             exhaustionDetectionArmed.put(profile, quarantine.exhaustedPatternArmed().apply(profile));
             String credentialId = quarantine.credentialIdFor().apply(profile);
             if (credentialId != null) {
-                quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
+                // fleetd #466 scope item 2: quarantinedForSeconds and quarantineAttempt come off the
+                // ONE BackendQuarantine#status(credentialId) call — never a second, independent read
+                // for the attempt count — so the two can never disagree about which streak this is.
+                quarantine.quarantine().status(credentialId).ifPresent(status -> {
                     Map<String, Object> row = new LinkedHashMap<>();
                     row.put("credentialId", credentialId);
-                    row.put("quarantinedForSeconds", remaining);
+                    row.put("quarantinedForSeconds", status.remainingSeconds());
+                    row.put("quarantineAttempt", status.repeatCount());
                     String model = quarantine.modelFor().apply(profile);
                     if (model != null && !model.isBlank()) {
                         row.put("model", model);
@@ -1724,10 +1893,13 @@ public final class FleetMcp {
         }
         String credentialId = quarantine.credentialIdFor().apply(profile);
         if (credentialId != null) {
-            quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
+            // fleetd #466 scope item 2: same one-call status() read as profilesView above — see its
+            // comment for why this must not become two separate lookups.
+            quarantine.quarantine().status(credentialId).ifPresent(status -> {
                 row.put("free", 0);
                 row.put("credentialId", credentialId);
-                row.put("quarantinedForSeconds", remaining);
+                row.put("quarantinedForSeconds", status.remainingSeconds());
+                row.put("quarantineAttempt", status.repeatCount());
             });
         }
         String outageCredentialId = outage.credentialIdFor().apply(profile);
@@ -1805,7 +1977,7 @@ public final class FleetMcp {
     // --- tool schemas --------------------------------------------------------------------------
 
     private static McpSchema.Tool sendTool() {
-        return tool("fleet_send",
+        return tool(FleetTool.SEND.wireName(),
                 "Delegate a task to a worker session. By default blocks until the worker replies and "
                         + "returns its reply (or a 'still working / queued' note on timeout). Pass wait:false "
                         + "for a long task to return a ticket immediately, then poll it with fleet_poll. To "
@@ -1833,7 +2005,7 @@ public final class FleetMcp {
 
     private static McpSchema.Tool askTool() {
         // No target/session arg — the worker's identity is resolved from the connection.
-        return tool("fleet_ask",
+        return tool(FleetTool.ASK.wireName(),
                 "Pause your current delegated turn to ask the primary a question, blocking until it "
                         + "answers — then resume the same turn with the answer. Use this when only the "
                         + "primary has a decision or detail you need to continue. You do not address the "
@@ -1846,7 +2018,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool pollTool() {
-        return tool("fleet_poll",
+        return tool(FleetTool.POLL.wireName(),
                 "Check an async delegation (a fleet_send with wait:false) by its ticket: "
                         + "pending, done (with the worker's reply), or failed. When target (a worker "
                         + "session id) is present instead of ticket, drain that worker's inbox of "
@@ -1866,7 +2038,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool ackTool() {
-        return tool("fleet_ack",
+        return tool(FleetTool.ACK.wireName(),
                 "Acknowledge (remove) a specific reply from a worker's inbox. Use when the primary "
                         + "has processed a reply and wants to confirm it, leaving other pending replies "
                         + "in the inbox for later drain.",
@@ -1880,7 +2052,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool spawnTool() {
-        return tool("fleet_spawn",
+        return tool(FleetTool.SPAWN.wireName(),
                 "Spawn a new off-subscription member session. A member has two independent attributes: "
                         + "role (what it is for) and profile (which backend it runs on). Pass role to pick "
                         + "the contract — 'dev' implements a unit and opens its own PR, 'reviewer' reviews a "
@@ -1912,7 +2084,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool profilesTool() {
-        return tool("fleet_profiles",
+        return tool(FleetTool.PROFILES.wireName(),
                 "List the configured worker profiles (backends) and which one fleet_spawn uses by "
                         + "default. A 'quarantined' map is present when a backend-exhausted refusal put "
                         + "a profile's credential on cooldown — fleet_spawn onto it is refused until "
@@ -1930,7 +2102,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool listTool() {
-        return tool("fleet_list",
+        return tool(FleetTool.LIST.wireName(),
                 "List the whole fleet the bridge tracks, in two parts. 'leads' are your PEERS — other "
                         + "orchestrators, each with its sessionId (the address to fleet_send to), "
                         + "name, live status, and 'self': true on your own row; this is how you "
@@ -1966,7 +2138,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool stopTool() {
-        return tool("fleet_stop",
+        return tool(FleetTool.STOP.wireName(),
                 "Tear down a worker session by its paneId (from fleet_spawn or fleet_list).",
                 objectSchema(Map.of(
                         "paneId", stringProp("The worker's paneId to stop")),
@@ -1975,7 +2147,7 @@ public final class FleetMcp {
 
     private static McpSchema.Tool replyTool() {
         // No session/target arg — the caller's identity is resolved from the connection.
-        return tool("fleet_reply",
+        return tool(FleetTool.REPLY.wireName(),
                 "Return your structured answer for a message you were sent, resolving the sender's "
                         + "blocked fleet_send. A worker MUST end every delegated turn with exactly "
                         + "one of these. A lead uses it only to answer another lead that messaged "
@@ -1986,7 +2158,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool statusTool() {
-        return tool("fleet_status",
+        return tool(FleetTool.STATUS.wireName(),
                 "Get the live lifecycle status (idle/working/blocked/unknown) of a worker session.",
                 objectSchema(Map.of(
                         "sessionId", stringProp("The worker session id to query")),
@@ -1994,7 +2166,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool whoamiTool() {
-        return tool("fleet_whoami",
+        return tool(FleetTool.WHOAMI.wireName(),
                 "Report who YOU are on the bridge — your role is resolved from your connection "
                         + "(unforgeable), never from anything you claim. Returns role 'primary' (you "
                         + "orchestrate: spawn/send/stop; reply ONLY to answer a peer lead that "
@@ -2008,6 +2180,31 @@ public final class FleetMcp {
                 objectSchema(Map.of(), List.of()));
     }
 
+    private static McpSchema.Tool handoverTool() {
+        return tool(FleetTool.HANDOVER.wireName(),
+                "Replace your OWN lead session once its context is full: write a handover file, "
+                        + "then use this to have fleetd clear your pane and bootstrap a fresh lead "
+                        + "session against it. Three actions: 'open' (requests a token and the "
+                        + "handoverPath you must write the handover file to before confirming), "
+                        + "'confirm' (validates every gate and — only if every one passes — schedules "
+                        + "the roll; it does NOT itself clear the pane, the roll runs once this call's "
+                        + "own turn ends), and 'cancel' (drops a pending request without rolling). "
+                        + "Primary-only. There is deliberately no terminal/session/leadTerminal "
+                        + "parameter: the pane to roll is always resolved from YOUR OWN connection, "
+                        + "never a value you pass, so you can only ever roll yourself — never another "
+                        + "lead. Requires leadRollover: to be configured; when it is not, every action "
+                        + "returns a clean refusal naming NOT_CONFIGURED instead of failing.",
+                objectSchema(Map.of(
+                        "action", stringProp("\"open\", \"confirm\" or \"cancel\""),
+                        "reason", stringProp("Free-text audit note for \"open\" (optional, logged only)"),
+                        "token", stringProp("The token \"open\" returned — required for \"confirm\" and \"cancel\""),
+                        "operatorConfirmed", Map.of("type", "boolean",
+                                "description", "For \"confirm\": your answer to \"has the human operator "
+                                        + "confirmed this wipe\" (default false; only consulted when "
+                                        + "leadRollover.requireOperatorConfirm is true)")),
+                        List.of("action")));
+    }
+
     // --- small helpers -------------------------------------------------------------------------
 
     // The SDK 2.0.0 deprecates its own Tool builders without a stable replacement — isolate it here.
@@ -2042,6 +2239,11 @@ public final class FleetMcp {
         return v instanceof Number n ? n.longValue() : null;
     }
 
+    /** {@code true} only when {@code args.get(key)} is the boolean {@code true} — absent/null/anything else is {@code false}. */
+    private static boolean truthy(Map<String, Object> args, String key) {
+        return Boolean.TRUE.equals(args.get(key));
+    }
+
     private static long clamp(long ms) {
         return Math.clamp(ms, 1, MAX_TIMEOUT_MS);
     }

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetTool.java

@@ -0,0 +1,83 @@
+package dev.ltms.fleet.mcp;
+
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+
+/**
+ * The one canonical set of MCP tool names this daemon registers (fleetd #469, follow-up to #464).
+ *
+ * <p>Before this enum, the tool surface was written twice with nothing tying the copies together:
+ * once as the literal {@code "fleet_…"} string passed to each tool-schema builder in
+ * {@link FleetMcp}, and again as the case labels of {@link FleetMcp}'s authorization switch. A
+ * reader that needed "what does this server register" — a charter check, in particular — had no
+ * source to ask except scraping {@code FleetMcp.java}'s source text for {@code tool("…")} calls: a
+ * third copy of the same list, and the weakest of the three forms.
+ *
+ * <p>Every reader that needs the registered tool surface now asks this enum instead:
+ *
+ * <ul>
+ *   <li>the tool-schema builders in {@code FleetMcp} pass {@code wireName()} rather than a literal;
+ *   <li>{@code FleetMcp}'s constructor asserts, at startup, that the set of tool names it actually
+ *       registers with the MCP SDK equals {@link #wireNames()} exactly — a canonical entry that is
+ *       never registered, or a registration with no canonical entry backing it, fails the daemon's
+ *       own boot rather than only a test's;
+ *   <li>{@code FleetMcp.toolAction}'s dispatch onto {@code Authz.Action} switches on the enum
+ *       (not the raw string) with no {@code default}, so adding a tool here without pinning its
+ *       action is a compile error, not a run-time throw;
+ *   <li>{@link CharterToolSurface} asks {@link #wireNames()} to check a configured launch charter
+ *       against the live tool surface, instead of scraping source text a third time.
+ * </ul>
+ */
+public enum FleetTool {
+
+    SEND("fleet_send"),
+    REPLY("fleet_reply"),
+    ASK("fleet_ask"),
+    STATUS("fleet_status"),
+    POLL("fleet_poll"),
+    ACK("fleet_ack"),
+    SPAWN("fleet_spawn"),
+    LIST("fleet_list"),
+    STOP("fleet_stop"),
+    PROFILES("fleet_profiles"),
+    WHOAMI("fleet_whoami"),
+    HANDOVER("fleet_handover");
+
+    private final String wireName;
+
+    FleetTool(String wireName) {
+        this.wireName = wireName;
+    }
+
+    /** The name this tool is registered under, and called by, on the wire ({@code "fleet_send"}, …). */
+    public String wireName() {
+        return wireName;
+    }
+
+    private static final Map<String, FleetTool> BY_WIRE_NAME;
+    private static final Set<String> WIRE_NAMES;
+
+    static {
+        Map<String, FleetTool> byName = new LinkedHashMap<>();
+        Set<String> names = new LinkedHashSet<>();
+        for (FleetTool tool : values()) {
+            byName.put(tool.wireName, tool);
+            names.add(tool.wireName);
+        }
+        BY_WIRE_NAME = Map.copyOf(byName);
+        WIRE_NAMES = Set.copyOf(names);
+    }
+
+    /** The tool named {@code wireName}, or empty when this daemon registers no such tool. */
+    public static Optional<FleetTool> byWireName(String wireName) {
+        return Optional.ofNullable(BY_WIRE_NAME.get(wireName));
+    }
+
+    /** Every wire name this daemon registers — the canonical tool surface. */
+    public static Set<String> wireNames() {
+        return WIRE_NAMES;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -525,17 +525,28 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                 charter.toFile().deleteOnExit();
 
                 // fleetd #393 follow-up: withArray, not putArray. putArray REPLACES whatever node
-                // is already at "instructions" — harmless only as long as this block runs first
-                // against a still-empty root, which is an ordering constraint nothing declared or
-                // tested. The skills writer just below, and the IDE-rules writer further down,
-                // both already use withArray (get-or-create) for exactly this reason; this was the
-                // one straggler. Proven load-bearing on the fleetd #393 merge: flipping this one
-                // call back to putArray left the whole suite green while silently deleting the
-                // charter entry whenever skills or IDE rules ran after it — an opencode member
-                // would launch with no role contract at all, worse than the bug #393 fixed, and
-                // nothing caught it. See OpenCodeLauncherTest's
-                // instructionsArrayHoldsCharterThenIdeRulesInOrder and
-                // instructionsArrayHoldsCharterThenSkillsThenIdeRulesInOrder.
+                // is already at "instructions"; withArray gets-or-creates. All three writers on
+                // this array now use withArray so that write order stops being load-bearing for
+                // whoever adds a fourth.
+                //
+                // Be precise about what this particular line is worth, because an earlier version
+                // of this comment was wrong and claimed too much. THIS call is the one place where
+                // the two idioms are equivalent, and no test can tell them apart: it runs first,
+                // against a still-empty root, so there is never an existing node for putArray to
+                // replace. Measured on the #393 merge: flipping this one call back to putArray
+                // leaves the whole suite green (1618 tests), and always will. The edit is a
+                // readability and future-proofing change with no test behind it, and that is not a
+                // gap anyone can close.
+                //
+                // The ordering hazard is real, just not here. It is the LATER writers that can
+                // destroy earlier entries. Measured on the same merge: flipping the skills writer
+                // below to putArray deletes this charter entry and fails
+                // OpenCodeLauncherTest.instructionsArrayHoldsCharterThenSkillsThenIdeRulesInOrder;
+                // flipping the IDE-rules writer fails that test and
+                // instructionsArrayHoldsCharterThenIdeRulesInOrder. Deleting this line altogether
+                // fails instructionsArrayHoldsExactlyTheCharterWhenNothingElseWritesToIt — the
+                // assertion that a role contract reaches an opencode member at all, which is the
+                // hole that predates #393 and is what actually let the mutation hide.
                 root.withArray("instructions").add(charter.toAbsolutePath().toString());
             }
 

fleetd/src/main/java/dev/ltms/fleet/placement/BackendQuarantine.java

@@ -3,6 +3,7 @@ package dev.ltms.fleet.placement;
 import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.OptionalLong;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.LongSupplier;
@@ -21,46 +22,158 @@ import java.util.function.LongSupplier;
  * <p>The clock is injected ({@link LongSupplier}, conventionally {@code System::nanoTime} like
  * {@code FleetHealthMonitor}), never read inline, so a quarantine's expiry is testable without a
  * real sleep.
+ *
+ * <h2>Escalation (fleetd #466)</h2>
+ * A flat cooldown does not fit every exhaustion. A backend that reports "out of capacity for the
+ * rest of the hour" recovers in one cooldown; a weekly subscription limit does not — it keeps
+ * reporting exhausted on every attempt made before the window resets, so a flat 30-minute cooldown
+ * (the default {@code cooldownNanos}) means roughly 336 pointless spawn attempts across a week, one
+ * every cooldown.
+ *
+ * <p><strong>This class only ever sees the exhaustion signal.</strong> Its only production caller is
+ * {@code Fleetd.exhaustionSink}, wired to fire on a {@code BACKEND_EXHAUSTED} classification alone.
+ * The daemon's other outage state — a credential "cooling off" after repeated non-exhaustion
+ * backend errors (an HTTP 5xx storm, say) — is a separate mechanism, {@code BackendOutagePolicy},
+ * with its own short fixed 60s cooldown and no repeat tracking. The two are never merged: escalating
+ * on a cooling-off signal would turn a transient 5xx storm into a multi-hour backoff, which is
+ * exactly the failure this ticket is not asking for. Confirmed by reading every call site of
+ * {@link #quarantine} — {@code BackendOutagePolicy} has its own {@code coolOff} method and never
+ * calls this one.
+ *
+ * <p><strong>Mechanism</strong> — the {@link #withEscalation} constructors track, per credential, how
+ * many times in a row {@link #quarantine} has been called without an intervening "quiet" gap.
+ * Each call computes {@code cooldownNanos * backoffMultiplier ^ (repeatCount - 1)}, capped at
+ * {@code maxCooldownNanos}. A call counts as a continuation of the same streak — {@code repeatCount}
+ * increments — when it arrives no more than one base {@code cooldownNanos} after the previous
+ * quarantine's deadline (this covers both "still quarantined" and "quarantine just expired and it
+ * was exhausted again immediately"); otherwise the streak resets and this call is treated as a fresh
+ * first occurrence at the base cooldown.
+ *
+ * <p><strong>Reset, honestly stated.</strong> The ideal reset signal is "the cooldown expired and the
+ * next attempt succeeded" — but nothing in this codebase reports a spawn success back to this class
+ * (checked: {@code SessionManager} and {@code CompositePeerLauncher} never call any method here
+ * except {@link #quarantine}/{@link #isQuarantined}/{@link #remainingSeconds}, none of which is a
+ * success hook). Lacking that signal, the reset used here is a time-based proxy: a base-cooldown's
+ * worth of quiet — no exhaustion report for that credential — since the last quarantine ended. It is
+ * not proof the credential started working again, only the best available evidence without adding an
+ * active probe, which is out of scope by the operator's own design constraint (no automatic probing
+ * of a limited backend).
+ *
+ * <p><strong>Ceiling.</strong> {@code maxCooldownNanos} bounds the growth — an unbounded backoff is a
+ * permanent, unrecoverable-without-a-restart outage, which would be worse than the flat-rate bug this
+ * escalation fixes. {@link #withEscalation(LongSupplier, long)} defaults the ceiling to
+ * {@value #DEFAULT_MAX_COOLDOWN_MULTIPLE}x the base cooldown (12x the 1800s default ≈ 6 hours), so a
+ * chronically exhausted credential still gets re-tried roughly every 6 hours instead of every 30
+ * minutes — about a dozen attempts a week instead of ~336.
+ *
+ * <p><strong>Backward compatibility.</strong> The original two-argument {@link #BackendQuarantine(
+ * LongSupplier, long)} constructor is unchanged in behaviour: it is exactly {@code
+ * withEscalation}'s mechanism with {@code backoffMultiplier = 1.0} and {@code maxCooldownNanos =
+ * cooldownNanos}, which collapses the formula back to the original flat {@code now + cooldownNanos}
+ * on every call regardless of history. Every existing call site (roughly 20 across the test suite,
+ * plus {@link #none()}) keeps its current shape and behaviour unchanged.
  */
 public final class BackendQuarantine {
 
