fleetd #439 : pin the caller at the fleet_list call site, not just the gate

Review of PR #462 found M2: the coordinatorVisibleTo gate (then an inline principal(exchange).isPrimary() check) could survive a mutation that replaced the argument with a literal true at the one production call site, because every existing test drove listFleet directly and supplied the boolean itself -- nothing exercised the handler's own call. - Name the decision: FleetMcp.coordinatorVisibleTo(Principal), a small package-private predicate next to denyFor/recordPrimarySingleton. The fleet_list handler now calls coordinatorVisibleTo(principal(exchange)) instead of inlining .isPrimary(). - Pin the predicate's role table in FleetMcpAuthzTest (onlyThePrimaryMaySeeTheCoordinatorRow), covering primary/worker/ architect and, newly, anonymous. - Add a source-reading detector at the boundary (theFleetListHandlerActuallyConsultsCoordinatorVisibleTo), same idiom as toolsTheServerRegisters/everyRegisteredToolHasItsHandlerActionPinned: it reads FleetMcp.java, isolates the listHandler block, asserts (as a control) that the block actually contains a listFleet( call, then asserts the call's trailing boolean argument is exactly coordinatorVisibleTo(principal(exchange)) -- not a literal true/false. Both mutations from the review were reproduced and killed by these tests, then reverted; see the PR body for the full break-and-restore transcript.
fleetd #439 : omit fleet_list's coordinator key for non-primary callers
2026-09-10 18:28:16 +07:00 · 2026-09-10 18:16:48 +07:00 · 2026-09-10 18:05:07 +07:00 · 2026-09-10 13:04:09 +02:00 · 2026-09-10 17:59:52 +07:00 · 2026-09-10 17:49:37 +07:00
17 changed files with 381 additions and 973 deletions
@@ -207,12 +207,8 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      omit and this profile's completion fallback behaves exactly as before.
 #                      Every backend words its refusal differently, so this is config, never a
 #                      vendor string baked into fleetd itself.
-#                      HOT (fleetd #446): read live, cached by profile name, at every
-#                      completion-fallback check AND by fleet_profiles' exhaustionDetectionArmed —
-#                      editing it and reloading arms or disarms usage-limit detection for this
-#                      profile with no daemon restart. (Before fleetd #446 this was DEFERRED,
-#                      compiled once into a startup pattern map like model/baseUrl/argv still are —
-#                      see errorPattern below, which is still deferred that way on purpose.)
+#                      DEFERRED: compiled once into a startup pattern map — editing it needs a
+#                      daemon restart, same as this profile's model/baseUrl/argv.
 #   credentialId     → CB-578 stage B: the credential this profile quarantines WITH when a
 #                      BACKEND_EXHAUSTED classification fires. Two profiles that set the SAME
 #                      credentialId share one quarantine — the case this exists for is two models
@@ -231,9 +227,8 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      happens, just without a profile-specific match; every backend words its
 #                      failure differently, so a hardcoded sentence would only ever match one
 #                      of them.
-#                      DEFERRED: compiled once into a startup pattern map — editing it needs a
-#                      daemon restart. Unlike exhaustedPattern above (made hot by fleetd #446),
-#                      errorPattern was scoped out of that ticket on purpose and stays deferred.
+#                      DEFERRED: compiled once into a startup pattern map, same as exhaustedPattern
+#                      — editing it needs a daemon restart.
 #                      # errorPattern: "503 Service Unavailable"   # opt-in: classify a backend outage
 #
 #                      What happens once a match fires (BackendOutagePolicy, credentialId-keyed,
@@ -473,10 +468,9 @@ placement: weighted
 # when the reload happens — not about how important the key is:
 #   HOT       → takes effect on the next spawn: the whole `fleet:` block (every role pool,
 #               `charters`, and `tabLabel`), `placement:`, and an existing profile's weight / maxLoad
-#               / credentialId / exhaustedPattern. Those are hot because the placement policy (and,
-#               for credentialId, the CB-578 stage B quarantine check; for exhaustedPattern, fleetd
-#               #446's LiveExhaustedPatterns) reads them through a supplier — being config is not by
-#               itself enough to make a key hot.
+#               / credentialId. Those are hot because the placement policy (and, for credentialId,
+#               the CB-578 stage B quarantine check) reads them through a supplier — being config is
+#               not by itself enough to make a key hot.
 #               EXCEPT `fleet.leaders`: Fleetd.main reads it once at startup to build the lead tab
 #               scanner and launcher, and neither is rebuilt on reload. A changed/added/removed
 #               `fleet.leaders` entry is silently accepted — the reload reports "config reloaded"
@@ -488,10 +482,10 @@ placement: weighted
 #               stage B — baked once into the quarantine tracker built at startup), ADDING or
 #               REMOVING a profile (a new backend needs its own launcher, and launchers are built
 #               once), AND an existing profile's launch settings — model, baseUrl, argv, env,
-#               configDir, mcpUrl, tabLabel, errorPattern (fleetd #201 / #227 — compiled once into
-#               a startup pattern map; exhaustedPattern used to be compiled the same way until
-#               fleetd #446 made it hot — see above). The launcher takes a copy of `profiles:` at
-#               startup and resolves every spawn out of that copy, so those never
+#               configDir, mcpUrl, tabLabel, exhaustedPattern, errorPattern (fleetd #201 / #227 —
+#               compiled once into a startup pattern map the same way exhaustedPattern is). The
+#               launcher takes a copy of `profiles:` at startup and resolves every spawn out of
+#               that copy, so those never
 #               reach a launch until you restart. The reload logs them by name rather than
 #               pretending they applied.
 #   COLD      → cannot change at all: `bind:`, `herdrSocket:`, `broker:` and `auth:`. The socket is
@@ -18,7 +18,6 @@ import dev.ltms.fleet.inject.BackendErrorSink;
 import dev.ltms.fleet.inject.CompletionResolver;
 import dev.ltms.fleet.inject.ExhaustedPatternLookup;
 import dev.ltms.fleet.inject.ExhaustionSink;
-import dev.ltms.fleet.inject.LiveExhaustedPatterns;
 import dev.ltms.fleet.inject.Injector;
 import dev.ltms.fleet.inject.StatusPoller;
 import dev.ltms.fleet.inject.TurnListener;
@@ -66,13 +65,11 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
-import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.TreeSet;
-import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
@@ -81,7 +78,6 @@ import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;

 /**
 * {@code fleetd} entry point. Wires the real herdr socket client to the REST app and
@@ -382,34 +378,28 @@ public final class Fleetd {
        Rendezvous rendezvous = new Rendezvous();
        // CB-578 stage A: classify a completion-fallback scrape that matches a profile's configured
        // usage-limit refusal as BACKEND_EXHAUSTED rather than handing it back as a real answer.
-        // fleetd #446: read live off `config` per lookup, cached by profile name — see
-        // LiveExhaustedPatterns's class doc for why this replaces the old compiled-once-at-startup
-        // map. A profile with no exhaustedPattern simply returns null here, so its workers keep
-        // today's completion-fallback behaviour unchanged.
-        LiveExhaustedPatterns liveExhaustedPatterns = new LiveExhaustedPatterns(() -> config.get().profiles());
+        // Compiled once at startup, keyed by profile name; a profile with no exhaustedPattern is
+        // simply absent here, so its workers keep today's completion-fallback behaviour unchanged.
+        Map<String, Pattern> exhaustedPatternsByProfile = new LinkedHashMap<>();
+        cfg.profiles().forEach((name, profile) -> {
+            if (profile.hasExhaustedPattern()) {
+                exhaustedPatternsByProfile.put(name, Pattern.compile(profile.exhaustedPattern()));
+            }
+        });
        ExhaustedPatternLookup exhaustedPatterns = target -> sessions.roster().stream()
                .filter(session -> target.equals(session.terminalId()))
                .findFirst()
-                .map(session -> liveExhaustedPatterns.patternFor(session.profile()))
+                .map(session -> exhaustedPatternsByProfile.get(session.profile()))
                .orElse(null);
-        // The startup coverage line still reports the boot-time snapshot only — it is printed once,
-        // here, and a reload no longer needs to change what it said; exhaustionDetectionArmed (via
-        // liveExhaustedPatterns.armed, wired into quarantineSource below) is what stays live.
-        Set<String> exhaustedConfiguredAtStartup = cfg.profiles().entrySet().stream()
-                .filter(e -> e.getValue().hasExhaustedPattern())
-                .map(Map.Entry::getKey)
-                .collect(Collectors.toCollection(LinkedHashSet::new));
        log.info("backend-exhausted classification (CB-578 stage A): {}",
-                exhaustedPatternCoverageLine(cfg.profiles().keySet(), exhaustedConfiguredAtStartup));
+                exhaustedPatternCoverageLine(cfg.profiles().keySet(), exhaustedPatternsByProfile.keySet()));
        // fleetd #201 Unit 5: classify a completion-fallback scrape that matches a profile's
        // configured backend-error refusal (a credential outage, a provider 5xx) as a backend error
-        // rather than handing it back as a real answer. Still compiled once at startup, keyed by
-        // profile name — unlike exhaustedPattern above (fleetd #446), errorPattern was left DEFERRED
-        // on purpose: the ticket that made exhaustedPattern hot scoped errorPattern/cooling-off out
-        // explicitly. A profile with no configured errorPattern is simply absent here, so
-        // CompletionResolver falls back to its built-in narrow {@code (?i)\bAPI Error\s*:}
-        // compatibility pattern for that profile's targets (BackendErrorPatternLookup#legacy's
-        // contract — see backendErrorPatterns below).
+        // rather than handing it back as a real answer. Compiled once at startup, keyed by profile
+        // name, mirroring exhaustedPatternsByProfile above — a profile with no configured
+        // errorPattern is simply absent here, so CompletionResolver falls back to its built-in
+        // narrow {@code (?i)\bAPI Error\s*:} compatibility pattern for that profile's targets
+        // (BackendErrorPatternLookup#legacy's contract — see backendErrorPatterns below).
        Map<String, Pattern> errorPatternsByProfile = new LinkedHashMap<>();
        cfg.profiles().forEach((name, profile) -> {
            if (profile.hasErrorPattern()) {
@@ -427,20 +417,46 @@ public final class Fleetd {
        // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
        // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
        // the profile config live off `config`, so a credentialId edit is hot: no restart needed.
-        // fleetd #446 criterion 3: the backend text that triggered the most recent quarantine of
-        // each credential, so fleet_profiles can report WHY a limit was hit, not only that it was.
-        // Keyed by credential id — the same key BackendQuarantine's own remainingSeconds uses —
-        // and written at the one call site that actually quarantines (inside exhaustionSink below),
-        // so a reason can never be reported for a quarantine that never happened. Bounded the same
-        // way BackendQuarantine's own internal map is documented to be: by the number of distinct
-        // credentials ever exhausted, not by how often the config is edited.
-        Map<String, String> quarantineReasonByCredential = new ConcurrentHashMap<>();
-        // fleetd #446 follow-up (round 3): extracted into exhaustionSink(...) below — see that
-        // method's javadoc for the full fleetd #175/#234/#446 history this used to carry inline —
-        // so a dedicated test can drive the exact ExhaustionSink main() builds, not a hand-rebuilt
-        // copy of its shape.
-        ExhaustionSink exhaustionSink = exhaustionSink(sessions, config, quarantine,
-                quarantineReasonByCredential, cfg);
+        //
+        // fleetd #175: this sink is now also the quarantine target for OpenCodeLauncher's
+        // model-mismatch check — it needs nothing profile-specific from the caller beyond `target`
+        // (a herdr terminal id) and `reason`, so reusing it here is exactly "the existing
+        // ExhaustionSink path", not a new mechanism.
+        //
+        // fleetd #234: that check fires from SessionAwareHandle.agentSessionId(), which runs during
+        // SessionManager.acquire() BEFORE this session is registered in sessions.roster() — so the
+        // roster-only lookup below used to find nothing, .ifPresent silently no-op'd, and the
+        // ERROR the check had just logged ("quarantining this profile's credential") was a lie:
+        // nothing was quarantined, and nothing said so. Two changes: (1) OpenCodeLauncher now
+        // passes its OWN profile name via ExhaustionSink's 3-arg overload — it already has the
+        // FleetConfig.Profile in hand and does not need the roster at all — used here as a
+        // fallback whenever the roster lookup misses; (2) if a profile still cannot be resolved
+        // (neither the roster nor the hint names a configured one), this logs loudly at ERROR
+        // instead of silently doing nothing — a control that cannot act must say so.
+        // fleetd #234, round 4: the 3-arg overload is now ExhaustionSink's single abstract method,
+        // so this is safely a lambda — there is no separate 2-arg overload left for it to bind to
+        // instead and silently drop profileHint (that was rounds 1-3's whole hazard).
+        ExhaustionSink exhaustionSink = (target, reason, profileHint) -> {
+            String profileName = sessions.roster().stream()
+                    .filter(session -> target.equals(session.terminalId()))
+                    .findFirst()
+                    .map(MemberSession::profile)
+                    .orElse(profileHint);
+            FleetConfig.Profile profile = profileName == null ? null : config.get().profiles().get(profileName);
+            if (profile == null) {
+                log.error("quarantine requested for target '{}' ({}) but no profile could be "
+                                + "resolved — the target is not (yet) in the roster, and {} — "
+                                + "credential NOT quarantined (fleetd #234)",
+                        target, reason,
+                        profileHint == null ? "no profile hint was given"
+                                : "the hinted profile '" + profileHint + "' is not configured");
+                return;
+            }
+            String credentialId = profile.effectiveCredentialId();
+            quarantine.quarantine(credentialId);
+            log.warn("credential '{}' quarantined for {}s (profile '{}'): {}", credentialId,
+                    cfg.quarantineCooldownSeconds(), profile.profile(), reason);
+        };
        // fleetd #175: point the forwarding sink handed to OpenCodeLauncher above at the real one,
        // now that `sessions` exists to resolve target -> session -> profile.
        exhaustionSinkRef.set(exhaustionSink);
@@ -657,7 +673,7 @@ public final class Fleetd {
        // / BackendOutagePolicy would still be able to drift (e.g. a future edit to the credentialIdFor
        // closure in only one of the two places), exactly the shape #284 was.
        FleetMcp.QuarantineSource quarantineSource = quarantineSource(config, quarantine,
-                liveExhaustedPatterns, quarantineReasonByCredential);
+                exhaustedPatternsByProfile);
        FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(profile -> {
            var configured = config.get().profiles().get(profile);
            return configured == null ? null : configured.effectiveCredentialId();
@@ -789,99 +805,16 @@ public final class Fleetd {
    }

