fleetd #469: one canonical FleetTool set backs registration, authz and charter checks

FleetConfig.validateCharters() only checked that a charter key is a role
wire name and its text is non-blank; #464's CharterToolSurfaceTest compared
charter text against the registered tool surface, but wrote its own charter
into a @TempDir fixture, so nothing anyone wrote into the live fleetd.yaml
could ever fail it.

Add FleetTool, an enum in dev.ltms.fleet.mcp holding the one canonical set
of registered tool wire names. FleetMcp's tool schemas now derive their
names from it, its constructor asserts at startup that what it actually
registers with the SDK equals FleetTool.wireNames() exactly, and its authz
dispatch (toolAction/authzAction) resolves the wire string against FleetTool
before switching on the enum itself with no default -- adding a tool without
pinning its Authz.Action is now a compile error, not just a test gap.

Add CharterToolSurface (mcp package, not config -- config loads before the
MCP server exists) and call it from Fleetd.main right after
cfg.validateAll(), so a charter naming a tool the server does not register
refuses the daemon's startup, naming both the charter key and the unknown
tool. FleetdStartupValidationTest proves this through Fleetd.main itself
against a live-shaped config fixture (bridge_send, CB-634's own removed
name).

CharterToolSurfaceTest, FleetMcpAuthzTest and McpContractDocTest each kept
an independent regex scrape of FleetMcp.java's source for the registered
side of their own comparison -- three more copies of the same list nothing
tied together. All three now read FleetTool.wireNames() instead.

Proved canonical by removal: deleting FleetTool.ACK while ackTool() still
referenced it broke mvn compile in two places (FleetMcp.java:940,:1898);
registering a schema under a literal not backed by FleetTool
("fleet_ack_v2") failed FleetMcp's new startup assertion in every test that
constructs it (12 errors, IllegalStateException at FleetMcp.<init>). Both
reverted before this commit.

fleetd/fleetd.example.yaml

@@ -452,6 +452,15 @@ placement: weighted
 # seconds, before a spawn may land on it again. Applies to every profile's effective credential
 # (its own name, or its credentialId if set above) — there is no per-profile override. Default
 # 1800 (30 minutes) when omitted or non-positive.
+#
+# fleetd #466: this is now only the BASE of an escalating backoff, not a flat retry rate. A
+# credential quarantined again within one base cooldown of the previous quarantine ending (still
+# reporting exhausted — e.g. a weekly subscription limit that hasn't reset) backs off further:
+# cooldown doubles each such time, capped at 12x this value (~6 hours at the 1800s default). A
+# quarantine that starts after a base-cooldown's worth of quiet resets back to this value. Not
+# configurable per se — the multiplier and ceiling are constants in BackendQuarantine, not new
+# YAML keys; see its class doc for the exact formula and why there is no automatic probe to clear
+# it early (the operator's own design constraint — a probe spends the quota it's measuring).
 # DEFERRED: baked once into the BackendQuarantine built at startup — a running quarantine keeps
 # its original cooldown regardless; a new value only applies to a quarantine that starts after a
 # restart. Editing this needs a daemon restart to take effect.
@@ -793,21 +802,12 @@ guard:
 # .claude/skills/, so a member spawned against ANY repo — not only one that already ships its own
 # copy — can load a bridge skill (e.g. implementer). Unset (the default): no worktree is touched
 # beyond today's behaviour. A skill folder the target repo already carries under
-# .claude/skills/<name> is never overwritten — the repo's own copy always wins. Best-effort like
-# worktreeGroup above: a missing/unreadable directory here is logged and skipped, never a failed
-# spawn. Every non-hidden subdirectory of this directory is copied wholesale, with no per-file
-# allowlist — don't park scratch files or drafts alongside the real skill folders, they will be
-# copied into every provisioned worktree too.
-#
-# fleetd #393: which member KINDS actually consume this once it is copied. kind: claude-code —
-# the Claude Code CLI discovers .claude/skills/ on its own; nothing else is needed. kind: opencode
-# — opencode has no such discovery, so OpenCodeLauncher reads whatever landed under
-# .claude/skills/ and appends each seeded skill's SKILL.md to the generated instructions[] file
-# (opencode's only channel for static guidance text; unlike Claude Code's Skill tool, the content
-# is always part of the system prompt, not loaded on demand). Both kinds are covered as of #393 —
-# earlier builds copied the files for every kind but only claude-code could read them, and the
-# seeding log said "N of M" regardless. Check the per-spawn launcher log (not just the seeding
-# log) to see what a given member actually got.
+# .claude/skills/<name> is never overwritten — the repo's own copy always wins. Claude Code
+# members only; an opencode member reads a different path (.opencode/agent) this key does not
+# touch. Best-effort like worktreeGroup above: a missing/unreadable directory here is logged and
+# skipped, never a failed spawn. Every non-hidden subdirectory of this directory is copied
+# wholesale, with no per-file allowlist — don't park scratch files or drafts alongside the real
+# skill folders, they will be copied into every provisioned worktree too.
 # memberSkills: /path/to/fleetd/checkout/.claude/skills
 
 # Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -26,6 +26,7 @@ import dev.ltms.fleet.inject.MemberPresence;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.mcp.CharterToolSurface;
 import dev.ltms.fleet.mcp.ConnectionIdentity;
 import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
@@ -163,6 +164,17 @@ public final class Fleetd {
         // and the Fleetd-startup tests actually pin — see FleetConfig#validateAll's javadoc for
         // why a name-by-name list here would have the same defect it replaces.
         cfg.validateAll();
+        // fleetd #469, follow-up to #464: validateAll() (and validateCharters() inside it) only
+        // checks that a charter's KEY is a role wire name and its text is non-blank — it never
+        // looks at what the text actually names. This is the separate check that does: it asks
+        // dev.ltms.fleet.mcp.FleetTool (the canonical registered-tool set) whether every fleet_*/
+        // bridge_* token a charter names is a tool this server actually registers. It cannot live
+        // inside FleetConfig#validateCharters() — config loads before the MCP server exists, and
+        // must not gain a dependency on the mcp package — so it runs here instead, at the one seam
+        // that already holds both a loaded FleetConfig and the mcp package, before anything below
+        // opens a socket or spawns a member.
+        CharterToolSurface.assertChartersNameOnlyRegisteredTools(
+                cfg.fleet() == null ? Map.of() : cfg.fleet().charters());
 
         Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
                 ? Path.of(cfg.herdrSocket())
@@ -222,7 +234,13 @@ public final class Fleetd {
         // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
         // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
         // here, at startup, and a config reload only changes it for a daemon restart.
-        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
+        // fleetd #466: escalating, not flat — a credential that keeps reporting exhaustion (e.g. a
+        // weekly subscription limit, which would otherwise be retried on every ~30-minute cooldown,
+        // about 336 times across the week) backs off further each consecutive time, capped at
+        // BackendQuarantine.DEFAULT_MAX_COOLDOWN_MULTIPLE x the base cooldown. See BackendQuarantine's
+        // class doc for the mechanism, why this never fires on cooling-off (a separate, unescalated
+        // mechanism — BackendOutagePolicy below), and the reset.
+        BackendQuarantine quarantine = BackendQuarantine.withEscalation(System::nanoTime,
                 TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
         // fleetd #201 Unit 5: one outage-cool-off tracker for the whole daemon, shared between the
         // launcher (checked at spawn, like `quarantine` above) and the backend-error sink wired in

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -70,12 +70,14 @@ import java.util.regex.PatternSyntaxException;
  *                      {@code fixed} (default), {@code round-robin}, or {@code weighted}
  * @param auth          API authentication mode ({@code null} → {@code loopback-trust}, the
  *                      historical behaviour), CB-501
- * @param quarantineCooldownSeconds  how long a credential stays quarantined after a
+ * @param quarantineCooldownSeconds  the BASE cooldown a credential is quarantined for after a
  *                      {@code BACKEND_EXHAUSTED} classification (CB-578 stage B); {@code null}/{@code
- *                      <=0} → {@link #DEFAULT_QUARANTINE_COOLDOWN_SECONDS}. Baked once into the
- *                      {@code BackendQuarantine} built at startup, so it is DEFERRED: changing it
- *                      needs a restart, and a quarantine already running keeps whatever cooldown was
- *                      live when it started.
+ *                      <=0} → {@link #DEFAULT_QUARANTINE_COOLDOWN_SECONDS}. Since fleetd #466 this is
+ *                      only the first occurrence's length — a credential quarantined again shortly
+ *                      after this cooldown ends backs off further, up to a ceiling; see {@code
+ *                      BackendQuarantine}'s class doc. Baked once into the {@code BackendQuarantine}
+ *                      built at startup, so it is DEFERRED: changing it needs a restart, and a
+ *                      quarantine already running keeps whatever cooldown was live when it started.
  * @param memberCredentials deny-by-default policy (CB-596) for which of the operator's own host
  *                      credentials a spawned member's pane inherits. {@code null} (the block
  *                      omitted) blocks nothing — see {@link MemberCredentials}.

