fleetd #589 (Groups 1 & 2): pin 6 main() wiring sites with named factories

Extracts 6 inline wiring expressions from Fleetd.main() into named, directly-testable package-private static factories, following the FleetdLoopHealthSourceWiringTest (#584) shape, and adds one wiring test per factory: Group 1 (exhaustion/quarantine): - forwardingExhaustionSink(exhaustionSinkRef) — was inline ExhaustionSink.forwardingTo(exhaustionSinkRef::get) - publishExhaustionSink(...) — was two untested statements building the real sink and .set()-ing it into exhaustionSinkRef - liveExhaustedPatterns(config) — was inline new LiveExhaustedPatterns(() -> config.get().profiles()) - exhaustedPatternLookup(roster, liveExhaustedPatterns) — was an inline lambda resolving a herdr target to its profile's live pattern; silently losing this is the worst regression in the sweep, since a real usage-limit refusal would stop being classified as BACKEND_EXHAUSTED Group 2 (CB-596 credential policy): - claudeCodeLauncher(...) — was an inline `new ClaudeCodeLauncher(...)` whose memberCredentials supplier argument was untestable wiring - openCodeLauncher(...) — same, for OpenCodeLauncher Each new test pins its factory behaviorally (never via source-text assertions): built and confirmed RED by name against the named inert mutation, then confirmed GREEN again after restoring, and separately confirmed GREEN after a behavior-preserving reformat/local-variable extraction of the same call, to rule out a disguised source-text test. Suite: 1789 -> 1799 tests (+10, matching the 10 tests added), 0 failures, mvn -o clean install BUILD SUCCESS. Scope strictly limited to main()'s :214-:468 range per the ticket split with the concurrent worker handling Group 3 at line 500+.
CLAUDE.md: a blocked lead consults architects, not the operator
2026-09-19 15:35:32 +07:00 · 2026-09-19 14:57:04 +07:00 · 2026-09-13 07:01:15 +07:00 · 2026-09-12 15:52:25 +02:00 · 2026-09-12 20:28:14 +07:00 · 2026-09-12 20:28:14 +07:00
19 changed files with 1474 additions and 81 deletions
@@ -139,6 +139,15 @@ prefer `wait:false` + `fleet_poll` for anything non-trivial: a blocking `fleet_s
 **Delegating does not delegate responsibility.** Workers open PRs; you are the gate. Never delegate
 the merge — and merging on a reviewer's word is delegating it by proxy.

+**When a decision blocks you, consult architects — not the operator.** Spawn one or more architect
+members, give them the question and the evidence you have, and act on what they agree. They are
+authorized to settle it, not only to advise. If two of them still disagree after two rounds, they
+return both positions and you decide. Go to the operator only for something outside the fleet's
+authority: money, credentials, or a promise made to someone else. **Then write the decision on the
+ticket.** Taking the operator out of the loop also removes the signal they used to get, because
+that signal was the block itself — work stopped, so they found out. A ticket comment replaces it,
+and it reaches them whether or not they are at a terminal when you decide.
+
 | Intent | Tool |
 |---|---|
 | Confirm your own role | `fleet_whoami` |
@@ -5,6 +5,21 @@
 here took a revert and two upstream fixes — see §7.1, which is the useful part of this document. One
 risk is **accepted rather than solved**: a stream cut by any mid-response timer arrives as HTTP 200
 with no terminator, and our third-party members cannot detect it (§7.2).
+
+> **Superseded in part — 2026-09-13.** Two claims on this page are no longer true of the live fleet.
+> I measured both on this host today.
+>
+> 1. **The model is named `acoder` now, not `deepseek-v4-flash`.** `acoder` is a stable alias, and
+>    the model behind it changed on 2026-08-28: it is Qwen3.8-27B, not DeepSeek. The old name is
+>    still served, so nothing broke — the gateway answers it and reports `"model": "acoder"` in the
+>    reply, which is how you can see for yourself that it is an alias. `fleetd.yaml` moved to
+>    `acoder` on 2026-09-13. Do not guess behaviour from the name; ask the gateway's own manifest,
+>    `GET https://llm.ltms.dev/v1/deployment`, and read its `generation` field.
+> 2. **`local` sits at `weight: 0`, not 100.** Only `gx` is auto-selected today.
+>
+> §2 and §3 below are the plan as written in August. They are the record of the migration, so they
+> stay as they are. If this note stops matching `fleetd.yaml`, re-measure and rewrite the note.
+
 · **Upstream:** [systems/vms wiki → LLM and MCP Gateway](https://git.ltms.dev/systems/vms/wiki/LLM-and-MCP-Gateway)
 · **Upstream issue:** [systems/vms#31](https://git.ltms.dev/systems/vms/issues/31)

@@ -380,7 +395,10 @@ one turn; this one costs the whole task and is indistinguishable from a slow wor

 - Token accepted on both surfaces. **Unauthenticated → 401**, so the Caddy proxy really does gate —
  the wiki's "SecurityPolicy fails open" warning is about the gateway itself, not the edge.
- `/v1/models` returns exactly `["deepseek-v4-flash"]`, so trap 3 is clear.
+- `/v1/models` returned exactly `["deepseek-v4-flash"]` **on 2026-08-15**, so trap 3 was clear
+  then. It returns 6 ids now — `acoder`, `qwen3.8-27b-nvfp4`, `deepseek-v4-flash` and three
+  embedding names — measured on this host 2026-09-13. The exact-name rule still holds; the
+  one-item list does not.
 - **Reasoning survives both surfaces** — see §3b above.
 - The launcher's generated opencode provider block is correct, carrying a real 48-character `llmk-`
  key rather than the `fleetd-local-noauth` placeholder.
@@ -218,23 +218,23 @@ public final class Fleetd {
        // there is no 2-arg overload left for any lambda to silently bind to instead), but so a
        // test can call the exact same object this line builds, instead of asserting a copy of its
        // shape (round 3's lesson).
-        ExhaustionSink forwardingExhaustionSink = ExhaustionSink.forwardingTo(exhaustionSinkRef::get);
+        // fleetd #589 Group 1: extracted to forwardingExhaustionSink(...) below (see that method's
+        // javadoc) so a dedicated test can prove this factory keeps reading the reference live,
+        // rather than a rebuilt copy of its shape.
+        ExhaustionSink forwardingExhaustionSink = forwardingExhaustionSink(exhaustionSinkRef);
        // The claude-code adapter is the always-present default; keep it even with no profiles (so a
        // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
        // unless opencode is the only kind configured.
+        // fleetd #589 Group 2: extracted to claudeCodeLauncher(...)/openCodeLauncher(...) below (see
+        // those methods' javadoc) so a dedicated test can prove the CB-596 memberCredentials policy
+        // supplier is actually wired to each adapter, not silently replaced with `() -> null`.
        if (!claudeProfiles.isEmpty() || opencodeProfiles.isEmpty()) {
-            adapters.add(new ClaudeCodeLauncher(router.memberAgents(), router.memberSpaces(), guard,
-                    claudeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
-                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
-                    () -> config.get().fleet(),
-                    () -> config.get().memberCredentials(), null, config::get));
+            adapters.add(claudeCodeLauncher(router.memberAgents(), router.memberSpaces(), guard,
+                    claudeProfiles, cfg, config));
        }
        if (!opencodeProfiles.isEmpty()) {
-            adapters.add(new OpenCodeLauncher(router.memberAgents(), router.memberSpaces(),
-                    opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
-                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
-                    () -> config.get().fleet(),
-                    () -> config.get().memberCredentials(), config::get, forwardingExhaustionSink));
+            adapters.add(openCodeLauncher(router.memberAgents(), router.memberSpaces(),
+                    opencodeProfiles, cfg, config, forwardingExhaustionSink));
        }
        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
        // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
@@ -408,12 +408,12 @@ public final class Fleetd {
        // LiveExhaustedPatterns's class doc for why this replaces the old compiled-once-at-startup
        // map. A profile with no exhaustedPattern simply returns null here, so its workers keep
        // today's completion-fallback behaviour unchanged.