    /**
-     * fleetd #446 follow-up (round 3): the quarantine {@link ExhaustionSink} main() actually wires
-     * — extracted out of {@code main} for the same reason {@link #quarantineSource} below and
-     * {@link #usageLimitFixWarning}/{@link #usageLimitFixWarningNoModel} were. Round 2 pinned the
-     * WARNING text by having {@code FleetdUsageLimitFixWarningTest} call those two methods
-     * directly, but a mutation battery proved that left two gaps: nothing proved this sink's
-     * {@code log.warn} call actually uses either method (replacing the whole ternary with a
-     * literal string), and nothing proved it picks the right one for a profile WITH a configured
-     * {@code model:} versus one WITHOUT (swapping the ternary's two branches) — both mutations
-     * left round 2's full 1592-test suite green. {@code FleetdExhaustionSinkWarningTest} drives
-     * THIS factory's return value directly and asserts on the real text a {@code ListAppender}
-     * attached to this class's own logger captures — the only way to prove the caller, not just
-     * the two callees in isolation.
-     *
-     * <p>Behaviourally unchanged from the inline lambda this replaces:
-     * <ul>
-     *   <li>fleetd #175: also the quarantine target for {@code OpenCodeLauncher}'s model-mismatch
-     *       check — it needs nothing profile-specific beyond {@code target}/{@code reason}, so
-     *       reusing this sink is the existing {@code ExhaustionSink} path, not a new mechanism;</li>
-     *   <li>fleetd #234 (round 4): resolves {@code target} to a profile via the live session
-     *       roster first, falling back to {@code profileHint} — {@code
-     *       SessionAwareHandle.agentSessionId()} fires this sink during {@code
-     *       SessionManager.acquire()}, <em>before</em> that session is registered, so the
-     *       roster-only lookup alone used to silently miss it. A profile resolved neither way
-     *       logs loudly at ERROR instead of doing nothing;</li>
-     *   <li>fleetd #446 criterion 3: writes {@code quarantineReasonByCredential} at the one call
-     *       site that actually quarantines, keyed by credential id — see the field's declaration
-     *       in {@code main} for the bound on its size.</li>
-     * </ul>
-     *
-     * <p>{@code cfg} is the startup {@link FleetConfig} snapshot, read only for {@code
-     * quarantineCooldownSeconds()} in the log text — a Cold key (see {@code ConfigRef}'s class
-     * doc), so reading it off the snapshot rather than {@code config.get()} makes no observable
-     * difference and matches what the inline version already did.
-     */
-    static ExhaustionSink exhaustionSink(SessionManager sessions, ConfigRef config, BackendQuarantine quarantine,
-            Map<String, String> quarantineReasonByCredential, FleetConfig cfg) {
-        return (target, reason, profileHint) -> {
-            String profileName = sessions.roster().stream()
-                    .filter(session -> target.equals(session.terminalId()))
-                    .findFirst()
-                    .map(MemberSession::profile)
-                    .orElse(profileHint);
-            FleetConfig.Profile profile = profileName == null ? null : config.get().profiles().get(profileName);
-            if (profile == null) {
-                log.error("quarantine requested for target '{}' ({}) but no profile could be "
-                                + "resolved — the target is not (yet) in the roster, and {} — "
-                                + "credential NOT quarantined (fleetd #234)",
-                        target, reason,
-                        profileHint == null ? "no profile hint was given"
-                                : "the hinted profile '" + profileHint + "' is not configured");
-                return;
-            }
-            String credentialId = profile.effectiveCredentialId();
-            quarantine.quarantine(credentialId);
-            quarantineReasonByCredential.put(credentialId, reason);
-            log.warn("credential '{}' quarantined for {}s (profile '{}'): {}", credentialId,
-                    cfg.quarantineCooldownSeconds(), profile.profile(), reason);
-            // fleetd #446 criterion 2: name the fix, not just the fact — an operator reading this
-            // should not have to work out which of several configured models to touch.
-            String model = profile.model();
-            log.warn(model != null && !model.isBlank()
-                    ? usageLimitFixWarning(profile.profile(), model)
-                    : usageLimitFixWarningNoModel(profile.profile(), cfg.quarantineCooldownSeconds()));
-        };
-    }
-
-    /**
-     * fleetd #404, superseded by fleetd #446: production source for quarantine reporting.
-     * Credential IDs were already hot; {@code exhaustedPattern} used to be compiled once at
-     * startup for {@link CompletionResolver}, so the armed field had to read that same frozen map
-     * until restart — the exact asymmetry #446 exists to close. Both {@code exhaustedPatternArmed}
-     * here and {@link CompletionResolver}'s own classification now read the ONE live {@link
-     * LiveExhaustedPatterns} instance ({@code exhaustedPatterns.armed}/{@code .patternFor}), so a
-     * reload that arms or disarms a profile's detection is visible to both at once — never two
-     * independently-updated copies that could disagree, the fleetd #404 rule this method used to
-     * violate on purpose and now upholds.
-     *
-     * <p>{@code modelFor} and {@code reasonFor} back fleetd #446 criterion 3 — {@code
-     * fleet_profiles}'s quarantined row naming which model a quarantined profile runs
-     * ({@code modelFor}, read live off {@code config} the same way {@code credentialIdFor} already
-     * is) and the backend text that triggered the most recent quarantine of that credential
-     * ({@code reasonFor}, backed by {@code reasonByCredential} — see its call site in {@code main}
-     * for where that map is written, at the one place a credential is actually quarantined).
+     * fleetd #404: production source for quarantine reporting. Credential IDs are hot, but
+     * exhausted patterns are compiled once at startup for {@link CompletionResolver}, so the armed
+     * field must use that same compiled map until restart.
     */
    static FleetMcp.QuarantineSource quarantineSource(ConfigRef config, BackendQuarantine quarantine,
-            LiveExhaustedPatterns exhaustedPatterns, Map<String, String> reasonByCredential) {
+            Map<String, Pattern> startupExhaustedPatterns) {
        return new FleetMcp.QuarantineSource(profile -> {
            var configured = config.get().profiles().get(profile);
            return configured == null ? null : configured.effectiveCredentialId();
-        }, quarantine, exhaustedPatterns::armed, profile -> {
-            var configured = config.get().profiles().get(profile);
-            return configured == null ? null : configured.model();
-        }, reasonByCredential::get);
+        }, quarantine, profile -> startupExhaustedPatterns.containsKey(profile));
    }

    /**
@@ -900,40 +833,6 @@ public final class Fleetd {
     * with 0 errors and left all 1506 existing tests green before {@code
     * FleetdPatternCoverageLineTest} was added to catch exactly that swap.
     */
-    /**
-     * fleetd #446 follow-up: the criterion-2 WARNING text — "name the fix, not just the fact" —
-     * for a profile whose {@code model:} is configured. Extracted out of the {@code
-     * exhaustionSink} lambda the same way {@link #exhaustedPatternCoverageLine} was extracted out
-     * of {@code main}: the inline version compiled, ran, and read correctly, but nothing pinned
-     * its text, so a later edit could silently stop naming the fix and every test would stay
-     * green (measured: renaming the leading {@code "usage-limit fix:"} tag left all 1586
-     * pre-follow-up tests passing). {@link FleetdUsageLimitFixWarningTest} asserts on the return
-     * value of this method directly, which is exactly what the caller logs — {@code log.warn} is
-     * called with this method's result as a single, already-formatted argument, so the string a
-     * test sees here is byte-identical to what {@code fleetd.out} receives.
-     *
-     * <p>Deliberately asserts on three substrings, not the whole sentence (the profile name, the
-     * model name, and the literal {@code enabled: false} / {@code models.allow} action) — see that
-     * test's class doc for why a whole-sentence pin is the wrong granularity here.
-     */
-    static String usageLimitFixWarning(String profile, String model) {
-        return "usage-limit fix: profile '" + profile + "' runs model '" + model + "' — set "
-                + "`enabled: false` on that model's entry under models.allow in fleetd.yaml to "
-                + "stop new spawns landing on it (models: is hot, no restart needed); remove the "
-                + "line again once the subscription window resets";
-    }
-
-    /**
-     * fleetd #446 follow-up: the {@link #usageLimitFixWarning} counterpart for a profile with no
-     * {@code model:} configured — {@code models.allow} gates by model name, so there is nothing
-     * for an operator to flip, and this says so instead of naming a fix that does not exist.
-     */
-    static String usageLimitFixWarningNoModel(String profile, Integer quarantineCooldownSeconds) {
-        return "usage-limit fix: profile '" + profile + "' has no model: configured, so "
-                + "models.allow cannot gate it by name — the " + quarantineCooldownSeconds
-                + "s quarantine above is the only thing keeping new spawns off it for now";
-    }
-
    static String exhaustedPatternCoverageLine(Set<String> allProfiles, Set<String> configuredProfiles) {
        return CompletionResolver.coverage("exhaustedPattern", CompletionResolver.UnsetMeaning.OFF,
                allProfiles, configuredProfiles);
@@ -51,17 +51,7 @@ import java.util.function.Supplier;
 *       filter) and by {@code fleet_profiles}/{@code GET /profiles} (via
 *       {@code PeerLauncher.disabledModels()}). Nothing about {@code models:} is baked into an
 *       object built at startup, so — unlike the deferred keys below — there is no frozen half left
- *       to report; it moved here from deferred rather than joining split. An existing profile's
- *       {@code exhaustedPattern} (fleetd #446) joined this class the same way: it used to be
- *       compiled once into {@code Fleetd.main}'s startup pattern map (see the Deferred bullet's old
- *       wording, and {@code LiveExhaustedPatterns}'s class doc for the history), and is now read
- *       live, cached by profile name, by both {@code CompletionResolver}'s classification (via
- *       {@code LiveExhaustedPatterns.patternFor}) and {@code fleet_profiles}'s {@code
- *       exhaustionDetectionArmed} (via {@code LiveExhaustedPatterns.armed}) — the one live object
- *       both read, so a reload that arms or disarms a profile's usage-limit detection takes effect
- *       on the next check with no restart. {@code errorPattern}, {@code exhaustedPattern}'s sibling
- *       key for backend-error (not usage-limit) classification, was deliberately left OUT of this
- *       fleetd #446 change and stays deferred below — the ticket scoped it out explicitly.</li>
+ *       to report; it moved here from deferred rather than joining split.</li>
 *   <li><strong>Deferred</strong> — accepted into the new snapshot, but the wiring built at startup
 *       keeps the old value until a restart: {@code lifecycle:}, {@code leadHeartbeat:},
 *       {@code idleSleepGuard:} ({@code Fleetd.java} reads it once, at startup, to decide whether
@@ -91,17 +81,15 @@ import java.util.function.Supplier;
 *       (if any) simply keeps its old settings), adding or removing a profile (a new backend needs its own launcher,
 *       which is constructed once), <em>and an existing profile's launch settings</em> —
 *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
- *       {@code errorPattern} (fleetd #201 Unit 5 — compiled once into
- *       {@code Fleetd.main}'s backend-error pattern map at startup; deliberately NOT made hot
- *       alongside {@code exhaustedPattern} by fleetd #446 — that ticket scoped {@code errorPattern}
- *       and cooling-off out explicitly),
+ *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
+ *       pattern map at startup), {@code errorPattern} (fleetd #201 Unit 5 — compiled once into
+ *       {@code Fleetd.main}'s backend-error pattern map at startup, the same way),
 *       {@code ideProjectDir} / {@code ideOpenCommand} / {@code autoCompactWindow} (fleetd #323
 *       instance 1 — all three are read at spawn off the same frozen profile map and were missing
 *       from {@link #sameLaunchSettings}), and the rest of {@link #sameLaunchSettings}.
- *       {@code credentialId} (CB-578 stage B) and {@code exhaustedPattern} (fleetd #446) are NOT on
- *       this list — both are read live off the config supplier at every quarantine check and
- *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so both are hot instead
- *       (see the Hot bullet above for {@code exhaustedPattern}'s history).
+ *       {@code credentialId} (CB-578 stage B) is NOT on
+ *       this list — it is read live off the config supplier at every quarantine check and
+ *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
 *       {@code HerdrPeerLauncher} takes {@code Map.copyOf(profiles)} at construction and resolves
 *       each spawn out of that copy, so those never reach a launch until the daemon restarts. A
 *       reload logs these rather than pretending they applied.</li>
@@ -595,16 +583,12 @@ public final class ConfigRef implements Supplier<FleetConfig> {
     * {@link #sameLaunchSettings} because they are read <em>live</em>, not baked in at spawn — see
     * the class doc's <em>Hot</em> bullet. {@code weight} and {@code maxLoad} are read live by the
     * placement policy on every spawn; {@code credentialId} is read live by
-     * {@code CompositePeerLauncher} and the CB-578 stage B exhaustion sink; {@code exhaustedPattern}
-     * (fleetd #446) is read live, cached by profile name, by {@code LiveExhaustedPatterns} — see
-     * that class's doc and the class doc's <em>Hot</em> bullet for the history (it used to be
-     * compared here, deferred, like its sibling {@code errorPattern} still is). Nothing else is
+     * {@code CompositePeerLauncher} and the CB-578 stage B exhaustion sink. Nothing else is
     * excluded — see {@code sameLaunchSettingsComparesEveryProfileComponentOrExcludesIt} in
     * {@code ConfigRefProfileCoverageTest}, which enumerates every {@code Profile} record component
     * by reflection and fails the build if one is neither compared below nor named here.
     */
-    static final Set<String> LAUNCH_SETTINGS_EXCLUDED =
-            Set.of("weight", "maxLoad", "credentialId", "exhaustedPattern");
+    static final Set<String> LAUNCH_SETTINGS_EXCLUDED = Set.of("weight", "maxLoad", "credentialId");