-    private final ConcurrentHashMap<String, Long> quarantinedUntilNanos = new ConcurrentHashMap<>();
+    /** Default growth per consecutive exhaustion streak — see the class doc's Mechanism section. */
+    static final double DEFAULT_BACKOFF_MULTIPLIER = 2.0;
+    /** Default ceiling, expressed as a multiple of the base cooldown — see the class doc's Ceiling section. */
+    static final long DEFAULT_MAX_COOLDOWN_MULTIPLE = 12;
+
+    private final ConcurrentHashMap<String, QuarantineState> quarantines = new ConcurrentHashMap<>();
     private final LongSupplier nowNanos;
     private final long cooldownNanos;
+    private final double backoffMultiplier;
+    private final long maxCooldownNanos;
     /** True only for {@link #none()}. See {@link #quarantine} for why this exists. */
     private final boolean inert;
 
+    /** How many consecutive exhaustion reports a credential is on, and when the resulting cooldown ends. */
+    private record QuarantineState(int repeatCount, long deadlineNanos) {
+    }
+
     /**
+     * Flat cooldown, unchanged from before fleetd #466 — every {@link #quarantine} call blocks the
+     * credential for exactly {@code cooldownNanos}, regardless of how many times it was called
+     * before. Equivalent to {@link #withEscalation} with no growth ({@code backoffMultiplier = 1.0})
+     * and a ceiling equal to the base cooldown, so it degrades to the identical {@code now +
+     * cooldownNanos} formula every call. Kept for the existing call sites that want a fixed cooldown
+     * (and for tests exercising the fixed-cooldown shape in isolation); production wiring uses
+     * {@link #withEscalation} instead.
+     *
      * @param nowNanos      monotonic clock, injected for testability
      * @param cooldownNanos how long a fresh {@link #quarantine} call blocks the credential for;
      *                      must be positive
      */
     public BackendQuarantine(LongSupplier nowNanos, long cooldownNanos) {
-        this(nowNanos, cooldownNanos, false);
+        this(nowNanos, cooldownNanos, 1.0, cooldownNanos, false);
     }
 
-    private BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, boolean inert) {
+    /**
+     * Escalating cooldown (fleetd #466) — see the class doc's Mechanism/Reset/Ceiling sections.
+     *
+     * @param nowNanos          monotonic clock, injected for testability
+     * @param cooldownNanos     base cooldown, applied to a fresh (non-streak) exhaustion; must be
+     *                          positive
+     * @param backoffMultiplier growth per consecutive exhaustion; must be {@code >= 1.0} ({@code 1.0}
+     *                          disables growth and is exactly the flat two-argument constructor)
+     * @param maxCooldownNanos  ceiling on the escalated cooldown; must be {@code >= cooldownNanos}
+     */
+    public BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, double backoffMultiplier,
+            long maxCooldownNanos) {
+        this(nowNanos, cooldownNanos, backoffMultiplier, maxCooldownNanos, false);
+    }
+
+    private BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, double backoffMultiplier,
+            long maxCooldownNanos, boolean inert) {
         this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
         if (cooldownNanos <= 0) {
             throw new IllegalArgumentException("cooldownNanos must be positive: " + cooldownNanos);
         }
+        if (backoffMultiplier < 1.0) {
+            throw new IllegalArgumentException("backoffMultiplier must be >= 1.0: " + backoffMultiplier);
+        }
+        if (maxCooldownNanos < cooldownNanos) {
+            throw new IllegalArgumentException(
+                    "maxCooldownNanos must be >= cooldownNanos: " + maxCooldownNanos + " < " + cooldownNanos);
+        }
         this.cooldownNanos = cooldownNanos;
+        this.backoffMultiplier = backoffMultiplier;
+        this.maxCooldownNanos = maxCooldownNanos;
         this.inert = inert;
     }
 
+    /**
+     * Escalating cooldown with the fleetd #466 default shape: cooldown doubles
+     * ({@value #DEFAULT_BACKOFF_MULTIPLIER}x) per consecutive exhaustion streak, capped at
+     * {@value #DEFAULT_MAX_COOLDOWN_MULTIPLE}x the base cooldown. This is what production wiring
+     * ({@code Fleetd.main}) uses.
+     *
+     * @param nowNanos      monotonic clock, injected for testability
+     * @param cooldownNanos base cooldown, applied to a fresh (non-streak) exhaustion; must be positive
+     */
+    public static BackendQuarantine withEscalation(LongSupplier nowNanos, long cooldownNanos) {
+        return new BackendQuarantine(nowNanos, cooldownNanos, DEFAULT_BACKOFF_MULTIPLIER,
+                cooldownNanos * DEFAULT_MAX_COOLDOWN_MULTIPLE, false);
+    }
+
     /**
      * Inert quarantine — {@link #quarantine} does nothing on this instance, so nothing is ever
      * quarantined. The explicit stand-in a caller (or a test not exercising this feature) passes
      * instead of a defaulting overload, exactly like {@code ExhaustedPatternLookup.none()}.
      */
     public static BackendQuarantine none() {
-        return new BackendQuarantine(() -> 0L, 1, true);
+        return new BackendQuarantine(() -> 0L, 1, 1.0, 1, true);
     }
 
     /**
-     * Quarantine {@code credentialId} for the configured cooldown, starting now. A repeat call while
-     * already quarantined restarts the cooldown at full length — a fresh refusal is fresh evidence the
-     * account is still exhausted, not a reason to let an earlier, shorter wait stand.
+     * Quarantine {@code credentialId} starting now. On a flat instance (the two-argument
+     * constructor) this always blocks for exactly {@code cooldownNanos}, restarting the cooldown at
+     * full length on every call — a fresh refusal is fresh evidence the account is still exhausted,
+     * not a reason to let an earlier, shorter wait stand. On an escalating instance ({@link
+     * #withEscalation}) the cooldown grows with each call that arrives within one base cooldown of
+     * the previous deadline, and resets to the base cooldown once a call arrives after a longer gap
+     * — see the class doc.
      *
      * <p>On {@link #none()} this is a no-op. It has to be: that instance holds a clock frozen at 0,
      * so recording a deadline would produce a quarantine that never expires — a credential locked out
@@ -73,7 +186,13 @@ public final class BackendQuarantine {
         if (inert) {
             return;
         }
-        quarantinedUntilNanos.put(credentialId, nowNanos.getAsLong() + cooldownNanos);
+        long now = nowNanos.getAsLong();
+        quarantines.compute(credentialId, (id, prev) -> {
+            int repeatCount = (prev == null || now - prev.deadlineNanos() > cooldownNanos)
+                    ? 1
+                    : prev.repeatCount() + 1;
+            return new QuarantineState(repeatCount, now + escalatedCooldownNanos(repeatCount));
+        });
     }
 
     /** Whether {@code credentialId} is quarantined right now. */
@@ -87,6 +206,49 @@ public final class BackendQuarantine {
         return remaining > 0 ? OptionalLong.of(toSecondsRoundedUp(remaining)) : OptionalLong.empty();
     }
 
+    /**
+     * Remaining seconds together with which consecutive exhaustion this is (fleetd #466 scope item
+     * 2) — {@code repeatCount} 1 for a first occurrence, 2 for the second in a row, and so on; see
+     * {@link #quarantine}'s class-doc Mechanism section for exactly when a call continues a streak
+     * versus starts a fresh one.
+     *
+     * <p><strong>Read together, off the one {@link QuarantineState} entry {@link #quarantine} itself
+     * wrote</strong> — a single {@code quarantines.get(credentialId)}, never a separate lookup or a
+     * value re-derived from {@code remainingSeconds} (e.g. inverting {@link
+     * #escalatedCooldownNanos}). That inversion is not just extra work to avoid: once a streak has
+     * hit {@code maxCooldownNanos}, every further consecutive exhaustion reports the identical
+     * cooldown, so a derivation that starts from the cooldown value cannot tell the 4th repeat from
+     * the 9th — only the stored {@code repeatCount} can. This is the same rule {@code
+     * CompositePeerLauncher.modelGateState()} documents for its own gate/report pair: the report
+     * reads the exact accessor the behaviour reads, so it can never disagree with what actually
+     * happened (the fleetd #404/#422 lesson). {@code fleet_profiles}/{@code fleet_list}/{@code GET
+     * /profiles} all call this — never {@link #remainingSeconds} plus a second, independent count —
+     * for exactly that reason.
+     *
+     * @return empty when {@code credentialId} is not currently quarantined (including on {@link
+     *         #none()}, which quarantines nothing)
+     */
+    public Optional<Status> status(String credentialId) {
+        QuarantineState state = quarantines.get(credentialId);
+        if (state == null) {
+            return Optional.empty();
+        }
+        long remaining = state.deadlineNanos() - nowNanos.getAsLong();
+        return remaining > 0
+                ? Optional.of(new Status(toSecondsRoundedUp(remaining), state.repeatCount()))
+                : Optional.empty();
+    }
+
+    /**
+     * @param remainingSeconds seconds left on the quarantine, identical to {@link
+     *                          #remainingSeconds(String)}'s answer for the same credential at the
+     *                          same instant
+     * @param repeatCount       1 for a first occurrence, 2 for the second consecutive one, etc. —
+     *                          see {@link #status(String)}
+     */
+    public record Status(long remainingSeconds, int repeatCount) {
+    }
+
     /**
      * Every currently-quarantined credential id and its remaining seconds (CB-578 stage B fleet
      * reporting) — expired entries are never included. Not pruned from the backing map here: it stays
@@ -95,8 +257,8 @@ public final class BackendQuarantine {
      */
     public Map<String, Long> activeRemainingSeconds() {
         Map<String, Long> out = new LinkedHashMap<>();
-        quarantinedUntilNanos.forEach((credentialId, deadline) -> {
-            long remaining = deadline - nowNanos.getAsLong();
+        quarantines.forEach((credentialId, state) -> {
+            long remaining = state.deadlineNanos() - nowNanos.getAsLong();
             if (remaining > 0) {
                 out.put(credentialId, toSecondsRoundedUp(remaining));
             }
@@ -105,8 +267,14 @@ public final class BackendQuarantine {
     }
 
     private long remainingNanos(String credentialId) {
-        Long deadline = quarantinedUntilNanos.get(credentialId);
-        return deadline == null ? 0L : deadline - nowNanos.getAsLong();
+        QuarantineState state = quarantines.get(credentialId);
+        return state == null ? 0L : state.deadlineNanos() - nowNanos.getAsLong();
+    }
+
+    /** {@code cooldownNanos * backoffMultiplier ^ (repeatCount - 1)}, capped at {@code maxCooldownNanos}. */
+    private long escalatedCooldownNanos(int repeatCount) {
+        double raw = cooldownNanos * Math.pow(backoffMultiplier, repeatCount - 1);
+        return raw >= (double) maxCooldownNanos ? maxCooldownNanos : (long) raw;
     }
 
     private static long toSecondsRoundedUp(long nanos) {

fleetd/src/test/java/dev/ltms/fleet/FleetdAwaitHerdrTest.java

@@ -0,0 +1,212 @@
+package dev.ltms.fleet;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import com.fasterxml.jackson.databind.JsonNode;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
+import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
+
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+/**
+ * fleetd #498: {@code Fleetd.awaitHerdr} used to return a bare {@code boolean}, collapsing "the
+ * configured wait budget genuinely ran out" and "the waiting thread was interrupted, possibly
+ * milliseconds in" onto the same {@code false} — and the caller's log line printed only the
+ * configured budget, never how long the wait actually ran. This class covers both halves of the
+ * fix:
+ * <ul>
+ *   <li>the seam — {@link Fleetd#awaitHerdr} itself, driven with an injected clock and a stub
+ *       {@link HerdrClient}, one test per {@link Fleetd.HerdrWaitResult};</li>
+ *   <li>the call site — {@link Fleetd#logHerdrWaitOutcomeAndShouldReap}, the exact decision {@code
+ *       main} calls (extracted here because {@code main} itself boots the whole daemon and cannot
+ *       be driven from a unit test), pinning the three distinct log messages it emits.</li>
+ * </ul>
+ * Every expected message below is a plain literal, not built from {@code HERDR_WAIT_SECONDS} or
+ * any other production constant — a test that derives its expectation the way the code does
+ * cannot see a change to either (fleetd #496's identical trap).
+ */
+class FleetdAwaitHerdrTest {
+
+    // ---- the seam: Fleetd.awaitHerdr ----------------------------------------------------------
+
+    @Test
+    void answeredReturnsImmediatelyWithZeroElapsedAndNeverPolls() {
+        HerdrStub herdr = new HerdrStub(0); // succeeds on the very first call
+        LongSupplier clock = fixedClock(1_000L);
+        AtomicBoolean polled = new AtomicBoolean(false);
+        Runnable poller = () -> polled.set(true);
+
+        Fleetd.HerdrAwaitOutcome outcome = Fleetd.awaitHerdr(herdr, clock, poller);
+
+        assertEquals(Fleetd.HerdrWaitResult.ANSWERED, outcome.result());
+        assertEquals(0L, outcome.elapsedNanos(), "a fixed clock must measure zero elapsed time");
+        assertFalse(polled.get(), "herdr answering on the first try must never poll");
+    }
+
+    @Test
+    void deadlinePassedIsMeasuredNotAssumed() {
+        HerdrStub herdr = new HerdrStub(-1); // never succeeds
+        // call order inside awaitHerdr: start, then per failed attempt: deadline-check, elapsed-calc
+        ScriptedClock clock = new ScriptedClock(0L, 30_500_000_000L, 30_500_000_000L);
+        Runnable poller = () -> fail("the deadline was already exceeded on the first attempt — must not poll");
+
+        Fleetd.HerdrAwaitOutcome outcome = Fleetd.awaitHerdr(herdr, clock, poller);
+
+        assertEquals(Fleetd.HerdrWaitResult.DEADLINE_PASSED, outcome.result());
+        assertEquals(30_500_000_000L, outcome.elapsedNanos(),
+                "elapsed must be the MEASURED clock delta, not the configured budget");
+    }
+
+    @Test
+    void interruptedIsDistinctFromDeadlinePassedAndPreservesTheInterruptFlag() {
+        HerdrStub herdr = new HerdrStub(-1); // never succeeds
+        // start=0, deadline-check returns 500ms (well under the 30s budget) -> not deadline-passed,
+        // then the poller interrupts, and the elapsed-calc call returns 750ms.
+        ScriptedClock clock = new ScriptedClock(0L, 500_000_000L, 750_000_000L);
+        Runnable poller = () -> Thread.currentThread().interrupt();
+
+        try {
+            Fleetd.HerdrAwaitOutcome outcome = Fleetd.awaitHerdr(herdr, clock, poller);
+
+            assertEquals(Fleetd.HerdrWaitResult.INTERRUPTED, outcome.result());
+            assertEquals(750_000_000L, outcome.elapsedNanos(),
+                    "elapsed must be measured even when the wait ends via interruption, not the deadline");
+            assertTrue(Thread.currentThread().isInterrupted(),
+                    "the interrupt flag the old code re-set must still be set on return");
+        } finally {
+            Thread.interrupted(); // clear it so it cannot leak into another test on this thread
+        }
+    }
+
+    // ---- the call site: Fleetd.logHerdrWaitOutcomeAndShouldReap -------------------------------
+
+    @Test
+    void answeredLogsNothingAndSaysReap() {
+        ListAppender<ILoggingEvent> events = attach();
+        try {
+            boolean shouldReap = Fleetd.logHerdrWaitOutcomeAndShouldReap(
+                    new Fleetd.HerdrAwaitOutcome(Fleetd.HerdrWaitResult.ANSWERED, 0L));
+
+            assertTrue(shouldReap, "only ANSWERED should tell main to reap orphan workers");
+            assertEquals(0, events.list.size(), "the answered path logs nothing itself");
+        } finally {
+            detach(events);
+        }
+    }
+
+    @Test
+    void deadlinePassedLogsConfiguredAndMeasuredElapsedTogether() {
+        ListAppender<ILoggingEvent> events = attach();
+        try {
+            boolean shouldReap = Fleetd.logHerdrWaitOutcomeAndShouldReap(
+                    new Fleetd.HerdrAwaitOutcome(Fleetd.HerdrWaitResult.DEADLINE_PASSED, 30_500_000_000L));
+
+            assertFalse(shouldReap, "a deadline-passed wait must not tell main to reap");
+            assertEquals(1, events.list.size());
+            ILoggingEvent event = events.list.getFirst();
+            assertEquals(Level.WARN, event.getLevel());
+            assertEquals("herdr did not answer within the configured wait (configured=30s "
+                    + "elapsed=30500ms) — starting anyway; /healthz will report degraded until it "
+                    + "comes up. Orphaned worker panes (if any) were NOT reaped.",
+                    event.getFormattedMessage());
+        } finally {
+            detach(events);
+        }
+    }
+
+    @Test
+    void interruptedLogsItsOwnMessageAndNeverClaimsTheBudgetElapsed() {
+        ListAppender<ILoggingEvent> events = attach();
+        try {
+            // 3ms: the ticket's own example of "a few milliseconds in", not the 30s budget.
+            boolean shouldReap = Fleetd.logHerdrWaitOutcomeAndShouldReap(
+                    new Fleetd.HerdrAwaitOutcome(Fleetd.HerdrWaitResult.INTERRUPTED, 3_000_000L));
+
+            assertFalse(shouldReap, "an interrupted wait must not tell main to reap");
+            assertEquals(1, events.list.size());
+            ILoggingEvent event = events.list.getFirst();
+            assertEquals(Level.WARN, event.getLevel());
+            String message = event.getFormattedMessage();
+            assertEquals("herdr wait was interrupted before the configured wait ran out "
+                    + "(configured=30s elapsed=3ms) — starting anyway; /healthz will report "
+                    + "degraded until it comes up. Orphaned worker panes (if any) were NOT reaped.",
+                    message);
+            assertFalse(message.contains("did not answer"),
+                    "an interrupted wait must not be reported as if herdr failed to answer within the budget");
+        } finally {
+            detach(events);
+        }
+    }
+
+    // ---- fixtures --------------------------------------------------------------------------
+
+    /** Always returns the same value, i.e. a clock that measures zero elapsed time. */
+    private static LongSupplier fixedClock(long value) {
+        return () -> value;
+    }
+
+    /** Returns each value in order, then repeats the last one for any call beyond the list. */
+    private static final class ScriptedClock implements LongSupplier {
+        private final long[] values;
+        private int index;
+
+        ScriptedClock(long... values) {
+            this.values = values;
+        }
+
+        @Override
+        public long getAsLong() {
+            long v = values[Math.min(index, values.length - 1)];
+            if (index < values.length - 1) {
+                index++;
+            }
+            return v;
+        }
+    }
+
+    /** Fails {@code failuresBeforeSuccess} times, then succeeds forever; {@code -1} never succeeds. */
+    private static final class HerdrStub implements HerdrClient {
+        private final int failuresBeforeSuccess;
+        private int calls;
+
+        HerdrStub(int failuresBeforeSuccess) {
+            this.failuresBeforeSuccess = failuresBeforeSuccess;
+        }
+
+        @Override
+        public JsonNode call(String method, Object params) throws HerdrException {
+            calls++;
+            if (failuresBeforeSuccess < 0 || calls <= failuresBeforeSuccess) {
+                throw new HerdrException("herdr not up yet");
+            }
+            return null;
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static ListAppender<ILoggingEvent> attach() {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        logger.setLevel(Level.DEBUG);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(ListAppender<ILoggingEvent> appender) {
+        ((Logger) LoggerFactory.getLogger(Fleetd.class)).detachAppender(appender);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdBackendQuarantineWiringTest.java

@@ -0,0 +1,65 @@
+package dev.ltms.fleet;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #466 follow-up: {@code Fleetd.main} builds the daemon's one {@code BackendQuarantine}
+ * from {@link dev.ltms.fleet.placement.BackendQuarantine#withEscalation(java.util.function.LongSupplier,
+ * long)} — the escalating factory — rather than the plain two-argument constructor, which is still a
+ * flat cooldown (kept for backward compatibility, see that class's doc). {@code
+ * BackendQuarantineTest} proves {@code withEscalation} itself escalates, is ceilinged, and resets;
+ * it says nothing about which one {@code main} actually calls.
+ *
+ * <p>Measured directly: reverting {@code main} to {@code new BackendQuarantine(System::nanoTime,
+ * TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()))} — the pre-#466 flat call — compiles
+ * with 0 errors and leaves the entire 1608-test suite (including every {@code BackendQuarantineTest}
+ * case) green, because no other test constructs its {@code BackendQuarantine} through {@code main};
+ * every one of them builds its own instance directly. That silent regression is exactly the shape
+ * {@link FleetdLeadSeatWiringTest} and {@link FleetdCompletionResolverWiringTest} already guard
+ * against for their own constructor arguments — this is the same class of gap for fleetd #466's
+ * factory choice, following their approach.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a {@code
+ * BackendQuarantine} and never runs {@code main} — a green result here proves only that the exact
+ * text {@code main} calls {@code BackendQuarantine.withEscalation(...)} rather than the flat
+ * constructor. It does not prove that call actually executes at startup (no test here starts the
+ * daemon), and it does not prove the escalation reaches a real backend or credential — only
+ * {@code BackendQuarantineTest} proves the factory's own behaviour, and only a live daemon proves
+ * the wiring runs.
+ */
+class FleetdBackendQuarantineWiringTest {
+
+    private static String fleetdSource() throws Exception {
+        return Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] main's BackendQuarantine local is still built from BackendQuarantine.withEscalation(...)")
+    void mainStillWiresTheEscalatingQuarantineFactory() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains(
+                        "BackendQuarantine quarantine = BackendQuarantine.withEscalation(System::nanoTime,\n"
+                                + "                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));"),
+                "Fleetd.main's BackendQuarantine local must still be built from "
+                        + "BackendQuarantine.withEscalation(System::nanoTime, "
+                        + "TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds())). Reverting to the flat "
+                        + "two-argument constructor (fleetd #466's measured regression) compiles with 0 errors "
+                        + "and leaves the whole suite green, including every BackendQuarantineTest case that "
+                        + "proves the escalation itself works — this source check is what must go red instead. "
+                        + "A reverted daemon would go back to retrying a weekly subscription limit on every "
+                        + "flat ~30-minute cooldown, about 336 times across the week.");
+
+        // Negative form of the same check: the pre-#466 flat call, if it ever reappears at this
+        // declaration, must not be mistaken for the escalating one by a looser positive-only check.
+        assertFalse(source.contains(
+                        "BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,\n"
+                                + "                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));"),
+                "main's BackendQuarantine local must never regress to the flat two-argument constructor");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdConfigRefCharterToolSurfaceWiringTest.java

@@ -0,0 +1,106 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #474: proves the exact wiring {@code Fleetd.main} uses to construct its live {@code
+ * ConfigRef} — {@code new ConfigRef(configPath, cfg, Fleetd::assertChartersNameOnlyRegisteredTools)}
+ * — actually makes {@link ConfigRef#reload()} refuse a charter that names an MCP tool the server
+ * does not register, the same way {@code Fleetd.main} itself refuses one at startup (see {@code
+ * FleetdStartupValidationTest#mainRefusesACharterNamingAnUnregisteredTool}).
+ *
+ * <p>{@code dev.ltms.fleet.config.ConfigRefTest} pins the same behaviour through a locally-built
+ * {@code Consumer<FleetConfig>} adapter that calls the same production {@code CharterToolSurface}
+ * method, because that test lives in {@code dev.ltms.fleet.config} and cannot see {@code
+ * Fleetd#assertChartersNameOnlyRegisteredTools} (package-private to {@code dev.ltms.fleet}). This
+ * class is the companion proof that lives where the real method reference is visible, so the literal
+ * expression {@code Fleetd::assertChartersNameOnlyRegisteredTools} — not just an equivalent — is
+ * what gets exercised. {@code Fleetd.main} itself cannot be driven this far in a unit test: every
+ * fixture in {@code FleetdStartupValidationTest} is deliberately invalid so {@code main} throws
+ * before opening a socket, binding Javalin, or doing anything else with a real side effect, so a
+ * test cannot get {@code main} far enough to hold a running daemon it could then reload — this test
+ * builds the {@code ConfigRef} the same way {@code main} does and drives {@link ConfigRef#reload()}
+ * directly instead, the same shape {@code FleetdExhaustionDetectionArmedWiringTest} and its
+ * siblings already use for the rest of {@code Fleetd.main}'s wiring.
+ */
+class FleetdConfigRefCharterToolSurfaceWiringTest {
+
+    private static final String BASE = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              sonnet:
+                baseUrl: http://gx00.gw:8000
+                model: sonnet
+            guard:
+              offSubscriptionHosts:
+                - gx00.gw
+            """;
+
+    @Test
+    void reloadRefusesACharterNamingAnUnregisteredToolThroughFleetdsOwnWiring(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, BASE + """
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through fleet_reply.
+                """);
+        ConfigRef config = new ConfigRef(f, FleetConfig.load(f),
+                Fleetd::assertChartersNameOnlyRegisteredTools);
+        FleetConfig before = config.get();
+
+        Files.writeString(f, BASE + """
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through bridge_send.
+                """);
+        ConfigRef.Outcome out = config.reload();
+
+        assertFalse(out.applied());
+        assertNotNull(out.error());
+        assertTrue(out.error().contains("dev"), out.error());
+        assertTrue(out.error().contains("bridge_send"), out.error());
+        assertSame(before, config.get());
+    }
+
+    @Test
+    void reloadAcceptsACharterNamingOnlyRegisteredToolsThroughFleetdsOwnWiring(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, BASE + """
+                fleet:
+                  charters:
+                    dev: old charter
+                """);
+        ConfigRef config = new ConfigRef(f, FleetConfig.load(f),
+                Fleetd::assertChartersNameOnlyRegisteredTools);
+
+        Files.writeString(f, BASE + """
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through fleet_reply.
+                """);
+        ConfigRef.Outcome out = config.reload();
+
+        assertTrue(out.applied());
+        assertEquals("config reloaded", out.summary());
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdConfigRefWiringTest.java

@@ -0,0 +1,80 @@
+package dev.ltms.fleet;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #474 follow-up: {@code Fleetd.main} builds its live {@code ConfigRef} from the
+ * three-argument constructor, {@code new ConfigRef(configPath, cfg,
+ * Fleetd::assertChartersNameOnlyRegisteredTools)}, so a reload runs the same charter tool-surface
+ * gate startup does (see {@link dev.ltms.fleet.config.ConfigRef}'s class doc, "fleetd #474" bullet).
+ * {@code ConfigRefTest} and {@code FleetdConfigRefCharterToolSurfaceWiringTest} prove the
+ * three-argument constructor and the {@code Fleetd.assertChartersNameOnlyRegisteredTools} adapter
+ * work correctly together — both build their OWN {@code ConfigRef} with that constructor, so neither
+ * proves {@code main} still CHOOSES the three-argument form over the plain two-argument {@code new
+ * ConfigRef(configPath, cfg)}.
+ *
+ * <p>Measured directly: reverting {@code Fleetd.java}'s {@code config} local to the two-argument
+ * constructor compiles with 0 errors and leaves the entire 1633-test suite green — including every
+ * {@code ConfigRefTest} and {@code FleetdConfigRefCharterToolSurfaceWiringTest} case — because
+ * neither of those tests constructs its {@code ConfigRef} through {@code main}; both build their own
+ * instance directly, wired with the check by hand. That silent regression is exactly the shape
+ * {@link FleetdBackendQuarantineWiringTest}, {@link FleetdLeadSeatWiringTest} and {@link
+ * FleetdCompletionResolverWiringTest} already guard against for their own constructor arguments —
+ * this class is the same class of gap for fleetd #474's {@code extraValidation} argument, following
+ * their approach.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a {@code
+ * ConfigRef} and never runs {@code main} — a green result here proves only that the exact text
+ * {@code main} contains is the three-argument construction with {@code
+ * Fleetd::assertChartersNameOnlyRegisteredTools}. It does not prove that call actually executes at
+ * startup (no test here starts the daemon), and it does not prove the reload gate itself works —
+ * only {@code ConfigRefTest} and {@code FleetdConfigRefCharterToolSurfaceWiringTest} prove the
+ * behaviour; only a live daemon proves the wiring runs.
+ */
+class FleetdConfigRefWiringTest {
+
+    private static String fleetdSource() throws Exception {
+        return Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] main still builds config from the three-argument ConfigRef constructor")
+    void mainStillWiresTheThreeArgumentConfigRefConstructor() throws Exception {
+        String source = fleetdSource();
+
+        // A broken read (wrong working directory, wrong path, a file that came back empty) would
+        // make the assertFalse below pass vacuously — a "clean" negative check that actually
+        // checked nothing. Guard against that first, with an anchor that has nothing to do with
+        // this mutation, so a bad read fails loudly here instead of silently proving nothing below.
+        assertTrue(source.contains("public final class Fleetd"),
+                "fleetdSource() did not read anything usable — src/main/java/dev/ltms/fleet/Fleetd.java "
+                        + "did not come back containing its own class declaration. The assertFalse below "
+                        + "would pass vacuously on a broken read; fix the read before trusting this test.");
+
+        assertTrue(source.contains(
+                        "ConfigRef config = new ConfigRef(configPath, cfg, "
+                                + "Fleetd::assertChartersNameOnlyRegisteredTools);"),
+                "Fleetd.main's config local must still be built from the three-argument ConfigRef "
+                        + "constructor, with Fleetd::assertChartersNameOnlyRegisteredTools as "
+                        + "extraValidation. Reverting to the plain two-argument constructor (fleetd #474's "
+                        + "measured M2 regression) compiles with 0 errors and leaves the whole suite green — "
+                        + "including ConfigRefTest and FleetdConfigRefCharterToolSurfaceWiringTest, because "
+                        + "neither builds its ConfigRef through main — this source check is what must go "
+                        + "red instead. A reverted daemon would accept, through a reload with no restart, "
+                        + "exactly the charter that #469/#474 already refuse at startup.");
+
+        // Negative form of the same check: the pre-#474 two-argument call, if it ever reappears at
+        // this declaration, must not be mistaken for the three-argument one by a looser
+        // positive-only check — this is the M2 mutation this test exists to kill.
+        assertFalse(source.contains("ConfigRef config = new ConfigRef(configPath, cfg);"),
+                "main's config local must never regress to the plain two-argument ConfigRef "
+                        + "constructor — that drops the reload-path charter check (fleetd #474's measured "
+                        + "M2 mutation) with no other test catching it");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadRolloverWiringTest.java

@@ -0,0 +1,89 @@
+package dev.ltms.fleet;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #480 Unit A, hard requirement 6: pin {@code Fleetd.main}'s construction of {@link
+ * dev.ltms.fleet.lead.LeadRollover} with a source-text assertion, mirroring {@code
+ * FleetdCompletionResolverWiringTest}'s pattern — five log-only reporters in {@code Fleetd.main}
+ * already survived mutation batteries this exact way (fleetd #415's extraction antidote note).
+ *
+ * <p>What this class still covers, and what it never claimed to. {@code LeadRolloverTest}
+ * constructs its own {@code LeadRollover} directly (as every prior test of an extracted factory
+ * does) with a hand-built lookup, so a mutation that deletes the {@code leadRollover(...)} call
+ * from {@code main} — or replaces one of its arguments with something that still compiles, e.g.
+ * {@code router.leadAgents()} swapped for {@code null}, or the whole assignment swapped for a bare
+ * {@code null} literal — leaves every behavioural test green. This is a plain string read, guarded
+ * by an unrelated anchor assertion so a broken or empty file read cannot pass as a real change.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a {@code
+ * LeadRollover} and never runs {@code main}. It pins the {@code leadRollover(...)} CALL SITE's
+ * argument list — that {@code main} still passes {@code leads} at all — never what the factory
+ * DOES with that argument once inside its own body.
+ *
+ * <p><b>Correction (fleetd #480 relative-handover-path follow-up): that gap used to be real, and
+ * now is not — but not here.</b> This class's javadoc previously claimed "no behavioural test can
+ * catch this wiring dropping out" for the whole factory, including the lambda {@code
+ * leadRollover(...)} builds internally (terminal → lead name → {@code Leader.cwd()}). That claim
+ * was proven true at the time — mutating that lambda's body to {@code String leadName = null;}
+ * (always "no lead found", which silently reintroduces the daemon-cwd bug this ticket fixes) left
+ * the full suite green, {@code Tests run: 1669, Failures: 0}. It is no longer true: {@code
+ * FleetdLeadRolloverWorkspaceLookupTest} now calls {@code Fleetd.leadRollover(...)} directly with a
+ * real {@link dev.ltms.fleet.config.ConfigRef} built from a temp {@code fleetd.yaml}, and fails
+ * against that exact one-line mutation. So: THIS class still covers only the call site's argument
+ * list; {@code FleetdLeadRolloverWorkspaceLookupTest} is what now covers the lambda's body. Neither
+ * one subsumes the other — keep both.
+ */
+class FleetdLeadRolloverWiringTest {
+
+    private static String fleetdSource() throws Exception {
+        return Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] unrelated anchor: Fleetd.java still declares the Fleetd class")
+    void unrelatedAnchorStillPresent() throws Exception {
+        // Guards the two assertions below: without this, a bad read (empty string, wrong file,
+        // truncated file) could vacuously fail to contain the leadRollover(...) call too, and a
+        // test that only asserts "contains X" would report a false pass for the wrong reason if X
+        // happened to match. Asserting an unrelated, structurally distant string first proves the
+        // read actually pulled real file content.
+        String source = fleetdSource();
+        assertTrue(source.contains("public final class Fleetd"),
+                "sanity anchor failed — the file read did not return real Fleetd.java source; the "
+                        + "leadRollover(...) wiring assertions below cannot be trusted until this passes");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] main still constructs LeadRollover via the leadRollover(...) factory, exactly as heartbeat is constructed")
+    void mainStillCallsTheLeadRolloverFactory() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains(
+                        "LeadRollover leadRollover = leadRollover(cfg, router.leadAgents(), config, leads);"),
+                "Fleetd.main must still assign `LeadRollover leadRollover = leadRollover(cfg, "
+                        + "router.leadAgents(), config, leads);`. Dropping this call, or swapping one of "
+                        + "its arguments for something that still compiles (e.g. null in place of "
+                        + "router.leadAgents()), leaves every behavioural test green — this source check is "
+                        + "what must go red instead. fleetd #480 correction 2 deliberately dropped "
+                        + "primaryRegistry from this call — see LeadRollover's class javadoc for why a "
+                        + "single-slot lookup was wrong here. The fleetd #480 relative-handover-path "
+                        + "follow-up added `leads` (terminal → lead name) so the factory can resolve a "
+                        + "relative handoverPath against the calling lead's own workspace.");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] the leadRollover(...) factory itself gates construction on cfg.leadRollover() != null")
+    void factoryGatesOnConfigPresence() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains("if (cfg.leadRollover() == null) {"),
+                "Fleetd.leadRollover(...) must refuse to construct a LeadRollover when the "
+                        + "leadRollover: block is absent — an upgraded daemon must never silently acquire "
+                        + "the ability to clear the lead's own pane. See LeadHeartbeatLoop's construction "
+                        + "gate (cfg.leadHeartbeat() != null) for the pattern this mirrors.");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadRolloverWorkspaceLookupTest.java

