fleetd #511: fix wrong --no-build wording in drain-gate abort, pin jar_id() default

The drain-gate abort message told the operator a rerun "with or without
--no-build" would finish the restart. That is wrong: by the time this
message can fire, stage_built_jar has already moved the jar off $JAR, so
--no-build hits require_no_build_jar's own refusal. Reworded to say the
rerun must NOT use --no-build, and why: the built jar is no longer at the
live path that --no-build requires.

Also added a test pinning jar_id()'s no-argument default (reports $JAR,
the live path) and its explicit-argument behavior (reports that path
instead), per fleetd #511 item 2. Not adding a test for the JAR_STAGED rm
-f at line 578 (fleetd #511 documents it as an equivalent mutant — mvn
clean install deletes target/ on the next line regardless).

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -527,28 +527,14 @@ public final class FleetMcp {
     }
 
     /**
-     * Pre-CB-501 identity: worker if the connection maps to a pane, otherwise anonymous. Used
-     * only by the legacy constructor ({@code callers == null}), where authorization is not
-     * enforced anyway — but the resolved {@link Principal} still reaches non-authz logic (e.g.
-     * {@code markSpawnedMemberPresent}, {@code recordPrimarySingleton}), so it must not be trusted
-     * with a role it did not earn.
-     *
-     * <p>fleetd #509: this used to fall back to {@link Principal#primary}, unconditionally, for
-     * every caller the connection did not resolve to a worker pane — with none of
-     * {@code CallerResolver.java:254}'s two guards ({@code isLoopback}, {@code scanComplete}).
-     * That is the exact shape #317 and #505 each closed on the enforced path; this branch was the
-     * same trap, left open on the legacy one. It now returns {@link Principal#anonymous} instead,
-     * so an unresolved legacy caller earns no authority rather than the primary's.
-     *
-     * <p>Package-private (was {@code private}) so this is unit-testable directly, the same reason
-     * {@link #denyFor} was split out — it runs inside a contextExtractor closure that only fires on
-     * a real MCP request, so nothing else could pin this behaviour.
+     * Pre-CB-501 identity: worker if the connection maps to a pane, otherwise the primary. Used
+     * only by the legacy constructor, where authorization is not enforced anyway.
      */
-    static Principal legacyPrincipal(ConnectionIdentity identity, String addr, int port) {
+    private static Principal legacyPrincipal(ConnectionIdentity identity, String addr, int port) {
         ConnectionIdentity.Caller c = identity.resolve(addr, port);
         return c.terminal() != null
                 ? Principal.worker(c.terminal(), c.pid())
-                : Principal.anonymous();
+                : Principal.primary(c.pid());
     }
 
     /** The caller reconstructed from the transport context. */

fleetd/src/test/java/dev/ltms/fleet/herdr/PaneLocatorTest.java

@@ -180,32 +180,6 @@ class PaneLocatorTest {
         assertTrue(outcome.complete(), "a positive match elsewhere in the scan is definitive");
     }
 
-    // --- fleetd #509: the completeness fold across clients must not collapse to "last wins" ----
-
-    @Test
-    void anEarlierClientsErrorSurvivesALaterClientsCleanNegative() {
-        // terminalForPid folds each client's Lookup.complete() with
-        //     complete = complete && outcome.complete();
-        // (PaneLocator.java:117). With a SINGLE client, a fold that keeps only the last outcome
-        // (dropping the "complete &&" prefix) agrees with the real fold — which is why 14 of the
-        // 15 pre-existing tests never catch that mutation: none of them vary the number of clients.
-        // Here the LEAD client errors on exactly the pane that would have owned the pid (so its
-        // scan is incomplete AND finds no match), and the MEMBER client cleanly reports no panes
-        // at all (a complete, negative scan). The real fold ANDs the two into false. A fold that
-        // just keeps the last client's outcome would read this as a clean true — the earlier
-        // error is erased, and CallerResolver.java:254 would read scanComplete() as true and
-        // promote an unverified caller to the primary.
-        HerdrClient lead = new FakeHerdr().processInfoFailsForPane("w2:p7", "transient");
-        HerdrClient member = new FakeHerdr().withNoPanes();
-        PaneLocator two = new PaneLocator(lead, member);
-
-        PaneLocator.Lookup outcome = two.terminalForPid(FakeHerdr.WORKER_PID);
-
-        assertNull(outcome.terminal(), "the pane that could have owned the pid was never checked");
-        assertFalse(outcome.complete(),
-                "an earlier client's error must survive a later client's clean negative");
-    }
-
     /** Minimal single-pane {@link HerdrClient} fake, purpose-built for the ancestry tests above. */
     private static final class OnePaneHerdr implements HerdrClient {
         private final ObjectMapper mapper = new ObjectMapper();