    /**
     * Whether two versions of a profile would launch a peer identically.
@@ -641,15 +625,13 @@ public final class ConfigRef implements Supplier<FleetConfig> {
                && Objects.equals(a.kind(), b.kind())
                && Objects.equals(a.env(), b.env())
                && Objects.equals(a.subscription(), b.subscription())
-                // fleetd #446: exhaustedPattern moved to LAUNCH_SETTINGS_EXCLUDED — it is now read
-                // live, cached by profile name, through LiveExhaustedPatterns (see that class's doc
-                // and ConfigRef's class doc Hot bullet), so it must NOT be compared here any more: a
-                // reload that changes only exhaustedPattern must report "config reloaded", not
-                // "these changes need a restart".
+                // CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map
+                // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
+                // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
+                && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern())
                // fleetd #201 Unit 5: errorPattern is compiled once into Fleetd.main's backend-error
-                // pattern map at startup (see BackendErrorPatternLookup wiring) — unlike its sibling
-                // exhaustedPattern above (fleetd #446), a reload still never re-reads it; fleetd #446
-                // scoped errorPattern out on purpose (see the class doc's Hot bullet).
+                // pattern map at startup (see BackendErrorPatternLookup wiring), the same way
+                // exhaustedPattern is — a reload never re-reads it either.
                && Objects.equals(a.errorPattern(), b.errorPattern())
                // fleetd #323 instance 1: ideProjectDir and ideOpenCommand are read at spawn off the
                // same frozen profile map as ideMcpUrl above (ClaudeCodeLauncher.java:267/269,
@@ -424,12 +424,6 @@ public record FleetConfig(
     *                       {@code null}/blank ⇒ the classification never fires for this profile and
     *                       today's completion-fallback behaviour is unchanged. Every backend words
     *                       its refusal differently, so this is config, never a vendor string in code.
-     *                       Read live off the current config through {@code LiveExhaustedPatterns},
-     *                       cached by profile name (fleetd #446), so it is HOT: an operator can arm
-     *                       or disarm this profile's usage-limit detection by editing this key and
-     *                       reloading, with no restart. Before fleetd #446 this was compiled once at
-     *                       daemon startup, the same deferred shape its sibling {@code errorPattern}
-     *                       (below) still has.
     * @param credentialId   the shared account this profile authenticates as (CB-578 stage B). Two
     *                       or more profiles setting the <em>same</em> non-blank value are quarantined
     *                       together by one {@code exhaustedPattern} classification on any one of
@@ -1,91 +0,0 @@
-package dev.ltms.fleet.inject;
-
-import dev.ltms.fleet.config.FleetConfig;
-
-import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.function.Supplier;
-import java.util.regex.Pattern;
-
-/**
- * fleetd #446: the single live source for "is {@code exhaustedPattern} configured for this
- * profile, and what does it compile to". Read fresh off the config supplier on every call — the
- * same reason {@code CompositePeerLauncher#models0} is a live supplier read rather than a value
- * captured at construction (see that class's doc) — so an operator can arm or disarm usage-limit
- * detection for a profile by editing {@code exhaustedPattern} and reloading, with no restart.
- *
- * <p>Before this class, {@code exhaustedPattern} was compiled once into a {@code Map<String,
- * Pattern>} built inside {@code Fleetd.main} at startup ({@code ConfigRef}'s class doc used to
- * list it under <em>Deferred</em>, CB-578 stage A) — the asymmetry fleetd #446 exists to close:
- * an operator could turn a model off at runtime ({@code models.allow}'s {@code enabled: false},
- * hot since fleetd #422) but could not arm the detector that would tell them to, without a
- * restart. That was backwards for a feature whose whole point is to react while the fleet runs.
- *
- * <p>{@link #patternFor} is what {@link CompletionResolver} enforces on (via the {@link
- * ExhaustedPatternLookup} production wiring in {@code Fleetd.main}); {@link #armed} is what
- * {@code fleet_profiles}/{@code GET /profiles} report as {@code exhaustionDetectionArmed}. Both
- * read this ONE object, so the report can never disagree with the behaviour — the same rule
- * {@code CompositePeerLauncher#modelGateState()}'s javadoc states for the model gate's own
- * armed/off pair (fleetd #404): "armed" and "which models are off" must come from one read of the
- * same accessor the gate enforces on.
- *
- * <h2>Cache eviction</h2>
- * Cached by profile NAME, not by pattern text. A {@code Map<String, Pattern>} keyed by the
- * pattern STRING would grow by one entry per distinct regex ever typed for any profile across the
- * daemon's uptime — unbounded in practice, because tuning a regex to match a backend's exact
- * wording is exactly the kind of edit an operator makes several times while getting it right, and
- * every edit-and-reload cycle would leave the previous attempt's compiled {@link Pattern} behind
- * forever. Keyed by profile name instead, this cache holds at most one entry per profile name that
- * has ever been looked up — and that key space is bounded by the (small, human-authored) set of
- * configured profiles, which changes only on a restart: adding or removing a profile is itself a
- * deferred key (a new backend needs its own launcher, built once — see {@code ConfigRef}'s class
- * doc), so profile names do not churn the way pattern text does. Re-editing an EXISTING profile's
- * {@code exhaustedPattern} — the case this class exists to make hot — simply overwrites that
- * profile's one cache entry; it never adds a new one.
- */
-public final class LiveExhaustedPatterns {
-
-    /** A compiled pattern paired with the source string it was compiled from, for change detection. */
-    private record Cached(String source, Pattern compiled) {
-    }
-
-    private final Supplier<Map<String, FleetConfig.Profile>> profiles;
-    private final ConcurrentHashMap<String, Cached> cache = new ConcurrentHashMap<>();
-
-    public LiveExhaustedPatterns(Supplier<Map<String, FleetConfig.Profile>> profiles) {
-        this.profiles = Objects.requireNonNull(profiles, "profiles");
-    }
-
-    /**
-     * The compiled {@code exhaustedPattern} currently configured for {@code profileName}, or
-     * {@code null} when that profile is unknown or has none configured. Recompiles only when the
-     * live pattern text differs from what is cached for this profile name; {@code
-     * FleetConfig#rejectMalformedProfilePatterns} already refuses a config (at load and at reload)
-     * whose {@code exhaustedPattern} does not compile, so this is not expected to throw in
-     * production — it is not defended against here for that reason, the same trust
-     * {@code CompositePeerLauncher#models0} places in config validation having already run.
-     */
-    public Pattern patternFor(String profileName) {
-        if (profileName == null) {
-            return null;
-        }
-        FleetConfig.Profile profile = profiles.get().get(profileName);
-        if (profile == null || !profile.hasExhaustedPattern()) {
-            return null;
-        }
-        String source = profile.exhaustedPattern();
-        Cached cached = cache.get(profileName);
-        if (cached != null && cached.source().equals(source)) {
-            return cached.compiled();
-        }
-        Cached fresh = new Cached(source, Pattern.compile(source));
-        cache.put(profileName, fresh);
-        return fresh.compiled();
-    }
-
-    /** Whether {@code profileName} currently has a usage-limit pattern configured (live). */
-    public boolean armed(String profileName) {
-        return patternFor(profileName) != null;
-    }
-}
@@ -121,46 +121,17 @@ public final class FleetMcp {
     * CB-578 stage B quarantine facts used by {@code fleet_profiles}: a profile → credential id
     * lookup, plus the shared {@link BackendQuarantine} to read remaining cooldowns off.
     *
-     * @param exhaustedPatternArmed fleetd #395, made live by fleetd #446: profile → whether that
-     *                      profile's {@code exhaustedPattern} is configured right now (see {@code
+     * @param exhaustedPatternArmed fleetd #395: profile → whether that profile's {@code
+     *                      exhaustedPattern} is configured (see {@code
     *                      FleetConfig.Profile#hasExhaustedPattern}), i.e. whether a backend refusal
     *                      on it can EVER be classified {@code BACKEND_EXHAUSTED} and quarantine its
     *                      credential. Bundled here, not a separate Source, because it answers the
     *                      exact question {@code fleet_profiles}'s quarantine facts already answer
     *                      for a QUARANTINED profile — "can this profile's usage limit ever be
-     *                      caught?" — just for every profile, not only one currently caught. In
-     *                      production this reads {@link dev.ltms.fleet.inject.LiveExhaustedPatterns#armed} —
-     *                      the SAME live accessor {@link dev.ltms.fleet.inject.CompletionResolver}
-     *                      enforces on — so a reload that arms or disarms detection is reported
-     *                      correctly on the very next call, no restart (see that class's doc).
-     * @param modelFor      fleetd #446 criterion 3: profile → the {@code model:} it runs, or
-     *                      {@code null} when the profile names none. Read live off the current
-     *                      config, the same way {@code credentialIdFor} already is. Used to name,
-     *                      in a QUARANTINED profile's row, which of the operator's configured models
-     *                      the fix (\"set {@code enabled: false} on it under {@code models.allow}\")
-     *                      actually applies to.
-     * @param reasonFor     fleetd #446 criterion 3: credential id → the backend text that triggered
-     *                      its most recent quarantine, or {@code null} when none is known (e.g. an
-     *                      inert source, or a quarantine recorded before this field existed). Never
-     *                      consulted on its own to decide whether a credential is quarantined —
-     *                      callers gate on {@link BackendQuarantine#remainingSeconds} first, exactly
-     *                      like {@code credentialId} itself, so a stale reason left behind after a
-     *                      quarantine expires is never surfaced.
+     *                      caught?" — just for every profile, not only one currently caught.
     */
    public record QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine,
-                                    Function<String, Boolean> exhaustedPatternArmed,
-                                    Function<String, String> modelFor,
-                                    Function<String, String> reasonFor) {
-        /**
-         * Backward-compatible 3-arg form, before fleetd #446 added {@code modelFor}/{@code
-         * reasonFor} — neither is ever reported. Keeps every pre-existing call site (production and
-         * test) compiling and behaving identically for the quarantine facts they actually asked for.
-         */
-        public QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine,
-                                 Function<String, Boolean> exhaustedPatternArmed) {
-            this(credentialIdFor, quarantine, exhaustedPatternArmed, _ -> null, _ -> null);
-        }
-
+                                    Function<String, Boolean> exhaustedPatternArmed) {
        /**
         * Backward-compatible 2-arg form, before fleetd #395 added {@code exhaustedPatternArmed} —
         * reports every profile unarmed. Keeps every pre-existing call site (production and test)
@@ -455,7 +426,8 @@ public final class FleetMcp {
                    return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
                            leadSeats, callers == null ? Map.of() : callers.leads(),
                            callerTerminal(exchange),
-                            new CoordinationSource(leadChannel, peers));
+                            new CoordinationSource(leadChannel, peers),
+                            coordinatorVisibleTo(principal(exchange)));
                };
        BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> stopHandler =
                (exchange, req) -> {
@@ -608,6 +580,20 @@ public final class FleetMcp {
        }
    }