-        LiveExhaustedPatterns liveExhaustedPatterns = new LiveExhaustedPatterns(() -> config.get().profiles());
-        ExhaustedPatternLookup exhaustedPatterns = target -> sessions.roster().stream()
-                .filter(session -> target.equals(session.terminalId()))
-                .findFirst()
-                .map(session -> liveExhaustedPatterns.patternFor(session.profile()))
-                .orElse(null);
+        // fleetd #589 Group 1: both extracted to liveExhaustedPatterns(...)/
+        // exhaustedPatternLookup(...) below (see those methods' javadoc) — this is the worst
+        // consequence in the whole #589 sweep: silently losing either wiring means a genuine
+        // usage-limit refusal is handed back as a real completion instead of BACKEND_EXHAUSTED.
+        LiveExhaustedPatterns liveExhaustedPatterns = liveExhaustedPatterns(config);
+        ExhaustedPatternLookup exhaustedPatterns = exhaustedPatternLookup(sessions::roster, liveExhaustedPatterns);
        // The startup coverage line still reports the boot-time snapshot only — it is printed once,
        // here, and a reload no longer needs to change what it said; exhaustionDetectionArmed (via
        // liveExhaustedPatterns.armed, wired into quarantineSource below) is what stays live.
@@ -461,11 +461,13 @@ public final class Fleetd {
        // method's javadoc for the full fleetd #175/#234/#446 history this used to carry inline —
        // so a dedicated test can drive the exact ExhaustionSink main() builds, not a hand-rebuilt
        // copy of its shape.
-        ExhaustionSink exhaustionSink = exhaustionSink(sessions, config, quarantine,
-                quarantineReasonByCredential, cfg);
        // fleetd #175: point the forwarding sink handed to OpenCodeLauncher above at the real one,
        // now that `sessions` exists to resolve target -> session -> profile.
-        exhaustionSinkRef.set(exhaustionSink);
+        // fleetd #589 Group 1: both statements (build + set) folded into publishExhaustionSink(...)
+        // below (see that method's javadoc), so a test can prove the reference is actually
+        // repointed at the real sink, not silently left at ExhaustionSink.none().
+        ExhaustionSink exhaustionSink = publishExhaustionSink(exhaustionSinkRef, sessions, config,
+                quarantine, quarantineReasonByCredential, cfg);
        // fleetd #201 Unit 5: the production BackendErrorSink needs `pushLoop` (built further below,
        // after `sessions`) to tell a lead about an incident or an unmapped target — the same
        // construction-order cycle `exhaustionSinkRef` breaks above, broken the same way: a mutable
@@ -666,8 +668,7 @@ public final class Fleetd {
            return configured == null ? null : configured.effectiveCredentialId();
        }, outagePolicy);

-        FleetMcp.LoopHealthSource loopHealth = new FleetMcp.LoopHealthSource(poller::health,
-                () -> reaper == null ? LoopWatchdog.State.STOPPED : reaper.health());
+        FleetMcp.LoopHealthSource loopHealth = loopHealthSource(poller, reaper);
        FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
                primaryRegistry, callers, FleetMcp.AuthorizationMode.ENFORCED, metrics,
                capacitySource(config, cfg, profile -> liveCountRef.get().apply(profile)),
@@ -1010,6 +1011,120 @@ public final class Fleetd {
                cfg.profiles()::keySet, System::nanoTime);
    }

+    /**
+     * fleetd #589 Group 1: the forwarding {@link ExhaustionSink} handed to the adapters built
+     * before {@code sessions} exists (see the {@code exhaustionSinkRef}/{@code
+     * forwardingExhaustionSink} locals in {@code main}, just above {@link #capacitySource}'s call
+     * site). Before this ticket, {@code ExhaustionSink.forwardingTo(exhaustionSinkRef::get)} was
+     * built inline — nothing a test could call directly, so a mutation swapping the supplier for a
+     * hardcoded {@code () -> ExhaustionSink.none()} compiled clean and left the suite green: the
+     * forwarder would silently stop reading the reference at all, and {@link
+     * #publishExhaustionSink} repointing that reference later would have no effect.
+     *
+     * <p>Extracted the same way {@link #capacitySource}/{@link #loopHealthSource} were, so {@code
+     * FleetdExhaustionSinkForwardingWiringTest} can call this factory directly with a real {@link
+     * AtomicReference}, mutate the reference AFTER the forwarder is built, and prove the forwarder
+     * still reads it live rather than a fixed target captured at construction time.
+     */
+    static ExhaustionSink forwardingExhaustionSink(AtomicReference<ExhaustionSink> exhaustionSinkRef) {
+        return ExhaustionSink.forwardingTo(exhaustionSinkRef::get);
+    }
+
+    /**
+     * fleetd #589 Group 1: publish the real {@link ExhaustionSink} — built the same way {@link
+     * #exhaustionSink} always was — into the forwarding reference {@link #forwardingExhaustionSink}
+     * built above, replacing {@code main}'s previously untested two-statement sequence ({@code
+     * ExhaustionSink exhaustionSink = exhaustionSink(...); exhaustionSinkRef.set(exhaustionSink);}).
+     * Before this ticket, nothing proved the {@code .set(...)} call actually received the real sink
+     * rather than a hardcoded {@code ExhaustionSink.none()} — the whole point of {@code
+     * exhaustionSinkRef} existing (fleetd #175) is that {@link
+     * dev.ltms.fleet.member.OpenCodeLauncher}'s model-mismatch check, built before {@code sessions}
+     * exists, keeps working once this line runs; silently keeping the reference at {@code none()}
+     * would mean that check permanently does nothing, with the full suite still green because no
+     * existing test drives this exact call site.
+     *
+     * <p>Returns the built sink so {@code main} can still pass it to {@link CompletionResolver}'s
+     * constructor at the same call site it already does, without building it twice.
+     */
+    static ExhaustionSink publishExhaustionSink(AtomicReference<ExhaustionSink> exhaustionSinkRef,
+            SessionManager sessions, ConfigRef config, BackendQuarantine quarantine,
+            Map<String, String> quarantineReasonByCredential, FleetConfig cfg) {
+        ExhaustionSink sink = exhaustionSink(sessions, config, quarantine, quarantineReasonByCredential, cfg);
+        exhaustionSinkRef.set(sink);
+        return sink;
+    }
+
+    /**
+     * fleetd #589 Group 1: the live {@code exhaustedPattern} source (fleetd #446) {@link
+     * CompletionResolver} enforces on, extracted out of {@code main} for the same reason {@link
+     * #capacitySource} was. Before this ticket {@code new LiveExhaustedPatterns(() ->
+     * config.get().profiles())} was built inline; replacing the supplier with a hardcoded {@code ()
+     * -> Map.of()} compiled clean and left the suite green, meaning every profile's {@code
+     * exhaustedPattern} would silently stop being recognised and a genuine usage-limit refusal
+     * would be handed back as a real completion instead of {@code BACKEND_EXHAUSTED}.