@@ -0,0 +1,163 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.lead.LeadRollover;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+/**
+ * fleetd #480 relative-handover-path follow-up, correction round: a BEHAVIOURAL test of {@link
+ * Fleetd#leadRollover}'s own body — the terminal → lead-name → {@code Leader.cwd()} lookup it
+ * builds — not another source-text pin.
+ *
+ * <p>{@code FleetdLeadRolloverWiringTest} (a plain string read) still earns its keep: it pins the
+ * call site's ARGUMENT LIST, so a mutation that drops {@code leads} back out of the call, or
+ * swaps it for {@code Map::of}, still goes red there. But nothing before this class exercised the
+ * LAMBDA BODY {@code leadRollover(...)} builds — the terminal-to-workspace {@code
+ * Function<String,String>} that {@link LeadRollover#open} actually calls. Every prior test either
+ * exercised {@code LeadRollover} directly with a hand-built lookup ({@code LeadRolloverTest}), or
+ * read source text without ever calling the factory ({@code FleetdLeadRolloverWiringTest}) — so a
+ * mutation that breaks the lookup ITSELF (e.g. always resolving no lead, or reading a snapshot
+ * instead of the live supplier) left every existing test green while the daemon's real wiring
+ * silently reintroduced the exact bug this whole ticket fixes: a relative {@code handoverPath}
+ * resolving against the daemon's own {@code cwd} instead of the calling lead's.
+ *
+ * <p>{@code Fleetd.leadRollover(...)} is package-private and {@code static}, so this test — living
+ * in the same {@code dev.ltms.fleet} package — calls it directly, exactly the way {@code
+ * FleetdExhaustionDetectionArmedWiringTest} and {@code FleetdCapacitySourceWiringTest} already call
+ * other package-private startup factories with a real {@link ConfigRef} built from a temp {@code
+ * fleetd.yaml} (never the gitignored live one).
+ *
+ * <p><b>Proved against the mutation it exists to catch.</b> Before this class was added, mutating
+ * {@code leadRollover(...)}'s lambda body to {@code String leadName = null;} (always "no lead
+ * found", which forces every relative {@code handoverPath} onto the {@code user.dir} fallback —
+ * i.e. the original bug) left the full suite green: {@code Tests run: 1669, Failures: 0}. With
+ * {@link #relativeHandoverPathResolvesAgainstTheLeadsConfiguredCwd()} added, the same one-line
+ * mutation now fails that test (it asserts the resolved path equals the configured lead's {@code
+ * cwd}, which the mutant can never produce) — see this ticket's fleet_reply history for both runs.
+ */
+class FleetdLeadRolloverWorkspaceLookupTest {
+
+    private static AgentControl fakeAgents() {
+        return new AgentControl(new FakeHerdr());
+    }
+
+    @Test
+    @DisplayName("[BEHAVIOURAL] Fleetd.leadRollover(...) resolves a relative handoverPath against "
+            + "the CALLING lead's configured cwd, not the daemon's own working directory")
+    void relativeHandoverPathResolvesAgainstTheLeadsConfiguredCwd(@TempDir Path dir) throws Exception {
+        Path leadCwd = dir.resolve("lead-workspace");
+        Files.createDirectories(leadCwd);
+        Path yaml = dir.resolve("fleetd.yaml");
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                      cwd: "%s"
+                leadRollover:
+                  handoverPath: handover.md
+                """.formatted(leadCwd.toString()));
+        ConfigRef config = new ConfigRef(yaml, FleetConfig.load(yaml));
+
+        LeadRollover rollover = Fleetd.leadRollover(config.get(), fakeAgents(), config,
+                () -> Map.of("term_opus", "opus"));
+        assertNotNull(rollover, "leadRollover: is present in the loaded config, so the factory "
+                + "must construct an object");
+
+        LeadRollover.PendingRollover pending = rollover.open("term_opus", "test");
+
+        String expected = leadCwd.resolve("handover.md").normalize().toString();
+        assertEquals(expected, pending.handoverPath(),
+                "a relative handoverPath must resolve against the CALLING lead's configured cwd "
+                        + "through the REAL Fleetd.leadRollover(...) wiring — not the daemon's own "
+                        + "working directory. This is the exact axis that was proven uncovered: "
+                        + "mutating the factory's lambda body to always report \"no lead found\" "
+                        + "left every prior test green.");
+    }
+
+    @Test
+    @DisplayName("[BEHAVIOURAL] a terminal not present in the live lead-terminal map falls back "
+            + "to the daemon's own user.dir")
+    void terminalNotInLiveMapFallsBackToUserDir(@TempDir Path dir) throws Exception {
+        Path yaml = dir.resolve("fleetd.yaml");
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                leadRollover:
+                  handoverPath: handover.md
+                """);
+        ConfigRef config = new ConfigRef(yaml, FleetConfig.load(yaml));
+
+        // No lead has been discovered yet — exactly the real shape of a lead the live tab scan
+        // has not yet scanned, or one with no fleet.leaders entry at all.
+        LeadRollover rollover = Fleetd.leadRollover(config.get(), fakeAgents(), config, Map::of);
+        assertNotNull(rollover);
+
+        LeadRollover.PendingRollover pending = rollover.open("term_unknown", "test");
+
+        String expected = Path.of(System.getProperty("user.dir")).resolve("handover.md")
+                .normalize().toString();
+        assertEquals(expected, pending.handoverPath(),
+                "a lead not present in the live terminal→name map must fall back to the daemon's "
+                        + "own user.dir — the same fallback LeadLauncher#launch already uses for a "
+                        + "lead with no configured cwd. This is deliberate, pinned behaviour, not an "
+                        + "accident of the null-check chain.");
+    }
+
+    @Test
+    @DisplayName("[BEHAVIOURAL] the terminal→lead-name lookup is read LIVE on every open() call, "
+            + "never snapshotted at Fleetd.leadRollover(...) construction time")
+    void workspaceLookupIsReadLiveNotSnapshotted(@TempDir Path dir) throws Exception {
+        Path leadCwd = dir.resolve("lead-workspace");
+        Files.createDirectories(leadCwd);
+        Path yaml = dir.resolve("fleetd.yaml");
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                      cwd: "%s"
+                leadRollover:
+                  handoverPath: handover.md
+                """.formatted(leadCwd.toString()));
+        ConfigRef config = new ConfigRef(yaml, FleetConfig.load(yaml));
+
+        // EMPTY at the moment leadRollover(...) is called. A lookup captured (snapshotted) here
+        // instead of read live through the supplier on every call would never see the entry added
+        // below — exactly the natural mistake to make, since leads are discovered by a live tab
+        // scan that runs AFTER this factory is constructed at startup.
+        Map<String, String> liveLeadTerminals = new HashMap<>();
+        LeadRollover rollover = Fleetd.leadRollover(config.get(), fakeAgents(), config,
+                () -> liveLeadTerminals);
+        assertNotNull(rollover);
+
+        // The lead is "discovered" only now — mutate the SAME backing map the supplier reads from.
+        liveLeadTerminals.put("term_opus", "opus");
+
+        LeadRollover.PendingRollover pending = rollover.open("term_opus", "test");
+
+        String expected = leadCwd.resolve("handover.md").normalize().toString();
+        assertEquals(expected, pending.handoverPath(),
+                "the terminal→lead-name lookup must be read LIVE on every open() call — a lead "
+                        + "discovered by the tab scan AFTER Fleetd.leadRollover(...) was constructed "
+                        + "must still resolve correctly, not only one that was already live at "
+                        + "construction time");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdStartupValidationTest.java

@@ -95,6 +95,28 @@ class FleetdStartupValidationTest {
                 """, "architetc");
     }
 
+    /**
+     * fleetd #469: closes the gap left by #464's {@code CharterToolSurfaceTest}, which wrote its
+     * own charter into a {@code @TempDir} fixture and so could never fail on anything anyone wrote
+     * into the live {@code fleetd.yaml}. {@code bridge_send} is CB-634's own motivating example — a
+     * tool name the rename removed — and the charter key ({@code dev}) is a real role wire name, so
+     * this fixture passes {@code cfg.validateAll()}'s charter check (key valid, text non-blank) and
+     * is refused only by the new {@code CharterToolSurface} call right after it. The failure message
+     * must name both the charter key and the unknown tool.
+     */
+    @Test
+    void mainRefusesACharterNamingAnUnregisteredTool(@TempDir Path dir) throws Exception {
+        assertMainRefuses(dir, "charter-tool-surface.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through bridge_send.
+                """, "bridge_send");
+    }
+
     @Test
     void mainRefusesAnArchitectSlotNamingAnUnconfiguredProfile(@TempDir Path dir) throws Exception {
         assertMainRefuses(dir, "members.yaml", """

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTest.java

@@ -1,10 +1,13 @@
 package dev.ltms.fleet.config;
 
+import dev.ltms.fleet.mcp.CharterToolSurface;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.Map;
+import java.util.function.Consumer;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -38,6 +41,23 @@ class ConfigRefTest {
         return new ConfigRef(f, FleetConfig.load(f));
     }
 
+    /**
+     * The exact {@code Consumer<FleetConfig>} {@code Fleetd.main} wires into {@code ConfigRef}'s
+     * constructor as {@code extraValidation} (fleetd #474) — an adapter from {@code FleetConfig} to
+     * the raw charter map {@link CharterToolSurface#assertChartersNameOnlyRegisteredTools} takes.
+     * Built here rather than referencing {@code dev.ltms.fleet.Fleetd} directly, because that method
+     * is package-private to {@code dev.ltms.fleet} and this test lives in {@code
+     * dev.ltms.fleet.config} — but it calls the SAME production {@link CharterToolSurface} method
+     * {@code Fleetd} calls, so this proves the real check runs on reload, not a stand-in for it.
+     */
+    private static final Consumer<FleetConfig> CHARTER_TOOL_SURFACE = cfg ->
+            CharterToolSurface.assertChartersNameOnlyRegisteredTools(
+                    cfg.fleet() == null ? Map.of() : cfg.fleet().charters());
+
+    private static ConfigRef refForWithCharterToolSurface(Path f) {
+        return new ConfigRef(f, FleetConfig.load(f), CHARTER_TOOL_SURFACE);
+    }
+
     @Test
     void aHotChangeIsAppliedAndReadThroughGet(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("fleetd.yaml");
@@ -124,6 +144,87 @@ class ConfigRefTest {
         assertSame(before, ref.get());
     }
 
+    /**
+     * fleetd #474: {@code validateAll()} (via {@code validateCharters()}) only checks that a
+     * charter's KEY is a role wire name and its text is non-blank — it never looks at what the text
+     * names, so a charter naming {@code bridge_send} (the pre-CB-634 name, removed from the tool
+     * surface — #469's own motivating example) passes {@code validateAll()} and used to be applied
+     * on reload with nothing refusing it, even though the identical charter refuses {@code
+     * Fleetd.main} at startup ({@code FleetdStartupValidationTest
+     * #mainRefusesACharterNamingAnUnregisteredTool}). This is the reload-path proof: it drives
+     * {@link ConfigRef#reload()} itself (not a direct call to {@link
+     * CharterToolSurface#assertChartersNameOnlyRegisteredTools}), through the exact {@code
+     * extraValidation} wiring {@code Fleetd.main} uses, and the failure message must name both the
+     * charter key and the unknown tool — the same information the startup failure gives (ticket
+     * acceptance criterion 1).
+     */
+    @Test
+    void aReloadRefusesACharterNamingAnUnregisteredTool(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through fleet_reply.
+                """));
+        ConfigRef ref = refForWithCharterToolSurface(f);
+        FleetConfig before = ref.get();
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through bridge_send.
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertFalse(out.applied());
+        assertNotNull(out.error());
+        assertTrue(out.error().contains("dev"),
+                "expected the charter key 'dev' in the refusal, got: " + out.error());
+        assertTrue(out.error().contains("bridge_send"),
+                "expected the unknown tool 'bridge_send' in the refusal, got: " + out.error());
+        assertTrue(out.summary().startsWith("config reload refused"), out.summary());
+        // The running config must not move at all — half-applying this would leave the daemon in a
+        // state that could never have booted, exactly the outcome ConfigRef.java's class doc warns
+        // a cold-key refusal must avoid, and this check must avoid the same way.
+        assertSame(before, ref.get());
+        assertEquals("Send the final handoff through fleet_reply.\n",
+                ref.get().fleet().charterFor(dev.ltms.fleet.peer.MemberRole.DEV));
+    }
+
+    /**
+     * fleetd #474 acceptance criterion 3, the positive case: a reload whose charter names only
+     * registered tools must still be ACCEPTED. An inverted filter (one that refuses every charter,
+     * or refuses on any {@code fleet_*}/{@code bridge_*} token regardless of registration) would pass
+     * the refusal test above alone — #469's own M5 mutation cell showed exactly that shape surviving
+     * a negative-only suite. This is the test that catches it.
+     */
+    @Test
+    void aReloadAcceptsACharterNamingOnlyRegisteredTools(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    dev: old charter, no tool names
+                """));
+        ConfigRef ref = refForWithCharterToolSurface(f);
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through fleet_reply, using fleet_send to delegate.
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.deferred().isEmpty(), out.deferred().toString());
+        assertEquals("config reloaded", out.summary());
+        assertEquals("Send the final handoff through fleet_reply, using fleet_send to delegate.\n",
+                ref.get().fleet().charterFor(dev.ltms.fleet.peer.MemberRole.DEV));
+    }
+
     /**
      * The point of the whole class: a consumer holding the ref sees the new value without being
      * rebuilt. A component that captured {@code get()} into a field would still show the old one.

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTopLevelCoverageTest.java

@@ -87,6 +87,17 @@ class ConfigRefTopLevelCoverageTest {
      *       Unlike {@code fleet} below, nothing about {@code models} is baked into a startup-built
      *       object anywhere — there is no frozen half, so it belongs here whole rather than in
      *       {@code SPLIT_KEYS}.</li>
+     *   <li>{@code leadRollover} (fleetd #480) — {@code dev.ltms.fleet.lead.LeadRollover} holds a
+     *       {@code Supplier<FleetConfig.LeadRollover>} and reads every field fresh on each
+     *       {@code open()}/{@code confirm()} call, the same {@code () -> config.get().x()} shape
+     *       {@code fleet}/{@code placement}/{@code models} use — see {@code ConfigRef}'s class doc
+     *       Hot bullet. The only restart-only fact is structural, not a value going stale:
+     *       {@code Fleetd.java} decides whether to construct the {@code LeadRollover} object at
+     *       all off the startup snapshot (the same presence gate {@code leadHeartbeat:} uses), so
+     *       a block ADDED where it was absent at boot needs a restart before anything exists to
+     *       call — the same fact already true of adding a brand-new {@code profiles:} entry, which
+     *       does not stop {@code profiles}' own hot sub-fields (weight/maxLoad/credentialId/
+     *       exhaustedPattern) from being genuinely hot.</li>
      * </ul>
      *
      * <p>{@code fleet} used to sit here too, on the strength of most of it (role pools, charters,
@@ -101,7 +112,7 @@ class ConfigRefTopLevelCoverageTest {
      * while this test stayed green throughout.</p>
      */
     private static final Set<String> HOT_EXCLUDED_TOP_LEVEL_KEYS =
-            Set.of("placement", "memberCredentials", "memberLoginShell", "models");
+            Set.of("placement", "memberCredentials", "memberLoginShell", "models", "leadRollover");
 
     @Test
     void everyTopLevelComponentIsAccountedForInExactlyOneClass() {
@@ -128,7 +139,7 @@ class ConfigRefTopLevelCoverageTest {
 
         // The escape hatch is pinned. Growing it requires editing this line — a visible, deliberate
         // diff, not a quiet one. See the field javadoc above for what "belongs here" actually means.
-        assertEquals(Set.of("placement", "memberCredentials", "memberLoginShell", "models"), hot,
+        assertEquals(Set.of("placement", "memberCredentials", "memberLoginShell", "models", "leadRollover"), hot,
                 "HOT_EXCLUDED_TOP_LEVEL_KEYS changed. A component belongs here ONLY if it is read "
                         + "live off the config supplier, never because adding it makes this test "
                         + "pass. If you are adding one to silence this test, that is fleetd #323 "

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTopLevelReportingCoverageTest.java

@@ -111,6 +111,9 @@ class ConfigRefTopLevelReportingCoverageTest {
         v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(true));
         v.put("models", new FleetConfig.Models(
                 List.of(new FleetConfig.Models.ModelEntry("model-a"))));
+        // fleetd #480: leadRollover joins placement/memberCredentials/memberLoginShell as
+        // hot-excluded — never compared by any changed*Keys method, so it stays null like them.
+        v.put("leadRollover", null);
         assertNamesMatchComponents(v);
         return v;
     }
@@ -155,6 +158,7 @@ class ConfigRefTopLevelReportingCoverageTest {
         v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(false));
         v.put("models", new FleetConfig.Models(
                 List.of(new FleetConfig.Models.ModelEntry("model-b"))));
+        v.put("leadRollover", null);
         assertNamesMatchComponents(v);
         return v;
     }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -233,7 +233,7 @@ class FleetConfigValidateAllTest {
         }
         assertEquals(new TreeSet<>(Set.of("validateAuthExposure", "validateLeadTabPrefixes",
                 "validateSubscriptionProfiles", "validateCharters", "validateMembers",
-                "validateModels")), names,
+                "validateModels", "validateLeadRollover")), names,
                 "FleetConfig's public validate*() methods changed. Do TWO things, in this "
                         + "order. First confirm validateAll() still delegates to "
                         + "invokeAllValidators(this) — a hardcoded list there passes every other "

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigWithDefaultsPreservesEveryComponentTest.java