+    /**
+     * fleetd #439: only the primary may read {@code fleet_list}'s {@code coordinator} row —
+     * lead-to-lead coordination state (coord-ids, mailbox facts, held-message previews), never the
+     * roster. Split out of the {@code fleet_list} handler, same reason as {@link #denyFor} and
+     * {@link #recordPrimarySingleton}: the decision must be unit-testable without fabricating an
+     * SDK {@code McpSyncServerExchange}, and the handler must call this named predicate rather than
+     * inlining the check, so a future edit cannot silently pass a literal instead of asking who
+     * called ({@code FleetMcpAuthzTest.theFleetListHandlerActuallyConsultsCoordinatorVisibleTo}
+     * reads the source and asserts the handler calls this method by name, not a literal).
+     */
+    static boolean coordinatorVisibleTo(Principal caller) {
+        return caller.isPrimary();
+    }
+
    /** The worker identity resolved from this call's connection, or {@code null} if the primary. */
    private static String callerTerminal(McpSyncServerExchange exchange) {
        Object v = exchange.transportContext().get(CALLER_TERMINAL);
@@ -1239,21 +1225,13 @@ public final class FleetMcp {
     * #284 was, where one rule computed in two places was widened in only one and a single response
     * contradicted itself. Shared inputs do not make duplicated computation safe.
     *
-     * <p>fleetd #395, made live by fleetd #446: also reports {@code exhaustionDetectionArmed}, one
-     * boolean per configured profile — {@code true} when that profile's {@code exhaustedPattern} is
-     * set RIGHT NOW, {@code false} when it is not, so an operator can tell "this profile is
-     * healthy" from "nothing can ever quarantine this profile" without reading {@code fleetd.yaml}.
-     * Unlike {@code quarantined}/{@code coolingOff}, this map always names every profile: an
-     * unarmed profile never enters a transient state to be absent from, so silence here would read
-     * as "healthy" rather than "not being watched at all". Hot since fleetd #446: a reload that
-     * arms or disarms a profile's {@code exhaustedPattern} changes this map's answer on the very
-     * next call, no restart — see {@link dev.ltms.fleet.inject.LiveExhaustedPatterns}'s class doc.
-     *
-     * <p>fleetd #446 criterion 3: each {@code quarantined} row also names {@code model} (the
-     * profile's configured {@code model:}, omitted when the profile names none) and {@code reason}
-     * (the backend text that triggered the most recent quarantine of that credential, omitted when
-     * none is known) — so a lead can see WHICH model to turn off and WHY, without reading the
-     * daemon log.
+     * <p>fleetd #395: also reports {@code exhaustionDetectionArmed}, one boolean per configured
+     * profile — {@code true} when that profile's {@code exhaustedPattern} is set, {@code false}
+     * when it is not, so an operator can tell "this profile is healthy" from "nothing can ever
+     * quarantine this profile" without reading {@code fleetd.yaml}. Unlike {@code quarantined}/
+     * {@code coolingOff}, this map always names every profile: an unarmed profile never enters a
+     * transient state to be absent from, so silence here would read as "healthy" rather than "not
+     * being watched at all".
     */
    public static Map<String, Object> profilesView(PeerLauncher workers, QuarantineSource quarantine, OutageSource outage) {
        Map<String, Object> result = new LinkedHashMap<>();
@@ -1270,14 +1248,6 @@ public final class FleetMcp {
                    Map<String, Object> row = new LinkedHashMap<>();
                    row.put("credentialId", credentialId);
                    row.put("quarantinedForSeconds", remaining);
-                    String model = quarantine.modelFor().apply(profile);
-                    if (model != null && !model.isBlank()) {
-                        row.put("model", model);
-                    }
-                    String reason = quarantine.reasonFor().apply(credentialId);
-                    if (reason != null && !reason.isBlank()) {
-                        row.put("reason", reason);
-                    }
                    quarantined.put(profile, row);
                });
            }
@@ -1389,12 +1359,44 @@ public final class FleetMcp {
                LeadSeatSource.none(), leads, selfTerm, coordination);
    }

-    /** As above, plus fleetd #176 lead-seat facts (see {@link LeadSeatSource}). */
+    /**
+     * As above, plus fleetd #176 lead-seat facts (see {@link LeadSeatSource}).
+     *
+     * <p>Assumes the caller is the primary — every wrapper overload above delegates here without
+     * carrying a caller identity, which is exactly right for them: they exist for call sites (and
+     * unit tests) that have no {@link Principal} to hand over, and this preserves their pre-#439
+     * behavior unchanged. The one call site that has a real caller ({@code fleet_list}'s MCP
+     * handler) uses {@link #listFleet(PeerLauncher, SessionManager, MessageService, CapacitySource,
+     * HealthCoverageSource, QuarantineSource, OutageSource, LeadSeatSource, Map, String,
+     * CoordinationSource, boolean)} instead, so it can pass the true answer.
+     */
    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
                                               CapacitySource capacity, HealthCoverageSource healthCoverage,
                                               QuarantineSource quarantine, OutageSource outage,
                                               LeadSeatSource leadSeats, Map<String, String> leads, String selfTerm,
                                               CoordinationSource coordination) {
+        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
+                leadSeats, leads, selfTerm, coordination, true);
+    }
+
+    /**
+     * As above, gated by the caller's role (fleetd #439). The {@code coordinator} row is
+     * lead-to-lead coordination state — coordination between orchestrators, not roster
+     * observation — so it is assembled and included only when {@code callerIsPrimary} is
+     * {@code true}. A worker or an architect gets a result with the {@code coordinator} key
+     * <strong>absent</strong>, never an empty or redacted one, and never pays the cost of
+     * {@link #coordinatorView} probing peer mailboxes for a row it will not receive.
+     *
+     * @param callerIsPrimary whether the {@code fleet_list} caller is the primary; only the MCP
+     *                        handler computes this from the real connection (see
+     *                        {@code Principal#isPrimary()}) — every other overload passes
+     *                        {@code true}
+     */
+    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
+                                               CapacitySource capacity, HealthCoverageSource healthCoverage,
+                                               QuarantineSource quarantine, OutageSource outage,
+                                               LeadSeatSource leadSeats, Map<String, String> leads, String selfTerm,
+                                               CoordinationSource coordination, boolean callerIsPrimary) {
        try {
            Map<String, Agent> live = workers.list().stream()
                    .map(Agent.class::cast)
@@ -1416,9 +1418,14 @@ public final class FleetMcp {
            Map<String, Object> result = new LinkedHashMap<>();
            result.put("leads", leadRows); result.put("members", out);
            result.put("healthCoverage", healthCoverage.value().get());
-            Map<String, Object> coordinatorRow = coordinatorView(coordination);
-            if (coordinatorRow != null) {
-                result.put("coordinator", coordinatorRow);
+            // fleetd #439: coordinator/coordinatorView is lead-to-lead coordination state and must
+            // never reach a worker or an architect -- gate BEFORE assembling it, not after, so the
+            // key is absent rather than present-and-empty.
+            if (callerIsPrimary) {
+                Map<String, Object> coordinatorRow = coordinatorView(coordination);
+                if (coordinatorRow != null) {
+                    result.put("coordinator", coordinatorRow);
+                }
            }
            if (capacity.available()) result.put("capacity", profiles.stream()
                    .map(profile -> capacityView(profile, capacity.liveCount(), capacity.maxLoad(), roster, messages,
@@ -1860,16 +1867,11 @@ public final class FleetMcp {
                "List the configured worker profiles (backends) and which one fleet_spawn uses by "
                        + "default. A 'quarantined' map is present when a backend-exhausted refusal put "
                        + "a profile's credential on cooldown — fleet_spawn onto it is refused until "
-                        + "quarantinedForSeconds elapses; a profile sharing that credential is listed too, "
-                        + "each row naming 'model' (the model that profile runs, when configured) and "
-                        + "'reason' (the backend text that triggered the quarantine, when known) — the fix "
-                        + "is usually `enabled: false` on that model under models.allow. "
+                        + "quarantinedForSeconds elapses; a profile sharing that credential is listed too. "
                        + "'exhaustionDetectionArmed' reports, per profile, whether a usage-limit refusal "
                        + "on it can EVER be classified and quarantined (its exhaustedPattern is "
                        + "configured) — false means that profile's credential can never be quarantined "
-                        + "by this mechanism, however many usage-limit refusals it sees. Both "
-                        + "exhaustedPattern and models.allow's on/off state are hot: editing fleetd.yaml "
-                        + "and reloading arms/disarms detection or flips a model off with no restart.",
+                        + "by this mechanism, however many usage-limit refusals it sees.",
                objectSchema(Map.of(), List.of()));
    }

@@ -168,6 +168,23 @@ public interface PeerLauncher {
     * answer for a launcher with no role-pool concept of its own (e.g. a single {@code
     * HerdrPeerLauncher} adapter, which is never reached this way in production: {@code
     * CompositePeerLauncher} always fronts it and resolves roles itself).
+     *
+     * <p>fleetd #453: this default is deliberately <em>not</em> abstract — unlike {@link
+     * #spawn(SpawnRequest, PlacementDecision)} (fleetd #450), there is no live defect in inheriting
+     * it today, and the only current single-adapter implementer ({@code HerdrPeerLauncher}) is
+     * correct to do so. But it stays correct only as long as that holds: <strong>if a launcher ever
+     * routes more than one profile per role, it MUST override this method</strong>, or every role
+     * silently resolves to {@link #defaultProfile()} with no error and no log line. {@code
+     * HerdrPeerLauncher.spawn(SpawnRequest, PlacementDecision)} — the override in {@code
+     * dev.ltms.fleet.member}, not the declaration below — names this method and {@link #place}
+     * explicitly as "unoverridden here" for exactly this reason. Read it before adding role-pool
+     * routing to any {@code HerdrPeerLauncher} subclass.
+     *
+     * <p>Who is forced to read which paragraph, because it is not symmetric. A new class that
+     * implements this interface directly must write a body for {@link #spawn(SpawnRequest,
+     * PlacementDecision)}, which is abstract here, so it lands on this javadoc. A subclass of
+     * {@code HerdrPeerLauncher} does not: that class already implements the method, and the
+     * subclass inherits the body. So for a subclass this paragraph is advice, not a gate.
     */
    default String defaultProfileFor(MemberRole role) {
        return defaultProfile();
@@ -228,6 +245,13 @@ public interface PeerLauncher {
     * placement condition — the right answer for a launcher with no pool or placement-policy
     * concept of its own, matching {@link #defaultProfileFor}'s own default.
     *
+     * <p>fleetd #453: same reasoning as {@link #defaultProfileFor}'s own #453 note — this default
+     * is deliberately not abstract (no live defect today, correct for the sole single-adapter
+     * implementer), but <strong>a launcher that ever routes more than one profile per role MUST
+     * override this method too</strong>, or placement silently ignores {@code role} for it. See
+     * {@code HerdrPeerLauncher.spawn(SpawnRequest, PlacementDecision)}'s javadoc, which names this
+     * method as "unoverridden here" and why that is correct only for a single-profile adapter.
+     *
     * @throws RuntimeException (implementation-specific, typically a placement exception) if no
     *                          candidate in {@code role}'s pool is currently placeable
     */
@@ -2,7 +2,6 @@ package dev.ltms.fleet;

 import dev.ltms.fleet.config.ConfigRef;
 import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.inject.LiveExhaustedPatterns;
 import dev.ltms.fleet.mcp.FleetMcp;
 import dev.ltms.fleet.placement.BackendQuarantine;
 import org.junit.jupiter.api.DisplayName;
@@ -12,31 +11,16 @@ import org.junit.jupiter.api.io.TempDir;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Map;
-
+import java.util.regex.Pattern;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;