+     */
+    static LiveExhaustedPatterns liveExhaustedPatterns(ConfigRef config) {
+        return new LiveExhaustedPatterns(() -> config.get().profiles());
+    }
+
+    /**
+     * fleetd #589 Group 1: the {@link ExhaustedPatternLookup} {@link CompletionResolver} enforces
+     * on, resolving a herdr {@code target} to its session's profile and then to that profile's live
+     * {@link LiveExhaustedPatterns#patternFor}. Extracted out of {@code main} the same way {@link
+     * #worktreeBranchLookup} was — same {@code Supplier<List<MemberSession>>} roster shape, same
+     * reason: before this ticket the lambda was built inline, and replacing it with {@code target ->
+     * null} (the exact shape of {@link ExhaustedPatternLookup#none()}) compiled clean and left the
+     * suite green. This is the worst consequence in the whole #589 sweep (see the ticket): a
+     * genuine usage-limit refusal would stop being classified as {@code BACKEND_EXHAUSTED} and
+     * would be handed back to a waiting {@code fleet_send} as if it were real completed work.
+     *
+     * @param roster the live member roster, normally {@code sessions::roster}
+     */
+    static ExhaustedPatternLookup exhaustedPatternLookup(Supplier<List<MemberSession>> roster,
+            LiveExhaustedPatterns liveExhaustedPatterns) {
+        return target -> roster.get().stream()
+                .filter(session -> target.equals(session.terminalId()))
+                .findFirst()
+                .map(session -> liveExhaustedPatterns.patternFor(session.profile()))
+                .orElse(null);
+    }
+
+    /**
+     * fleetd #589 Group 2: the production {@link ClaudeCodeLauncher} adapter, extracted out of
+     * {@code main} the same way {@link #capacitySource} was. Before this ticket the constructor
+     * call (11 arguments, including the CB-596 {@code memberCredentials} policy supplier) was built
+     * inline; replacing the {@code () -> config.get().memberCredentials()} argument with {@code ()
+     * -> null} compiled clean and left the suite green — {@code memberCredentials} is not {@code
+     * null} itself (a lambda is never {@code null}), so {@link
+     * dev.ltms.fleet.member.HerdrPeerLauncher#applyMemberCredentialPolicy} sees {@code
+     * memberCredentials.get() == null} and silently shadows nothing, reopening the exact CB-592
+     * exposure gap CB-596's policy closed. {@code FleetdClaudeCodeLauncherCredentialWiringTest}
+     * calls this factory with a real {@link ConfigRef} carrying a {@code memberCredentials:} block
+     * and proves a known-but-not-allowed name is actually shadowed on {@code spawn()}.
+     */
+    static ClaudeCodeLauncher claudeCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+            SubscriptionGuard guard, Map<String, FleetConfig.Profile> claudeProfiles, FleetConfig cfg,
+            ConfigRef config) {
+        return new ClaudeCodeLauncher(agents, spaces, guard, claudeProfiles, cfg.effectiveDefaultProfile(),
+                System::getenv, cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
+                () -> config.get().fleet(), () -> config.get().memberCredentials(), null, config::get);
+    }
+
+    /**
+     * fleetd #589 Group 2: the production {@link OpenCodeLauncher} adapter, the {@code opencode}
+     * counterpart to {@link #claudeCodeLauncher} above and extracted for the identical reason: the
+     * same {@code () -> config.get().memberCredentials()} argument, reopening the same CB-592
+     * exposure gap if silently replaced with {@code () -> null}.
+     */
+    static OpenCodeLauncher openCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+            Map<String, FleetConfig.Profile> opencodeProfiles, FleetConfig cfg, ConfigRef config,
+            ExhaustionSink forwardingExhaustionSink) {
+        return new OpenCodeLauncher(agents, spaces, opencodeProfiles, cfg.effectiveDefaultProfile(),
+                System::getenv, cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
+                () -> config.get().fleet(), () -> config.get().memberCredentials(), config::get,
+                forwardingExhaustionSink);
+    }
+
    /**
     * fleetd #426: package-private factory for {@code fleet_list}'s {@code healthCoverage} source,
     * extracted out of {@code main} for the same reason {@link #capacitySource} and {@link
@@ -1042,6 +1157,31 @@ public final class Fleetd {
        });
    }

+    /**
+     * fleetd #562 follow-up: package-private factory for {@code fleet_list}'s and {@code
+     * /healthz}'s {@code loopHealth} source, extracted out of {@code main} for the same reason
+     * {@link #capacitySource} and {@link #healthCoverageSource} were. Before this ticket the
+     * {@link FleetMcp.LoopHealthSource} was built inline with a bare {@code new}, so there was
+     * nothing a test could call directly — measured: replacing {@code poller::health} with a
+     * constant {@code () -> LoopWatchdog.State.RUNNING} at the call site compiled clean and left
+     * the full suite green, meaning the daemon could report the {@link StatusPoller} as always
+     * {@code RUNNING} even while it was actually stalled. That is a false negative on the exact
+     * signal this ticket exists to surface, and is the mirror of a false positive muting a real
+     * monitoring component — worse, because there is no noise for anyone to notice and then
+     * silence. {@link FleetdLoopHealthSourceWiringTest} calls this factory directly and pins both
+     * halves separately, plus the {@code reaper == null} branch below.
+     *
+     * <p>{@code reaper} may be {@code null} — a {@link SessionReaper} is only constructed when
+     * {@code lifecycle.idleTtlSeconds} is configured (see the {@code reaper} local above) — and
+     * this factory preserves the existing behaviour of reporting {@link LoopWatchdog.State#STOPPED}
+     * in that case, rather than a {@code NullPointerException} on the first {@code fleet_list} or
+     * {@code /healthz} call.
+     */
+    static FleetMcp.LoopHealthSource loopHealthSource(StatusPoller poller, SessionReaper reaper) {
+        return new FleetMcp.LoopHealthSource(poller::health,
+                () -> reaper == null ? LoopWatchdog.State.STOPPED : reaper.health());
+    }
+
    /**
     * fleetd #248: package-private factory for the member worktree/branch lookup {@link
     * CompletionResolver} uses to name a fallback report's worktree and branch (fleetd#241).
@@ -828,6 +828,12 @@ public final class FleetMcp {
                    + "answered (turnId stale)");
            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> text("[no reply within " + timeout + "ms — worker "
                    + r.outcome().name().toLowerCase().replace("timed_out_", "") + "; retry or poll status]");
+            // fleetd #571: delivery is unknown here — agent.prompt pastes and submits in one call,
+            // so the message may already be sitting in the pane. Do not invite a blind retry the way
+            // the case above does; a resend on this route can double-deliver the same brief.