fleetd/src/main/java/dev/ltms/fleet/mcp/CharterToolSurface.java

@@ -0,0 +1,67 @@
+package dev.ltms.fleet.mcp;
+
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * fleetd #469: a launch charter that names an MCP tool the server does not register must stop the
+ * daemon at startup, not wait for a member to discover the gap by calling something that is not
+ * there.
+ *
+ * <p>Deliberately its own class outside {@code dev.ltms.fleet.config}, not a case in {@link
+ * dev.ltms.fleet.config.FleetConfig#validateCharters()}. The canonical tool surface ({@link
+ * FleetTool}) lives in the {@code mcp} package; config is loaded before the MCP server exists and
+ * must not gain a dependency on it. So this check belongs at the seam that already holds both a
+ * loaded {@code FleetConfig} and the {@code mcp} package: {@code Fleetd.main}, called right after
+ * {@code cfg.validateAll()} and before anything opens a socket or spawns a member.
+ *
+ * <p>{@code #464}'s {@code CharterToolSurfaceTest} proved the same comparison against a charter
+ * fixture it wrote itself into a {@code @TempDir}, which meant nothing anyone wrote into the live
+ * {@code fleetd.yaml} could ever fail it. This class is what a real charter is actually checked
+ * against at boot; {@code FleetdStartupValidationTest} exercises it through {@code Fleetd.main}
+ * itself, the same way it proves every other {@code validateXxx()} still runs there.
+ */
+public final class CharterToolSurface {
+
+    /** A {@code fleet_…} (current) or {@code bridge_…} (pre-CB-634) tool-shaped token in prose. */
+    private static final Pattern TOOL_REFERENCE = Pattern.compile("(fleet_[a-z_]+|bridge_[a-z_]+)");
+
+    private CharterToolSurface() {
+    }
+
+    /**
+     * @param charters the configured {@code fleet.charters:} map (role wire name → charter text);
+     *                 {@code null} or empty is a no-op, same as an absent {@code fleet:} block
+     * @throws IllegalStateException naming the charter key and every tool it names that {@link
+     *                                FleetTool} does not list, when any charter does so
+     */
+    public static void assertChartersNameOnlyRegisteredTools(Map<String, String> charters) {
+        if (charters == null || charters.isEmpty()) {
+            return;
+        }
+        Set<String> registered = FleetTool.wireNames();
+        List<String> bad = new ArrayList<>();
+        charters.forEach((key, text) -> {
+            if (text == null) {
+                return;
+            }
+            Set<String> named = new LinkedHashSet<>();
+            Matcher m = TOOL_REFERENCE.matcher(text);
+            while (m.find()) {
+                named.add(m.group(1));
+            }
+            named.stream()
+                    .filter(t -> !registered.contains(t))
+                    .forEach(unknown -> bad.add("fleet.charters." + key + " names '" + unknown
+                            + "', which the server does not register (registered: " + registered + ")."));
+        });
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
+        }
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -490,6 +490,21 @@ public final class FleetMcp {
         McpSchema.Tool fleetProfiles = profilesTool();
         McpSchema.Tool fleetWhoami = whoamiTool();
 
+        // fleetd #469: the tool schemas above are already named from FleetTool.wireName(), but
+        // this is the check that a schema was not accidentally dropped, duplicated, or added
+        // under a name FleetTool does not list. It runs once, at construction (startup), rather
+        // than being left to CharterToolSurface or a test to discover later — a canonical entry
+        // this server never registers, or a registration with no canonical entry backing it, is a
+        // startup failure, not a silent gap.
+        Set<String> registeredToolNames = Set.of(fleetSend.name(), fleetReply.name(), fleetAsk.name(),
+                fleetStatus.name(), fleetPoll.name(), fleetAck.name(), fleetSpawn.name(),
+                fleetList.name(), fleetStop.name(), fleetProfiles.name(), fleetWhoami.name());
+        if (!registeredToolNames.equals(FleetTool.wireNames())) {
+            throw new IllegalStateException("fleetd #469: registered MCP tools " + registeredToolNames
+                    + " do not match the canonical tool set " + FleetTool.wireNames()
+                    + " -- FleetTool is the single source of truth for what this server registers");
+        }
+
         this.server = McpServer.sync(transport)
                 .serverInfo("fleet", "0.1.0")
                 .capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
@@ -897,20 +912,34 @@ public final class FleetMcp {
 
     /**
      * The action a registered tool handler actually hands to the authorization gate.
-     * Keeping this choice beside the registered-tool inventory makes a new tool fail the coverage
-     * test until its action is pinned.
+     *
+     * <p>{@code toolName} is a raw string off the wire (an MCP call names its tool by string, and a
+     * malformed or stale client can send anything), so resolving it against {@link FleetTool} first
+     * — and throwing on a miss — is still a run-time check by necessity. What moved to compile time
+     * is the second step: {@link #authzAction(FleetTool, Map)} switches on the resolved {@link
+     * FleetTool} itself with no {@code default}, so a new {@link FleetTool} constant with no pinned
+     * action fails {@code mvn compile}, not just {@code FleetMcpAuthzTest} at run time.
      */
     static Authz.Action toolAction(String toolName, Map<String, Object> arguments) {
-        return switch (toolName) {
-            case "fleet_send" -> Authz.Action.SEND;
-            case "fleet_reply" -> Authz.Action.REPLY;
-            case "fleet_ask" -> Authz.Action.ASK;
-            case "fleet_status", "fleet_list", "fleet_profiles", "fleet_whoami" -> Authz.Action.READ;
-            case "fleet_poll" -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
-            case "fleet_ack" -> Authz.Action.DRAIN;
-            case "fleet_spawn" -> Authz.Action.SPAWN;
-            case "fleet_stop" -> Authz.Action.STOP;
-            default -> throw new IllegalArgumentException("unregistered tool: " + toolName);
+        FleetTool tool = FleetTool.byWireName(toolName)
+                .orElseThrow(() -> new IllegalArgumentException("unregistered tool: " + toolName));
+        return authzAction(tool, arguments);
+    }
+
+    /**
+     * Exhaustive over {@link FleetTool} on purpose — no {@code default}. Adding a tool to {@link
+     * FleetTool} without adding its case here is a compile error (fleetd #469).
+     */
+    private static Authz.Action authzAction(FleetTool tool, Map<String, Object> arguments) {
+        return switch (tool) {
+            case SEND -> Authz.Action.SEND;
+            case REPLY -> Authz.Action.REPLY;
+            case ASK -> Authz.Action.ASK;
+            case STATUS, LIST, PROFILES, WHOAMI -> Authz.Action.READ;
+            case POLL -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
+            case ACK -> Authz.Action.DRAIN;
+            case SPAWN -> Authz.Action.SPAWN;
+            case STOP -> Authz.Action.STOP;
         };
     }
 
@@ -1805,7 +1834,7 @@ public final class FleetMcp {
     // --- tool schemas --------------------------------------------------------------------------
 
     private static McpSchema.Tool sendTool() {
-        return tool("fleet_send",
+        return tool(FleetTool.SEND.wireName(),
                 "Delegate a task to a worker session. By default blocks until the worker replies and "
                         + "returns its reply (or a 'still working / queued' note on timeout). Pass wait:false "
                         + "for a long task to return a ticket immediately, then poll it with fleet_poll. To "
@@ -1833,7 +1862,7 @@ public final class FleetMcp {
 
     private static McpSchema.Tool askTool() {
         // No target/session arg — the worker's identity is resolved from the connection.
-        return tool("fleet_ask",
+        return tool(FleetTool.ASK.wireName(),
                 "Pause your current delegated turn to ask the primary a question, blocking until it "
                         + "answers — then resume the same turn with the answer. Use this when only the "
                         + "primary has a decision or detail you need to continue. You do not address the "
@@ -1846,7 +1875,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool pollTool() {
-        return tool("fleet_poll",
+        return tool(FleetTool.POLL.wireName(),
                 "Check an async delegation (a fleet_send with wait:false) by its ticket: "
                         + "pending, done (with the worker's reply), or failed. When target (a worker "
                         + "session id) is present instead of ticket, drain that worker's inbox of "
@@ -1866,7 +1895,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool ackTool() {
-        return tool("fleet_ack",
+        return tool(FleetTool.ACK.wireName(),
                 "Acknowledge (remove) a specific reply from a worker's inbox. Use when the primary "
                         + "has processed a reply and wants to confirm it, leaving other pending replies "
                         + "in the inbox for later drain.",
@@ -1880,7 +1909,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool spawnTool() {
-        return tool("fleet_spawn",
+        return tool(FleetTool.SPAWN.wireName(),
                 "Spawn a new off-subscription member session. A member has two independent attributes: "
                         + "role (what it is for) and profile (which backend it runs on). Pass role to pick "
                         + "the contract — 'dev' implements a unit and opens its own PR, 'reviewer' reviews a "
@@ -1912,7 +1941,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool profilesTool() {
-        return tool("fleet_profiles",
+        return tool(FleetTool.PROFILES.wireName(),
                 "List the configured worker profiles (backends) and which one fleet_spawn uses by "
                         + "default. A 'quarantined' map is present when a backend-exhausted refusal put "
                         + "a profile's credential on cooldown — fleet_spawn onto it is refused until "
@@ -1930,7 +1959,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool listTool() {
-        return tool("fleet_list",
+        return tool(FleetTool.LIST.wireName(),
                 "List the whole fleet the bridge tracks, in two parts. 'leads' are your PEERS — other "
                         + "orchestrators, each with its sessionId (the address to fleet_send to), "
                         + "name, live status, and 'self': true on your own row; this is how you "
@@ -1966,7 +1995,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool stopTool() {
-        return tool("fleet_stop",
+        return tool(FleetTool.STOP.wireName(),
                 "Tear down a worker session by its paneId (from fleet_spawn or fleet_list).",
                 objectSchema(Map.of(
                         "paneId", stringProp("The worker's paneId to stop")),
@@ -1975,7 +2004,7 @@ public final class FleetMcp {
 
     private static McpSchema.Tool replyTool() {
         // No session/target arg — the caller's identity is resolved from the connection.
-        return tool("fleet_reply",
+        return tool(FleetTool.REPLY.wireName(),
                 "Return your structured answer for a message you were sent, resolving the sender's "
                         + "blocked fleet_send. A worker MUST end every delegated turn with exactly "
                         + "one of these. A lead uses it only to answer another lead that messaged "
@@ -1986,7 +2015,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool statusTool() {
-        return tool("fleet_status",
+        return tool(FleetTool.STATUS.wireName(),
                 "Get the live lifecycle status (idle/working/blocked/unknown) of a worker session.",
                 objectSchema(Map.of(
                         "sessionId", stringProp("The worker session id to query")),
@@ -1994,7 +2023,7 @@ public final class FleetMcp {
     }
 
     private static McpSchema.Tool whoamiTool() {
-        return tool("fleet_whoami",
+        return tool(FleetTool.WHOAMI.wireName(),
                 "Report who YOU are on the bridge — your role is resolved from your connection "
                         + "(unforgeable), never from anything you claim. Returns role 'primary' (you "
                         + "orchestrate: spawn/send/stop; reply ONLY to answer a peer lead that "