 /**
- * fleetd #446: {@code exhaustionDetectionArmed} must describe the LIVE config, not a startup
- * snapshot — the opposite of what fleetd #404 asked for. #404 pinned {@code exhaustedPattern} as
- * compiled once at startup (matching {@code CompletionResolver}'s then-frozen behaviour); #446's
- * whole point is that both sides — the classification {@code CompletionResolver} enforces and the
- * {@code exhaustionDetectionArmed} field this reports — now read the SAME live {@link
- * LiveExhaustedPatterns} instance, so a reload arms or disarms detection with no restart, and the
- * report can never disagree with the behaviour (the fleetd #404 rule, now upheld for real instead
- * of by freezing both sides).
+ * fleetd #404: {@code exhaustionDetectionArmed} must describe the startup pattern map, not the
+ * reloaded config snapshot.
 *
 * <p>This test needs a reload. At startup the two snapshots agree, so a test of only a newly
 * started daemon would not detect a live {@code config.get()} lookup in the report field.
- *
- * <p><b>The hotness proof criterion 1 demands:</b> run this against the fixed code (green) and
- * against the pre-#446 compile site — {@code Fleetd.main}'s {@code exhaustedPatternsByProfile}
- * compiled once into a {@code Map<String, Pattern>} at startup, handed to {@code quarantineSource}
- * — and show it fails there. See the class doc history above: that shape is exactly what
- * {@code reloadedPatternArmsDetectionWithNoRestart} below is written to catch, and it is the test
- * that used to assert the opposite (see git history for this file's pre-#446 version, which
- * asserted {@code assertFalse(...)} on the identical scenario this now asserts {@code assertTrue}
- * on).
 */
 class FleetdExhaustionDetectionArmedWiringTest {

@@ -70,68 +54,41 @@ class FleetdExhaustionDetectionArmedWiringTest {
            """;

    @Test
-    @DisplayName("reloading a profile's exhaustedPattern IN arms exhaustionDetectionArmed, no restart")
-    void reloadedPatternArmsDetectionWithNoRestart(@TempDir Path dir) throws Exception {
+    @DisplayName("reloading an exhaustedPattern does not arm the startup detection source")
+    void reloadedPatternDoesNotChangeTheArmedFieldUntilRestart(@TempDir Path dir) throws Exception {
        Path file = dir.resolve("fleetd.yaml");
        Files.writeString(file, NO_PATTERN);
        ConfigRef config = new ConfigRef(file, FleetConfig.load(file));

-        FleetMcp.QuarantineSource before = Fleetd.quarantineSource(config, BackendQuarantine.none(),
-                new LiveExhaustedPatterns(() -> config.get().profiles()), Map.of());
-        assertFalse(before.exhaustedPatternArmed().apply("terra"),
-                "no exhaustedPattern configured yet — must report unarmed");
-
        Files.writeString(file, WITH_PATTERN);
        assertTrue(config.reload().applied());
        assertTrue(config.get().profiles().get("terra").hasExhaustedPattern());

-        // Re-read exhaustedPatternArmed off the SAME QuarantineSource built BEFORE the reload — no
-        // new object, no new wiring — to prove the field itself is live, not merely that a freshly
-        // built source would be. This is the exact axis the pre-#446 code fails on: the same
-        // Function<String,Boolean> lambda, called again after a reload, sees the new answer only if
-        // it re-reads config.get() on every call rather than a value captured earlier.
-        assertTrue(before.exhaustedPatternArmed().apply("terra"),
-                "exhaustionDetectionArmed must read the LIVE config on every call — fleetd #446 made "
-                        + "this hot; it must reflect a reload with no restart and no new QuarantineSource");
-    }
-
-    @Test
-    @DisplayName("reloading exhaustedPattern OUT disarms exhaustionDetectionArmed, no restart")
-    void reloadedPatternRemovalDisarmsDetectionWithNoRestart(@TempDir Path dir) throws Exception {
-        Path file = dir.resolve("fleetd.yaml");
-        Files.writeString(file, WITH_PATTERN);
-        ConfigRef config = new ConfigRef(file, FleetConfig.load(file));
-
        FleetMcp.QuarantineSource source = Fleetd.quarantineSource(config, BackendQuarantine.none(),
-                new LiveExhaustedPatterns(() -> config.get().profiles()), Map.of());
-        assertTrue(source.exhaustedPatternArmed().apply("terra"),
-                "exhaustedPattern is configured from the start — must report armed");
-
-        Files.writeString(file, NO_PATTERN);
-        assertTrue(config.reload().applied());
-
+                Map.of());
        assertFalse(source.exhaustedPatternArmed().apply("terra"),
-                "removing exhaustedPattern and reloading must disarm detection with no restart — an "
-                        + "operator turning detection off (e.g. while debugging a false positive) "
-                        + "must see that reflected immediately, exactly like arming it is");
+                "exhaustionDetectionArmed must use the startup pattern map, not config.get()");
    }

    @Test
-    @DisplayName("a profile with no exhaustedPattern configured is reported unarmed")
-    void aProfileWithNoPatternIsUnarmed(@TempDir Path dir) throws Exception {
-        // fleetd #404's second direction, carried forward: this test alone fails if
-        // exhaustedPatternArmed degenerates to a constant `profile -> true` — it needs at least one
-        // profile that is genuinely unarmed to catch that.
+    @DisplayName("a profile in the startup pattern map is reported as armed")
+    void aProfileInTheStartupMapIsArmed(@TempDir Path dir) throws Exception {
+        // fleetd #404, second direction. The test above only ever passes an EMPTY startup map, so
+        // it cannot tell a correct lookup from one that is permanently off. Measured: replacing the
+        // armed lambda with `profile -> false` left the whole suite green at 1475 tests. That
+        // mutation would make #395's visibility feature dead — an operator fixing a detection gap
+        // would be told the gap is still open after fixing it, forever. Both directions are needed:
+        // this test is the only thing that fails when the field stops reporting armed at all.
        Path file = dir.resolve("fleetd.yaml");
        Files.writeString(file, WITH_PATTERN);
        ConfigRef config = new ConfigRef(file, FleetConfig.load(file));

        FleetMcp.QuarantineSource source = Fleetd.quarantineSource(config, BackendQuarantine.none(),
-                new LiveExhaustedPatterns(() -> config.get().profiles()), Map.of());
+                Map.of("terra", Pattern.compile("usage limit")));