+            case TIMED_OUT_UNCONFIRMED -> text("[no reply within " + timeout + "ms — delivery unconfirmed; "
+                    + "the message may already have reached the worker, so a retry risks sending it "
+                    + "twice — poll status before resending]");
        };
    }

@@ -93,25 +93,30 @@ public final class MessageService {
        /** Timed out after the message was delivered — the worker is still working. */
        TIMED_OUT_WORKING,
        /**
-         * Timed out with no confirmed delivery. Despite the name, this does not mean the message
-         * is sitting in a queue. {@link #send} reaches this outcome through {@link Injector#cancel},
-         * whose result tells three routes apart:
-         * {@link Injector.Cancellation#CANCELLED} means the message was still queued and this call
-         * removed it, so the target saw nothing and it will not arrive later;
-         * {@link Injector.Cancellation#NOT_DELIVERED} means nothing was ever sent — the queue was
-         * cleared because the target never became ready or was abandoned, or the injector's call to
-         * the target's terminal ({@link dev.ltms.fleet.herdr.AgentControl#send}) failed with a herdr
-         * error that this codebase already treats as a confirmed absence — so this route too
-         * establishes that the target saw nothing and it will not arrive later; but
-         * {@link Injector.Cancellation#ATTEMPTED} (fleetd #551) means that call was made and its
-         * outcome is unknown. {@code agent.prompt} pastes <em>and submits</em> in one call, so on
-         * this route the target may hold a complete, already-submitted turn and be working on it
-         * right now — {@link Outcome#TIMED_OUT_WORKING}'s meaning, reported here as
-         * {@code TIMED_OUT_QUEUED} only because this caller never observed the pickup. Only
-         * {@code CANCELLED} and {@code NOT_DELIVERED} establish that the target saw nothing;
-         * {@code ATTEMPTED} does not.
+         * Timed out with no confirmed delivery, and the target saw nothing — the message will not
+         * arrive later, so a caller may resend. {@link #send} reaches this outcome through {@link
+         * Injector#cancel} reporting one of two routes: {@link Injector.Cancellation#CANCELLED}
+         * means the message was still queued and this call removed it; {@link
+         * Injector.Cancellation#NOT_DELIVERED} means nothing was ever sent — the queue was cleared
+         * because the target never became ready or was abandoned, or the injector's call to the
+         * target's terminal ({@link dev.ltms.fleet.herdr.AgentControl#send}) failed with a herdr
+         * error that this codebase already treats as a confirmed absence. A third route,
+         * {@link Injector.Cancellation#ATTEMPTED}, used to be folded into this same outcome
+         * (fleetd #571) — it no longer is; see {@link #TIMED_OUT_UNCONFIRMED}.
         */
        TIMED_OUT_QUEUED,
+        /**
+         * Timed out with delivery unknown. {@link #send} reaches this outcome when {@link
+         * Injector#cancel} reports {@link Injector.Cancellation#ATTEMPTED} (fleetd #551): the call
+         * to the target's terminal ({@link dev.ltms.fleet.herdr.AgentControl#send}) was made, but
+         * this caller never observed whether it reached the pane. {@code agent.prompt} pastes
+         * <em>and submits</em> in one call, so the target may already hold a complete, submitted
+         * turn and be working on it right now — the same reality as {@link #TIMED_OUT_WORKING},
+         * just not confirmed. The message may or may not have arrived. Treat this as neither a
+         * confirmed delivery nor a confirmed absence: a caller that resends on this outcome risks a
+         * double delivery — the same brief typed into the pane twice (fleetd #571).
+         */
+        TIMED_OUT_UNCONFIRMED,
        /** Another send to this session was in flight for the whole window. */
        BUSY,
        /**
@@ -317,20 +322,21 @@ public final class MessageService {
     */
    private final ConcurrentHashMap<String, Boolean> strandedReplies = new ConcurrentHashMap<>();
    /**
-     * Targets whose last send timed out with {@link Outcome#TIMED_OUT_QUEUED} (CB-640) — {@link
-     * #send} called {@link Injector#cancel} and got back something other than {@code DELIVERED}.
-     * That covers three histories, not one: {@link Injector.Cancellation#CANCELLED} — the message
-     * was still queued and {@code cancel} removed it right there; {@link
-     * Injector.Cancellation#NOT_DELIVERED} — nothing was ever sent, because the target never became
-     * ready, was torn down, or the call to its terminal failed with a herdr error this codebase
-     * already treats as a confirmed absence; or {@link Injector.Cancellation#ATTEMPTED} (fleetd
-     * #551) — the call to the target's terminal was made and its outcome is unknown, so the target
-     * may already hold a complete, submitted turn. Only the first two mean the message will not
-     * arrive later and the target saw nothing; on the third it may already have arrived in full.
-     * Set where {@link #send} already computes {@code wasDelivered} for that outcome; no queue is
-     * kept here, only the fact that the send ended with no confirmed delivery. Cleared the same way
-     * as {@link #strandedReplies}: the next accepted delivery for the target ({@link #send} opening
-     * a fresh waiter) or a teardown ({@link #abandon}).
+     * Targets whose last send timed out with no confirmed delivery (CB-640) — {@link #send} called
+     * {@link Injector#cancel} and got back something other than {@code DELIVERED}. That covers
+     * three histories, not one: {@link Injector.Cancellation#CANCELLED} — the message was still
+     * queued and {@code cancel} removed it right there; {@link Injector.Cancellation#NOT_DELIVERED}
+     * — nothing was ever sent, because the target never became ready, was torn down, or the call to
+     * its terminal failed with a herdr error this codebase already treats as a confirmed absence; or
+     * {@link Injector.Cancellation#ATTEMPTED} (fleetd #551) — the call to the target's terminal was
+     * made and its outcome is unknown, so the target may already hold a complete, submitted turn.
+     * Only the first two mean the message will not arrive later and the target saw nothing; on the
+     * third it may already have arrived in full — and the caller sees a different outcome for it
+     * ({@link Outcome#TIMED_OUT_UNCONFIRMED}, fleetd #571) than for the first two ({@link
+     * Outcome#TIMED_OUT_QUEUED}). Set where {@link #send} already computes {@code wasDelivered} for
+     * that outcome; no queue is kept here, only the fact that the send ended with no confirmed
+     * delivery. Cleared the same way as {@link #strandedReplies}: the next accepted delivery for the
+     * target ({@link #send} opening a fresh waiter) or a teardown ({@link #abandon}).
     */
    private final ConcurrentHashMap<String, Boolean> queuedDeliveries = new ConcurrentHashMap<>();
    private final AtomicLong ticketSeq = new AtomicLong();
@@ -417,21 +423,22 @@ public final class MessageService {

    /**
     * Read-only delegation fact for fleet views (CB-640): {@code target}'s last send timed out
-     * with no confirmed delivery — the caller saw {@link Outcome#TIMED_OUT_QUEUED} (see the
-     * {@code TimeoutException} branch of {@link #send}). Despite the method's name, this is not
-     * proof that a message is sitting in a queue: {@link Injector#cancel} reports this outcome
-     * through three routes. {@link Injector.Cancellation#CANCELLED} means the message was still
-     * queued and got removed right there. {@link Injector.Cancellation#NOT_DELIVERED} means
-     * nothing was ever sent — the target never became ready, was torn down, or the call to its
-     * terminal failed with a herdr error this codebase already treats as a confirmed absence.