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetTool.java

@@ -0,0 +1,82 @@
+package dev.ltms.fleet.mcp;
+
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+
+/**
+ * The one canonical set of MCP tool names this daemon registers (fleetd #469, follow-up to #464).
+ *
+ * <p>Before this enum, the tool surface was written twice with nothing tying the copies together:
+ * once as the literal {@code "fleet_…"} string passed to each tool-schema builder in
+ * {@link FleetMcp}, and again as the case labels of {@link FleetMcp}'s authorization switch. A
+ * reader that needed "what does this server register" — a charter check, in particular — had no
+ * source to ask except scraping {@code FleetMcp.java}'s source text for {@code tool("…")} calls: a
+ * third copy of the same list, and the weakest of the three forms.
+ *
+ * <p>Every reader that needs the registered tool surface now asks this enum instead:
+ *
+ * <ul>
+ *   <li>the tool-schema builders in {@code FleetMcp} pass {@code wireName()} rather than a literal;
+ *   <li>{@code FleetMcp}'s constructor asserts, at startup, that the set of tool names it actually
+ *       registers with the MCP SDK equals {@link #wireNames()} exactly — a canonical entry that is
+ *       never registered, or a registration with no canonical entry backing it, fails the daemon's
+ *       own boot rather than only a test's;
+ *   <li>{@code FleetMcp.toolAction}'s dispatch onto {@code Authz.Action} switches on the enum
+ *       (not the raw string) with no {@code default}, so adding a tool here without pinning its
+ *       action is a compile error, not a run-time throw;
+ *   <li>{@link CharterToolSurface} asks {@link #wireNames()} to check a configured launch charter
+ *       against the live tool surface, instead of scraping source text a third time.
+ * </ul>
+ */
+public enum FleetTool {
+
+    SEND("fleet_send"),
+    REPLY("fleet_reply"),
+    ASK("fleet_ask"),
+    STATUS("fleet_status"),
+    POLL("fleet_poll"),
+    ACK("fleet_ack"),
+    SPAWN("fleet_spawn"),
+    LIST("fleet_list"),
+    STOP("fleet_stop"),
+    PROFILES("fleet_profiles"),
+    WHOAMI("fleet_whoami");
+
+    private final String wireName;
+
+    FleetTool(String wireName) {
+        this.wireName = wireName;
+    }
+
+    /** The name this tool is registered under, and called by, on the wire ({@code "fleet_send"}, …). */
+    public String wireName() {
+        return wireName;
+    }
+
+    private static final Map<String, FleetTool> BY_WIRE_NAME;
+    private static final Set<String> WIRE_NAMES;
+
+    static {
+        Map<String, FleetTool> byName = new LinkedHashMap<>();
+        Set<String> names = new LinkedHashSet<>();
+        for (FleetTool tool : values()) {
+            byName.put(tool.wireName, tool);
+            names.add(tool.wireName);
+        }
+        BY_WIRE_NAME = Map.copyOf(byName);
+        WIRE_NAMES = Set.copyOf(names);
+    }
+
+    /** The tool named {@code wireName}, or empty when this daemon registers no such tool. */
+    public static Optional<FleetTool> byWireName(String wireName) {
+        return Optional.ofNullable(BY_WIRE_NAME.get(wireName));
+    }
+
+    /** Every wire name this daemon registers — the canonical tool surface. */
+    public static Set<String> wireNames() {
+        return WIRE_NAMES;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -331,22 +331,11 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                             + "form — opencode's per-model context limit could not be applied for this profile",
                     cfg.profile(), cfg.model());
         }
-        // fleetd #393: memberSkills seeding (GitWorktrees#seedSkills) copies skill folders into
-        // EVERY provisioned worktree's .claude/skills/ regardless of which kind ultimately spawns
-        // into it — that copy step cannot know the kind, only the caller of GitWorktrees#add does
-        // (see that method's own javadoc). .claude/skills/ is a Claude Code CLI convention the CLI
-        // discovers on its own; opencode has no such discovery, so without this, a seeded skill
-        // never reaches an opencode member even though GitWorktrees logged it as seeded. Read
-        // whatever landed under <cwd>/.claude/skills/ here — the one place in this launcher that
-        // knows both the kind (opencode, by construction: this IS OpenCodeLauncher) and the cwd.
-        List<Path> skillInstructionFiles = skillInstructionFiles(spec.cwd());
         // A config file is needed for the bridge MCP mount, a member charter, the IDE MCP (+ its
-        // guidance overlay, CB-634), a pinned endpoint (CB-508), a resolvable autoCompactWindow, or
-        // at least one seeded skill to deliver via instructions[] (fleetd #393).
+        // guidance overlay, CB-634), a pinned endpoint (CB-508), or a resolvable autoCompactWindow.
         if (cfg.hasMcp() || cfg.hasIdeMcp() || spec.charter() != null || hasCustomProvider(cfg)
-                || wantsContextLimit || !skillInstructionFiles.isEmpty()) {
-            workerEnv.put("OPENCODE_CONFIG",
-                    writeConfig(cfg, spec.charter(), spec.cwd(), skillInstructionFiles).toString());
+                || wantsContextLimit) {
+            workerEnv.put("OPENCODE_CONFIG", writeConfig(cfg, spec.charter(), spec.cwd()).toString());
         }
         applyGitToken(workerEnv, cfg);
         List<String> argv = argvWithResume(argvWithModel(argvWithAuto(cfg), cfg), spec.resumeSessionId());
@@ -369,65 +358,6 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         return withAgent;
     }
 
-    /**
-     * fleetd #393: the {@code SKILL.md} paths under {@code <cwd>/.claude/skills/} this launcher can
-     * turn into {@code instructions[]} entries, plus the honest log this ticket asks for — emitted
-     * here, at the one point a skill's fate for THIS spawn is actually known, rather than trusting
-     * {@code GitWorktrees#seedSkills}'s kind-blind "N of M" line to mean "and it will be read."
-     *
-     * <p>Every non-hidden subdirectory of {@code .claude/skills/} is a candidate, whether it got
-     * there via {@code memberSkills:} seeding or because the target repo ships its own copy — this
-     * launcher does not care which; it only cares what it can find at spawn time. A candidate with
-     * a {@code SKILL.md} at its top level (the same shape {@link #writeConfig} already requires for
-     * the charter and IDE-rules instructions entries) is delivered; anything else is a directory
-     * this launcher cannot turn into a flat instructions entry, named explicitly in the log rather
-     * than silently dropped, so a caller sees a real "cannot consume" reason and not just a smaller
-     * number than {@code GitWorktrees}' own count.
-     *
-     * <p>No candidates at all (directory absent or empty) logs nothing — the same
-     * no-log-when-nothing-to-say shape {@link #hasCustomProvider} and friends already follow, and
-     * the shape {@code GitWorktrees#seedSkills} itself uses when {@code memberSkills:} is unset.
-     * A failure to even list the directory is logged and treated as "nothing delivered" — best
-     * effort, must never fail the spawn, matching {@code GitWorktrees#seedSkills}'s own contract.
-     */
-    private List<Path> skillInstructionFiles(String cwd) {
-        if (cwd == null || cwd.isBlank()) {
-            return List.of();
-        }
-        Path skillsDir = Path.of(cwd, ".claude", "skills");
-        if (!Files.isDirectory(skillsDir)) {
-            return List.of();
-        }
-        List<Path> candidates;
-        try (var listing = Files.list(skillsDir)) {
-            candidates = listing.filter(Files::isDirectory)
-                    .filter(p -> !p.getFileName().toString().startsWith("."))
-                    .sorted()
-                    .toList();
-        } catch (IOException e) {
-            log.warn("could not scan {} for skill folders to deliver to this opencode member: {}",
-                    skillsDir, e.getMessage());
-            return List.of();
-        }
-        if (candidates.isEmpty()) {
-            return List.of();
-        }
-        List<Path> delivered = candidates.stream()
-                .map(dir -> dir.resolve("SKILL.md"))
-                .filter(Files::isRegularFile)
-                .toList();
-        List<String> undeliverable = candidates.stream()
-                .filter(dir -> !Files.isRegularFile(dir.resolve("SKILL.md")))
-                .map(dir -> dir.getFileName().toString())
-                .toList();
-        log.info("skill delivery: {} of {} skill folder(s) under {} reached this opencode member via "
-                        + "instructions[] (opencode does not read .claude/skills/ natively, unlike "
-                        + "Claude Code){}",
-                delivered.size(), candidates.size(), skillsDir,
-                undeliverable.isEmpty() ? "" : "; no SKILL.md, could not be delivered: " + undeliverable);
-        return delivered;
-    }
-
     /**
      * True when this profile pins its own OpenAI-compatible endpoint (CB-508) rather than using
      * whatever provider opencode resolves by default.
@@ -488,15 +418,8 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * fresh per-spawn directory under {@link #configRoot}, and return the config file's path for
      * {@code OPENCODE_CONFIG}. The dir is unique per spawn so concurrent workers never race on it;
      * it is best-effort cleaned on JVM exit (worker config is disposable — regenerated every spawn).
-     *
-     * @param skillInstructionFiles fleetd #393: absolute {@code SKILL.md} paths from
-     *                              {@link #skillInstructionFiles(String)}, appended to
-     *                              {@code instructions[]} so a {@code memberSkills:}-seeded skill
-     *                              reaches this opencode member the same way the charter and IDE
-     *                              rules already do.
      */
-    private Path writeConfig(FleetConfig.Profile cfg, String charterText, String cwd,
-                              List<Path> skillInstructionFiles) {
+    private Path writeConfig(FleetConfig.Profile cfg, String charterText, String cwd) {
         try {
             Path dir = Files.createTempDirectory(configParentDir(), "fleetd-opencode-");
             dir.toFile().deleteOnExit();
@@ -524,28 +447,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                 Files.writeString(charter, charterText);
                 charter.toFile().deleteOnExit();
 