        assertTrue(source.exhaustedPatternArmed().apply("terra"),
-                "a profile whose exhaustedPattern is configured must report armed");
+                "a profile whose pattern was compiled at startup must report armed");
        assertFalse(source.exhaustedPatternArmed().apply("sonnet"),
-                "a profile absent from config entirely must not report armed");
+                "a profile absent from the startup map must not report armed");
    }
 }
@@ -1,175 +0,0 @@
-package dev.ltms.fleet;
-
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.fleet.config.ConfigRef;
-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.guard.SubscriptionGuard;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.inject.ExhaustionSink;
-import dev.ltms.fleet.member.ClaudeCodeLauncher;
-import dev.ltms.fleet.placement.BackendQuarantine;
-import dev.ltms.fleet.session.SessionManager;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-import org.slf4j.LoggerFactory;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * fleetd #446 follow-up (round 3): round 2's {@link FleetdUsageLimitFixWarningTest} calls {@link
- * Fleetd#usageLimitFixWarning}/{@link Fleetd#usageLimitFixWarningNoModel} directly, which pins
- * the two methods' TEXT but cannot see whether {@link Fleetd#exhaustionSink}'s {@code log.warn}
- * call actually invokes either one, or invokes the right one. A mutation battery run against
- * round 2's merge (1592 green tests) proved both gaps real:
- *
- * <ul>
- *   <li><b>Cell A</b> — replacing the whole ternary result with a literal string
- *       ({@code "usage-limit fix: MUTANT"}) left every test green;</li>
- *   <li><b>Cell B</b> — swapping the ternary's two branches, so a profile WITH a {@code model:}
- *       gets the no-model fallback message and vice versa, was measured unmeasured by the lead
- *       but the existing test file shows no call that would notice it either.</li>
- * </ul>
- *
- * <p>This class drives {@link Fleetd#exhaustionSink} — the actual factory {@code main} wires,
- * since round 3's extraction pulled it out of the inline lambda for exactly this reason — and
- * asserts on the REAL text a {@link ListAppender} attached to {@code Fleetd}'s own logger
- * captures, mirroring {@code ExhaustedPatternGapReportTest}'s idiom. Chosen over a source-text
- * assertion (the {@code FleetMcpAuthzTest} {@code everyRegisteredToolHasItsHandlerActionPinned}
- * idiom) because that route can prove Cell A (the ternary is still there, still built from the
- * two named methods) but not Cell B (which branch a given profile actually reaches) — this route
- * answers both from one mechanism, since it reads what the sink actually logged for each shape of
- * profile.
- *
- * <p>Each test filters for the WARN line starting {@code "usage-limit fix:"} specifically — {@link
- * Fleetd#exhaustionSink} also logs a separate {@code "credential '...' quarantined for..."} WARN
- * on every call, and asserting against the wrong one would pass or fail for the wrong reason. That
- * prefix survives even under the M5 mutation above (the mutant keeps the tag, only the body
- * becomes {@code "MUTANT"}), so the filter itself is not what either mutation defeats.
- */
-class FleetdExhaustionSinkWarningTest {
-
-    private static final String YAML = """
-            bind:
-              host: 127.0.0.1
-              port: 8765
-            herdrSocket: ~/.config/herdr/herdr.sock
-            profiles:
-              terra:
-                baseUrl: http://gx00.gw:8000
-                model: claude-opus-5
-              gx:
-                baseUrl: http://gx00.gw:8000
-            guard:
-              offSubscriptionHosts:
-                - gx00.gw
-            """;
-
-    private static SessionManager emptyRosterSessions() {
-        FakeHerdr h = new FakeHerdr();
-        FleetConfig.Profile dummy = new FleetConfig.Profile(
-                "dummy", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
-                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(dummy.profile(), dummy), dummy.profile(), _ -> "tok");
-        // Never acquires a session — exhaustionSink's roster lookup is expected to miss and fall
-        // back to the profileHint argument, exactly like OpenCodeLauncher's real call site does
-        // (fleetd #234) — so the sink under test never needs a populated roster.
-        return new SessionManager(launcher);
-    }
-
-    private static ListAppender<ILoggingEvent> attach() {
-        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        return appender;
-    }
-
-    private static void detach(ListAppender<ILoggingEvent> appender) {
-        ((Logger) LoggerFactory.getLogger(Fleetd.class)).detachAppender(appender);
-    }
-
-    /** The one WARN line {@code exhaustionSink} builds from the ternary under test, or {@code null}. */
-    private static String fixWarning(ListAppender<ILoggingEvent> appender) {
-        List<String> warns = appender.list.stream()
-                .filter(e -> e.getLevel() == Level.WARN)
-                .map(ILoggingEvent::getFormattedMessage)
-                .filter(m -> m.startsWith("usage-limit fix:"))
-                .toList();
-        assertTrue(warns.size() == 1,
-                "expected exactly one 'usage-limit fix:' WARN per onExhausted call, got " + warns.size()
-                        + ": " + warns);
-        return warns.getFirst();
-    }
-
-    @Test
-    @DisplayName("a profile WITH a configured model gets the actionable models.allow fix, not the fallback")
-    void profileWithModelGetsTheActionableFix(@TempDir Path dir) throws Exception {
-        Path file = dir.resolve("fleetd.yaml");
-        Files.writeString(file, YAML);
-        FleetConfig cfg = FleetConfig.load(file);
-        ConfigRef config = ConfigRef.fixed(cfg);
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        Map<String, String> reasonByCredential = new HashMap<>();
-        ExhaustionSink sink = Fleetd.exhaustionSink(emptyRosterSessions(), config, quarantine,
-                reasonByCredential, cfg);
-
-        ListAppender<ILoggingEvent> appender = attach();
-        try {
-            sink.onExhausted("term_x", "The usage limit has been reached", "terra");
-        } finally {
-            detach(appender);
-        }
-
-        String warning = fixWarning(appender);
-        assertTrue(warning.contains("terra"), "must name the profile: " + warning);
-        assertTrue(warning.contains("claude-opus-5"), "must name the model: " + warning);
-        assertTrue(warning.contains("enabled: false"), "must name the action: " + warning);
-        assertTrue(warning.contains("models.allow"), "must name where the action goes: " + warning);
-        assertFalse(warning.contains("has no model: configured"),
-                "a profile WITH a model must not get the no-model fallback text: " + warning);
-    }
-
-    @Test
-    @DisplayName("a profile with NO configured model gets the fallback, never a fix that does not exist")
-    void profileWithNoModelGetsTheFallbackNotAFix(@TempDir Path dir) throws Exception {
-        Path file = dir.resolve("fleetd.yaml");
-        Files.writeString(file, YAML);
-        FleetConfig cfg = FleetConfig.load(file);
-        ConfigRef config = ConfigRef.fixed(cfg);
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        Map<String, String> reasonByCredential = new HashMap<>();
-        ExhaustionSink sink = Fleetd.exhaustionSink(emptyRosterSessions(), config, quarantine,
-                reasonByCredential, cfg);
-
-        ListAppender<ILoggingEvent> appender = attach();
-        try {
-            sink.onExhausted("term_y", "The usage limit has been reached", "gx");
-        } finally {
-            detach(appender);
-        }
-
-        String warning = fixWarning(appender);
-        assertTrue(warning.contains("gx"), "must name the profile: " + warning);
-        assertTrue(warning.contains("has no model: configured"),
-                "must say there is no model to gate by name: " + warning);
-        assertFalse(warning.contains("enabled: false"),
-                "a profile with no model: configured has no models.allow entry to flip — must "
-                        + "not claim one exists: " + warning);
-    }
-}
@@ -1,75 +0,0 @@
-package dev.ltms.fleet;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * fleetd #446 follow-up (criterion 2): {@code exhaustionSink} used to build the "name the fix"
- * WARNING inline with two SLF4J {@code {}}-placeholder {@code log.warn} calls. Nothing pinned
- * that text — a mutation battery run against the merged PR #457 proved it: renaming the leading
- * {@code "usage-limit fix:"} tag to {@code "MUTANT no fix named:"} at both call sites left all
- * 1586 existing tests green. This class is what makes that mutation red.
- *
- * <p>{@link Fleetd#usageLimitFixWarning} and {@link Fleetd#usageLimitFixWarningNoModel} are the
- * extracted call sites {@code exhaustionSink} actually invokes — {@code log.warn} is called with
- * each method's return value as a single, already-formatted argument, so the string these tests
- * assert on is byte-identical to what {@code fleetd.out} receives. Same extracted-static-method +
- * dedicated-test idiom as {@link Fleetd#exhaustedPatternCoverageLine} /
- * {@link FleetdPatternCoverageLineTest}, chosen over the {@link ch.qos.logback.core.read.ListAppender}
- * idiom {@code ExhaustedPatternGapReportTest} uses — this warning is built once, at one call site,
- * from a single method with no branching inside the message itself, so there is no real log
- * plumbing left to prove; capturing an appender would only add setup/teardown around the same
- * assertion.
- *
- * <p>Each assertion below checks for a specific substring — the leading {@code "usage-limit fix:"}
- * tag an operator would grep the log for, the profile name, the model name, and the literal
- * action ({@code enabled: false} under {@code models.allow}) — rather than the whole sentence.
- * Criterion 2 promised those facts, not a particular wording of the prose that carries them; a
- * whole-sentence {@code assertEquals} breaks on every copy-edit of that surrounding prose and
- * teaches the next person to delete the test rather than read why it failed. The leading tag is
- * pinned on purpose, unlike the rest of the sentence: it is the identifying label the fleetd #446
- * follow-up's own mutation battery renamed ({@code "usage-limit fix:"} → {@code "MUTANT no fix
- * named:"}) to prove this class did not yet catch a tag rename — only the three-fact substrings
- * above would have missed it, since none of them mention the tag itself.
- */
-class FleetdUsageLimitFixWarningTest {
-
-    @Test
-    @DisplayName("usageLimitFixWarning names the profile, the model, and the models.allow fix")
-    void usageLimitFixWarningNamesProfileModelAndFix() {
-        String warning = Fleetd.usageLimitFixWarning("terra", "claude-opus-5");
-
-        assertTrue(warning.startsWith("usage-limit fix:"),
-                "must carry the grep-able identifying tag: " + warning);
-        assertTrue(warning.contains("terra"), "must name the profile: " + warning);
-        assertTrue(warning.contains("claude-opus-5"), "must name the model: " + warning);
-        assertTrue(warning.contains("enabled: false"), "must name the action: " + warning);
-        assertTrue(warning.contains("models.allow"), "must name where the action goes: " + warning);
-    }
-
-    @Test
-    @DisplayName("usageLimitFixWarning does not cross-name a different profile or model")
-    void usageLimitFixWarningDoesNotCrossName() {
-        String warning = Fleetd.usageLimitFixWarning("terra", "claude-opus-5");
-
-        // Guards against the mutation of swapping the two profile/model arguments at the call
-        // site — a test that only checks "some name appears" cannot catch that.
-        assertTrue(!warning.contains("sonnet"), "must not name an unrelated model: " + warning);
-    }
-
-    @Test
-    @DisplayName("usageLimitFixWarningNoModel names the profile but no fix, since none exists")
-    void usageLimitFixWarningNoModelNamesProfileNotAFix() {
-        String warning = Fleetd.usageLimitFixWarningNoModel("gx", 1800);
-
-        assertTrue(warning.startsWith("usage-limit fix:"),
-                "must carry the grep-able identifying tag: " + warning);
-        assertTrue(warning.contains("gx"), "must name the profile: " + warning);
-        assertTrue(warning.contains("1800"), "must name the quarantine duration it falls back to: " + warning);
-        assertTrue(!warning.contains("enabled: false"),
-                "a profile with no model: configured has no models.allow entry to flip — the "
-                        + "fallback message must not claim one exists: " + warning);
-    }
-}
@@ -161,15 +161,7 @@ class ConfigRefProfileCoverageTest {
        // the #323 bug. Only ideProjectDir and worktreeGroup were saved by a behavioural test in
        // ConfigRefTest; the other two had none. So: growing this set now requires editing this
        // line as well, which is a visible, deliberate diff rather than a quiet one.
-        //
-        // fleetd #446: "exhaustedPattern" joined the set legitimately — it moved from compiled
-        // once at Fleetd.main startup to read live, cached by profile name, through
-        // LiveExhaustedPatterns (see that class's doc and ConfigRef's class doc). Unlike the #323
-        // hazard this comment warns about, it is pinned by its OWN behavioural tests:
-        // FleetdExhaustionDetectionArmedWiringTest proves the reload takes effect with no restart,
-        // and the same test rerun against the pre-#446 compile site (see that ticket's report) is
-        // what proves the assertion would have failed before the fix.
-        assertEquals(Set.of("weight", "maxLoad", "credentialId", "exhaustedPattern"), excluded,
+        assertEquals(Set.of("weight", "maxLoad", "credentialId"), excluded,
                "ConfigRef.LAUNCH_SETTINGS_EXCLUDED changed. A component belongs in it ONLY if it "
                        + "is read live off the config supplier, not baked into a launcher at "
                        + "startup. If you are adding one to silence this test, that is fleetd #323 "
@@ -339,18 +339,12 @@ class ConfigRefTest {
    }

    /**
-     * fleetd #446: exhaustedPattern moved from deferred to hot — {@code LiveExhaustedPatterns}
-     * reads {@code config.get()} fresh on every lookup, cached by profile name (not baked into a
-     * frozen map inside {@code Fleetd.main} any more, the way it was before this ticket, and the
-     * way its sibling {@code errorPattern} still is — see
-     * {@code changingAProfilesErrorPatternIsReportedAsDeferred} right below for the contrast).
-     * So a reload that changes ONLY exhaustedPattern must report a plain "config reloaded", with
-     * nothing deferred — the opposite of what this test asserted before fleetd #446, when
-     * ConfigRef.sameLaunchSettings still compared exhaustedPattern and this reload reported it as
-     * one of the changes needing a restart.
+     * CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map at startup
+     * (see ExhaustedPatternLookup), so a reload never re-reads it — a changed pattern must be
+     * reported deferred exactly like model/baseUrl, not silently claimed as applied.
     */
    @Test
-    void changingAProfilesExhaustedPatternTakesEffectWithNoRestart(@TempDir Path dir) throws Exception {
+    void changingAProfilesExhaustedPatternIsReportedAsDeferred(@TempDir Path dir) throws Exception {
        Path f = dir.resolve("fleetd.yaml");
        Files.writeString(f, """
                bind:
@@ -385,21 +379,17 @@ class ConfigRefTest {
        ConfigRef.Outcome out = ref.reload();

        assertTrue(out.applied());
-        assertEquals(0, out.deferred().size(),
-                "exhaustedPattern is hot since fleetd #446 — changing only this key must not be "
-                        + "reported as needing a restart: " + out.deferred());
-        assertEquals(0, out.split().size(), out.split().toString());
-        assertEquals("config reloaded", out.summary());
-        // The snapshot carries the new value immediately — this IS the live value now, not
-        // merely what a restart would eventually pick up.
+        assertEquals(1, out.deferred().size(), out.deferred().toString());
+        assertTrue(out.deferred().getFirst().contains("sonnet"), out.deferred().toString());
+        assertTrue(out.deferred().getFirst().contains("launch settings"), out.deferred().toString());
+        // The snapshot still carries the new value — a restart is what makes it take effect.
        assertEquals("rate limit exceeded", ref.get().profiles().get("sonnet").exhaustedPattern());
    }