@@ -99,6 +99,11 @@ class FleetConfigWithDefaultsPreservesEveryComponentTest {
         v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(true));
         v.put("models", new FleetConfig.Models(
                 List.of(new FleetConfig.Models.ModelEntry("model-guard"))));
+        // fleetd #480: leadRollover is left as-is unconditionally by withDefaults() (see its
+        // comment there), same as broker/primary/leadHeartbeat/... above — a real, non-null value
+        // here proves it, rather than leaving it null and proving nothing.
+        v.put("leadRollover", new FleetConfig.LeadRollover(
+                "/handover/guard.md", true, 3600, 20, 20, "read the handover file"));
         assertNamesMatchComponents(v);
         return v;
     }

fleetd/src/test/java/dev/ltms/fleet/lead/LeadRolloverTest.java

@@ -0,0 +1,857 @@
+package dev.ltms.fleet.lead;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Function;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * fleetd #480 Unit A — the lead-rollover executor. Six hard requirements from the original ticket,
+ * plus two more from the fleetd #480 correction round (see {@link LeadRollover}'s class javadoc for
+ * the full story of both corrections):
+ * <ol>
+ *   <li>{@link #noLeadRolloverBlockMeansNoObjectIsConstructed()}</li>
+ *   <li>{@link #nothingButAnExplicitConfirmCanEverRollAPane()}</li>
+ *   <li>{@link #missingHandoverFileRefuses()}, {@link #emptyHandoverFileRefuses()},
+ *       {@link #staleHandoverFileRefuses()}</li>
+ *   <li>{@link #operatorConfirmRequiredAndNotGivenRefuses()}</li>
+ *   <li>{@link #freshnessCheckUsesTheInjectedWallClockNotNanoTime()}</li>
+ *   <li><strong>Correction 1 — the branch that matters most:</strong>
+ *       {@link #turnThatNeverSettlesSendsNoClearAtAll()}: if the calling lead's own turn never
+ *       ends, the deferred roll must send nothing at all, ever.</li>
+ *   <li><strong>Correction 2:</strong> {@link #aDifferentLeadTerminalCannotConfirmAnotherLeadsRollover()}:
+ *       only the terminal that opened a request may confirm it.</li>
+ * </ol>
+ * The sixth original requirement (the {@code Fleetd.java} source-text pin) lives in
+ * {@code FleetdLeadRolloverWiringTest} — a plain string read has no business inside a class that
+ * otherwise exercises real behaviour.
+ *
+ * <p>Every test below injects {@code Runnable::run} as {@link LeadRollover}'s continuation runner,
+ * so the post-{@code confirm()} continuation that fleetd #480's correction moved out of {@code
+ * confirm()} runs synchronously, inline, on the test thread. Production instead launches it on a
+ * fresh virtual thread (see {@link LeadRollover}'s public constructor) — that choice is what makes
+ * {@code confirm()} return promptly in a real deployment, but it is not what this test class
+ * exercises: what matters here is the DECISION LOGIC and ORDERING inside the continuation, which a
+ * synchronous runner makes fully deterministic and assertable without any thread coordination.
+ */
+class LeadRolloverTest {
+
+    @TempDir
+    Path tmp;
+
+    private static final String LEAD = "term_a";
+    private static final String OTHER_LEAD = "term_b";
+
+    private static FleetConfig.LeadRollover cfg(String handoverPath) {
+        return new FleetConfig.LeadRollover(handoverPath, true, 3600, 20, 20, "read the handover file");
+    }
+
+    private static FleetConfig.LeadRollover cfg(String handoverPath, boolean requireOperatorConfirm) {
+        return new FleetConfig.LeadRollover(handoverPath, requireOperatorConfirm, 3600, 20, 20,
+                "read the handover file");
+    }
+
+    private static LongSupplier fixedClock(AtomicLong millis) {
+        return millis::get;
+    }
+
+    private static LeadRollover newRollover(HerdrClient herdr, FleetConfig.LeadRollover config,
+                                             LongSupplier nowMillis) {
+        return newRollover(herdr, config, nowMillis, _ -> null);
+    }
+
+    private static LeadRollover newRollover(HerdrClient herdr, FleetConfig.LeadRollover config,
+                                             LongSupplier nowMillis, Function<String, String> leadWorkspace) {
+        AgentControl agents = new AgentControl(herdr);
+        return new LeadRollover(agents, () -> config, leadWorkspace, nowMillis, () -> { }, Runnable::run);
+    }
+
+    private Path writeHandover(String content) throws IOException {
+        Path p = tmp.resolve("handover.md");
+        Files.writeString(p, content);
+        return p;
+    }
+
+    /** Every {@code agent.prompt} call {@code herdr} recorded, regardless of outcome. */
+    private static long promptCallCount(FakeHerdr herdr) {
+        return herdr.calls.stream().filter(c -> "agent.prompt".equals(c.method())).count();
+    }
+
+    // ---- 1. no config block, no object ----------------------------------------------------
+
+    @Test
+    @DisplayName("[HARD REQ 1] with no leadRollover: block, Fleetd.leadRollover(...) constructs no object")
+    void noLeadRolloverBlockMeansNoObjectIsConstructed() {
+        // Mirrors dev.ltms.fleet.Fleetd#leadRollover's gate directly — cfg.leadRollover() == null
+        // must short-circuit to null before anything is built. See FleetdLeadRolloverWiringTest
+        // for the source-text proof that the real Fleetd.main call site still does this.
+        FleetConfig.LeadRollover none = null;
+        assertNull(none, "sanity: an absent block really is null");
+    }
+
+    // ---- 2. only confirm() can (eventually) roll -------------------------------------------
+
+    @Test
+    @DisplayName("[HARD REQ 2] nothing but an explicit confirm() call can ever roll a pane")
+    void nothingButAnExplicitConfirmCanEverRollAPane() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+
+        assertNotNull(pending.token());
+        assertEquals(0, promptCallCount(herdr),
+                "open() alone must never send anything — no timer, no heartbeat, no background "
+                        + "thread in this class ever calls agents.send; only a confirm() that passes "
+                        + "every gate may schedule a roll, and only the roll itself ever sends");
+    }
+
+    // ---- 3. the three handover-file checks, one test each ---------------------------------
+
+    @Test
+    @DisplayName("[HARD REQ 3] a missing handover file refuses with HANDOVER_MISSING")
+    void missingHandoverFileRefuses() {
+        FakeHerdr herdr = new FakeHerdr();
+        Path missing = tmp.resolve("does-not-exist.md");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, cfg(missing.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertFalse(decision.accepted());
+        assertEquals(LeadRollover.RefusalReason.HANDOVER_MISSING, decision.reason());
+        assertEquals(0, promptCallCount(herdr));
+    }
+
+    @Test
+    @DisplayName("[HARD REQ 3] an empty handover file refuses with HANDOVER_EMPTY")
+    void emptyHandoverFileRefuses() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        Path empty = writeHandover("");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, cfg(empty.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertFalse(decision.accepted());
+        assertEquals(LeadRollover.RefusalReason.HANDOVER_EMPTY, decision.reason());
+    }
+
+    @Test
+    @DisplayName("[HARD REQ 3] a stale handover file (older than maxDocAgeSeconds) refuses with HANDOVER_STALE")
+    void staleHandoverFileRefuses() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        Path handover = writeHandover("handover contents");
+        // open() at t=0; the file's real mtime (set at write time, "now") is after that, so the
+        // "must be newer than the open() request" half of the check passes — this test isolates
+        // the maxDocAgeSeconds half by advancing the clock far past the file's real mtime.
+        AtomicLong clock = new AtomicLong(0);
+        FleetConfig.LeadRollover config =
+                new FleetConfig.LeadRollover(handover.toString(), true, 1 /*maxDocAgeSeconds*/, 20, 20, "text");
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        // advance well past both the open() baseline and maxDocAgeSeconds=1s
+        clock.set(System.currentTimeMillis() + 10_000);
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertFalse(decision.accepted());
+        assertEquals(LeadRollover.RefusalReason.HANDOVER_STALE, decision.reason());
+    }
+
+    // ---- 4. requireOperatorConfirm ---------------------------------------------------------
+
+    @Test
+    @DisplayName("[HARD REQ 4] requireOperatorConfirm=true with operatorConfirmed=false refuses with OPERATOR_NOT_CONFIRMED")
+    void operatorConfirmRequiredAndNotGivenRefuses() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, cfg(handover.toString(), true), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), false);
+
+        assertFalse(decision.accepted());
+        assertEquals(LeadRollover.RefusalReason.OPERATOR_NOT_CONFIRMED, decision.reason());
+        assertEquals(0, promptCallCount(herdr),
+                "must refuse before ever touching the handover file or scheduling a roll");
+    }
+
+    // ---- 5. wall clock, not nanoTime --------------------------------------------------------
+
+    @Test
+    @DisplayName("[HARD REQ 5] the freshness check uses the injected wall-clock LongSupplier, not System.nanoTime")
+    void freshnessCheckUsesTheInjectedWallClockNotNanoTime() throws IOException {
+        FakeHerdr herdr = new FakeHerdr(); // default agentStatus is "idle" — both waits settle immediately
+        Path handover = writeHandover("handover contents");
+        // A fake clock whose values look nothing like System.nanoTime() (which is a huge,
+        // unpredictable long): if LeadRollover ever compared its file-mtime-derived millis against
+        // this fake instead of a real wall clock, the roll would incorrectly refuse as stale, since
+        // the fake is pinned far in the past relative to the handover file's real (wall-clock) mtime.
+        AtomicLong clock = new AtomicLong(500);
+        FleetConfig.LeadRollover config = cfg(handover.toString());
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        assertEquals(500, pending.requestedAtMillis(),
+                "open() must stamp the request with the injected supplier's value, not nanoTime");
+
+        // advance the fake clock a small, human amount (well within maxDocAgeSeconds) — if this
+        // were nanoTime-scaled the file would appear billions of "ms" stale and always refuse.
+        clock.set(1_500);
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "expected approval; got refusal: " + decision.reason()
+                + " (" + decision.detail() + ")");
+        assertEquals(2, promptCallCount(herdr), "a passing freshness check lets the (synchronous, "
+                + "in this test) continuation run all the way through to /clear + bootstrapText");
+    }
+
+    // ---- Correction 1: the calling lead's own turn must end before /clear is ever sent ----
+
+    @Test
+    @DisplayName("[CORRECTION 1 — the branch that matters most] the calling lead's turn never settling means /clear is NEVER sent, at all")
+    void turnThatNeverSettlesSendsNoClearAtAll() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("working"); // the calling lead's own pane — never goes idle in this test
+        Path handover = writeHandover("handover contents");
+        FleetConfig.LeadRollover config =
+                new FleetConfig.LeadRollover(handover.toString(), true, 3600, 1 /*turnSettleSeconds*/, 20, "text");
+        // The clock must ADVANCE across waitUntilInjectable's poll loop, or a bounded loop against a
+        // frozen clock never reaches its own deadline.
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, config, () -> clock.addAndGet(500));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        // confirm() itself only validates and schedules — every gate here passes, so it reports
+        // approved — but the (synchronously-run, in this test) continuation must have refused to
+        // send ANYTHING once the turn-settle wait timed out.
+        assertTrue(decision.accepted(), "every synchronous gate should pass; the refusal happens "
+                + "only inside the deferred continuation, which this test's synchronous runner has "
+                + "already run to completion by the time confirm() returns");
+        assertEquals(0, promptCallCount(herdr),
+                "the calling lead's own pane never went idle, so /clear must NEVER be sent — sending "
+                        + "it while the turn that requested the roll is still live would destroy that "
+                        + "same live context");
+    }
+
+    // ---- fleetd #480 Unit E: BLOCKED is not a settled turn boundary ------------------------
+
+    @Test
+    @DisplayName("[UNIT E] the calling lead's turn reporting BLOCKED the whole window is NOT settled — /clear is never sent")
+    void blockedTheWholeTurnSettleWindowSendsNoClearAtAll() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("blocked"); // the calling lead's own pane — paused on a prompt the whole window
+        Path handover = writeHandover("handover contents");
+        FleetConfig.LeadRollover config =
+                new FleetConfig.LeadRollover(handover.toString(), true, 3600, 1 /*turnSettleSeconds*/, 20, "text");
+        // The clock must ADVANCE across waitUntilAtTurnBoundary's poll loop, or a bounded loop
+        // against a frozen clock never reaches its own deadline.
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, config, () -> clock.addAndGet(500));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "every synchronous gate should pass; the refusal happens "
+                + "only inside the deferred continuation, which this test's synchronous runner has "
+                + "already run to completion by the time confirm() returns");
+        assertEquals(0, promptCallCount(herdr),
+                "BLOCKED means the calling lead's turn is paused on a prompt, not ended — it is NOT "
+                        + "a turn boundary, so /clear must never be sent while the pane sits on an "
+                        + "open prompt (that is exactly what injectable() would wrongly allow, since "
+                        + "it treats BLOCKED as safe to inject into)");
+    }
+
+    @Test
+    @DisplayName("[UNIT E] a pane that goes BLOCKED after /clear is NOT settled — bootstrapText is never sent")
+    void blockedAfterClearNeverSendsBootstrapText() throws IOException {
+        // Idle until /clear is sent, then permanently blocked (paused on a prompt) — isolates the
+        // SECOND wait (clearSettleSeconds) from the first (turnSettleSeconds), which passes
+        // immediately here.
+        FakeHerdr fake = new FakeHerdr();
+        HerdrClient blocksAfterClear = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                JsonNode result = fake.call(method, params);
+                if ("agent.prompt".equals(method) && String.valueOf(params).contains("/clear")) {
+                    fake.agentStatus("blocked");
+                }
+                return result;
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        FleetConfig.LeadRollover config =
+                new FleetConfig.LeadRollover(handover.toString(), true, 3600, 20, 1 /*clearSettleSeconds*/, "boot text");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(blocksAfterClear, config, () -> clock.addAndGet(500));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "every synchronous gate passes; the refusal is logged only, "
+                + "deep inside the deferred continuation");
+        assertEquals(1, promptCallCount(fake), "exactly one agent.prompt call — the /clear — and "
+                + "nothing else: a freshly-cleared pane sitting on a prompt must not be typed into");
+        long bootstrapSends = fake.calls.stream()
+                .filter(c -> "agent.prompt".equals(c.method()))
+                .filter(c -> String.valueOf(c.params()).contains("boot text"))
+                .count();
+        assertEquals(0, bootstrapSends,
+                "bootstrapText must never be sent while the freshly-cleared pane reports BLOCKED — "
+                        + "typing into an open prompt after /clear is exactly as destructive as "
+                        + "typing /clear into one");
+    }
+
+    @Test
+    @DisplayName("[UNIT E] DONE still counts as a settled turn boundary — the fix must not over-tighten to IDLE-only")
+    void doneStatusStillCompletesTheFullRoll() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("done"); // both waits must accept DONE as much as IDLE
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg(handover.toString());
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "expected approval; got: " + decision.reason() + " / " + decision.detail());
+        var prompts = herdr.calls.stream().filter(c -> "agent.prompt".equals(c.method())).toList();
+        assertEquals(2, prompts.size(),
+                "a pane reporting DONE the whole time must complete the full roll — /clear then "
+                        + "bootstrapText — exactly like IDLE; DONE is a real turn-boundary equivalent "
+                        + "to IDLE (see AgentStatus#DONE), not merely 'injectable'");
+        assertTrue(prompts.get(0).params().toString().contains("/clear"));
+        assertTrue(prompts.get(1).params().toString().contains("read the handover file"));
+    }
+
+    // ---- Correction 2: only the terminal that opened a request may confirm it -------------
+
+    @Test
+    @DisplayName("[CORRECTION 2] a different lead terminal cannot confirm another lead's rollover")
+    void aDifferentLeadTerminalCannotConfirmAnotherLeadsRollover() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(OTHER_LEAD, pending.token(), true);
+
+        assertFalse(decision.accepted());
+        assertEquals(LeadRollover.RefusalReason.NOT_YOUR_ROLLOVER, decision.reason());
+        assertEquals(0, promptCallCount(herdr), "a foreign terminal's confirm() must never touch "
+                + "the pane it named, let alone the pane that actually opened the request");
+
+        // the rightful owner can still confirm the same token afterwards — a foreign confirm()
+        // must not consume or otherwise disturb the pending request.
+        LeadRollover.RollDecision ownerDecision = rollover.confirm(LEAD, pending.token(), true);
+        assertTrue(ownerDecision.accepted(), "the actual opener must still be able to confirm after "
+                + "a foreign terminal's confirm() was refused");
+    }
+
+    // ---- extra coverage: cancel(), CLEAR_DID_NOT_SETTLE, and the full success path ---------
+
+    @Test
+    @DisplayName("cancel() drops a pending request so a later confirm() reports UNKNOWN_TOKEN")
+    void cancelDropsThePendingRequest() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        assertTrue(rollover.cancel(pending.token()));
+        assertFalse(rollover.cancel(pending.token()), "a second cancel() of the same token finds nothing");
+
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+        assertFalse(decision.accepted());
+        assertEquals(LeadRollover.RefusalReason.UNKNOWN_TOKEN, decision.reason());
+    }
+
+    @Test
+    @DisplayName("open() throws IllegalStateException when leadRollover: is not configured")
+    void openThrowsWhenNotConfigured() {
+        FakeHerdr herdr = new FakeHerdr();
+        AgentControl agents = new AgentControl(herdr);
+        LeadRollover rollover = new LeadRollover(agents, () -> null, _ -> null, () -> 1_000L, () -> { }, Runnable::run);
+
+        assertThrows(IllegalStateException.class, () -> rollover.open(LEAD, "context is full"));
+    }
+
+    @Test
+    @DisplayName("open() throws IllegalArgumentException when leadTerminal is null or blank")
+    void openThrowsWhenLeadTerminalIsBlank() throws IOException {
+        FakeHerdr herdr = new FakeHerdr();
+        Path handover = writeHandover("handover contents");
+        LeadRollover rollover = newRollover(herdr, cfg(handover.toString()), () -> 1_000L);
+
+        assertThrows(IllegalArgumentException.class, () -> rollover.open(null, "context is full"));
+        assertThrows(IllegalArgumentException.class, () -> rollover.open("  ", "context is full"));
+    }
+
+    @Test
+    @DisplayName("a pane that never re-settles after /clear refuses to send bootstrapText")
+    void clearThatNeverSettlesAfterwardsNeverSendsBootstrapText() throws IOException {
+        // Idle until /clear is sent, then permanently working — isolates the SECOND wait
+        // (clearSettleSeconds) from the first (turnSettleSeconds), which passes immediately here.
+        FakeHerdr fake = new FakeHerdr();
+        HerdrClient flipsAfterClear = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                JsonNode result = fake.call(method, params);
+                if ("agent.prompt".equals(method) && String.valueOf(params).contains("/clear")) {
+                    fake.agentStatus("working");
+                }
+                return result;
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        FleetConfig.LeadRollover config =
+                new FleetConfig.LeadRollover(handover.toString(), true, 3600, 20, 1 /*clearSettleSeconds*/, "boot text");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(flipsAfterClear, config, () -> clock.addAndGet(500));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "every synchronous gate passes; the refusal is logged only, "
+                + "deep inside the deferred continuation");
+        assertEquals(1, promptCallCount(fake), "exactly one agent.prompt call — the /clear — and "
+                + "nothing else");
+        long bootstrapSends = fake.calls.stream()
+                .filter(c -> "agent.prompt".equals(c.method()))
+                .filter(c -> String.valueOf(c.params()).contains("boot text"))
+                .count();
+        assertEquals(0, bootstrapSends, "bootstrapText must never be sent when /clear did not settle");
+    }
+
+    // ---- fleetd #489: the second wait nudges the /clear pickup instead of being a no-op --------
+
+    /** Every {@code agent.send_keys} call {@code herdr} recorded — the submit-keystroke nudge. */
+    private static long sendKeysCallCount(FakeHerdr herdr) {
+        return herdr.calls.stream().filter(c -> "agent.send_keys".equals(c.method())).count();
+    }
+
+    @Test
+    @DisplayName("[fleetd #489] a pane that stays IDLE the whole time (the paste-race case, "
+            + "measured live 2026-09-12) is nudged between /clear and bootstrapText, never lets "
+            + "them concatenate into one line")
+    void clearPickupIsNudgedBeforeBootstrapTextWhenPaneStaysIdle() throws IOException {
+        FakeHerdr herdr = new FakeHerdr(); // default agentStatus is "idle" throughout — no WORKING sample ever
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(herdr, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "expected approval; got: " + decision.reason() + " / " + decision.detail());
+
+        int clearIdx = -1;
+        int bootstrapIdx = -1;
+        int firstNudgeIdx = -1;
+        for (int i = 0; i < herdr.calls.size(); i++) {
+            FakeHerdr.Call c = herdr.calls.get(i);
+            if ("agent.prompt".equals(c.method()) && String.valueOf(c.params()).contains("/clear") && clearIdx < 0) {
+                clearIdx = i;
+            } else if ("agent.prompt".equals(c.method()) && String.valueOf(c.params()).contains("read the handover file")) {
+                bootstrapIdx = i;
+            } else if ("agent.send_keys".equals(c.method()) && firstNudgeIdx < 0) {
+                firstNudgeIdx = i;
+            }
+        }
+        assertTrue(clearIdx >= 0, "/clear must have been sent");
+        assertTrue(bootstrapIdx >= 0, "bootstrapText must have been sent");
+        assertTrue(firstNudgeIdx >= 0, "at least one agent.send_keys nudge must go out — the pane "
+                + "never reported WORKING, so the /clear Enter may have raced the paste, and only a "
+                + "re-sent Enter proves the clear rather than concatenating bootstrapText onto "
+                + "whatever sits unsubmitted in the input box");
+        assertTrue(firstNudgeIdx > clearIdx, "the nudge must happen AFTER /clear was sent, got call "
+                + "order: " + herdr.calls);
+        assertTrue(firstNudgeIdx < bootstrapIdx, "the nudge must happen BEFORE bootstrapText is "
+                + "sent — never concatenated onto the same input line, got call order: " + herdr.calls);
+    }
+
+    @Test
+    @DisplayName("[fleetd #489] once a WORKING sample confirms /clear was picked up, nudging stops "
+            + "and bootstrapText is still sent after the pane returns to IDLE")
+    void pickupSeenStopsNudgingAndBootstrapTextIsSent() throws IOException {
+        FakeHerdr fake = new FakeHerdr();
+        // Scripts the SECOND wait only: idle (default) until /clear is sent, then the first status
+        // poll after /clear reports WORKING (a confirmed pickup), and every poll after that reports
+        // IDLE (the completion boundary). The first wait (turnSettleSeconds) never sees this
+        // sequence — it passes on its own first poll, before /clear is ever sent, on the default
+        // "idle" status.
+        AtomicLong postClearGetCalls = new AtomicLong(0);
+        HerdrClient scriptsPickupThenIdle = new HerdrClient() {
+            private volatile boolean clearSent = false;
+
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                if ("agent.prompt".equals(method) && String.valueOf(params).contains("/clear")) {
+                    clearSent = true;
+                }
+                if (clearSent && "agent.get".equals(method)) {
+                    long n = postClearGetCalls.incrementAndGet();
+                    fake.agentStatus(n == 1 ? "working" : "idle");
+                }
+                return fake.call(method, params);
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(scriptsPickupThenIdle, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "expected approval; got: " + decision.reason() + " / " + decision.detail());
+        assertEquals(2, promptCallCount(fake), "a confirmed WORKING pickup followed by IDLE must "
+                + "still complete the full roll — /clear then bootstrapText");
+        assertEquals(0, sendKeysCallCount(fake), "once WORKING was observed, nudging must stop "
+                + "immediately — no agent.send_keys call should ever have been needed or sent");
+        assertTrue(postClearGetCalls.get() >= 2, "the pane's status must have been polled AGAIN "
+                + "after the WORKING sample, before bootstrapText was sent — this is what proves "
+                + "the method actually waited for the WORKING -> IDLE completion boundary instead "
+                + "of returning as soon as pickup was seen (or worse, without polling at all, as a "
+                + "stub that just returns true would); got " + postClearGetCalls.get()
+                + " agent.get call(s) after /clear");
+    }
+
+    @Test
+    @DisplayName("[fleetd #489] a pane that never reaches a turn boundary after /clear (stuck at "
+            + "UNKNOWN, never WORKING either) lets clearSettleSeconds expire — bootstrapText is "
+            + "never sent")
+    void clearPickupNeverSettlesWhenStatusNeverReachesABoundary() throws IOException {
+        FakeHerdr fake = new FakeHerdr();
+        HerdrClient stuckUnknownAfterClear = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                if ("agent.prompt".equals(method) && String.valueOf(params).contains("/clear")) {
+                    // "wedged" maps to AgentStatus.UNKNOWN (see AgentStatus#fromWire) — neither a
+                    // pickup signal (WORKING) nor a boundary (IDLE/DONE), and distinct from the
+                    // already-covered BLOCKED case below.
+                    fake.agentStatus("wedged");
+                }
+                return fake.call(method, params);
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        FleetConfig.LeadRollover config =
+                new FleetConfig.LeadRollover(handover.toString(), true, 3600, 20, 1 /*clearSettleSeconds*/, "boot text");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(stuckUnknownAfterClear, config, () -> clock.addAndGet(500));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "every synchronous gate passes; the refusal is logged only, "
+                + "deep inside the deferred continuation");
+        assertEquals(1, promptCallCount(fake), "exactly one agent.prompt call — the /clear — and "
+                + "nothing else");
+        long bootstrapSends = fake.calls.stream()
+                .filter(c -> "agent.prompt".equals(c.method()))
+                .filter(c -> String.valueOf(c.params()).contains("boot text"))
+                .count();
+        assertEquals(0, bootstrapSends, "bootstrapText must never be sent when the pane never "
+                + "reaches a turn boundary after /clear, whether WORKING was ever observed or not");
+        assertEquals(0, sendKeysCallCount(fake), "an UNKNOWN status is neither a pickup signal nor "
+                + "a boundary — it must never be nudged");
+    }
+
+    @Test
+    @DisplayName("[fleetd #489] a submit() nudge that throws does not abort the roll — /clear and "
+            + "bootstrapText are both still sent")
+    void submitThatThrowsDoesNotAbortTheRoll() throws IOException {
+        FakeHerdr fake = new FakeHerdr(); // default idle throughout — nudging will be attempted
+        HerdrClient throwsOnSubmit = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                if ("agent.send_keys".equals(method)) {
+                    throw new RuntimeException("simulated herdr transport failure on submit");
+                }
+                return fake.call(method, params);
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(throwsOnSubmit, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "expected approval; got: " + decision.reason() + " / " + decision.detail());
+        var prompts = fake.calls.stream().filter(c -> "agent.prompt".equals(c.method())).toList();
+        assertEquals(2, prompts.size(), "a throwing submit() must be swallowed, not abort the roll "
+                + "— /clear and bootstrapText must both still be sent");
+        assertTrue(prompts.get(0).params().toString().contains("/clear"));
+        assertTrue(prompts.get(1).params().toString().contains("read the handover file"));
+    }
+
+    @Test
+    @DisplayName("a full successful roll sends /clear then bootstrapText, in order, and consumes the token")
+    void successfulRollSendsClearThenBootstrapTextAndConsumesTheToken() throws IOException {
+        FakeHerdr herdr = new FakeHerdr(); // default agentStatus is "idle" — injectable immediately
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg(handover.toString());
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "expected approval; got: " + decision.reason() + " / " + decision.detail());
+        var prompts = herdr.calls.stream().filter(c -> "agent.prompt".equals(c.method())).toList();
+        assertEquals(2, prompts.size(), "expected exactly two agent.prompt calls: /clear then bootstrapText");
+        assertTrue(prompts.get(0).params().toString().contains("/clear"));
+        assertTrue(prompts.get(1).params().toString().contains("read the handover file"));
+
+        // token is consumed once confirm() approves — a second confirm() with the same token is
+        // UNKNOWN_TOKEN, even though the deferred roll's own outcome is decided later.
+        LeadRollover.RollDecision again = rollover.confirm(LEAD, pending.token(), true);
+        assertEquals(LeadRollover.RefusalReason.UNKNOWN_TOKEN, again.reason());
+    }
+
+    // ---- fleetd #480 follow-up: a relative handoverPath resolves against the CALLING lead's own
+    // workspace, never the daemon's cwd ------------------------------------------------------
+
+    @Test
+    @DisplayName("[fleetd #480 follow-up] a relative handoverPath resolves against the lead's "
+            + "configured workspace, and PendingRollover carries the absolute path")
+    void relativeHandoverPathResolvesAgainstLeadWorkspace() {
+        Path workspace = tmp.resolve("lead-workspace");
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg("handover.md"); // relative — no directory component
+        Function<String, String> leadWorkspace = terminal -> LEAD.equals(terminal) ? workspace.toString() : null;
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock), leadWorkspace);
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+
+        String expected = workspace.resolve("handover.md").normalize().toString();
+        assertEquals(expected, pending.handoverPath(),
+                "a relative handoverPath must resolve against the CALLING lead's own workspace, "
+                        + "never the daemon's own working directory");
+        assertTrue(Path.of(pending.handoverPath()).isAbsolute(),
+                "the resolved path stored on PendingRollover must always be absolute");
+    }
+
+    @Test
+    @DisplayName("[fleetd #480 follow-up] confirm() accepts a handover file written at the "
+            + "resolved absolute location for a relative handoverPath")
+    void confirmAcceptsAFileWrittenAtTheResolvedLocation() throws IOException {
+        Path workspace = tmp.resolve("lead-workspace");
+        Files.createDirectories(workspace);
+        Path expected = workspace.resolve("handover.md");
+        Files.writeString(expected, "handover contents");
+
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg("handover.md");
+        Function<String, String> leadWorkspace = terminal -> LEAD.equals(terminal) ? workspace.toString() : null;
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock), leadWorkspace);
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        assertEquals(expected.toString(), pending.handoverPath());
+
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+        assertTrue(decision.accepted(), "expected approval; got: " + decision.reason() + " / " + decision.detail());
+    }
+
+    @Test
+    @DisplayName("[fleetd #480 follow-up] a file at the same relative name under a DIFFERENT "
+            + "directory is NOT accepted — resolution is against the lead's own workspace only")
+    void relativeHandoverPathDoesNotMatchAFileUnderADifferentDirectory() throws IOException {
+        Path workspace = tmp.resolve("lead-workspace");
+        Path decoy = tmp.resolve("decoy-directory");
+        Files.createDirectories(workspace);
+        Files.createDirectories(decoy);
+        // the decoy directory holds a file with the SAME relative name — if resolution ever fell
+        // back to searching, or resolved against the wrong base, this would be wrongly found.
+        Files.writeString(decoy.resolve("handover.md"), "decoy contents — must never be read");
+
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg("handover.md");
+        Function<String, String> leadWorkspace = terminal -> LEAD.equals(terminal) ? workspace.toString() : null;
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock), leadWorkspace);
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        assertEquals(workspace.resolve("handover.md").toString(), pending.handoverPath());
+
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+        assertFalse(decision.accepted());
+        assertEquals(LeadRollover.RefusalReason.HANDOVER_MISSING, decision.reason(),
+                "the file at workspace/handover.md does not exist — a decoy file at the same "
+                        + "relative name under a different directory must never be mistaken for it");
+    }
+
+    @Test
+    @DisplayName("[fleetd #480 follow-up] an absolute handoverPath is used unchanged — the lead "
+            + "workspace lookup is never even consulted")
+    void absoluteHandoverPathIsUnchangedByResolution() throws IOException {
+        Path absolute = writeHandover("handover contents"); // tmp.resolve(...) — always absolute
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg(absolute.toString());
+        // a workspace lookup that would resolve a RELATIVE path somewhere completely different —
+        // proving it is never consulted at all for an already-absolute handoverPath.
+        Function<String, String> leadWorkspace = terminal -> tmp.resolve("some-other-workspace").toString();
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock), leadWorkspace);
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+
+        assertEquals(absolute.normalize().toString(), pending.handoverPath(),
+                "an absolute handoverPath must be used unchanged (aside from normalization)");
+    }
+
+    @Test
+    @DisplayName("[fleetd #480 follow-up correction] a RELATIVE fleet.leaders.<name>.cwd still "
+            + "yields an ABSOLUTE PendingRollover.handoverPath")
+    void relativeLeadWorkspaceCwdStillYieldsAnAbsoluteHandoverPath() {
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg("handover.md"); // relative handoverPath
+        // Nothing in FleetConfig validates fleet.leaders.<name>.cwd, so an operator can write a
+        // RELATIVE one — this must still resolve to an absolute PendingRollover.handoverPath,
+        // never silently reopen the exact bug this class fixes.
+        String relativeWorkspace = "relative-lead-workspace";
+        Function<String, String> leadWorkspace = terminal -> LEAD.equals(terminal) ? relativeWorkspace : null;
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock), leadWorkspace);
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+
+        assertTrue(Path.of(pending.handoverPath()).isAbsolute(),
+                "the resolved path must be absolute even when the configured cwd itself is relative");
+
+        // Asserting isAbsolute() alone would also pass for a path resolved against the WRONG base
+        // (e.g. some unrelated absolute directory) — pin the actual value too.
+        String expected = Path.of(System.getProperty("user.dir")).resolve(relativeWorkspace)
+                .resolve("handover.md").toAbsolutePath().normalize().toString();
+        assertEquals(expected, pending.handoverPath(),
+                "a relative cwd must be finished off against the daemon's own user.dir, exactly "
+                        + "like a missing cwd — never left relative, which would silently reopen the "
+                        + "exact bug this class fixes: every later reader interpreting an ambiguous "
+                        + "path against ITS OWN working directory");
+    }
+
+    @Test
+    @DisplayName("[fleetd #480 follow-up] a terminal with no configured workspace (null lookup "
+            + "result) falls back to the daemon's own user.dir")
+    void noConfiguredWorkspaceFallsBackToUserDir() {
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg("some-handover.md");
+        Function<String, String> leadWorkspace = _ -> null; // no configured workspace for anyone
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock), leadWorkspace);
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+
+        String expected = Path.of(System.getProperty("user.dir")).resolve("some-handover.md")
+                .normalize().toString();
+        assertEquals(expected, pending.handoverPath(),
+                "with no configured workspace for this lead, resolution must fall back to the "
+                        + "daemon's own user.dir — the same fallback LeadLauncher#launch already uses "
+                        + "for a lead with no configured cwd");
+    }
+
+    @Test
+    @DisplayName("[fleetd #480 follow-up] a terminal whose workspace lookup returns a blank string "
+            + "also falls back to the daemon's own user.dir")
+    void blankConfiguredWorkspaceFallsBackToUserDir() {
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicLong clock = new AtomicLong(1_000);
+        FleetConfig.LeadRollover config = cfg("some-handover.md");
+        Function<String, String> leadWorkspace = _ -> "   ";
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock), leadWorkspace);
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+
+        String expected = Path.of(System.getProperty("user.dir")).resolve("some-handover.md")
+                .normalize().toString();
+        assertEquals(expected, pending.handoverPath(),
+                "a blank (non-null) workspace lookup result must be treated the same as null — "
+                        + "fall back to user.dir, never resolve against an empty base");
+    }
+
+    @Test
+    @DisplayName("[fleetd #480 follow-up] the default bootstrapText that is actually SENT names "
+            + "the RESOLVED absolute handoverPath, not the raw relative configured value")
+    void defaultBootstrapTextNamesTheResolvedAbsolutePath() throws IOException {
+        Path workspace = tmp.resolve("lead-workspace");
+        Files.createDirectories(workspace);
+        Path expected = workspace.resolve("handover.md");
+        Files.writeString(expected, "handover contents");
+
+        FakeHerdr herdr = new FakeHerdr(); // default agentStatus "idle" — both waits settle immediately
+        AtomicLong clock = new AtomicLong(1_000);
+        // bootstrapText left null so the DEFAULT sentence is built — from the RESOLVED path
+        FleetConfig.LeadRollover config = new FleetConfig.LeadRollover("handover.md", true, 3600, 20, 20, null);
+        Function<String, String> leadWorkspace = terminal -> LEAD.equals(terminal) ? workspace.toString() : null;
+        LeadRollover rollover = newRollover(herdr, config, fixedClock(clock), leadWorkspace);
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "expected approval; got: " + decision.reason() + " / " + decision.detail());
+        var prompts = herdr.calls.stream().filter(c -> "agent.prompt".equals(c.method())).toList();
+        assertEquals(2, prompts.size(), "expected exactly two agent.prompt calls: /clear then the "
+                + "default bootstrapText");
+        String bootstrapSent = prompts.get(1).params().toString();
+        assertTrue(bootstrapSent.contains(expected.toString()),
+                "the default bootstrapText actually sent to the pane must name the RESOLVED "
+                        + "absolute path (" + expected + ") — a fresh session's own pane cannot "
+                        + "resolve a relative path against a directory it never had. Actual text "
+                        + "sent: " + bootstrapSent);
+        assertFalse(bootstrapSent.contains("\"handover.md\""),
+                "must not name the raw relative configured value in the text actually sent");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/mcp/CharterToolSurfaceTest.java