-                // fleetd #393 follow-up: withArray, not putArray. putArray REPLACES whatever node
-                // is already at "instructions" — harmless only as long as this block runs first
-                // against a still-empty root, which is an ordering constraint nothing declared or
-                // tested. The skills writer just below, and the IDE-rules writer further down,
-                // both already use withArray (get-or-create) for exactly this reason; this was the
-                // one straggler. Proven load-bearing on the fleetd #393 merge: flipping this one
-                // call back to putArray left the whole suite green while silently deleting the
-                // charter entry whenever skills or IDE rules ran after it — an opencode member
-                // would launch with no role contract at all, worse than the bug #393 fixed, and
-                // nothing caught it. See OpenCodeLauncherTest's
-                // instructionsArrayHoldsCharterThenIdeRulesInOrder and
-                // instructionsArrayHoldsCharterThenSkillsThenIdeRulesInOrder.
-                root.withArray("instructions").add(charter.toAbsolutePath().toString());
-            }
-
-            // fleetd #393: each seeded skill's SKILL.md, delivered as a plain instructions[] entry
-            // — the only mechanism opencode has for static guidance text. Unlike Claude Code's
-            // Skill tool, opencode cannot load one of these on demand by name; the content is just
-            // always part of the system prompt from spawn. That is a real difference in HOW the
-            // content reaches the member, not a reason to withhold it.
-            for (Path skillFile : skillInstructionFiles) {
-                root.withArray("instructions").add(skillFile.toAbsolutePath().toString());
+                root.putArray("instructions").add(charter.toAbsolutePath().toString());
             }
 
             if (cfg.hasMcp() || cfg.hasIdeMcp()) {

fleetd/src/main/java/dev/ltms/fleet/placement/BackendQuarantine.java

@@ -21,46 +21,158 @@ import java.util.function.LongSupplier;
  * <p>The clock is injected ({@link LongSupplier}, conventionally {@code System::nanoTime} like
  * {@code FleetHealthMonitor}), never read inline, so a quarantine's expiry is testable without a
  * real sleep.
+ *
+ * <h2>Escalation (fleetd #466)</h2>
+ * A flat cooldown does not fit every exhaustion. A backend that reports "out of capacity for the
+ * rest of the hour" recovers in one cooldown; a weekly subscription limit does not — it keeps
+ * reporting exhausted on every attempt made before the window resets, so a flat 30-minute cooldown
+ * (the default {@code cooldownNanos}) means roughly 336 pointless spawn attempts across a week, one
+ * every cooldown.
+ *
+ * <p><strong>This class only ever sees the exhaustion signal.</strong> Its only production caller is
+ * {@code Fleetd.exhaustionSink}, wired to fire on a {@code BACKEND_EXHAUSTED} classification alone.
+ * The daemon's other outage state — a credential "cooling off" after repeated non-exhaustion
+ * backend errors (an HTTP 5xx storm, say) — is a separate mechanism, {@code BackendOutagePolicy},
+ * with its own short fixed 60s cooldown and no repeat tracking. The two are never merged: escalating
+ * on a cooling-off signal would turn a transient 5xx storm into a multi-hour backoff, which is
+ * exactly the failure this ticket is not asking for. Confirmed by reading every call site of
+ * {@link #quarantine} — {@code BackendOutagePolicy} has its own {@code coolOff} method and never
+ * calls this one.
+ *
+ * <p><strong>Mechanism</strong> — the {@link #withEscalation} constructors track, per credential, how
+ * many times in a row {@link #quarantine} has been called without an intervening "quiet" gap.
+ * Each call computes {@code cooldownNanos * backoffMultiplier ^ (repeatCount - 1)}, capped at
+ * {@code maxCooldownNanos}. A call counts as a continuation of the same streak — {@code repeatCount}
+ * increments — when it arrives no more than one base {@code cooldownNanos} after the previous
+ * quarantine's deadline (this covers both "still quarantined" and "quarantine just expired and it
+ * was exhausted again immediately"); otherwise the streak resets and this call is treated as a fresh
+ * first occurrence at the base cooldown.
+ *
+ * <p><strong>Reset, honestly stated.</strong> The ideal reset signal is "the cooldown expired and the
+ * next attempt succeeded" — but nothing in this codebase reports a spawn success back to this class
+ * (checked: {@code SessionManager} and {@code CompositePeerLauncher} never call any method here
+ * except {@link #quarantine}/{@link #isQuarantined}/{@link #remainingSeconds}, none of which is a
+ * success hook). Lacking that signal, the reset used here is a time-based proxy: a base-cooldown's
+ * worth of quiet — no exhaustion report for that credential — since the last quarantine ended. It is
+ * not proof the credential started working again, only the best available evidence without adding an
+ * active probe, which is out of scope by the operator's own design constraint (no automatic probing
+ * of a limited backend).
+ *
+ * <p><strong>Ceiling.</strong> {@code maxCooldownNanos} bounds the growth — an unbounded backoff is a
+ * permanent, unrecoverable-without-a-restart outage, which would be worse than the flat-rate bug this
+ * escalation fixes. {@link #withEscalation(LongSupplier, long)} defaults the ceiling to
+ * {@value #DEFAULT_MAX_COOLDOWN_MULTIPLE}x the base cooldown (12x the 1800s default ≈ 6 hours), so a
+ * chronically exhausted credential still gets re-tried roughly every 6 hours instead of every 30
+ * minutes — about a dozen attempts a week instead of ~336.
+ *
+ * <p><strong>Backward compatibility.</strong> The original two-argument {@link #BackendQuarantine(
+ * LongSupplier, long)} constructor is unchanged in behaviour: it is exactly {@code
+ * withEscalation}'s mechanism with {@code backoffMultiplier = 1.0} and {@code maxCooldownNanos =
+ * cooldownNanos}, which collapses the formula back to the original flat {@code now + cooldownNanos}
+ * on every call regardless of history. Every existing call site (roughly 20 across the test suite,
+ * plus {@link #none()}) keeps its current shape and behaviour unchanged.
  */
 public final class BackendQuarantine {
 
-    private final ConcurrentHashMap<String, Long> quarantinedUntilNanos = new ConcurrentHashMap<>();
+    /** Default growth per consecutive exhaustion streak — see the class doc's Mechanism section. */
+    static final double DEFAULT_BACKOFF_MULTIPLIER = 2.0;
+    /** Default ceiling, expressed as a multiple of the base cooldown — see the class doc's Ceiling section. */
+    static final long DEFAULT_MAX_COOLDOWN_MULTIPLE = 12;
+
+    private final ConcurrentHashMap<String, QuarantineState> quarantines = new ConcurrentHashMap<>();
     private final LongSupplier nowNanos;
     private final long cooldownNanos;
+    private final double backoffMultiplier;
+    private final long maxCooldownNanos;
     /** True only for {@link #none()}. See {@link #quarantine} for why this exists. */
     private final boolean inert;
 
+    /** How many consecutive exhaustion reports a credential is on, and when the resulting cooldown ends. */
+    private record QuarantineState(int repeatCount, long deadlineNanos) {
+    }
+
     /**
+     * Flat cooldown, unchanged from before fleetd #466 — every {@link #quarantine} call blocks the
+     * credential for exactly {@code cooldownNanos}, regardless of how many times it was called
+     * before. Equivalent to {@link #withEscalation} with no growth ({@code backoffMultiplier = 1.0})
+     * and a ceiling equal to the base cooldown, so it degrades to the identical {@code now +
+     * cooldownNanos} formula every call. Kept for the existing call sites that want a fixed cooldown
+     * (and for tests exercising the fixed-cooldown shape in isolation); production wiring uses
+     * {@link #withEscalation} instead.
+     *
      * @param nowNanos      monotonic clock, injected for testability
      * @param cooldownNanos how long a fresh {@link #quarantine} call blocks the credential for;
      *                      must be positive
      */
     public BackendQuarantine(LongSupplier nowNanos, long cooldownNanos) {
-        this(nowNanos, cooldownNanos, false);
+        this(nowNanos, cooldownNanos, 1.0, cooldownNanos, false);
     }
 
-    private BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, boolean inert) {
+    /**
+     * Escalating cooldown (fleetd #466) — see the class doc's Mechanism/Reset/Ceiling sections.
+     *
+     * @param nowNanos          monotonic clock, injected for testability
+     * @param cooldownNanos     base cooldown, applied to a fresh (non-streak) exhaustion; must be
+     *                          positive
+     * @param backoffMultiplier growth per consecutive exhaustion; must be {@code >= 1.0} ({@code 1.0}
+     *                          disables growth and is exactly the flat two-argument constructor)
+     * @param maxCooldownNanos  ceiling on the escalated cooldown; must be {@code >= cooldownNanos}
+     */
+    public BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, double backoffMultiplier,
+            long maxCooldownNanos) {
+        this(nowNanos, cooldownNanos, backoffMultiplier, maxCooldownNanos, false);
+    }
+
+    private BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, double backoffMultiplier,
+            long maxCooldownNanos, boolean inert) {
         this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
         if (cooldownNanos <= 0) {
             throw new IllegalArgumentException("cooldownNanos must be positive: " + cooldownNanos);
         }
+        if (backoffMultiplier < 1.0) {
+            throw new IllegalArgumentException("backoffMultiplier must be >= 1.0: " + backoffMultiplier);
+        }
+        if (maxCooldownNanos < cooldownNanos) {
+            throw new IllegalArgumentException(
+                    "maxCooldownNanos must be >= cooldownNanos: " + maxCooldownNanos + " < " + cooldownNanos);
+        }
         this.cooldownNanos = cooldownNanos;
+        this.backoffMultiplier = backoffMultiplier;
+        this.maxCooldownNanos = maxCooldownNanos;
         this.inert = inert;
     }
 