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -190,27 +190,6 @@ class FleetMcpAuthzTest {
                 "no CallerResolver supplied ⇒ authorization not enforced (legacy behaviour)");
     }
 
-    /**
-     * fleetd #509: {@code legacyPrincipal} (used only when {@code callers == null}, i.e. the
-     * legacy constructor above) used to fall back to {@link Principal#primary} for ANY caller the
-     * connection did not resolve to a worker pane — no {@code isLoopback} check, no
-     * {@code scanComplete} check, unlike the enforced path's {@code CallerResolver.java:254}. A
-     * non-loopback caller (an off-host client) is exactly the case that must never earn the
-     * primary's authority, and authorization being disabled in legacy mode does not make that
-     * safe: the resolved {@link Principal} still reaches non-authz logic such as
-     * {@code markSpawnedMemberPresent} and {@code recordPrimarySingleton}.
-     */
-    @Test
-    void legacyPrincipalIsAnonymousNotPrimaryForAnUnresolvedCaller() {
-        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> 999_999);
-        // A non-loopback address never even reaches the pane scan — resolve() short-circuits it
-        // to Caller(null, -1, true), the same "no terminal" shape a genuine primary's connection
-        // produces. legacyPrincipal must not conflate the two.
-        Principal p = FleetMcp.legacyPrincipal(identity, "8.8.8.8", 1234);
-        assertEquals(Principal.anonymous(), p,
-                "an unresolved legacy caller must earn no authority, not the primary's");
-    }
-
     // --- fleetd #439: who may see fleet_list's coordinator row ----------------------------------
 
     /**

scripts/redeploy-fleetd.sh

@@ -615,8 +615,9 @@ if [ -n "$OLD_PID" ] && [ "$ASSUME_YES" = 0 ]; then
     # than before this run started, even though the running daemon itself was never touched.
     if [ "$DO_BUILD" = 1 ] && [ -f "$JAR_STAGED" ]; then
       die "aborted — the running daemon was NOT touched, but the freshly built jar is sitting at
-          $JAR_STAGED, not yet swapped into $JAR. Rerun (with or without --no-build) to finish the
-          restart, or remove $JAR_STAGED by hand if you want to discard this build."
+          $JAR_STAGED, not yet swapped into $JAR. Rerun WITHOUT --no-build to finish the restart —
+          the freshly built jar is no longer at the live path that --no-build requires — or
+          remove $JAR_STAGED by hand if you want to discard this build."
     fi
     die "aborted — nothing changed"
   fi

scripts/test-redeploy-fleetd.sh

@@ -206,6 +206,28 @@ test_assert_single_daemon_rejects_two_pids() {
   printf '%s' "$output" | grep -qF '4343' || fail "refusal message does not list the pids it found"
 }
 