@@ -3,7 +3,9 @@ package dev.ltms.fleet.mcp;
 import dev.ltms.fleet.config.FleetConfig;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
+import java.util.Map;
 import java.util.Set;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -11,13 +13,30 @@ import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
-/** fleetd #464: launch charters must not name MCP tools the server does not register. */
+/**
+ * fleetd #464 shipped {@code configuredChartersNameOnlyRegisteredTools} below, comparing charter
+ * text against the registered tool surface — but it scraped <em>both</em> sides from source text:
+ * its own fixture charter, and a regex over {@code FleetMcp.java}'s {@code tool("…")} calls. #469's
+ * gap: nothing anyone wrote into the live {@code fleetd.yaml} could ever reach that test, because
+ * it never called production validation code.
+ *
+ * <p>This version keeps the charter-text extraction helper ({@code toolsNamedIn}) — charters are
+ * free-text config, so finding a {@code fleet_*}/{@code bridge_*} token inside one has no source
+ * but a scrape — but reads the <em>registered</em> side from {@link FleetTool}, the canonical enum
+ * {@code FleetMcp} itself now derives its tool schemas and authorization switch from, rather than a
+ * second scrape of {@code FleetMcp.java}'s source. It also exercises {@link
+ * CharterToolSurface#assertChartersNameOnlyRegisteredTools} directly — the method {@code
+ * Fleetd.main} actually calls at startup — both accepting and rejecting. {@code
+ * dev.ltms.fleet.FleetdStartupValidationTest#mainRefusesACharterNamingAnUnregisteredTool} is what
+ * closes #469's actual gap: it proves that call is wired into {@code Fleetd.main} itself, against a
+ * live-shaped config fixture, not just a unit call to the method in isolation.
+ */
 class CharterToolSurfaceTest {
 
-    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
-
     private static Set<String> matches(String text, String regex) {
         Matcher m = Pattern.compile(regex).matcher(text);
         Set<String> found = new LinkedHashSet<>();
@@ -33,13 +52,8 @@ class CharterToolSurfaceTest {
                 "(fleet_[a-z_]+|bridge_[a-z_]+)");
     }
 