+    /**
+     * Escalating cooldown with the fleetd #466 default shape: cooldown doubles
+     * ({@value #DEFAULT_BACKOFF_MULTIPLIER}x) per consecutive exhaustion streak, capped at
+     * {@value #DEFAULT_MAX_COOLDOWN_MULTIPLE}x the base cooldown. This is what production wiring
+     * ({@code Fleetd.main}) uses.
+     *
+     * @param nowNanos      monotonic clock, injected for testability
+     * @param cooldownNanos base cooldown, applied to a fresh (non-streak) exhaustion; must be positive
+     */
+    public static BackendQuarantine withEscalation(LongSupplier nowNanos, long cooldownNanos) {
+        return new BackendQuarantine(nowNanos, cooldownNanos, DEFAULT_BACKOFF_MULTIPLIER,
+                cooldownNanos * DEFAULT_MAX_COOLDOWN_MULTIPLE, false);
+    }
+
     /**
      * Inert quarantine — {@link #quarantine} does nothing on this instance, so nothing is ever
      * quarantined. The explicit stand-in a caller (or a test not exercising this feature) passes
      * instead of a defaulting overload, exactly like {@code ExhaustedPatternLookup.none()}.
      */
     public static BackendQuarantine none() {
-        return new BackendQuarantine(() -> 0L, 1, true);
+        return new BackendQuarantine(() -> 0L, 1, 1.0, 1, true);
     }
 
     /**
-     * Quarantine {@code credentialId} for the configured cooldown, starting now. A repeat call while
-     * already quarantined restarts the cooldown at full length — a fresh refusal is fresh evidence the
-     * account is still exhausted, not a reason to let an earlier, shorter wait stand.
+     * Quarantine {@code credentialId} starting now. On a flat instance (the two-argument
+     * constructor) this always blocks for exactly {@code cooldownNanos}, restarting the cooldown at
+     * full length on every call — a fresh refusal is fresh evidence the account is still exhausted,
+     * not a reason to let an earlier, shorter wait stand. On an escalating instance ({@link
+     * #withEscalation}) the cooldown grows with each call that arrives within one base cooldown of
+     * the previous deadline, and resets to the base cooldown once a call arrives after a longer gap
+     * — see the class doc.
      *
      * <p>On {@link #none()} this is a no-op. It has to be: that instance holds a clock frozen at 0,
      * so recording a deadline would produce a quarantine that never expires — a credential locked out
@@ -73,7 +185,13 @@ public final class BackendQuarantine {
         if (inert) {
             return;
         }
-        quarantinedUntilNanos.put(credentialId, nowNanos.getAsLong() + cooldownNanos);
+        long now = nowNanos.getAsLong();
+        quarantines.compute(credentialId, (id, prev) -> {
+            int repeatCount = (prev == null || now - prev.deadlineNanos() > cooldownNanos)
+                    ? 1
+                    : prev.repeatCount() + 1;
+            return new QuarantineState(repeatCount, now + escalatedCooldownNanos(repeatCount));
+        });
     }
 
     /** Whether {@code credentialId} is quarantined right now. */
@@ -95,8 +213,8 @@ public final class BackendQuarantine {
      */
     public Map<String, Long> activeRemainingSeconds() {
         Map<String, Long> out = new LinkedHashMap<>();
-        quarantinedUntilNanos.forEach((credentialId, deadline) -> {
-            long remaining = deadline - nowNanos.getAsLong();
+        quarantines.forEach((credentialId, state) -> {
+            long remaining = state.deadlineNanos() - nowNanos.getAsLong();
             if (remaining > 0) {
                 out.put(credentialId, toSecondsRoundedUp(remaining));
             }
@@ -105,8 +223,14 @@ public final class BackendQuarantine {
     }
 
     private long remainingNanos(String credentialId) {
-        Long deadline = quarantinedUntilNanos.get(credentialId);
-        return deadline == null ? 0L : deadline - nowNanos.getAsLong();
+        QuarantineState state = quarantines.get(credentialId);
+        return state == null ? 0L : state.deadlineNanos() - nowNanos.getAsLong();
+    }
+
+    /** {@code cooldownNanos * backoffMultiplier ^ (repeatCount - 1)}, capped at {@code maxCooldownNanos}. */
+    private long escalatedCooldownNanos(int repeatCount) {
+        double raw = cooldownNanos * Math.pow(backoffMultiplier, repeatCount - 1);
+        return raw >= (double) maxCooldownNanos ? maxCooldownNanos : (long) raw;
     }
 
     private static long toSecondsRoundedUp(long nanos) {

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -690,18 +690,14 @@ public final class GitWorktrees implements Worktrees {
      * {@code fleet.seededSkillsNote}, readable with {@code git config --worktree --get-all
      * fleet.seededSkills}.
      *
-     * <p><b>Kind-blind by construction, not by a backend check here — this used to be a real gap
-     * (fleetd #393).</b> This method only copies files; like {@link #isolateToolSurface} — which
-     * neutralizes BOTH {@code .mcp.json} and {@code opencode.json} unconditionally — it runs the
-     * same for every worktree regardless of which backend ultimately spawns into it, because no
-     * caller of {@link #add} hands this class a kind to consult. Before fleetd #393, that made the
-     * log line below a false claim of success for a {@code kind: opencode} member: opencode has no
-     * built-in discovery of {@code .claude/skills/}, unlike the Claude Code CLI, so a seeded skill
-     * never reached one. It now does — {@code OpenCodeLauncher#skillInstructionFiles} reads
-     * whatever this method copied into {@code .claude/skills/} and appends each {@code SKILL.md} to
-     * the generated {@code instructions[]} — but that delivery, and the log line that honestly
-     * claims it (kind-aware, unlike this one), happens at the launcher, once the kind is actually
-     * known, not here.
+     * <p><b>Claude Code specific by construction, not by a backend check here.</b> Only {@code
+     * .claude/skills/<name>/SKILL.md} is a path any launcher reads today (opencode's equivalent is a
+     * different shape under {@code .opencode/agent}, out of scope — see issue #362). This method
+     * only copies files; like {@link #isolateToolSurface} — which neutralizes BOTH {@code .mcp.json}
+     * and {@code opencode.json} unconditionally — it runs the same for every worktree regardless of
+     * which backend ultimately spawns into it, because the backend is not yet chosen at {@link #add}
+     * time. A seeded {@code .claude/skills/} directory in an opencode member's worktree is simply
+     * never read by that launcher.
      */
     private void seedSkills(String worktreePath) {
         if (memberSkillsSource == null) {
@@ -743,15 +739,7 @@ public final class GitWorktrees implements Worktrees {
         if (detail.isEmpty()) {
             detail = "no skill folders found under " + source;
         }
-        // fleetd #393: this only claims the copy step, deliberately — it cannot know the member
-        // kind that will spawn into this worktree (see this method's own javadoc), so it must not
-        // read as "and the member will act on it." Whether that is true depends on the kind: the
-        // Claude Code CLI discovers .claude/skills/ on its own; OpenCodeLauncher logs its own
-        // "skill delivery" line, once the kind is known, naming what it could and could not turn
-        // into instructions[].
-        log.info("skill seeding: {} of {} candidate(s) from {} into {}/.claude/skills — {} "
-                        + "(whether the spawned member can act on this depends on its kind — see "
-                        + "the launcher's own log for that)",
+        log.info("skill seeding: {} of {} candidate(s) from {} into {}/.claude/skills — {}",
                 seeded.size(), seeded.size() + kept.size(), source, worktreePath, detail);
         if (seeded.isEmpty()) {
             return;

fleetd/src/test/java/dev/ltms/fleet/FleetdStartupValidationTest.java

@@ -95,6 +95,28 @@ class FleetdStartupValidationTest {
                 """, "architetc");
     }
 
+    /**
+     * fleetd #469: closes the gap left by #464's {@code CharterToolSurfaceTest}, which wrote its
+     * own charter into a {@code @TempDir} fixture and so could never fail on anything anyone wrote
+     * into the live {@code fleetd.yaml}. {@code bridge_send} is CB-634's own motivating example — a
+     * tool name the rename removed — and the charter key ({@code dev}) is a real role wire name, so
+     * this fixture passes {@code cfg.validateAll()}'s charter check (key valid, text non-blank) and
+     * is refused only by the new {@code CharterToolSurface} call right after it. The failure message
+     * must name both the charter key and the unknown tool.
+     */
+    @Test
+    void mainRefusesACharterNamingAnUnregisteredTool(@TempDir Path dir) throws Exception {
+        assertMainRefuses(dir, "charter-tool-surface.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through bridge_send.
+                """, "bridge_send");
+    }
+
     @Test
     void mainRefusesAnArchitectSlotNamingAnUnconfiguredProfile(@TempDir Path dir) throws Exception {
         assertMainRefuses(dir, "members.yaml", """

fleetd/src/test/java/dev/ltms/fleet/mcp/CharterToolSurfaceTest.java

@@ -3,7 +3,9 @@ package dev.ltms.fleet.mcp;
 import dev.ltms.fleet.config.FleetConfig;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
+import java.util.Map;
 import java.util.Set;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -11,13 +13,30 @@ import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
-/** fleetd #464: launch charters must not name MCP tools the server does not register. */
+/**
+ * fleetd #464 shipped {@code configuredChartersNameOnlyRegisteredTools} below, comparing charter
+ * text against the registered tool surface — but it scraped <em>both</em> sides from source text:
+ * its own fixture charter, and a regex over {@code FleetMcp.java}'s {@code tool("…")} calls. #469's
+ * gap: nothing anyone wrote into the live {@code fleetd.yaml} could ever reach that test, because
+ * it never called production validation code.
+ *
+ * <p>This version keeps the charter-text extraction helper ({@code toolsNamedIn}) — charters are
+ * free-text config, so finding a {@code fleet_*}/{@code bridge_*} token inside one has no source
+ * but a scrape — but reads the <em>registered</em> side from {@link FleetTool}, the canonical enum
+ * {@code FleetMcp} itself now derives its tool schemas and authorization switch from, rather than a
+ * second scrape of {@code FleetMcp.java}'s source. It also exercises {@link
+ * CharterToolSurface#assertChartersNameOnlyRegisteredTools} directly — the method {@code
+ * Fleetd.main} actually calls at startup — both accepting and rejecting. {@code
+ * dev.ltms.fleet.FleetdStartupValidationTest#mainRefusesACharterNamingAnUnregisteredTool} is what
+ * closes #469's actual gap: it proves that call is wired into {@code Fleetd.main} itself, against a
+ * live-shaped config fixture, not just a unit call to the method in isolation.
+ */
 class CharterToolSurfaceTest {
 