-     * Only these two routes mean the message will not arrive later. {@link
+     * with no confirmed delivery — the caller saw {@link Outcome#TIMED_OUT_QUEUED} or {@link
+     * Outcome#TIMED_OUT_UNCONFIRMED} (fleetd #571; see the {@code TimeoutException} branch of
+     * {@link #send}). Despite the method's name, this is not proof that a message is sitting in a
+     * queue: {@link Injector#cancel} reports this outcome through three routes. {@link
+     * Injector.Cancellation#CANCELLED} means the message was still queued and got removed right
+     * there. {@link Injector.Cancellation#NOT_DELIVERED} means nothing was ever sent — the target
+     * never became ready, was torn down, or the call to its terminal failed with a herdr error this
+     * codebase already treats as a confirmed absence. Only these two routes mean the message will
+     * not arrive later, and both report {@code TIMED_OUT_QUEUED}. {@link
     * Injector.Cancellation#ATTEMPTED} (fleetd #551) means the call to the target's terminal was
     * made and its outcome is unknown: {@code agent.prompt} pastes <em>and submits</em> in one
     * call, so on this route the target may already hold a complete, submitted turn and be
-     * working on it right now — it does NOT follow that the target saw nothing. Distinct from
-     * {@link Outcome#TIMED_OUT_WORKING}, where delivery already happened and only the reply is
-     * outstanding. Cleared the next time this target's delivery is accepted or the target is
-     * abandoned — see {@link #queuedDeliveries}.
+     * working on it right now — it does NOT follow that the target saw nothing, and this route
+     * reports {@code TIMED_OUT_UNCONFIRMED} instead. Distinct from {@link Outcome#TIMED_OUT_WORKING},
+     * where delivery already happened and only the reply is outstanding. Cleared the next time this
+     * target's delivery is accepted or the target is abandoned — see {@link #queuedDeliveries}.
     */
    public boolean hasQueuedDelivery(String target) {
        return target != null && queuedDeliveries.containsKey(target);
@@ -646,7 +653,7 @@ public final class MessageService {
        return switch (o) {
            case REPLIED -> "replied";
            case COMPLETED_UNREPLIED -> "completion_fallback";
-            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> "timeout";
+            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, TIMED_OUT_UNCONFIRMED, BUSY -> "timeout";
            case WORKER_FAILED -> "failed";
            case BACKEND_EXHAUSTED -> "backend_exhausted";
            case STALE_TURN, QUESTION -> null; // not a completed delegation
@@ -975,6 +982,7 @@ public final class MessageService {
                } catch (TimeoutException e) {
                    boolean wasDelivered = delivery.completion().isDone()
                            && !delivery.completion().isCompletedExceptionally();
+                    Injector.Cancellation cancellation = null;
                    if (!wasDelivered) {
                        if (timeoutCancellationRaceHookForTest != null) {
                            // Test-only (fleetd #345): see the field's own javadoc.
@@ -982,20 +990,27 @@ public final class MessageService {
                        }
                        // The target monitor makes cancellation atomic with onStatus picking this
                        // Pending up. If pickup won, report TIMED_OUT_WORKING because the text landed.
-                        wasDelivered = injector.cancel(delivery) == Injector.Cancellation.DELIVERED;
+                        cancellation = injector.cancel(delivery);
+                        wasDelivered = cancellation == Injector.Cancellation.DELIVERED;
                    }
                    log.debug("send to {} timed out (delivered={})", target, wasDelivered);
-                    if (!wasDelivered) {
+                    Outcome outcome;
+                    if (wasDelivered) {
+                        outcome = Outcome.TIMED_OUT_WORKING;
+                    } else if (cancellation == Injector.Cancellation.ATTEMPTED) {
+                        // fleetd #571: the call to the target's terminal was made and its outcome is
+                        // unknown — the message may already have arrived in full, so this must not
+                        // be reported as TIMED_OUT_QUEUED, which promises it never will.
+                        outcome = Outcome.TIMED_OUT_UNCONFIRMED;
+                    } else {
                        // CB-640: record that delivery is not confirmed, for fleet health (see
-                        // queuedDeliveries). Whatever injector.cancel() reported above — this call
-                        // removed a still-queued Pending (CANCELLED), an earlier attempt already
-                        // failed with a confirmed absence (NOT_DELIVERED), or an earlier attempt was
-                        // made and its outcome is unknown (ATTEMPTED, fleetd #551 — the message may
-                        // already have arrived in full) — the send ends with no confirmed delivery.
+                        // queuedDeliveries). cancellation is CANCELLED (this call removed a
+                        // still-queued Pending) or NOT_DELIVERED (an earlier attempt already failed
+                        // with a confirmed absence) — both mean the target saw nothing.
                        queuedDeliveries.put(target, Boolean.TRUE);
+                        outcome = Outcome.TIMED_OUT_QUEUED;
                    }
-                    return recorded(new Reply(
-                            wasDelivered ? Outcome.TIMED_OUT_WORKING : Outcome.TIMED_OUT_QUEUED, null));
+                    return recorded(new Reply(outcome, null));
                } catch (ExecutionException e) {
                    Throwable cause = e.getCause();
                    throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
@@ -670,15 +670,31 @@ public final class FleetApp {
            }
            default -> ctx.status(202).json(Map.of(
                    "sessionId", id,
+                    // fleetd #571 (ticket comment 17126): no `default` here on purpose. This switch
+                    // is an expression, so the compiler already demands every Outcome constant have
+                    // an arm — adding an 11th constant to Outcome is a compile error here, not a
+                    // silent fall-through. That is exactly the bug this ticket exists to fix:
+                    // `default -> "done"` used to sit here and would have told a REST caller the
+                    // delegation completed for TIMED_OUT_UNCONFIRMED, the one outcome where delivery
+                    // is unknown. REPLIED, COMPLETED_UNREPLIED, QUESTION and STALE_TURN can never
+                    // actually reach this inner switch — the outer switch above always dispatches
+                    // them first — but they still need an arm to keep this switch exhaustive.
                    "status", switch (reply.outcome()) {
                        case TIMED_OUT_WORKING -> "working";
                        case TIMED_OUT_QUEUED -> "queued";
+                        // Delivery here is unknown, not merely still queued — see
+                        // Outcome#TIMED_OUT_UNCONFIRMED's own javadoc.
+                        case TIMED_OUT_UNCONFIRMED -> "unconfirmed";
                        case BUSY -> "busy";
                        case WORKER_FAILED -> "failed";
                        case BACKEND_EXHAUSTED -> "backend_exhausted";
-                        default -> "done"; // unreachable (terminal outcomes handled above)
+                        case REPLIED, COMPLETED_UNREPLIED, QUESTION, STALE_TURN -> "done"; // unreachable
                    },
-                    "detail", (reply.outcome() == MessageService.Outcome.WORKER_FAILED
+                    "detail", reply.outcome() == MessageService.Outcome.TIMED_OUT_UNCONFIRMED
+                            ? "no reply within " + timeout + "ms; delivery is unconfirmed — the "
+                                    + "message may already have reached the worker, so a resend "
+                                    + "risks sending it twice; poll status first"
+                            : (reply.outcome() == MessageService.Outcome.WORKER_FAILED
                                    || reply.outcome() == MessageService.Outcome.BACKEND_EXHAUSTED)
                                    && reply.text() != null
                            ? reply.text()
@@ -0,0 +1,84 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+/**
+ * fleetd #589 Group 2: {@link Fleetd#claudeCodeLauncher} is the factory that replaced {@code
+ * main}'s inline {@code new ClaudeCodeLauncher(...)} call, whose 10th argument is the CB-596 {@code
+ * memberCredentials} policy supplier ({@code () -> config.get().memberCredentials()}). Before this
+ * ticket that argument was untestable wiring: replacing it with {@code () -> null} compiled with 0
+ * errors and left every existing test green, since no existing test builds the exact object {@code
+ * main} wires and then spawns it. {@code memberCredentials} being a lambda is never itself {@code
+ * null}, so {@link dev.ltms.fleet.member.HerdrPeerLauncher#applyMemberCredentialPolicy} sees {@code
+ * memberCredentials.get() == null} and silently shadows nothing — reopening the exact CB-592
+ * exposure gap CB-596's policy closed (gitea issue #82).