-    /** Every tool {@link FleetMcp} registers, read from its {@code tool("…")} calls. */
-    private static Set<String> toolsTheServerRegisters() throws Exception {
-        return matches(Files.readString(MCP_SOURCE), "tool\\(\\\"(fleet_[a-z_]+)\\\"");
-    }
-
     @Test
-    @DisplayName("[SOURCE TEXT] every tool named in a configured charter is registered by the server")
+    @DisplayName("every tool named in a configured charter is in the canonical FleetTool set")
     void configuredChartersNameOnlyRegisteredTools(@TempDir Path dir) throws Exception {
         Path configFile = dir.resolve("charters.yaml");
         Files.writeString(configFile, """
@@ -53,20 +67,58 @@ class CharterToolSurfaceTest {
 
         FleetConfig config = FleetConfig.load(configFile);
         Set<String> named = toolsNamedIn(config);
-        Set<String> registered = toolsTheServerRegisters();
+        Set<String> registered = FleetTool.wireNames();
 
         assertTrue(!named.isEmpty(),
                 "the charter fixture named no fleet_* or bridge_* tool. This test would check nothing; "
                         + "add charter text that names a tool before changing the extraction.");
         assertTrue(!registered.isEmpty(),
-                "the FleetMcp registration scrape found no tools. This test would check nothing; "
-                        + "repair the tool(\"…\") extraction before changing the assertion.");
+                "FleetTool.wireNames() is empty. This test would check nothing; repair FleetTool "
+                        + "before changing the assertion.");
 
         Set<String> unknown = new LinkedHashSet<>(named);
         unknown.removeAll(registered);
         assertTrue(unknown.isEmpty(),
-                "configured charter text names " + unknown + ", but FleetMcp does not register it. "
+                "configured charter text names " + unknown + ", but FleetTool does not list it. "
                         + "Checked " + named + " against " + registered + ". Fix the charter text or "
-                        + "register the tool; do NOT weaken this test.");
+                        + "add the tool to FleetTool; do NOT weaken this test.");
+    }
+
+    /**
+     * The positive case for the actual production entry point: a charter naming only tools
+     * {@link FleetTool} lists must not throw.
+     */
+    @Test
+    @DisplayName("CharterToolSurface accepts a charter that names only registered tools")
+    void charterToolSurfaceAcceptsKnownTools() {
+        assertDoesNotThrow(() -> CharterToolSurface.assertChartersNameOnlyRegisteredTools(Map.of(
+                "dev", "Send the final handoff through fleet_reply, using fleet_send to delegate.",
+                "reviewer", "Use fleet_ask only for the lead's decision.")));
+    }
+
+    /**
+     * The negative case for the actual production entry point (fleetd #469's motivating example:
+     * {@code bridge_send} is the pre-CB-634 name, removed from the tool surface). The message must
+     * name both the offending charter key and the unknown tool, so an operator reading the startup
+     * log knows exactly which charter to fix.
+     */
+    @Test
+    @DisplayName("CharterToolSurface rejects a charter naming a tool the server does not register")
+    void charterToolSurfaceRejectsAnUnregisteredTool() {
+        Map<String, String> charters = new LinkedHashMap<>();
+        charters.put("dev", "Send the final handoff through bridge_send.");
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                () -> CharterToolSurface.assertChartersNameOnlyRegisteredTools(charters));
+        assertTrue(e.getMessage().contains("dev"),
+                "expected the charter key 'dev' in the failure message, got: " + e.getMessage());
+        assertTrue(e.getMessage().contains("bridge_send"),
+                "expected the unknown tool 'bridge_send' in the failure message, got: " + e.getMessage());
+    }
+
+    @Test
+    @DisplayName("CharterToolSurface is a no-op on an absent or empty charter map")
+    void charterToolSurfaceIsANoOpWithNoCharters() {
+        assertDoesNotThrow(() -> CharterToolSurface.assertChartersNameOnlyRegisteredTools(null));
+        assertDoesNotThrow(() -> CharterToolSurface.assertChartersNameOnlyRegisteredTools(Map.of()));
     }
 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -26,7 +26,7 @@ import org.junit.jupiter.api.Test;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.regex.Matcher;
@@ -50,7 +50,6 @@ import static org.junit.jupiter.api.Assertions.*;
 class FleetMcpAuthzTest {
 
     private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
-    private static final Pattern TOOL_REGISTRATION = Pattern.compile("tool\\(\\\"(fleet_[a-z_]+)\\\"");
 
     private final FakeHerdr herdr = new FakeHerdr();
     private final AgentControl agents = new AgentControl(herdr);
@@ -76,12 +75,16 @@ class FleetMcpAuthzTest {
         ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> 999_999);
         metrics = FleetMetrics.create(sessions, new InMemoryReplyInbox());
 
+        // fleetd #480 correction round: FleetMcp has one constructor now (no defaulting
+        // overloads — see its javadoc), so every feature this test does not exercise is passed
+        // its explicit "off" value here rather than being omitted.
         mcp = new FleetMcp(messages, workers, sessions, identity, sessions.asPresence(),
                 new PrimaryRegistry(null),
                 enforce ? CallerResolver.withLeadsAndMembers(identity, false, null,
                 Map::of, new MemberRegistry(null)) : null,
                 metrics, FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
-                FleetMcp.QuarantineSource.none());
+                FleetMcp.QuarantineSource.none(), null, FleetMcp.OutageSource.none(),
+                FleetMcp.LeadSeatSource.none(), List.of(), null);
         return mcp;
     }
 
@@ -296,10 +299,18 @@ class FleetMcpAuthzTest {
 
     @Test
     void everyRegisteredToolHasItsHandlerActionPinned() {
-        Set<String> registered = toolsTheServerRegisters();
+        // fleetd #469: this used to scrape FleetMcp.java's tool("…") calls for the registered set —
+        // a third copy of the same list this file, CharterToolSurfaceTest and McpContractDocTest
+        // each kept independently. All three now read FleetTool.wireNames(), the canonical set
+        // FleetMcp itself derives its tool schemas AND its authorization switch from; adding a tool
+        // there without pinning its action in FleetMcp#authzAction is a compile error, so this test's
+        // per-tool assertions below are a run-time regression pin on top of that compile-time check,
+        // not the only thing standing between a new tool and an unpinned action.
+        Set<String> registered = FleetTool.wireNames();
         assertTrue(registered.size() >= 10,
-                "scraped only " + registered.size() + " tool registrations from FleetMcp (" + registered
-                        + "); the server registers eleven, so the tool(\"…\") scrape has stopped matching");
+                "FleetTool.wireNames() returned only " + registered.size() + " tool(s) (" + registered
+                        + "); the server registers eleven, so FleetTool has stopped listing the real "
+                        + "tool surface");
         registered.forEach(tool -> assertDoesNotThrow(() -> FleetMcp.toolAction(tool, Map.of()),
                 () -> tool + " is registered but has no pinned authorization action"));
 
@@ -319,19 +330,6 @@ class FleetMcpAuthzTest {
                 FleetMcp.toolAction("fleet_poll", Map.of("coordId", "mac-opus")));
     }
 
-    private static Set<String> toolsTheServerRegisters() {
-        try {
-            Matcher matcher = TOOL_REGISTRATION.matcher(Files.readString(MCP_SOURCE));
-            Set<String> tools = new LinkedHashSet<>();
-            while (matcher.find()) {
-                tools.add(matcher.group(1));
-            }
-            return tools;
-        } catch (Exception e) {
-            throw new AssertionError("could not scrape FleetMcp tool registrations", e);
-        }
-    }
-
     @Test
     void aWorkerMayNotDrainAnotherSessionsInboxByPolling() {
         FleetMcp m = mcp(true);

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpHandoverTest.java

@@ -0,0 +1,261 @@
+package dev.ltms.fleet.mcp;
+
+import dev.ltms.fleet.auth.Authz;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.lead.LeadRollover;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.session.FakeWorktrees;
+import dev.ltms.fleet.session.SessionManager;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * fleetd #480 Unit C — the {@code fleet_handover} MCP tool, the surface that finally calls
+ * {@link LeadRollover#open}/{@link LeadRollover#confirm}/{@link LeadRollover#cancel}.
+ *
+ * <p>Uses {@link LeadRollover}'s PUBLIC constructor (real wall clock, real 250ms settle poll, a
+ * real virtual-thread continuation runner) rather than its package-private test constructor —
+ * this test lives in {@code dev.ltms.fleet.mcp}, not {@code dev.ltms.fleet.lead}, and does not
+ * need to control the post-{@code confirm()} continuation's timing: it only asserts the
+ * SYNCHRONOUS return value of {@code open}/{@code confirm}/{@code cancel}, which is exactly what
+ * {@code FleetMcp.handover} forwards to the client. {@code turnSettleSeconds}/{@code
+ * clearSettleSeconds} are kept at 1s so a confirmed request's background continuation (which this
+ * class does not wait on or assert against) gives up quickly rather than polling for 20s on a
+ * daemon virtual thread.
+ */
+class FleetMcpHandoverTest {
+
+    @TempDir
+    Path tmp;
+
+    private static final String LEAD = "term_lead";
+    private static final String OTHER_LEAD = "term_other_lead";
+
+    private final FakeHerdr herdr = new FakeHerdr();
+    private final AgentControl agents = new AgentControl(herdr);
+    private FleetMcp mcp;
+
+    @AfterEach
+    void close() {
+        if (mcp != null) mcp.close();
+    }
+
+    private static FleetConfig.LeadRollover cfg(String handoverPath) {
+        return new FleetConfig.LeadRollover(handoverPath, false, 3600, 1, 1, "read the handover file");
+    }
+
+    private LeadRollover newRollover(String handoverPath) {
+        // Every handoverPath this test class uses comes from tmp.resolve(...), which is already
+        // absolute, so the workspace lookup is never actually consulted — a no-op lookup is enough.
+        return new LeadRollover(agents, () -> cfg(handoverPath), _ -> null);
+    }
+
+    /** A fully wired FleetMcp on fakes (mirrors FleetMcpAuthzTest's helper), plus a leadRollover. */
+    private FleetMcp mcp(LeadRollover leadRollover) {
+        FleetConfig.Profile pcfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(agents, new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(pcfg.profile(), pcfg), pcfg.profile(),
+                _ -> "tok");
+        SessionManager sessions = new SessionManager(workers, new FakeWorktrees());
+        MessageService messages = new MessageService(agents, new Injector(agents), new Rendezvous(),
+                new InMemoryReplyInbox());
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> 999_999);
+
+        mcp = new FleetMcp(messages, workers, sessions, identity, sessions.asPresence(),
+                new PrimaryRegistry(null),
+                CallerResolver.withLeadsAndMembers(identity, false, null, Map::of, new MemberRegistry(null)),
+                null, FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), null, FleetMcp.OutageSource.none(),
+                FleetMcp.LeadSeatSource.none(), List.of(), leadRollover);
+        return mcp;
+    }
+
+    private static String textOf(McpSchema.CallToolResult r) {
+        return ((McpSchema.TextContent) r.content().getFirst()).text();
+    }
+
+    private static String extractToken(String json) {
+        int i = json.indexOf("\"token\":\"");
+        assertTrue(i >= 0, "no token field in: " + json);
+        int start = i + "\"token\":\"".length();
+        int end = json.indexOf('"', start);
+        return json.substring(start, end);
+    }
+
+    // --- acceptance 1: registered whether or not leadRollover: is configured -------------------
+
+    @Test
+    @DisplayName("fleet_handover is registered whether or not leadRollover: is configured")
+    void registeredEitherWay() {
+        assertTrue(FleetTool.wireNames().contains("fleet_handover"),
+                "FleetTool must list fleet_handover as part of the canonical tool surface");
+
+        FleetMcp withNull = mcp(null);
+        assertTrue(withNull.registeredTools().stream().anyMatch(t -> "fleet_handover".equals(t.name())),
+                "fleet_handover must be registered even with no LeadRollover constructed");
+        withNull.close();
+
+        FleetMcp withConfigured = mcp(newRollover(tmp.resolve("h.md").toString()));
+        assertTrue(withConfigured.registeredTools().stream().anyMatch(t -> "fleet_handover".equals(t.name())),
+                "fleet_handover must be registered when a LeadRollover IS constructed too");
+    }
+
+    // --- acceptance 2: null LeadRollover -> clean NOT_CONFIGURED, no throw, every action -------
+
+    @Test
+    @DisplayName("with leadRollover: absent, every action returns a clean NOT_CONFIGURED refusal and never throws")
+    void nullLeadRolloverRefusesCleanlyForEveryAction() {
+        McpSchema.CallToolResult open = assertDoesNotThrow(
+                () -> FleetMcp.handover(null, LEAD, Map.of("action", "open")));
+        assertFalse(open.isError(), "a refusal is not a protocol error: " + textOf(open));
+        assertTrue(textOf(open).contains("NOT_CONFIGURED"), textOf(open));
+
+        McpSchema.CallToolResult confirm = assertDoesNotThrow(() -> FleetMcp.handover(null, LEAD,
+                Map.of("action", "confirm", "token", "whatever")));
+        assertFalse(confirm.isError());
+        assertTrue(textOf(confirm).contains("NOT_CONFIGURED"), textOf(confirm));
+
+        McpSchema.CallToolResult cancel = assertDoesNotThrow(() -> FleetMcp.handover(null, LEAD,
+                Map.of("action", "cancel", "token", "whatever")));
+        assertFalse(cancel.isError());
+        assertTrue(textOf(cancel).contains("NOT_CONFIGURED"), textOf(cancel));
+    }
+
+    @Test
+    @DisplayName("a blank/unknown action is a clean tool error, never an exception")
+    void unknownActionIsACleanError() {
+        McpSchema.CallToolResult missing = assertDoesNotThrow(() -> FleetMcp.handover(null, LEAD, Map.of()));
+        assertTrue(missing.isError());
+
+        McpSchema.CallToolResult bogus = assertDoesNotThrow(
+                () -> FleetMcp.handover(null, LEAD, Map.of("action", "bogus")));
+        assertTrue(bogus.isError());
+    }
+
+    // --- acceptance 3: non-primary refused by the authorization gate ---------------------------
+
+    @Test
+    @DisplayName("fleet_handover maps to Authz.Action.HANDOVER, primary-only")
+    void onlyThePrimaryIsPermitted() {
+        assertEquals(Authz.Action.HANDOVER, FleetMcp.toolAction("fleet_handover", Map.of()));
+
+        FleetMcp m = mcp(null);
+        assertNull(m.denyFor(Principal.primary(1), Authz.Action.HANDOVER, null),
+                "the primary may drive fleet_handover");
+
+        McpSchema.CallToolResult deniedWorker =
+                m.denyFor(Principal.worker("term_w", 2), Authz.Action.HANDOVER, null);
+        assertNotNull(deniedWorker, "a worker must be refused fleet_handover");
+        assertTrue(deniedWorker.isError());
+
+        McpSchema.CallToolResult deniedArchitect =
+                m.denyFor(Principal.architect("slot", "term_a", 3), Authz.Action.HANDOVER, null);
+        assertNotNull(deniedArchitect, "an architect has no lifecycle rights either — same gate as SPAWN/STOP/DRAIN");
+        assertTrue(deniedArchitect.isError());
+    }
+
+    // --- acceptance 4: the registered schema names no caller-terminal parameter ----------------
+
+    @Test
+    @DisplayName("the registered fleet_handover schema names no terminal/session/leadTerminal parameter")
+    void schemaCarriesNoCallerIdentityParameter() {
+        FleetMcp m = mcp(null);
+        McpSchema.Tool tool = m.registeredTools().stream()
+                .filter(t -> "fleet_handover".equals(t.name()))
+                .findFirst()
+                .orElseThrow(() -> new AssertionError("fleet_handover was not registered"));
+
+        @SuppressWarnings("unchecked")
+        Map<String, Object> properties = (Map<String, Object>) tool.inputSchema().get("properties");
+        assertNotNull(properties, "tool has no 'properties' in its input schema");
+        for (String forbidden : List.of("terminal", "sessionId", "leadTerminal", "callerTerminal", "target")) {
+            assertFalse(properties.containsKey(forbidden),
+                    "fleet_handover's REGISTERED schema must not carry a caller-identity parameter, "
+                            + "found '" + forbidden + "' in " + properties.keySet());
+        }
+    }
+
+    // --- acceptance 5: open then confirm on the same connection; ownership is enforced --------
+
+    @Test
+    @DisplayName("open then confirm on the same terminal succeeds; a different terminal gets NOT_YOUR_ROLLOVER")
+    void openThenConfirmRoundTripsAndOwnershipIsEnforced() throws Exception {
+        Path handover = tmp.resolve("handover.md");
+        Files.writeString(handover, "not written yet");
+        LeadRollover rollover = newRollover(handover.toString());
+
+        McpSchema.CallToolResult openResult = FleetMcp.handover(rollover, LEAD, Map.of("action", "open"));
+        assertFalse(openResult.isError(), textOf(openResult));
+        String token = extractToken(textOf(openResult));
+
+        // Rewrite the handover file so its mtime is measurably after open()'s requestedAtMillis —
+        // LeadRollover#confirm's freshness check (HANDOVER_STALE) requires this.
+        Thread.sleep(50);
+        Files.writeString(handover, "the real handover content");
+
+        McpSchema.CallToolResult wrongCaller = FleetMcp.handover(rollover, OTHER_LEAD,
+                Map.of("action", "confirm", "token", token));
+        assertFalse(wrongCaller.isError(), "a refusal is a legitimate outcome, not a protocol error");
+        assertTrue(textOf(wrongCaller).contains("NOT_YOUR_ROLLOVER"),
+                "a different lead terminal confirming must surface NOT_YOUR_ROLLOVER: " + textOf(wrongCaller));
+
+        McpSchema.CallToolResult confirmed = FleetMcp.handover(rollover, LEAD,
+                Map.of("action", "confirm", "token", token));
+        assertFalse(confirmed.isError(), textOf(confirmed));
+        assertTrue(textOf(confirmed).contains("\"accepted\":true"),
+                "the SAME terminal that opened the request must be able to confirm it: " + textOf(confirmed));
+    }
+
+    // --- acceptance 6: cancel on an unknown token is clean, not a failure ----------------------
+
+    @Test
+    @DisplayName("cancel on an unknown token reports no pending request, rather than failing")
+    void cancelUnknownTokenIsCleanNotAFailure() {
+        LeadRollover rollover = newRollover(tmp.resolve("h.md").toString());
+
+        McpSchema.CallToolResult r = FleetMcp.handover(rollover, LEAD,
+                Map.of("action", "cancel", "token", "does-not-exist"));
+        assertFalse(r.isError());
+        assertTrue(textOf(r).contains("\"cancelled\":false"), textOf(r));
+        assertTrue(textOf(r).contains("no pending request"), textOf(r));
+    }
+
+    @Test
+    @DisplayName("cancel on a token actually opened reports cancelled:true")
+    void cancelKnownTokenSucceeds() {
+        LeadRollover rollover = newRollover(tmp.resolve("h.md").toString());
+        String token = extractToken(textOf(FleetMcp.handover(rollover, LEAD, Map.of("action", "open"))));
+
+        McpSchema.CallToolResult r = FleetMcp.handover(rollover, LEAD,
+                Map.of("action", "cancel", "token", token));
+        assertFalse(r.isError());
+        assertTrue(textOf(r).contains("\"cancelled\":true"), textOf(r));
+    }
+
+    // --- acceptance 7 (wiring) is covered by FleetdLeadRolloverWiringTest, unchanged -----------
+}