    /**
     * fleetd #201 Unit 5: errorPattern is compiled once into Fleetd.main's backend-error pattern
-     * map at startup (see BackendErrorPatternLookup) — unlike its sibling exhaustedPattern above,
-     * which fleetd #446 made hot, errorPattern was scoped OUT of that ticket on purpose and stays
-     * deferred: a reload still never re-reads it, so a changed value must be reported deferred.
+     * map at startup (see BackendErrorPatternLookup), the same way exhaustedPattern is above — a
+     * reload never re-reads it either, so a changed value must be reported deferred.
     */
    @Test
    void changingAProfilesErrorPatternIsReportedAsDeferred(@TempDir Path dir) throws Exception {
@@ -25,13 +25,23 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue;
 * So this polls for a real signal instead of guessing a sleep length.
 *
 * <p><strong>What was measured, and what was not.</strong> Polling fixes it: 5 standalone runs
- * green. The load-bearing half is {@link #waitForText}. With {@link #SHELL_READY_TIMEOUT_MS}
- * set to 0 — so input is typed at once, with no settle wait at all — the test still passed 3 of
- * 3. So the proven cause is the 800ms READ deadline being too short, not the 1000ms write delay.
- * Note the direction, because it matters: typing at 0ms works where typing at 1000ms failed. The
- * earlier explanation for this test — that input typed before the prompt is swallowed by the
- * shell's startup — is therefore NOT supported by any measurement here. Please do not repeat it
- * as the reason; if it were true, 0ms would be worse than 1000ms, and it is better.
+ * green. The load-bearing half is {@link #waitForText}, and one cell proves it. Keep the old
+ * 1000ms write sleep and change only the read — the 800ms fixed sleep becomes a 5s poll — and
+ * the test goes from 0 of 3 passing to 3 of 3. Removing the write wait instead
+ * ({@link #SHELL_READY_TIMEOUT_MS} set to 0, so input is typed at once) also passes 3 of 3. So
+ * the cause is the 800ms READ deadline, not the 1000ms write delay. The old version fails every
+ * time, not sometimes, so "race" is the wrong word for it. The earlier explanation — that input
+ * typed before the prompt is swallowed by the shell's startup — is not supported by anything
+ * measured here. Please do not repeat it: if it were true, typing at 0ms would be worse than
+ * typing at 1000ms, and it is not.
+ *
+ * <p><strong>Where this was measured.</strong> A 12-core macOS host, load average 2.6 to 5.9,
+ * on commit 20c1094. The same four cells were also run under load and gave the same answer, but
+ * that run is not clean evidence: the load average climbed from 7 to 50 while the cells ran, and
+ * the old version ran last, at the top of that climb. Above about load 20 everything here is
+ * slow for reasons that have nothing to do with this seam. So read the claim as "measured near
+ * idle on a 12-core host", and nothing stronger. If this test fails on a smaller or busier
+ * machine, raise {@link #OUTPUT_TIMEOUT_MS} before you suspect the seam.
 *
 * <p>{@link #waitUntilSettled} is kept as cheap insurance against that swallow case, not because
 * anyone showed it was needed. If you want to delete it, the honest test is whether you can make
@@ -1,138 +0,0 @@
-package dev.ltms.fleet.inject;
-
-import dev.ltms.fleet.config.FleetConfig;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-
-import java.util.Map;
-import java.util.regex.Pattern;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotSame;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertSame;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * fleetd #446: {@code LiveExhaustedPatterns} is the mechanism that makes {@code exhaustedPattern}
- * hot — read fresh off a config supplier per lookup, cached by profile name. This is the direct,
- * minimal unit test of that mechanism: read the pattern once, mutate the backing "config", read
- * again, and assert the second read saw the new value — the exact hotness proof shape.
- *
- * <p>This class alone does not prove {@code Fleetd.main} actually wires the live source into
- * production — {@link dev.ltms.fleet.FleetdExhaustionDetectionArmedWiringTest} and {@code
- * CompletionResolverTest}'s {@code ExhaustedPatternLookup} tests do that at the wiring level. What
- * this class proves is that the mechanism itself is genuinely live and genuinely cached, not that
- * it is used.
- */
-class LiveExhaustedPatternsTest {
-
-    private static FleetConfig.Profile profileWithPattern(String pattern) {
-        return new FleetConfig.Profile("terra", "http://gx00.gw:8000", "terra",
-                null, null, null, "tab", "fleetd-workers", "w #{n}", null, null, null,
-                null, null, null, null, null, null, null, pattern);
-    }
-
-    /** Simple mutable holder standing in for {@code ConfigRef} — swapped, never mutated in place. */
-    private static final class MutableProfiles {
-        private volatile Map<String, FleetConfig.Profile> profiles;
-
-        MutableProfiles(Map<String, FleetConfig.Profile> initial) {
-            this.profiles = initial;
-        }
-
-        Map<String, FleetConfig.Profile> get() {
-            return profiles;
-        }
-
-        void set(Map<String, FleetConfig.Profile> fresh) {
-            this.profiles = fresh;
-        }
-    }
-
-    @Test
-    @DisplayName("patternFor reads the live config: read, change, read again, see the change — no restart")
-    void patternForIsHotAcrossAConfigChange() {
-        MutableProfiles live = new MutableProfiles(Map.of("terra", profileWithPattern("usage limit")));
-        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(live::get);
-
-        Pattern before = patterns.patternFor("terra");
-        assertTrue(before.matcher("your usage limit has been reached").find());
-
-        // Change the "config" — the exact thing a reload does to ConfigRef in production.
-        live.set(Map.of("terra", profileWithPattern("rate limit exceeded")));
-
-        Pattern after = patterns.patternFor("terra");
-        assertTrue(after.matcher("429: rate limit exceeded, try later").find(),
-                "the second read must see the NEW pattern text with no restart");
-        assertFalse(after.matcher("your usage limit has been reached").find(),
-                "the second read must have actually recompiled — not just reused a stale match");
-    }
-
-    @Test
-    @DisplayName("armed follows the same live read: on, then off, after a config change — no restart")
-    void armedIsHotAcrossAConfigChange() {
-        MutableProfiles live = new MutableProfiles(Map.of("terra", profileWithPattern("usage limit")));
-        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(live::get);
-
-        assertTrue(patterns.armed("terra"));
-
-        live.set(Map.of("terra", profileWithPattern(null)));
-
-        assertFalse(patterns.armed("terra"),
-                "removing exhaustedPattern and 'reloading' must disarm detection with no restart");
-    }
-
-    @Test
-    @DisplayName("an unchanged pattern string is not recompiled — the cache is reused")
-    void unchangedPatternTextReusesTheCompiledInstance() {
-        MutableProfiles live = new MutableProfiles(Map.of("terra", profileWithPattern("usage limit")));
-        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(live::get);
-
-        Pattern first = patterns.patternFor("terra");
-        // A NEW Profile object, same pattern text — a reload of an unrelated key produces a fresh
-        // FleetConfig even though this profile's own text did not change.
-        live.set(Map.of("terra", profileWithPattern("usage limit")));
-        Pattern second = patterns.patternFor("terra");
-
-        assertSame(first, second,
-                "identical pattern text must reuse the cached compiled Pattern, not recompile it — "
-                        + "recompiling a regex on every check is exactly the cost the cache exists to avoid");
-    }
-
-    @Test
-    @DisplayName("a changed pattern string is recompiled, not silently reused from the cache")
-    void changedPatternTextIsRecompiled() {
-        MutableProfiles live = new MutableProfiles(Map.of("terra", profileWithPattern("usage limit")));
-        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(live::get);
-
-        Pattern first = patterns.patternFor("terra");
-        live.set(Map.of("terra", profileWithPattern("rate limit")));
-        Pattern second = patterns.patternFor("terra");
-
-        assertNotSame(first, second, "changed pattern text must produce a freshly compiled Pattern");
-    }
-
-    @Test
-    void unknownProfileReturnsNullAndUnarmed() {
-        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(Map::of);
-        assertNull(patterns.patternFor("nope"));
-        assertFalse(patterns.armed("nope"));
-    }
-
-    @Test
-    void nullProfileNameReturnsNullAndUnarmed() {
-        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(
-                () -> Map.of("terra", profileWithPattern("usage limit")));
-        assertNull(patterns.patternFor(null));
-        assertFalse(patterns.armed(null));
-    }
-
-    @Test
-    void profileWithNoPatternConfiguredReturnsNull() {
-        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(
-                () -> Map.of("terra", profileWithPattern(null)));
-        assertNull(patterns.patternFor("terra"));
-        assertFalse(patterns.armed("terra"));
-    }
-}
@@ -187,6 +187,71 @@ class FleetMcpAuthzTest {
                "no CallerResolver supplied ⇒ authorization not enforced (legacy behaviour)");
    }

+    // --- fleetd #439: who may see fleet_list's coordinator row ----------------------------------
+
+    /**
+     * fleetd #439: {@link FleetMcp#coordinatorVisibleTo} is the whole policy decision for
+     * {@code fleet_list}'s {@code coordinator} row — lead-to-lead coordination state, not roster
+     * observation. Only the primary may see it; a worker, an architect, and (the case the previous
+     * pass of this ticket did not cover) an anonymous caller must all be refused.
+     */
+    @Test
+    void onlyThePrimaryMaySeeTheCoordinatorRow() {
+        assertTrue(FleetMcp.coordinatorVisibleTo(PRIMARY), "the primary must see its own coordination state");
+        assertFalse(FleetMcp.coordinatorVisibleTo(WORKER_A), "a worker must not see lead-to-lead coordination state");
+        assertFalse(FleetMcp.coordinatorVisibleTo(ARCH_DESIGN),
+                "an architect holds READ today, but that must not extend to coordinator");
+        assertFalse(FleetMcp.coordinatorVisibleTo(ANON), "authenticated as nothing must not see it either");
+    }
+
+    /**
+     * fleetd #439 / PR #462 review finding M2: the predicate above can be perfectly correct while
+     * the one production call site (the {@code fleet_list} MCP handler) never actually asks it —
+     * a literal {@code true} compiles, and the whole suite stayed green under that mutation because
+     * every existing test drives {@link FleetMcp#listFleet} directly and supplies the boolean
+     * itself. This test reads {@code FleetMcp.java}'s own source (same idiom as {@link
+     * #toolsTheServerRegisters()} / {@link #everyRegisteredToolHasItsHandlerActionPinned()}) and
+     * asserts the handler's call passes {@code coordinatorVisibleTo(principal(exchange))} — not a
+     * literal {@code true} or {@code false} — as {@code listFleet}'s trailing argument.
+     *
+     * <p>Anchored on argument position, not a bare substring search: {@code true} appears many
+     * times elsewhere in this file for unrelated reasons, so a plain {@code contains("true")}
+     * check would prove nothing. The pattern requires the literal text immediately before the
+     * closing {@code );} of the {@code listFleet(} call inside the handler block to be exactly
+     * {@code coordinatorVisibleTo(principal(exchange))}.
+     */
+    @Test
+    void theFleetListHandlerActuallyConsultsCoordinatorVisibleTo() throws Exception {
+        String source = Files.readString(MCP_SOURCE);
+
+        // Isolate the fleet_list handler block: from its declaration up to the next handler's
+        // declaration. A change to variable naming would break this scrape loudly (see the control
+        // assertion just below), rather than silently reporting "no violation found".
+        int start = source.indexOf("listHandler =");
+        assertTrue(start >= 0, "could not find the fleet_list handler (listHandler) in " + MCP_SOURCE
+                + " -- the scrape has stopped matching, fix the anchor before trusting this test");
+        int end = source.indexOf("stopHandler =", start);
+        assertTrue(end > start, "could not find the handler declared after listHandler to bound the scrape");
+        String handlerBlock = source.substring(start, end);
+
+        // CONTROL: the block we scraped really does contain a call to listFleet(...) -- if this
+        // fails, the anchors above moved and the assertion below would otherwise pass on nothing.
+        assertTrue(handlerBlock.contains("listFleet("),
+                "control failed: the scraped listHandler block contains no listFleet( call at all -- "
+                        + "the anchors have drifted, this test is not testing what it claims to");
+
+        Pattern trailingArg = Pattern.compile(
+                "listFleet\\([^;]*?,\\s*(coordinatorVisibleTo\\(principal\\(exchange\\)\\)|true|false)\\s*\\)\\s*;",
+                Pattern.DOTALL);
+        Matcher m = trailingArg.matcher(handlerBlock);
+        assertTrue(m.find(), "could not locate listFleet(...)'s trailing boolean argument in the "
+                + "listHandler block -- the call shape changed, update this test's anchor: " + handlerBlock);
+        String trailing = m.group(1);
+        assertEquals("coordinatorVisibleTo(principal(exchange))", trailing,
+                "the fleet_list handler must ask coordinatorVisibleTo(principal(exchange)) who is "
+                        + "calling, not pass a literal boolean -- found: " + trailing);
+    }
+
    // --- which action each tool hands the gate (fleetd #272) ------------------------------------

    /**
@@ -676,6 +676,95 @@ class FleetMcpTest {
                "an ordinary fleet's output must be unchanged by this feature");
    }