+ *
+ * <p>This test drives the factory with a real {@link ConfigRef} carrying a {@code
+ * memberCredentials:} block, spawns through the resulting launcher, and inspects what {@code
+ * tab.create} actually carried — the same observable surface {@code ClaudeCodeLauncherTest}'s
+ * {@code everyKnownNameNotAllowedIsShadowedWithTheSentinel} uses for the launcher's own credential
+ * policy, applied here to prove {@code main}'s wiring reaches it.
+ */
+class FleetdClaudeCodeLauncherCredentialWiringTest {
+
+    private static final String YAML = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              ltms-local:
+                baseUrl: http://gx00.gw:8000
+                model: coder
+            memberCredentials:
+              policy: deny-by-default
+              known:
+                - GITEA_ACCESS_TOKEN
+            """;
+
+    @SuppressWarnings("unchecked")
+    private static Map<String, String> startEnv(FakeHerdr herdr) {
+        return (Map<String, String>) ((Map<String, Object>) herdr.lastCall("tab.create").params()).get("env");
+    }
+
+    @Test
+    @DisplayName("main's memberCredentials wiring reaches ClaudeCodeLauncher: a known-but-not-allowed "
+            + "name is shadowed on spawn")
+    void memberCredentialsWiringReachesClaudeCodeLauncher(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, YAML);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = ConfigRef.fixed(cfg);
+        FakeHerdr herdr = new FakeHerdr();
+
+        ClaudeCodeLauncher launcher = Fleetd.claudeCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), new SubscriptionGuard(Set.of("gx00.gw")),
+                cfg.profiles(), cfg, config);
+        launcher.spawn();
+
+        String shadowed = startEnv(herdr).get("GITEA_ACCESS_TOKEN");
+        assertNotNull(shadowed,
+                "GITEA_ACCESS_TOKEN is 'known' but not 'allow'-ed in the loaded config — it must be "
+                        + "explicitly shadowed on spawn; replacing the memberCredentials supplier with "
+                        + "() -> null at the Fleetd.claudeCodeLauncher call site must fail this "
+                        + "assertion, since a null policy shadows nothing");
+        assertFalse(shadowed.isBlank(), "the overlay value must be non-blank");
+    }
+}
@@ -0,0 +1,86 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.inject.ExhaustedPatternLookup;
+import dev.ltms.fleet.inject.LiveExhaustedPatterns;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.session.MemberSession;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.regex.Pattern;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #589 Group 1: {@link Fleetd#exhaustedPatternLookup} is the factory that replaced {@code
+ * main}'s inline lambda — resolve a herdr {@code target} to its session's profile, then to that
+ * profile's live {@link LiveExhaustedPatterns#patternFor}. Same shape as {@link
+ * Fleetd#worktreeBranchLookup} (which {@code FleetdWorktreeBranchLookupTest} pins the same way).
+ *
+ * <p>Before this ticket the lambda was built inline in {@code main} and untestable: replacing it
+ * with {@code target -> null} — the exact shape of {@link ExhaustedPatternLookup#none()} — compiled
+ * with 0 errors and left every existing test green. Per the ticket, this is the worst consequence
+ * in the whole #589 sweep: a genuine usage-limit refusal would stop being classified as {@code
+ * BACKEND_EXHAUSTED} and would be handed back to a waiting {@code fleet_send} as if it were real
+ * completed work.
+ */
+class FleetdExhaustedPatternLookupWiringTest {
+
+    private static final String YAML = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: claude-opus-5
+                exhaustedPattern: "usage limit"
+            """;
+
+    private static MemberSession session(String terminal, String profile) {
+        return new MemberSession("pane-" + terminal, terminal, profile, MemberRole.DEV,
+                "/cwd", null, 0L, 0L, 0, MemberSession.State.READY, null, null);
+    }
+
+    private static LiveExhaustedPatterns liveExhaustedPatterns(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, YAML);
+        FleetConfig cfg = FleetConfig.load(file);
+        return new LiveExhaustedPatterns(() -> ConfigRef.fixed(cfg).get().profiles());
+    }
+
+    @Test
+    @DisplayName("a known target resolves through its session's profile to that profile's live pattern")
+    void knownTargetResolvesThroughItsProfile(@TempDir Path dir) throws Exception {
+        LiveExhaustedPatterns patterns = liveExhaustedPatterns(dir);
+        ExhaustedPatternLookup lookup = Fleetd.exhaustedPatternLookup(
+                () -> List.of(session("term1", "terra")), patterns);
+
+        Pattern resolved = lookup.patternFor("term1");
+
+        assertNotNull(resolved,
+                "the lookup must resolve term1 -> profile 'terra' -> LiveExhaustedPatterns.patternFor("
+                        + "'terra') — replacing the lambda body with 'target -> null' at the "
+                        + "Fleetd.exhaustedPatternLookup call site must fail this assertion");
+        assertTrue(resolved.matcher("the usage limit has been reached").find());
+    }
+
+    @Test
+    @DisplayName("an unknown target resolves to null, not a thrown exception")
+    void unknownTargetResolvesToNull(@TempDir Path dir) throws Exception {
+        LiveExhaustedPatterns patterns = liveExhaustedPatterns(dir);
+        ExhaustedPatternLookup lookup = Fleetd.exhaustedPatternLookup(
+                () -> List.of(session("term1", "terra")), patterns);
+
+        assertNull(lookup.patternFor("term_stranger"));
+    }
+}
@@ -0,0 +1,62 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.inject.ExhaustionSink;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #589 Group 1: {@link Fleetd#forwardingExhaustionSink} is the factory that replaced
+ * {@code main}'s inline {@code ExhaustionSink.forwardingTo(exhaustionSinkRef::get)} (fleetd #175's
+ * construction-order break: the adapters need a sink before {@code sessions} exists to build the
+ * real one). Before this ticket that call site was untestable wiring: replacing the supplier
+ * argument with a hardcoded {@code () -> ExhaustionSink.none()} compiled with 0 errors and left
+ * every existing test green, because no test builds the object {@code main} actually wires and
+ * then mutates the reference afterward — every existing {@code ExhaustionSink.forwardingTo} caller
+ * in this codebase reads and writes the SAME reference within one test, so a hardcoded-none supplier
+ * and a correctly-forwarding one are indistinguishable to them.
+ *
+ * <p>This test builds the reference, builds the forwarder from it, and only THEN repoints the
+ * reference at a spy sink — the discriminating order fleetd #175's whole design depends on
+ * ({@code exhaustionSinkRef} starts at {@code none()} and is repointed once {@code sessions}
+ * exists). A forwarder that captured a fixed target at construction time (the inert form) can never
+ * see that later repoint.