-    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
-
     private static Set<String> matches(String text, String regex) {
         Matcher m = Pattern.compile(regex).matcher(text);
         Set<String> found = new LinkedHashSet<>();
@@ -33,13 +52,8 @@ class CharterToolSurfaceTest {
                 "(fleet_[a-z_]+|bridge_[a-z_]+)");
     }
 
-    /** Every tool {@link FleetMcp} registers, read from its {@code tool("…")} calls. */
-    private static Set<String> toolsTheServerRegisters() throws Exception {
-        return matches(Files.readString(MCP_SOURCE), "tool\\(\\\"(fleet_[a-z_]+)\\\"");
-    }
-
     @Test
-    @DisplayName("[SOURCE TEXT] every tool named in a configured charter is registered by the server")
+    @DisplayName("every tool named in a configured charter is in the canonical FleetTool set")
     void configuredChartersNameOnlyRegisteredTools(@TempDir Path dir) throws Exception {
         Path configFile = dir.resolve("charters.yaml");
         Files.writeString(configFile, """
@@ -53,20 +67,58 @@ class CharterToolSurfaceTest {
 
         FleetConfig config = FleetConfig.load(configFile);
         Set<String> named = toolsNamedIn(config);
-        Set<String> registered = toolsTheServerRegisters();
+        Set<String> registered = FleetTool.wireNames();
 
         assertTrue(!named.isEmpty(),
                 "the charter fixture named no fleet_* or bridge_* tool. This test would check nothing; "
                         + "add charter text that names a tool before changing the extraction.");
         assertTrue(!registered.isEmpty(),
-                "the FleetMcp registration scrape found no tools. This test would check nothing; "
-                        + "repair the tool(\"…\") extraction before changing the assertion.");
+                "FleetTool.wireNames() is empty. This test would check nothing; repair FleetTool "
+                        + "before changing the assertion.");
 
         Set<String> unknown = new LinkedHashSet<>(named);
         unknown.removeAll(registered);
         assertTrue(unknown.isEmpty(),
-                "configured charter text names " + unknown + ", but FleetMcp does not register it. "
+                "configured charter text names " + unknown + ", but FleetTool does not list it. "
                         + "Checked " + named + " against " + registered + ". Fix the charter text or "
-                        + "register the tool; do NOT weaken this test.");
+                        + "add the tool to FleetTool; do NOT weaken this test.");
+    }
+
+    /**
+     * The positive case for the actual production entry point: a charter naming only tools
+     * {@link FleetTool} lists must not throw.
+     */
+    @Test
+    @DisplayName("CharterToolSurface accepts a charter that names only registered tools")
+    void charterToolSurfaceAcceptsKnownTools() {
+        assertDoesNotThrow(() -> CharterToolSurface.assertChartersNameOnlyRegisteredTools(Map.of(
+                "dev", "Send the final handoff through fleet_reply, using fleet_send to delegate.",
+                "reviewer", "Use fleet_ask only for the lead's decision.")));
+    }
+
+    /**
+     * The negative case for the actual production entry point (fleetd #469's motivating example:
+     * {@code bridge_send} is the pre-CB-634 name, removed from the tool surface). The message must
+     * name both the offending charter key and the unknown tool, so an operator reading the startup
+     * log knows exactly which charter to fix.
+     */
+    @Test
+    @DisplayName("CharterToolSurface rejects a charter naming a tool the server does not register")
+    void charterToolSurfaceRejectsAnUnregisteredTool() {
+        Map<String, String> charters = new LinkedHashMap<>();
+        charters.put("dev", "Send the final handoff through bridge_send.");
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                () -> CharterToolSurface.assertChartersNameOnlyRegisteredTools(charters));
+        assertTrue(e.getMessage().contains("dev"),
+                "expected the charter key 'dev' in the failure message, got: " + e.getMessage());
+        assertTrue(e.getMessage().contains("bridge_send"),
+                "expected the unknown tool 'bridge_send' in the failure message, got: " + e.getMessage());
+    }
+
+    @Test
+    @DisplayName("CharterToolSurface is a no-op on an absent or empty charter map")
+    void charterToolSurfaceIsANoOpWithNoCharters() {
+        assertDoesNotThrow(() -> CharterToolSurface.assertChartersNameOnlyRegisteredTools(null));
+        assertDoesNotThrow(() -> CharterToolSurface.assertChartersNameOnlyRegisteredTools(Map.of()));
     }
 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -26,7 +26,6 @@ import org.junit.jupiter.api.Test;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;
 import java.util.regex.Matcher;
@@ -50,7 +49,6 @@ import static org.junit.jupiter.api.Assertions.*;
 class FleetMcpAuthzTest {
 
     private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
-    private static final Pattern TOOL_REGISTRATION = Pattern.compile("tool\\(\\\"(fleet_[a-z_]+)\\\"");
 
     private final FakeHerdr herdr = new FakeHerdr();
     private final AgentControl agents = new AgentControl(herdr);
@@ -296,10 +294,18 @@ class FleetMcpAuthzTest {
 
     @Test
     void everyRegisteredToolHasItsHandlerActionPinned() {
-        Set<String> registered = toolsTheServerRegisters();
+        // fleetd #469: this used to scrape FleetMcp.java's tool("…") calls for the registered set —
+        // a third copy of the same list this file, CharterToolSurfaceTest and McpContractDocTest
+        // each kept independently. All three now read FleetTool.wireNames(), the canonical set
+        // FleetMcp itself derives its tool schemas AND its authorization switch from; adding a tool
+        // there without pinning its action in FleetMcp#authzAction is a compile error, so this test's
+        // per-tool assertions below are a run-time regression pin on top of that compile-time check,
+        // not the only thing standing between a new tool and an unpinned action.
+        Set<String> registered = FleetTool.wireNames();
         assertTrue(registered.size() >= 10,
-                "scraped only " + registered.size() + " tool registrations from FleetMcp (" + registered
-                        + "); the server registers eleven, so the tool(\"…\") scrape has stopped matching");
+                "FleetTool.wireNames() returned only " + registered.size() + " tool(s) (" + registered
+                        + "); the server registers eleven, so FleetTool has stopped listing the real "
+                        + "tool surface");
         registered.forEach(tool -> assertDoesNotThrow(() -> FleetMcp.toolAction(tool, Map.of()),
                 () -> tool + " is registered but has no pinned authorization action"));
 
@@ -319,19 +325,6 @@ class FleetMcpAuthzTest {
                 FleetMcp.toolAction("fleet_poll", Map.of("coordId", "mac-opus")));
     }
 
-    private static Set<String> toolsTheServerRegisters() {
-        try {
-            Matcher matcher = TOOL_REGISTRATION.matcher(Files.readString(MCP_SOURCE));
-            Set<String> tools = new LinkedHashSet<>();
-            while (matcher.find()) {
-                tools.add(matcher.group(1));
-            }
-            return tools;
-        } catch (Exception e) {
-            throw new AssertionError("could not scrape FleetMcp tool registrations", e);
-        }
-    }
-
     @Test
     void aWorkerMayNotDrainAnotherSessionsInboxByPolling() {
         FleetMcp m = mcp(true);

fleetd/src/test/java/dev/ltms/fleet/mcp/McpContractDocTest.java

@@ -27,16 +27,21 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  * somewhere to be readable, and that is exactly the sentence that rots. This test is what makes it
  * safe to write.
  *
- * <p><b>It checks source text, not behaviour.</b> It reads the Markdown and reads {@link FleetMcp}'s
- * source, and it only catches a name in the doc that the server does not register. It cannot catch a
- * flow that describes the wrong order, or a parameter name in prose — those are not name-shaped. The
- * doc's own header carries that caveat for its readers.
+ * <p><b>It checks source text, not behaviour.</b> It reads the Markdown, and it only catches a name
+ * in the doc that the server does not register. It cannot catch a flow that describes the wrong
+ * order, or a parameter name in prose — those are not name-shaped. The doc's own header carries
+ * that caveat for its readers.
+ *
+ * <p>fleetd #469: the registered side used to be its own scrape of {@code FleetMcp.java}'s {@code
+ * tool("…")} calls — a third copy of the same list {@code CharterToolSurfaceTest} and {@code
+ * FleetMcpAuthzTest} each kept their own copy of too. All three now read {@link
+ * FleetTool#wireNames()}, the one canonical set {@code FleetMcp} itself derives its tool schemas and
+ * authorization switch from.
  */
 class McpContractDocTest {
 
     /** Tests run with the module directory as cwd, so the repo-root doc is one level up. */
     private static final Path DOC = Path.of("../docs/MCP-Contract.md");
-    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
 
     private static Set<String> matches(Path file, String regex) throws Exception {
         Matcher m = Pattern.compile(regex).matcher(Files.readString(file));
@@ -52,15 +57,10 @@ class McpContractDocTest {
         return matches(DOC, "(fleet_[a-z_]+)");
     }
 