+    /**
+     * fleetd #439: a worker calling {@code fleet_list} must get a result with the {@code
+     * coordinator} key <strong>absent</strong> -- not an empty object, not a redacted one -- even
+     * though lead coordination is fully configured and would otherwise report a row. This drives
+     * the same {@code callerIsPrimary} value the MCP handler computes ({@code
+     * Principal.worker(...).isPrimary()}), so it pins the real production boolean, not a literal.
+     */
+    @Test
+    void listOmitsTheCoordinatorKeyEntirelyForAWorkerEvenWhenLeadCoordinationIsOn() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1));
+        boolean callerIsPrimary = Principal.worker("term_a", 1).isPrimary();
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), callerIsPrimary);
+
+        String out = textOf(res);
+        assertFalse(out.contains("\"coordinator\""), "a worker must never see the coordinator key at all: " + out);
+        assertFalse(out.contains("mac-opus"), "no fragment of the coordinator row may leak either: " + out);
+        assertTrue(out.contains("\"leads\""), "the rest of the result must still be present: " + out);
+        assertTrue(out.contains("\"members\""), out);
+        assertTrue(out.contains("\"healthCoverage\""), out);
+    }
+
+    /**
+     * fleetd #439 acceptance criterion 2: an architect gets exactly the same treatment as a worker.
+     * This is a real, executed test (not just reasoning by analogy) -- it drives the actual
+     * {@code Principal.architect(...).isPrimary()} value the production handler would compute for
+     * an architect caller, through the same gate a worker's call goes through.
+     */
+    @Test
+    void listOmitsTheCoordinatorKeyEntirelyForAnArchitectToo() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1));
+        boolean callerIsPrimary = Principal.architect("lead-designer", "term_design", 400).isPrimary();
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), callerIsPrimary);
+
+        String out = textOf(res);
+        assertFalse(out.contains("\"coordinator\""), "an architect must never see the coordinator key either: " + out);
+    }
+
+    /**
+     * fleetd #439 acceptance criterion 3: the primary's {@code fleet_list} is byte-for-byte
+     * unchanged by this fix. Proven by comparing the new gated overload (with {@code
+     * callerIsPrimary=true}, exactly what the MCP handler passes for the primary) against the
+     * pre-#439 overload that always assembled the row -- if the gate changed anything for a
+     * primary caller, these two strings would differ.
+     */
+    @Test
+    void listIsByteForByteUnchangedForThePrimaryCaller() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1));
+
+        String preExisting = textOf(FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), Map.of(), "",
+                new FleetMcp.CoordinationSource(channel, List.of())));
+        String gatedAsPrimary = textOf(FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), true));
+
+        assertEquals(preExisting, gatedAsPrimary,
+                "a primary caller must see byte-for-byte the same result as before this fix");
+        assertTrue(gatedAsPrimary.contains("\"coordinator\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"selfId\":\"mac-opus\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"mailbox\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"heldCount\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"heldDurable\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"held\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"peers\""), gatedAsPrimary);
+    }
+
    @Test
    void listReportsHeldMessagesWithATruncatedPreviewNeverTheFullBody() {
        FakeHerdr h = new FakeHerdr();
@@ -1,111 +0,0 @@
-package dev.ltms.fleet.mcp;
-
-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.guard.SubscriptionGuard;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.member.ClaudeCodeLauncher;
-import dev.ltms.fleet.peer.PeerLauncher;
-import dev.ltms.fleet.placement.BackendQuarantine;
-import io.modelcontextprotocol.spec.McpSchema;
-import org.junit.jupiter.api.Test;
-
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * fleetd #446 follow-up (criterion 3): a mutation battery run against the merged PR #457 proved
- * that deleting either {@code row.put("model", model);} or {@code row.put("reason", reason);}
- * from {@link FleetMcp#profilesView} left all 1586 existing tests green — nothing exercised a
- * {@link FleetMcp.QuarantineSource} whose {@code modelFor}/{@code reasonFor} actually return a
- * value. This class is what makes both deletions red, and also pins the two "must be omitted, not
- * emitted as null/blank" branches those two {@code if} guards exist for — {@link
- * FleetMcpTest#profilesReportsAQuarantinedCredential} covers the credential/quarantine-duration
- * shape but supplies neither function, so it cannot distinguish "the field is missing" from "the
- * field was never asked for".
- */
-class FleetProfilesQuarantineModelReasonFieldsTest {
-
-    private static final String PROFILE = "terra";
-    private static final String CREDENTIAL = "cred-terra";
-
-    private static PeerLauncher launcher(FakeHerdr h) {
-        FleetConfig.Profile profile = new FleetConfig.Profile(
-                PROFILE, "http://gx00.gw:8000", "claude-opus-5", null, "FLEETD_WORKER_TOKEN", null,
-                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
-        return new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(PROFILE, profile), PROFILE, _ -> "tok");
-    }
-
-    private static BackendQuarantine quarantined(String credentialId) {
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        quarantine.quarantine(credentialId);
-        return quarantine;
-    }
-
-    private static String textOf(McpSchema.CallToolResult r) {
-        return ((McpSchema.TextContent) r.content().getFirst()).text();
-    }
-
-    @Test
-    void quarantinedRowNamesTheModelAndTheReason() {
-        FakeHerdr h = new FakeHerdr();
-        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
-                _ -> CREDENTIAL, quarantined(CREDENTIAL), _ -> true,
-                _ -> "claude-opus-5", _ -> "The usage limit has been reached");
-
-        McpSchema.CallToolResult res = FleetMcp.profiles(launcher(h), source);
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-
-        assertTrue(out.contains("\"quarantined\""), out);
-        assertTrue(out.contains("\"model\":\"claude-opus-5\""),
-                "the quarantined row must name the model the fix applies to: " + out);
-        assertTrue(out.contains("\"reason\":\"The usage limit has been reached\""),
-                "the quarantined row must name why it was quarantined: " + out);
-    }
-
-    @Test
-    void quarantinedRowOmitsModelWhenNoneIsConfigured() {
-        FakeHerdr h = new FakeHerdr();
-        // null and "" (blank) both exercise the same production guard (`!model.isBlank()`) —
-        // covered together since both must produce the identical outcome: the key absent.
-        for (String noModel : new String[] {null, "", "   "}) {
-            FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
-                    _ -> CREDENTIAL, quarantined(CREDENTIAL), _ -> true,
-                    _ -> noModel, _ -> "some reason");
-
-            McpSchema.CallToolResult res = FleetMcp.profiles(launcher(h), source);
-            String out = textOf(res);
-
-            assertTrue(out.contains("\"quarantined\""), out);
-            assertFalse(out.contains("\"model\""),
-                    "modelFor returned " + (noModel == null ? "null" : "'" + noModel + "'")
-                            + " — the key must be ABSENT, not emitted as null or an empty string: " + out);
-        }
-    }
-
-    @Test
-    void quarantinedRowOmitsReasonWhenNoneIsKnown() {
-        FakeHerdr h = new FakeHerdr();
-        for (String noReason : new String[] {null, "", "  "}) {
-            FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
-                    _ -> CREDENTIAL, quarantined(CREDENTIAL), _ -> true,
-                    _ -> "claude-opus-5", _ -> noReason);
-
-            McpSchema.CallToolResult res = FleetMcp.profiles(launcher(h), source);
-            String out = textOf(res);
-
-            assertTrue(out.contains("\"quarantined\""), out);
-            assertFalse(out.contains("\"reason\""),
-                    "reasonFor returned " + (noReason == null ? "null" : "'" + noReason + "'")
-                            + " — the key must be ABSENT, not emitted as null or an empty string: " + out);
-        }
-    }
-}
Author	SHA1	Message	Date
Dai Ha	c1ca6273fc	fleetd #439 : pin the caller at the fleet_list call site, not just the gate CI / contract (pull_request) Successful in 1m29s Details CI / build (pull_request) Successful in 1m33s Details Review of PR #462 found M2: the coordinatorVisibleTo gate (then an inline principal(exchange).isPrimary() check) could survive a mutation that replaced the argument with a literal true at the one production call site, because every existing test drove listFleet directly and supplied the boolean itself -- nothing exercised the handler's own call. - Name the decision: FleetMcp.coordinatorVisibleTo(Principal), a small package-private predicate next to denyFor/recordPrimarySingleton. The fleet_list handler now calls coordinatorVisibleTo(principal(exchange)) instead of inlining .isPrimary(). - Pin the predicate's role table in FleetMcpAuthzTest (onlyThePrimaryMaySeeTheCoordinatorRow), covering primary/worker/ architect and, newly, anonymous. - Add a source-reading detector at the boundary (theFleetListHandlerActuallyConsultsCoordinatorVisibleTo), same idiom as toolsTheServerRegisters/everyRegisteredToolHasItsHandlerActionPinned: it reads FleetMcp.java, isolates the listHandler block, asserts (as a control) that the block actually contains a listFleet( call, then asserts the call's trailing boolean argument is exactly coordinatorVisibleTo(principal(exchange)) -- not a literal true/false. Both mutations from the review were reproduced and killed by these tests, then reverted; see the PR body for the full break-and-restore transcript.	2026-09-10 18:28:16 +07:00
Dai Ha	e54e3d87ea	fleetd #439 : omit fleet_list's coordinator key for non-primary callers CI / contract (pull_request) Successful in 56s Details CI / build (pull_request) Successful in 1m40s Details The coordinator row is lead-to-lead coordination state (coord-ids, mailbox facts, held-message previews). fleet_list returned it to every caller, including a worker or an architect, because coordinatorView() had no way to know who was asking. Gate at the call site inside listFleet: a new overload takes callerIsPrimary and only assembles/attaches the coordinator row when it is true, so the key is absent (not empty) for a worker or an architect. The MCP handler now passes principal(exchange).isPrimary(); every other listFleet overload keeps passing true, so callers with no caller identity (existing unit tests, the no-op wrappers) are unaffected -- confirmed by a byte-for-byte comparison test against the pre-fix overload. Authz's READ case is untouched: it stays shared by fleet_status, fleet_profiles and fleet_whoami, and the gate here is purely inside fleet_list's own result assembly.	2026-09-10 18:16:48 +07:00
Dai Ha	3c5873dfe2	fleetd #453 : point the new javadoc at the right javadoc CI / contract (push) Successful in 51s Details CI / build (push) Successful in 1m52s Details #456's first paragraph said "HerdrPeerLauncher's own {@link #spawn(SpawnRequest, PlacementDecision)} javadoc". That link resolves to this interface's own abstract declaration, not to HerdrPeerLauncher's override, so a reader who follows it lands on the wrong text. The second paragraph already used the plain {@code HerdrPeerLauncher.spawn(...)} form; both now match. Also says who is actually forced to read the paragraph, because #456's reasoning rests on it and the two cases differ. A class that implements this interface directly must write a body for spawn(SpawnRequest, PlacementDecision) - it is abstract here - so it reads this javadoc. A subclass of HerdrPeerLauncher does not: HerdrPeerLauncher already implements that method (member/HerdrPeerLauncher.java:611) and the subclass inherits the body. For a subclass the paragraph is advice, not a gate. javadoc -Ddoclint=reference: 5 "reference not found", the same 5 in the same 5 untouched files as origin/main at `2af13ab`, and none in PeerLauncher.java. Those 5 are ticket #459. mvn compile rc=0.	2026-09-10 18:05:07 +07:00
ltms	e29227d5f4	Merge #456 : document the override obligation on PeerLauncher.defaultProfileFor/place (fleetd #453 ) CI / contract (push) Successful in 51s Details CI / build (push) Successful in 1m34s Details Doc-only, one file, 17 added lines. Verified by me on a local merge of `0788d84` onto `2af13ab` (merge commit 5b46538): - mvn -B clean test: Tests run: 1578, Failures: 0, Errors: 0, Skipped: 0. BUILD SUCCESS, rc=0. - javadoc reference lint (mvn javadoc:javadoc -Ddoclint=reference): the merge has 5 "reference not found" errors; origin/main at `2af13ab` has the same 5, in the same 5 untouched files. So this PR adds no broken link. Both runs rc=1 for that pre-existing reason, which is now ticket #459. - The quoted phrase is real: "are unoverridden here and just wrap {@link #defaultProfile()}" is at member/HerdrPeerLauncher.java:604. place() is not overloaded, so {@link #place} is unambiguous. One inaccuracy I am fixing in a follow-up commit rather than sending the PR back: the first new paragraph writes "HerdrPeerLauncher's own {@link #spawn(SpawnRequest, PlacementDecision)} javadoc", but that link resolves to PeerLauncher's own abstract declaration, not to HerdrPeerLauncher's override. The second paragraph already gets this right with plain {@code HerdrPeerLauncher.spawn(...)}.	2026-09-10 13:04:09 +02:00
Dai Ha	2af13ab1ff	fleetd #449 : name the decisive cell and the load the claim was measured at CI / contract (push) Successful in 54s Details CI / build (push) Successful in 2m8s Details The previous comment named a cause with no cell behind it. fleet01's review made the point: a confident wrong mechanism gets copied, and a confident under-determined one gets copied the same way. So the comment now names the cell that settles it. Hold the old 1000ms write sleep and change only the read - 800ms fixed sleep becomes a 5s poll - and the test goes 0 of 3 to 3 of 3. The read deadline was the whole story. It also says where: a 12-core macOS host near idle (load 2.6 to 5.9). The loaded run agreed, but its load climbed from 7 to 50 while the cells ran and the old version ran last, so it is not clean evidence and the comment says so. Comment only. No test or production code changed.	2026-09-10 17:59:52 +07:00
Dai Ha	0788d84be8	fleetd #453 : document the override obligation on PeerLauncher.defaultProfileFor/place CI / contract (pull_request) Successful in 50s Details CI / build (pull_request) Successful in 1m34s Details Decision: leave both as default methods (option 1), not abstract. Neither default is a live defect today — HerdrPeerLauncher is the sole single-profile implementer and the degenerate answer (ignore role, always defaultProfile()) is correct for it. Making them abstract would force ~10 boilerplate one-line overrides across 5 unrelated PeerLauncher test doubles (NeverSpawnsLauncher, RaceLauncher, NoResumeLauncher, ClearContextSpyLauncher, LazyIdLauncher) that never call either method, for a risk that is speculative (no multi-profile HerdrPeerLauncher subclass exists or is planned). Strengthens both javadocs with an explicit MUST-override warning and cross- references HerdrPeerLauncher.spawn(SpawnRequest, PlacementDecision)'s existing #450 javadoc, which already names both methods as "unoverridden here" and ties that to being a single-profile adapter -- the concrete place a future multi-profile launcher author would read, since #450 made that method abstract and any subclass must write its body.	2026-09-10 17:49:37 +07:00