+ */
+class FleetdExhaustionSinkForwardingWiringTest {
+
+    @Test
+    @DisplayName("the forwarder reads the reference live: repointing it AFTER construction is honoured")
+    void forwarderReadsTheReferenceLiveNotAFixedTargetCapturedAtConstruction() {
+        AtomicReference<ExhaustionSink> exhaustionSinkRef = new AtomicReference<>(ExhaustionSink.none());
+        ExhaustionSink forwarder = Fleetd.forwardingExhaustionSink(exhaustionSinkRef);
+
+        AtomicBoolean spyCalled = new AtomicBoolean(false);
+        exhaustionSinkRef.set((target, reason, profile) -> spyCalled.set(true));
+
+        forwarder.onExhausted("term_x", "usage limit reached", "terra");
+
+        assertTrue(spyCalled.get(),
+                "forwardingExhaustionSink must delegate to whatever exhaustionSinkRef currently "
+                        + "holds — hardcoding the supplier to () -> ExhaustionSink.none() at the "
+                        + "Fleetd.forwardingExhaustionSink call site must fail this assertion, "
+                        + "since the spy set into the reference after construction would never run");
+    }
+
+    @Test
+    @DisplayName("before any repoint, the forwarder is inert — it starts at none(), not a crash")
+    void beforeAnyRepointTheForwarderIsInert() {
+        AtomicReference<ExhaustionSink> exhaustionSinkRef = new AtomicReference<>(ExhaustionSink.none());
+        ExhaustionSink forwarder = Fleetd.forwardingExhaustionSink(exhaustionSinkRef);
+
+        AtomicBoolean spyCalled = new AtomicBoolean(false);
+        forwarder.onExhausted("term_x", "usage limit reached", "terra");
+
+        assertFalse(spyCalled.get(), "nothing was ever wired to be called here — this only pins "
+                + "that the factory does not throw before a real sink is published");
+    }
+}
@@ -0,0 +1,110 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.session.SessionManager;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #589 Group 1: {@link Fleetd#publishExhaustionSink} is the factory that replaced {@code
+ * main}'s previously untested two-statement sequence — build the real {@link
+ * Fleetd#exhaustionSink}, then {@code exhaustionSinkRef.set(exhaustionSink)}. {@link
+ * Fleetd#exhaustionSink} itself is already pinned by {@code FleetdExhaustionSinkWarningTest} (its
+ * log text) — what was NEVER pinned is the {@code .set(...)} call: {@code main} could replace it
+ * with {@code exhaustionSinkRef.set(ExhaustionSink.none())} and compile with 0 errors, leaving
+ * every existing test green, because {@link Fleetd#exhaustionSink}'s own tests build and call the
+ * sink directly, never through the reference {@code main} publishes it into.
+ *
+ * <p>This test proves the PUBLISHED reference — not a freshly rebuilt sink — is the one that
+ * actually quarantines a credential, by reading {@link BackendQuarantine#isQuarantined} after
+ * calling {@code exhaustionSinkRef.get().onExhausted(...)}, the same object {@link
+ * Fleetd#forwardingExhaustionSink} forwards to in production.
+ */
+class FleetdExhaustionSinkPublishWiringTest {
+
+    private static final String YAML = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: claude-opus-5
+            guard:
+              offSubscriptionHosts:
+                - gx00.gw
+            """;
+
+    private static SessionManager emptyRosterSessions() {
+        FakeHerdr h = new FakeHerdr();
+        FleetConfig.Profile dummy = new FleetConfig.Profile(
+                "dummy", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(dummy.profile(), dummy), dummy.profile(), _ -> "tok");
+        // Never acquires a session — publishExhaustionSink's built sink resolves target -> profile
+        // via the profileHint fallback (fleetd #234), exactly like OpenCodeLauncher's real call
+        // site does, so this never needs a populated roster.
+        return new SessionManager(launcher);
+    }
+
+    @Test
+    @DisplayName("the published reference actually quarantines — not a rebuilt-but-never-set sink")
+    void publishedReferenceActuallyQuarantines(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, YAML);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = ConfigRef.fixed(cfg);
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
+        Map<String, String> reasonByCredential = new HashMap<>();
+        AtomicReference<ExhaustionSink> exhaustionSinkRef = new AtomicReference<>(ExhaustionSink.none());
+
+        Fleetd.publishExhaustionSink(exhaustionSinkRef, emptyRosterSessions(), config, quarantine,
+                reasonByCredential, cfg);
+        exhaustionSinkRef.get().onExhausted("term_x", "The usage limit has been reached", "terra");
+
+        assertTrue(quarantine.isQuarantined("terra"),
+                "publishExhaustionSink must repoint exhaustionSinkRef at the REAL sink — "
+                        + "replacing the .set(...) call with exhaustionSinkRef.set(ExhaustionSink.none()) "
+                        + "at the Fleetd.publishExhaustionSink call site must fail this assertion, "
+                        + "since none()'s onExhausted does nothing");
+    }
+
+    @Test
+    @DisplayName("before publishing, the reference is still inert — no quarantine, no crash")
+    void beforePublishingTheReferenceIsStillInert(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, YAML);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = ConfigRef.fixed(cfg);
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
+        AtomicReference<ExhaustionSink> exhaustionSinkRef = new AtomicReference<>(ExhaustionSink.none());
+
+        exhaustionSinkRef.get().onExhausted("term_x", "The usage limit has been reached", "terra");
+
+        assertFalse(quarantine.isQuarantined("terra"),
+                "nothing was published yet — this only pins the starting state the other test's "
+                        + "assertion actually distinguishes from");
+    }
+}
@@ -0,0 +1,72 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.inject.LiveExhaustedPatterns;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #589 Group 1: {@link Fleetd#liveExhaustedPatterns} is the factory that replaced {@code
+ * main}'s inline {@code new LiveExhaustedPatterns(() -> config.get().profiles())}. Before this
+ * ticket, that supplier argument was untestable wiring: replacing it with a hardcoded {@code () ->
+ * Map.of()} compiled with 0 errors and left every existing test green, because {@code
+ * LiveExhaustedPatternsTest} builds its own instance directly with a hand-supplied map and never
+ * goes through {@code main}'s call site.
+ *
+ * <p>Silently losing this wiring means every profile's {@code exhaustedPattern} stops being
+ * recognised — {@link Fleetd#exhaustedPatternLookup} would never see a match, and a genuine
+ * usage-limit refusal would be handed back to a waiting {@code fleet_send} as real completed work.