-    /** Every tool {@link FleetMcp} actually registers, read from its {@code tool("…")} calls. */
-    private static Set<String> toolsTheServerRegisters() throws Exception {
-        return matches(MCP_SOURCE, "tool\\(\"(fleet_[a-z_]+)\"");
-    }
-
     @Test
     @DisplayName("[SOURCE TEXT] every fleet_* tool named in MCP-Contract.md is one the server registers")
     void theDocNamesNoToolThatDoesNotExist() throws Exception {
-        Set<String> registered = toolsTheServerRegisters();
+        Set<String> registered = FleetTool.wireNames();
         Set<String> named = toolsNamedInTheDoc();
 
         Set<String> unknown = new LinkedHashSet<>(named);
@@ -84,13 +84,13 @@ class McpContractDocTest {
     @Test
     @DisplayName("[SOURCE TEXT] the doc/server name check is not vacuous — both sides found names")
     void theCheckActuallyHasSomethingToCheck() throws Exception {
-        Set<String> registered = toolsTheServerRegisters();
+        Set<String> registered = FleetTool.wireNames();
         Set<String> named = toolsNamedInTheDoc();
 
         assertTrue(registered.size() >= 10,
-                "scraped only " + registered.size() + " tool registrations from FleetMcp (" + registered
-                        + "); the server registers eleven, so the tool(\"…\") scrape has stopped matching "
-                        + "and the check above is now vacuous");
+                "FleetTool.wireNames() returned only " + registered.size() + " tool(s) (" + registered
+                        + "); the server registers eleven, so FleetTool has stopped listing the real "
+                        + "tool surface and the check above is now vacuous");
         assertTrue(named.size() >= 4,
                 "docs/MCP-Contract.md names only " + named.size() + " fleet_* tool(s) (" + named + "). "
                         + "The flows describe delegation, clarification, detached delivery and the "

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeLauncherTest.java

@@ -762,250 +762,6 @@ class OpenCodeLauncherTest {
                 "no IDE server when ideMcpUrl is unset");
     }
 
-    // --- fleetd #393: memberSkills seeding must actually reach an opencode member -------------------
-    //
-    // Before this fix, GitWorktrees#seedSkills copied skill folders into EVERY provisioned
-    // worktree's .claude/skills/ and logged "skill seeding: N of M" regardless of which kind ended
-    // up spawning into that worktree — a claim that held for kind: claude-code (the CLI discovers
-    // that directory on its own) but was a guaranteed no-op for kind: opencode, which has no such
-    // discovery. These tests drive the REAL GitWorktrees#add seeding path (not a hand-built
-    // .claude/skills/ fixture), then spawn an opencode-kind member against the seeded worktree and
-    // assert on what the member can actually consume — an instructions[] entry — not on the
-    // seeding log alone. A minimal, non-hermetic git repo is enough here: unlike
-    // GitWorktreesTest's own seeding tests, nothing in this file cares about core.excludesFile
-    // composition, only about what lands in .claude/skills/ and whether OpenCodeLauncher reads it.
-
-    private static void git(Path cwd, String... args) throws Exception {
-        Process p = new ProcessBuilder(prepend("git", args)).directory(cwd.toFile())
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git timed out: git " + String.join(" ", args));
-        assertEquals(0, p.exitValue(), "git " + String.join(" ", args) + " failed:\n" + out);
-    }
-
-    private static List<String> prepend(String head, String... rest) {
-        List<String> cmd = new ArrayList<>();
-        cmd.add(head);
-        cmd.addAll(List.of(rest));
-        return cmd;
-    }
-
-    private static Path initRepo(Path dir) throws Exception {
-        Files.createDirectories(dir);
-        git(dir, "init", "-q", "-b", "main");
-        git(dir, "config", "user.email", "test@example.invalid");
-        git(dir, "config", "user.name", "Test");
-        Files.writeString(dir.resolve("README.md"), "seed\n");
-        git(dir, "add", "README.md");
-        git(dir, "commit", "-q", "-m", "seed");
-        return dir;
-    }
-
-    @Test
-    void aSeededSkillReachesTheOpencodeMembersInstructionsArray(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        Path skillsSource = tmp.resolve("skills-src");
-        Path skillFile = skillsSource.resolve("implementer").resolve("SKILL.md");
-        Files.createDirectories(skillFile.getParent());
-        Files.writeString(skillFile, "IMPLEMENTER PROCEDURE\n");
-
-        // The real seeding path (fleetd #362), not a hand-built .claude/skills/ fixture — proves
-        // OpenCodeLauncher reads what GitWorktrees#add actually produced.
-        dev.ltms.fleet.session.GitWorktrees worktrees =
-                new dev.ltms.fleet.session.GitWorktrees(tmp.resolve("wts").toString(), null, skillsSource.toString());
-        String wt = worktrees.add(repo.toString(), "cb-393-opencode", "HEAD");
-        Path seededSkillMd = Path.of(wt, ".claude", "skills", "implementer", "SKILL.md");
-        assertTrue(Files.exists(seededSkillMd),
-                "sanity: the real seeding step must have copied the skill into the worktree");
-
-        Logger logger = (Logger) LoggerFactory.getLogger(OpenCodeLauncher.class);
-        Level original = logger.getLevel();
-        logger.setLevel(Level.INFO);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-
-        String cfgPath;
-        try {
-            // No mcpUrl, no ideUrl, no fleet (no charter): the seeded skill alone must be enough to
-            // trigger OPENCODE_CONFIG — proves the gate itself was updated, not only writeConfig's body.
-            FakeHerdr herdr = new FakeHerdr();
-            Path configRoot = Files.createDirectory(tmp.resolve("configs"));
-            service(herdr, configRoot, opencodeIdeCfg(null, null, wt)).spawn();
-            cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        } finally {
-            logger.detachAppender(appender);
-            logger.setLevel(original);
-        }
-
-        assertNotNull(cfgPath, "a seeded skill with nothing else configured must still write a config");
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        List<String> instructions = new ArrayList<>();
-        json.path("instructions").forEach(n -> instructions.add(n.asText()));
-        assertTrue(instructions.contains(seededSkillMd.toAbsolutePath().toString()),
-                "the seeded skill's SKILL.md must be an instructions[] entry — got: " + instructions);
-
-        List<String> infos = appender.list.stream()
-                .filter(e -> e.getLevel() == Level.INFO)
-                .map(ILoggingEvent::getFormattedMessage)
-                .toList();
-        assertTrue(infos.stream().anyMatch(m -> m.contains("skill delivery") && m.contains("1 of 1")),
-                "the launcher must log, kind-aware, that it delivered the skill — got:\n" + infos);
-    }
-
-    @Test
-    void aSkillFolderWithoutSkillMdIsNeverDeliveredAndTheLogNamesIt(@TempDir Path tmp) throws Exception {
-        Path wt = Files.createDirectories(tmp.resolve("wt"));
-        Path goodSkill = wt.resolve(".claude").resolve("skills").resolve("implementer");
-        Files.createDirectories(goodSkill);
-        Files.writeString(goodSkill.resolve("SKILL.md"), "GOOD\n");
-        Path halfShipped = wt.resolve(".claude").resolve("skills").resolve("half-shipped");
-        Files.createDirectories(halfShipped);
-        Files.writeString(halfShipped.resolve("README.md"), "no SKILL.md here\n");
-
-        Logger logger = (Logger) LoggerFactory.getLogger(OpenCodeLauncher.class);
-        Level original = logger.getLevel();
-        logger.setLevel(Level.INFO);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-
-        String cfgPath;
-        try {
-            FakeHerdr herdr = new FakeHerdr();
-            Path configRoot = Files.createDirectory(tmp.resolve("configs"));
-            service(herdr, configRoot, opencodeIdeCfg(null, null, wt.toString())).spawn();
-            cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        } finally {
-            logger.detachAppender(appender);
-            logger.setLevel(original);
-        }
-
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        List<String> instructions = new ArrayList<>();
-        json.path("instructions").forEach(n -> instructions.add(n.asText()));
-        assertTrue(instructions.contains(goodSkill.resolve("SKILL.md").toAbsolutePath().toString()),
-                "the well-formed skill is still delivered alongside the malformed one");
-        assertFalse(instructions.stream().anyMatch(i -> i.contains("half-shipped")),
-                "a skill folder with no SKILL.md can never become an instructions[] entry");
-
-        List<String> infos = appender.list.stream()
-                .filter(e -> e.getLevel() == Level.INFO)
-                .map(ILoggingEvent::getFormattedMessage)
-                .toList();
-        assertTrue(infos.stream().anyMatch(m -> m.contains("skill delivery") && m.contains("1 of 2")
-                        && m.contains("half-shipped") && m.contains("could not be delivered")),
-                "the log must say plainly which folder could not be consumed and why — got:\n" + infos);
-    }
-
-    // --- fleetd #393 follow-up: instructions[] has three writers (charter, seeded skills, IDE
-    // rules), and no test above ever exercises more than one or two of them together. A writer
-    // that flips from withArray (get-or-create) to putArray (create-or-REPLACE) silently deletes
-    // every entry written before it — proven live on this branch's merge: switching just the
-    // skills writer to putArray left the entire suite (1603 tests) green while deleting the
-    // charter entry an opencode member needs for its role contract. That hazard was found by the
-    // fleet01 lead and independently verified against this branch; it is not a defect in the
-    // skills-delivery or logging tests above, which both hold up under their own mutations — the
-    // gap is that none of them combine all three writers in one config.
-    //
-    // These three tests assert instructions[] CONTENT as an exact, ordered list, not a size or a
-    // "contains" check: a putArray mutation can replace N entries with a different N entries of
-    // the same count, so only a content comparison can tell "all three paths present" apart from
-    // "two paths present that replaced the earlier ones".
-
-    @Test
-    void instructionsArrayHoldsExactlyTheCharterWhenNothingElseWritesToIt(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Fleet fleet = new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        Path cwd = Files.createDirectory(root.resolve("checkout"));
-        service(herdr, root, opencodeIdeCfg(null, null, cwd.toString()), () -> fleet).spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "a role charter alone still writes a config");
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        Path charter = Path.of(cfgPath).resolveSibling("member-charter.md");
-        assertTrue(Files.exists(charter), "the charter file was written");
-
-        List<String> instructions = new ArrayList<>();
-        json.path("instructions").forEach(n -> instructions.add(n.asText()));
-        assertEquals(List.of(charter.toAbsolutePath().toString()), instructions,
-                "with only the charter writer active, instructions[] holds exactly one entry: the "
-                        + "charter — got: " + instructions);
-    }
-
-    @Test
-    void instructionsArrayHoldsCharterThenIdeRulesInOrder(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Fleet fleet = new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        Path cwd = Files.createDirectory(root.resolve("checkout"));
-        service(herdr, root, opencodeIdeCfg(null,
-                "http://127.0.0.1:29170/index-mcp/streamable-http", cwd.toString()), () -> fleet).spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "charter + IDE rules still writes a config");
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        Path charter = Path.of(cfgPath).resolveSibling("member-charter.md");
-        Path rules = Path.of(cfgPath).resolveSibling("ide-rules.md");
-        assertTrue(Files.exists(charter), "the charter file was written");
-        assertTrue(Files.exists(rules), "the ide-rules file was written");
-
-        List<String> instructions = new ArrayList<>();
-        json.path("instructions").forEach(n -> instructions.add(n.asText()));
-        assertEquals(List.of(charter.toAbsolutePath().toString(), rules.toAbsolutePath().toString()),
-                instructions,
-                "with charter + IDE-rules writers active, instructions[] holds both, charter first — "
-                        + "got: " + instructions);
-    }
-
-    @Test
-    void instructionsArrayHoldsCharterThenSkillsThenIdeRulesInOrder(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        Path skillsSource = tmp.resolve("skills-src");
-        Path skillFile = skillsSource.resolve("implementer").resolve("SKILL.md");
-        Files.createDirectories(skillFile.getParent());
-        Files.writeString(skillFile, "IMPLEMENTER PROCEDURE\n");
-
-        dev.ltms.fleet.session.GitWorktrees worktrees = new dev.ltms.fleet.session.GitWorktrees(
-                tmp.resolve("wts").toString(), null, skillsSource.toString());
-        String wt = worktrees.add(repo.toString(), "cb-393-follow-up", "HEAD");
-        Path seededSkillMd = Path.of(wt, ".claude", "skills", "implementer", "SKILL.md");
-        assertTrue(Files.exists(seededSkillMd), "sanity: the real seeding step copied the skill");
-
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Fleet fleet = new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        Path configRoot = Files.createDirectory(tmp.resolve("configs"));
-        service(herdr, configRoot, opencodeIdeCfg(null,
-                "http://127.0.0.1:29170/index-mcp/streamable-http", wt), () -> fleet).spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "charter + skills + IDE rules still writes a config");
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        Path charter = Path.of(cfgPath).resolveSibling("member-charter.md");
-        Path rules = Path.of(cfgPath).resolveSibling("ide-rules.md");
-        assertTrue(Files.exists(charter), "the charter file was written");
-        assertTrue(Files.exists(rules), "the ide-rules file was written");
-
-        List<String> instructions = new ArrayList<>();
-        json.path("instructions").forEach(n -> instructions.add(n.asText()));
-        // Exact ordered list, not size or "contains": a putArray mutation on any writer after the
-        // charter replaces every entry written before it, and the replacement can still be a
-        // plausible-looking array of a different shape. This is the one combination all three
-        // writers are active for — and per fleet01 the realistic shape on a host where weighted
-        // placement makes opencode the default for most members.
-        assertEquals(List.of(charter.toAbsolutePath().toString(),
-                        seededSkillMd.toAbsolutePath().toString(),
-                        rules.toAbsolutePath().toString()),
-                instructions,
-                "with all three writers active, instructions[] must hold charter, then the seeded "
-                        + "skill, then IDE rules — in that order and with nothing replaced. A "
-                        + "putArray mutation on any writer after the charter would silently drop "
-                        + "earlier entries here while still producing a same-shaped array — got: "
-                        + instructions);
-    }
-
     // --- fleetd #219: config root + discovery root under memberHerdrSocket ------------------------
 