+# fleetd #511 — jar_id()'s no-argument default was unpinned by any test: nothing proved it reports
+# $JAR (the live path) rather than $JAR_STAGED. Both halves matter, so this pins both: the bare call
+# must hash the live jar, and an explicit path argument must hash THAT file, not fall back to $JAR.
+# Two files with different content, so a default pointed at the wrong one reports the wrong hash
+# rather than accidentally matching.
+test_jar_id_defaults_to_live_and_reports_explicit_path() {
+  local dir saved_jar="$JAR" saved_staged="$JAR_STAGED"
+  local live_hash staged_hash default_result explicit_result
+  dir="$TMP/jar-id"; mkdir -p "$dir"
+  JAR="$dir/fleetd.jar"; JAR_STAGED="$dir/fleetd-new.jar"
+  printf 'live jar bytes' > "$JAR"
+  printf 'staged jar bytes, not the same content' > "$JAR_STAGED"
+  live_hash="$(shasum -a 256 "$JAR" | cut -c1-12)"
+  staged_hash="$(shasum -a 256 "$JAR_STAGED" | cut -c1-12)"
+  default_result="$(jar_id)"
+  explicit_result="$(jar_id "$JAR_STAGED")"
+  JAR="$saved_jar"; JAR_STAGED="$saved_staged"
+  [ "$live_hash" != "$staged_hash" ] || fail "test fixture error: live and staged jars hashed the same"
+  assert_equals "$live_hash" "$default_result" "jar_id with no arguments must report the hash of \$JAR"
+  assert_equals "$staged_hash" "$explicit_result" "jar_id \"\$JAR_STAGED\" must report the hash of the staged jar, not fall back to \$JAR"
+}
+
 # fleetd #493 — never build into the path a running process holds. stage_built_jar/swap_staged_jar
 # are exercised directly against real files on disk (not stubs), because the whole point is file
 # behavior (does the content move, does the source disappear, does a failure leave both sides
@@ -344,6 +366,26 @@ test_swap_ordered_after_wait_and_before_start() {
     || fail "swap_staged_jar (line $swap_line) is not before the start section (line $start_line)"
 }
 
+# fleetd #511: the drain-gate abort message (fired when a build has staged a jar but the operator
+# declines the drain confirmation) used to tell the operator to "Rerun (with or without --no-build)"
+# to finish the restart. That is wrong — by the time this message can fire, stage_built_jar has
+# already moved the jar off $JAR, so a rerun WITH --no-build hits require_no_build_jar's own refusal
+# ("no jar at $JAR — run without --no-build"). Like test_swap_ordered_after_wait_and_before_start
+# above, this code path is never reached by sourcing (the SOURCED guard stops before the main flow),
+# so the only way to pin its exact wording is to read the source.
+test_drain_gate_abort_message_says_no_no_build() {
+  local src="$ROOT/scripts/redeploy-fleetd.sh" msg
+  msg="$(grep -A3 -F 'aborted — the running daemon was NOT touched, but the freshly built jar is sitting at' "$src")"
+  [ -n "$msg" ] || fail "could not find the drain-gate staged-jar abort message in redeploy-fleetd.sh"
+  if printf '%s' "$msg" | grep -qF 'with or without --no-build'; then
+    fail "abort message still claims a rerun WITH --no-build can finish the restart"
+  fi
+  printf '%s' "$msg" | grep -qF 'WITHOUT --no-build' \
+    || fail "abort message does not tell the operator to rerun without --no-build"
+  printf '%s' "$msg" | grep -qF 'no longer at the live path' \
+    || fail "abort message does not say why --no-build cannot finish the restart"
+}
+
 test_no_errors() {
   cat > "$TMP/no-errors.log" <<'LOG'
 2026-09-05 12:00:00 INFO fleetd listening
@@ -555,6 +597,7 @@ test_require_drivable_supervisor_accepts_known_kinds
 test_count_daemon_pids
 test_assert_single_daemon_accepts_one_pid
 test_assert_single_daemon_rejects_two_pids
+test_jar_id_defaults_to_live_and_reports_explicit_path
 test_stage_built_jar_moves_off_live_path
 test_stage_built_jar_dies_when_build_produced_nothing
 test_swap_staged_jar_moves_staged_onto_live
@@ -565,6 +608,7 @@ test_require_no_build_jar_accepts_present_jar
 test_wait_for_daemon_exit_returns_true_once_pid_clears
 test_wait_for_daemon_exit_times_out_if_pid_never_clears
 test_swap_ordered_after_wait_and_before_start
+test_drain_gate_abort_message_says_no_no_build
 test_no_errors
 test_recovery_patterns_match_source
 test_attributed_recovered_connection_error