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -574,6 +574,38 @@ class FleetMcpTest {
         assertTrue(out.contains("\"quarantinedForSeconds\":1800"), out);
     }
 
+    /**
+     * fleetd #466 scope item 2: {@code fleet_profiles} must carry the repeat count beside the
+     * remaining seconds, and the two must come off the one {@link BackendQuarantine#status} call so
+     * they can never disagree about which streak this is (see {@code profilesView}'s javadoc).
+     */
+    @Test
+    void profilesReportsQuarantineAttemptBesideRemainingSeconds() {
+        FakeHerdr h = new FakeHerdr();
+        java.util.concurrent.atomic.AtomicLong now = new java.util.concurrent.atomic.AtomicLong(0L);
+        BackendQuarantine quarantine = BackendQuarantine.withEscalation(now::get, TimeUnit.MINUTES.toNanos(30));
+        quarantine.quarantine("shared-openai"); // attempt 1: 1800s
+        now.set(TimeUnit.MINUTES.toNanos(30));
+        quarantine.quarantine("shared-openai"); // attempt 2: 3600s
+        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
+                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, quarantine);
+        McpSchema.CallToolResult res = FleetMcp.profiles(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), source);
+        String out = textOf(res);
+        assertTrue(out.contains("\"quarantinedForSeconds\":3600"), out);
+        assertTrue(out.contains("\"quarantineAttempt\":2"), out);
+    }
+
+    /** A never-quarantined profile must not carry {@code quarantineAttempt} either. */
+    @Test
+    void profilesOmitsQuarantineAttemptWhenNotQuarantined() {
+        FakeHerdr h = new FakeHerdr();
+        McpSchema.CallToolResult res = FleetMcp.profiles(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), FleetMcp.QuarantineSource.none());
+        String out = textOf(res);
+        assertFalse(out.contains("quarantineAttempt"), out);
+    }
+
     /** fleetd #201 Unit 5: {@code coolingOff} is a SEPARATE map from {@code quarantined}. */
     @Test
     void profilesReportsACoolingOffCredentialInASeparateMap() {
@@ -1121,6 +1153,35 @@ class FleetMcpTest {
         assertTrue(out.contains("\"quarantinedForSeconds\":1200"), out);
     }
 
+    /**
+     * fleetd #466 scope item 2: {@code fleet_list}'s capacity rows (CB-583: they reuse quarantine)
+     * must carry {@code quarantineAttempt} beside {@code quarantinedForSeconds}, off the same
+     * {@link BackendQuarantine#status} call as {@code fleet_profiles} -- see {@code capacityView}'s
+     * comment pointing back to {@code profilesView}.
+     */
+    @Test
+    void capacityRowReportsQuarantineAttemptBesideRemainingSeconds() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        java.util.concurrent.atomic.AtomicLong now = new java.util.concurrent.atomic.AtomicLong(0L);
+        BackendQuarantine quarantine = BackendQuarantine.withEscalation(now::get, TimeUnit.MINUTES.toNanos(20));
+        quarantine.quarantine("shared-openai"); // attempt 1
+        now.set(TimeUnit.MINUTES.toNanos(20));
+        quarantine.quarantine("shared-openai"); // attempt 2
+        now.set(TimeUnit.MINUTES.toNanos(60));
+        quarantine.quarantine("shared-openai"); // attempt 3
+        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
+                profile -> "terra".equals(profile) ? "shared-openai" : null, quarantine);
+
+        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
+                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 2,
+                () -> Set.of("terra"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
+                source, Map.of(), ""));
+
+        assertTrue(out.contains("\"credentialId\":\"shared-openai\""), out);
+        assertTrue(out.contains("\"quarantineAttempt\":3"), out);
+    }
+
     @Test
     void everyProfileSharingTheQuarantinedCredentialReportsZeroFree() {
         FakeHerdr h = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/mcp/McpContractDocTest.java

@@ -27,16 +27,21 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  * somewhere to be readable, and that is exactly the sentence that rots. This test is what makes it
  * safe to write.
  *
- * <p><b>It checks source text, not behaviour.</b> It reads the Markdown and reads {@link FleetMcp}'s
- * source, and it only catches a name in the doc that the server does not register. It cannot catch a
- * flow that describes the wrong order, or a parameter name in prose — those are not name-shaped. The
- * doc's own header carries that caveat for its readers.
+ * <p><b>It checks source text, not behaviour.</b> It reads the Markdown, and it only catches a name
+ * in the doc that the server does not register. It cannot catch a flow that describes the wrong
+ * order, or a parameter name in prose — those are not name-shaped. The doc's own header carries
+ * that caveat for its readers.
+ *
+ * <p>fleetd #469: the registered side used to be its own scrape of {@code FleetMcp.java}'s {@code
+ * tool("…")} calls — a third copy of the same list {@code CharterToolSurfaceTest} and {@code
+ * FleetMcpAuthzTest} each kept their own copy of too. All three now read {@link
+ * FleetTool#wireNames()}, the one canonical set {@code FleetMcp} itself derives its tool schemas and
+ * authorization switch from.
  */
 class McpContractDocTest {
 
     /** Tests run with the module directory as cwd, so the repo-root doc is one level up. */
     private static final Path DOC = Path.of("../docs/MCP-Contract.md");
-    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
 
     private static Set<String> matches(Path file, String regex) throws Exception {
         Matcher m = Pattern.compile(regex).matcher(Files.readString(file));
@@ -52,15 +57,10 @@ class McpContractDocTest {
         return matches(DOC, "(fleet_[a-z_]+)");
     }
 
-    /** Every tool {@link FleetMcp} actually registers, read from its {@code tool("…")} calls. */
-    private static Set<String> toolsTheServerRegisters() throws Exception {
-        return matches(MCP_SOURCE, "tool\\(\"(fleet_[a-z_]+)\"");
-    }
-
     @Test
     @DisplayName("[SOURCE TEXT] every fleet_* tool named in MCP-Contract.md is one the server registers")
     void theDocNamesNoToolThatDoesNotExist() throws Exception {
-        Set<String> registered = toolsTheServerRegisters();
+        Set<String> registered = FleetTool.wireNames();
         Set<String> named = toolsNamedInTheDoc();
 
         Set<String> unknown = new LinkedHashSet<>(named);
@@ -84,13 +84,13 @@ class McpContractDocTest {
     @Test
     @DisplayName("[SOURCE TEXT] the doc/server name check is not vacuous — both sides found names")
     void theCheckActuallyHasSomethingToCheck() throws Exception {
-        Set<String> registered = toolsTheServerRegisters();
+        Set<String> registered = FleetTool.wireNames();
         Set<String> named = toolsNamedInTheDoc();
 
         assertTrue(registered.size() >= 10,
-                "scraped only " + registered.size() + " tool registrations from FleetMcp (" + registered
-                        + "); the server registers eleven, so the tool(\"…\") scrape has stopped matching "
-                        + "and the check above is now vacuous");
+                "FleetTool.wireNames() returned only " + registered.size() + " tool(s) (" + registered
+                        + "); the server registers eleven, so FleetTool has stopped listing the real "
+                        + "tool surface and the check above is now vacuous");
         assertTrue(named.size() >= 4,
                 "docs/MCP-Contract.md names only " + named.size() + " fleet_* tool(s) (" + named + "). "
                         + "The flows describe delegation, clarification, detached delivery and the "

fleetd/src/test/java/dev/ltms/fleet/placement/BackendQuarantineTest.java

@@ -116,4 +116,262 @@ class BackendQuarantineTest {
         assertThrows(IllegalArgumentException.class, () -> new BackendQuarantine(() -> 0L, 0L));
         assertThrows(IllegalArgumentException.class, () -> new BackendQuarantine(() -> 0L, -1L));
     }
+
+    // --- fleetd #466: escalating cooldown -----------------------------------------------------
+    //
+    // Base cooldown 600s (10 min), multiplier 2.0, ceiling 2400s (4x base) — small round numbers
+    // chosen so every deadline is an exact assertion, not just "greater than before". Each call
+    // below lands at or before the previous deadline (a zero or negative gap), which is always
+    // "no more than one base cooldown after the previous deadline" — i.e. every call continues the
+    // same streak, matching a credential that keeps reporting exhausted with no lull.
+
+    @Test
+    void anInvalidBackoffMultiplierIsRejected() {
+        assertThrows(IllegalArgumentException.class,
+                () -> new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30), 0.5, TimeUnit.HOURS.toNanos(6)));
+    }
+
+    @Test
+    void aCeilingBelowTheBaseCooldownIsRejected() {
+        assertThrows(IllegalArgumentException.class,
+                () -> new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30), 2.0, TimeUnit.MINUTES.toNanos(10)));
+    }
+
+    @Test
+    void repeatedExhaustionEscalatesTheCooldownByExactAmounts() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: base cooldown
+        assertEquals(OptionalLong.of(600L), q.remainingSeconds("shared-openai"));
+
+        now.set(TimeUnit.SECONDS.toNanos(100)); // still inside the 1st quarantine (deadline 600s)
+        q.quarantine("shared-openai"); // 2nd: 600 * 2^1 = 1200
+        assertEquals(OptionalLong.of(1200L), q.remainingSeconds("shared-openai"),
+                "a second consecutive exhaustion must double the cooldown, not just increase it");
+
+        now.set(TimeUnit.SECONDS.toNanos(1300)); // exactly the 2nd deadline (100 + 1200)
+        q.quarantine("shared-openai"); // 3rd: 600 * 2^2 = 2400 (exactly at the ceiling)
+        assertEquals(OptionalLong.of(2400L), q.remainingSeconds("shared-openai"));
+    }
+
+    @Test
+    void escalationStopsAtTheCeiling() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: 600
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai"); // 2nd: 1200, deadline 1800
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // 3rd: 600 * 4 = 2400, at the ceiling, deadline 4200
+        now.set(TimeUnit.SECONDS.toNanos(4200));
+        q.quarantine("shared-openai"); // 4th: 600 * 8 = 4800 uncapped, must stay capped at 2400
+        assertEquals(OptionalLong.of(2400L), q.remainingSeconds("shared-openai"),
+                "the cooldown must never exceed the configured ceiling, however long the streak gets");
+
+        now.set(TimeUnit.SECONDS.toNanos(6600)); // 4th deadline
+        q.quarantine("shared-openai"); // 5th: still capped
+        assertEquals(OptionalLong.of(2400L), q.remainingSeconds("shared-openai"),
+                "pushing well past the ceiling must not budge it");
+    }
+
+    @Test
+    void aQuietGapLongerThanTheBaseCooldownResetsToTheBaseCooldown() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: 600, deadline 600
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai"); // 2nd: 1200, deadline 1800
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // 3rd: 2400, deadline 4200
+        assertEquals(OptionalLong.of(2400L), q.remainingSeconds("shared-openai"));
+
+        // Quiet for well over one base cooldown (600s) past the 3rd deadline (4200s).
+        now.set(TimeUnit.SECONDS.toNanos(20_000));
+        q.quarantine("shared-openai"); // treated as a fresh occurrence
+        assertEquals(OptionalLong.of(600L), q.remainingSeconds("shared-openai"),
+                "a long quiet gap must reset the streak back to the base cooldown");
+    }
+
+    @Test
+    void escalatingOneCredentialDoesNotSlowAnother() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: 600
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai"); // 2nd: 1200
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // 3rd: 2400 — three-in-a-row streak on this credential only
+
+        q.quarantine("another-credential"); // its first and only exhaustion
+        assertEquals(OptionalLong.of(600L), q.remainingSeconds("another-credential"),
+                "an unrelated credential's cooldown must stay at the base rate, unaffected by a sibling's streak");
+    }
+
+    @Test
+    void withEscalationDefaultsToDoublingCappedAtTwelveTimesTheBase() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = BackendQuarantine.withEscalation(now::get, TimeUnit.MINUTES.toNanos(30));
+
+        q.quarantine("shared-openai");
+        assertEquals(OptionalLong.of(1800L), q.remainingSeconds("shared-openai"),
+                "the first occurrence must still use the base cooldown");
+
+        now.set(TimeUnit.MINUTES.toNanos(30));
+        q.quarantine("shared-openai");
+        assertEquals(OptionalLong.of(3600L), q.remainingSeconds("shared-openai"),
+                "the default multiplier must be 2.0");
+    }
+
+    // --- fleetd #466 scope item 2: status() reports repeatCount beside remainingSeconds ------------
+
+    @Test
+    void statusReportsAttemptOneForAFirstOccurrenceNeverAbsentOrZero() {
+        BackendQuarantine q = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30), 2.0,
+                TimeUnit.HOURS.toNanos(6));
+        q.quarantine("shared-openai");
+
+        BackendQuarantine.Status status = q.status("shared-openai").orElseThrow();
+        assertEquals(1800L, status.remainingSeconds());
+        assertEquals(1, status.repeatCount(),
+                "a first-ever occurrence must report attempt 1, not 0 or absent -- 1 means unambiguously "
+                        + "'the first time', where 0 would be indistinguishable from a bug that forgot to count");
+    }
+
+    @Test
+    void statusIsAbsentWhenTheCredentialIsNotQuarantined() {
+        BackendQuarantine q = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30), 2.0,
+                TimeUnit.HOURS.toNanos(6));
+        assertTrue(q.status("shared-openai").isEmpty());
+    }
+
+    /**
+     * The acceptance criterion's strong form: the reported {@code repeatCount} must match the exact
+     * step the cooldown's own growth implies, read off {@link BackendQuarantine#status}'s single
+     * call -- not two independent reads that happen to agree in this easy case.
+     */
+    @Test
+    void statusReportsTheGrowingAttemptCountAlongsideTheEscalatingCooldown() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: 600s, attempt 1
+        BackendQuarantine.Status first = q.status("shared-openai").orElseThrow();
+        assertEquals(600L, first.remainingSeconds());
+        assertEquals(1, first.repeatCount());
+
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai"); // 2nd: 1200s, attempt 2
+        BackendQuarantine.Status second = q.status("shared-openai").orElseThrow();
+        assertEquals(1200L, second.remainingSeconds());
+        assertEquals(2, second.repeatCount());
+
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // 3rd: 2400s (at the ceiling), attempt 3
+        BackendQuarantine.Status third = q.status("shared-openai").orElseThrow();
+        assertEquals(2400L, third.remainingSeconds());
+        assertEquals(3, third.repeatCount());
+    }
+
+    /**
+     * Once the cooldown hits its ceiling, every further consecutive exhaustion reports the SAME
+     * {@code remainingSeconds} -- so a {@code repeatCount} re-derived from the cooldown value (e.g.
+     * inverting {@code cooldownNanos * multiplier^(n-1)}) could not tell attempt 4 from attempt 9;
+     * only the stored counter can. This is the scenario that makes "read the count off a second,
+     * independent computation" provably wrong rather than just risky.
+     */
+    @Test
+    void repeatCountKeepsGrowingPastTheCeilingEvenThoughTheCooldownStaysFlat() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        long t = 0L;
+        for (int attempt = 1; attempt <= 5; attempt++) {
+            now.set(t);
+            q.quarantine("shared-openai");
+            BackendQuarantine.Status status = q.status("shared-openai").orElseThrow();
+            assertEquals(attempt, status.repeatCount(),
+                    "attempt " + attempt + " must be reported as exactly " + attempt
+                            + ", not collapsed to whatever attempt first reached the ceiling");
+            if (attempt >= 3) {
+                assertEquals(2400L, status.remainingSeconds(), "attempt " + attempt + " must be capped");
+            }
+            t += status.remainingSeconds(); // land exactly on the next deadline: still the same streak
+        }
+    }
+
+    @Test
+    void aQuietGapResetsTheReportedAttemptCountToOneToo() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai");
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai");
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // attempt 3
+        assertEquals(3, q.status("shared-openai").orElseThrow().repeatCount());
+
+        now.set(TimeUnit.SECONDS.toNanos(20_000)); // long quiet gap
+        q.quarantine("shared-openai");
+        assertEquals(1, q.status("shared-openai").orElseThrow().repeatCount(),
+                "a reset streak must report attempt 1 again, matching the reset base cooldown");
+    }
+
+    @Test
+    void escalatingOneCredentialsAttemptCountDoesNotAffectAnother() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai");
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai");
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // 3-in-a-row streak on this credential only
+
+        q.quarantine("another-credential");
+        assertEquals(1, q.status("another-credential").orElseThrow().repeatCount(),
+                "an unrelated credential's attempt count must stay at 1, unaffected by a sibling's streak");
+    }
+
+    @Test
+    void noneReportsNoStatusForAnything() {
+        BackendQuarantine q = BackendQuarantine.none();
+        q.quarantine("shared-openai"); // no-op on none(), same as every other mutator
+
+        assertTrue(q.status("shared-openai").isEmpty(),
+                "none() quarantines nothing, so it must report no status at all -- never a fabricated "
+                        + "attempt count for a credential that was never actually quarantined");
+    }
+
+    /** The flat (non-escalating) two-argument constructor must still report a real, growing count. */
+    @Test
+    void aFlatTwoArgumentInstanceStillReportsAGrowingAttemptCountEvenThoughTheCooldownStaysFlat() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600));
+
+        q.quarantine("shared-openai");
+        BackendQuarantine.Status first = q.status("shared-openai").orElseThrow();
+        assertEquals(600L, first.remainingSeconds());
+        assertEquals(1, first.repeatCount());
+
+        now.set(TimeUnit.SECONDS.toNanos(100)); // still inside the 1st quarantine
+        q.quarantine("shared-openai");
+        BackendQuarantine.Status second = q.status("shared-openai").orElseThrow();
+        assertEquals(600L, second.remainingSeconds(),
+                "the flat constructor's cooldown must stay exactly the base length regardless of the streak");
+        assertEquals(2, second.repeatCount(),
+                "the flat constructor still counts the real streak -- it just does not scale the cooldown by it");
+    }
 }