     /** A config with {@code memberHerdrSocket:} set, and optionally {@code worktreeRoot:}/{@code worktreeGroup:}. */

fleetd/src/test/java/dev/ltms/fleet/placement/BackendQuarantineTest.java

@@ -116,4 +116,117 @@ class BackendQuarantineTest {
         assertThrows(IllegalArgumentException.class, () -> new BackendQuarantine(() -> 0L, 0L));
         assertThrows(IllegalArgumentException.class, () -> new BackendQuarantine(() -> 0L, -1L));
     }
+
+    // --- fleetd #466: escalating cooldown -----------------------------------------------------
+    //
+    // Base cooldown 600s (10 min), multiplier 2.0, ceiling 2400s (4x base) — small round numbers
+    // chosen so every deadline is an exact assertion, not just "greater than before". Each call
+    // below lands at or before the previous deadline (a zero or negative gap), which is always
+    // "no more than one base cooldown after the previous deadline" — i.e. every call continues the
+    // same streak, matching a credential that keeps reporting exhausted with no lull.
+
+    @Test
+    void anInvalidBackoffMultiplierIsRejected() {
+        assertThrows(IllegalArgumentException.class,
+                () -> new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30), 0.5, TimeUnit.HOURS.toNanos(6)));
+    }
+
+    @Test
+    void aCeilingBelowTheBaseCooldownIsRejected() {
+        assertThrows(IllegalArgumentException.class,
+                () -> new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30), 2.0, TimeUnit.MINUTES.toNanos(10)));
+    }
+
+    @Test
+    void repeatedExhaustionEscalatesTheCooldownByExactAmounts() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: base cooldown
+        assertEquals(OptionalLong.of(600L), q.remainingSeconds("shared-openai"));
+
+        now.set(TimeUnit.SECONDS.toNanos(100)); // still inside the 1st quarantine (deadline 600s)
+        q.quarantine("shared-openai"); // 2nd: 600 * 2^1 = 1200
+        assertEquals(OptionalLong.of(1200L), q.remainingSeconds("shared-openai"),
+                "a second consecutive exhaustion must double the cooldown, not just increase it");
+
+        now.set(TimeUnit.SECONDS.toNanos(1300)); // exactly the 2nd deadline (100 + 1200)
+        q.quarantine("shared-openai"); // 3rd: 600 * 2^2 = 2400 (exactly at the ceiling)
+        assertEquals(OptionalLong.of(2400L), q.remainingSeconds("shared-openai"));
+    }
+
+    @Test
+    void escalationStopsAtTheCeiling() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: 600
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai"); // 2nd: 1200, deadline 1800
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // 3rd: 600 * 4 = 2400, at the ceiling, deadline 4200
+        now.set(TimeUnit.SECONDS.toNanos(4200));
+        q.quarantine("shared-openai"); // 4th: 600 * 8 = 4800 uncapped, must stay capped at 2400
+        assertEquals(OptionalLong.of(2400L), q.remainingSeconds("shared-openai"),
+                "the cooldown must never exceed the configured ceiling, however long the streak gets");
+
+        now.set(TimeUnit.SECONDS.toNanos(6600)); // 4th deadline
+        q.quarantine("shared-openai"); // 5th: still capped
+        assertEquals(OptionalLong.of(2400L), q.remainingSeconds("shared-openai"),
+                "pushing well past the ceiling must not budge it");
+    }
+
+    @Test
+    void aQuietGapLongerThanTheBaseCooldownResetsToTheBaseCooldown() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: 600, deadline 600
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai"); // 2nd: 1200, deadline 1800
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // 3rd: 2400, deadline 4200
+        assertEquals(OptionalLong.of(2400L), q.remainingSeconds("shared-openai"));
+
+        // Quiet for well over one base cooldown (600s) past the 3rd deadline (4200s).
+        now.set(TimeUnit.SECONDS.toNanos(20_000));
+        q.quarantine("shared-openai"); // treated as a fresh occurrence
+        assertEquals(OptionalLong.of(600L), q.remainingSeconds("shared-openai"),
+                "a long quiet gap must reset the streak back to the base cooldown");
+    }
+
+    @Test
+    void escalatingOneCredentialDoesNotSlowAnother() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.SECONDS.toNanos(600), 2.0,
+                TimeUnit.SECONDS.toNanos(2400));
+
+        q.quarantine("shared-openai"); // 1st: 600
+        now.set(TimeUnit.SECONDS.toNanos(600));
+        q.quarantine("shared-openai"); // 2nd: 1200
+        now.set(TimeUnit.SECONDS.toNanos(1800));
+        q.quarantine("shared-openai"); // 3rd: 2400 — three-in-a-row streak on this credential only
+
+        q.quarantine("another-credential"); // its first and only exhaustion
+        assertEquals(OptionalLong.of(600L), q.remainingSeconds("another-credential"),
+                "an unrelated credential's cooldown must stay at the base rate, unaffected by a sibling's streak");
+    }
+
+    @Test
+    void withEscalationDefaultsToDoublingCappedAtTwelveTimesTheBase() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendQuarantine q = BackendQuarantine.withEscalation(now::get, TimeUnit.MINUTES.toNanos(30));
+
+        q.quarantine("shared-openai");
+        assertEquals(OptionalLong.of(1800L), q.remainingSeconds("shared-openai"),
+                "the first occurrence must still use the base cooldown");
+
+        now.set(TimeUnit.MINUTES.toNanos(30));
+        q.quarantine("shared-openai");
+        assertEquals(OptionalLong.of(3600L), q.remainingSeconds("shared-openai"),
+                "the default multiplier must be 2.0");
+    }
 }