+ */
+class FleetdLiveExhaustedPatternsWiringTest {
+
+    private static final String YAML = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: claude-opus-5
+                exhaustedPattern: "usage limit"
+              gx:
+                baseUrl: http://gx00.gw:8000
+            """;
+
+    private static ConfigRef loadConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, YAML);
+        FleetConfig cfg = FleetConfig.load(file);
+        return ConfigRef.fixed(cfg);
+    }
+
+    @Test
+    @DisplayName("a profile with a configured exhaustedPattern is armed, with a compiled matcher")
+    void configuredProfileIsArmed(@TempDir Path dir) throws Exception {
+        LiveExhaustedPatterns patterns = Fleetd.liveExhaustedPatterns(loadConfig(dir));
+
+        assertTrue(patterns.armed("terra"),
+                "the config's live profiles() supplier must reach LiveExhaustedPatterns — hardcoding "
+                        + "the supplier to () -> Map.of() at the Fleetd.liveExhaustedPatterns call "
+                        + "site must fail this assertion");
+        assertTrue(patterns.patternFor("terra").matcher("the usage limit has been reached").find());
+    }
+
+    @Test
+    @DisplayName("a profile with no configured exhaustedPattern is not armed, but is still resolvable")
+    void unconfiguredProfileIsNotArmed(@TempDir Path dir) throws Exception {
+        LiveExhaustedPatterns patterns = Fleetd.liveExhaustedPatterns(loadConfig(dir));
+
+        assertFalse(patterns.armed("gx"), "'gx' has no exhaustedPattern configured");
+        assertNull(patterns.patternFor("gx"));
+    }
+}
@@ -0,0 +1,174 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.LoopWatchdog;
+import dev.ltms.fleet.inject.StatusPoller;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.PlacementDecision;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.SessionReaper;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * fleetd #562 follow-up (issue comment "HOLD on PR #579"): {@code Fleetd.main}'s {@code loopHealth}
+ * local used to be a bare {@code new FleetMcp.LoopHealthSource(poller::health, ...)} built inline,
+ * with nothing a test could call directly. Measured on that shape: replacing {@code
+ * poller::health} with a constant {@code () -> LoopWatchdog.State.RUNNING} at the call site
+ * compiled with 0 errors and left all 1771 existing tests green — the daemon could be changed to
+ * always report the {@link StatusPoller} as {@code RUNNING}, so the watchdog could never fire and
+ * a stalled poller would be invisible, while every test stayed green. That is exactly the false
+ * negative this ticket exists to prevent.
+ *
+ * <p>The five tests PR #579 added ({@code FleetMcpTest}, {@code FleetAppTest}) all build their own
+ * {@link FleetMcp.LoopHealthSource} directly with fixed lambdas — they prove the seam ({@code
+ * LoopHealthSource} reports what it is given) and nothing about what {@code Fleetd.main} actually
+ * gives it. This is the same hand-built-vs-config-wired shape as fleetd #561/#248/#426.
+ *
+ * <p>The fix extracts the inline {@code new} into {@link Fleetd#loopHealthSource}, a package-private
+ * factory in the same style as {@link Fleetd#capacitySource} and {@link Fleetd#healthCoverageSource}
+ * — which is exactly what makes it directly callable here. This test calls that factory with real
+ * {@link StatusPoller}/{@link SessionReaper} instances (never started, so no herdr or git I/O
+ * happens) and pins each half separately, plus the {@code reaper == null} branch: one invariant
+ * wired at three places needs three assertions, not one combined check whose non-zero total could
+ * hide a gap at any single place.
+ */
+class FleetdLoopHealthSourceWiringTest {
+
+    @Test
+    @DisplayName("the statusPoller half reports the real poller's health, not a hardcoded state")
+    void statusPollerHalfReflectsThePollersRealHealth() {
+        // Stopped without ever being started — stop() still marks the watchdog STOPPED. A poller
+        // that has never reported RUNNING is the discriminating case: if Fleetd.loopHealthSource
+        // ever hardcoded RUNNING (the exact mutation this test exists to catch), this would fail.
+        StatusPoller stoppedPoller = freshPoller();
+        stoppedPoller.stop();
+        SessionReaper unusedReaper = freshReaper(); // present only to satisfy the signature
+
+        FleetMcp.LoopHealthSource source = Fleetd.loopHealthSource(stoppedPoller, unusedReaper);
+
+        assertEquals(LoopWatchdog.State.STOPPED, source.statusPoller().get(),
+                "the statusPoller supplier must delegate to the real poller's health() — "
+                        + "replacing poller::health with a constant () -> RUNNING at the "
+                        + "Fleetd.loopHealthSource call site must fail this assertion");
+    }
+
+    @Test
+    @DisplayName("the sessionReaper half reports the real reaper's health, not a hardcoded state")
+    void sessionReaperHalfReflectsTheReapersRealHealth() {
+        StatusPoller unusedPoller = freshPoller(); // present only to satisfy the signature
+        SessionReaper stoppedReaper = freshReaper();
+        stoppedReaper.stop();
+
+        FleetMcp.LoopHealthSource source = Fleetd.loopHealthSource(unusedPoller, stoppedReaper);
+
+        assertEquals(LoopWatchdog.State.STOPPED, source.sessionReaper().get(),
+                "the sessionReaper supplier must delegate to the real reaper's health() — "
+                        + "replacing reaper.health() with a constant at the "
+                        + "Fleetd.loopHealthSource call site must fail this assertion");
+    }
+
+    @Test
+    @DisplayName("a null reaper (idle ttl not configured) still reports STOPPED, not a crash")
+    void nullReaperStillReportsStopped() {
+        // SessionReaper is only constructed when lifecycle.idleTtlSeconds is configured (see the
+        // `reaper` local in Fleetd.main) — a real deployment routinely passes null here. That null
+        // check is real behaviour, not a simplification to delete: it must keep reporting STOPPED
+        // rather than throwing a NullPointerException on the first fleet_list/healthz call.
+        StatusPoller runningPoller = freshPoller();
+
+        FleetMcp.LoopHealthSource source = Fleetd.loopHealthSource(runningPoller, null);
+
+        assertEquals(LoopWatchdog.State.STOPPED, source.sessionReaper().get(),
+                "reaper == null must still report STOPPED, exactly like an intentionally-stopped "
+                        + "reaper would — do not delete this null check to simplify the wiring");
+    }
+
+    /** Never started, so no herdr call is ever made; freshly constructed reports RUNNING. */
+    private static StatusPoller freshPoller() {
+        AgentControl agents = new AgentControl(new FakeHerdr());
+        return new StatusPoller(agents, new Injector(agents), 1000);
+    }
+
+    /** Never started, so no git/session I/O is ever made; freshly constructed reports RUNNING. */
+    private static SessionReaper freshReaper() {
+        return new SessionReaper(new SessionManager(new NeverSpawnsLauncher()), 60, 1000);
+    }
+
+    /**
+     * Same minimal shape as {@code FleetdBackendErrorSinkTest.NeverSpawnsLauncher} — every method
+     * throws or returns an empty/no-op value, since a {@link SessionReaper} that is only ever
+     * constructed and then stopped (never started) never calls any of them.
+     */
+    private static final class NeverSpawnsLauncher implements PeerLauncher {
+        @Override
+        public Set<Capability> capabilities() {
+            return Set.of();
+        }
+
+        @Override
+        public Set<Capability> capabilitiesFor(String profileName) {
+            return Set.of();
+        }
+
+        @Override
+        public PeerHandle spawn(SpawnRequest req) {
+            throw new UnsupportedOperationException("not reachable — this test never acquires a session");
+        }
+
+        @Override
+        public PeerHandle spawn(SpawnRequest req, PlacementDecision decision) {
+            throw new UnsupportedOperationException("not reachable — this test never acquires a session");
+        }
+
+        @Override
+        public Set<String> profiles() {
+            return Set.of();
+        }
+
+        @Override
+        public String defaultProfile() {
+            return null;
+        }
+
+        @Override
+        public String effectiveCwd(SpawnRequest req) {
+            throw new UnsupportedOperationException("not reachable — this test never acquires a session");
+        }
+
+        @Override
+        public List<String> parityOverlay(String profileName) {
+            return List.of();
+        }
+
+        @Override
+        public List<?> list() {
+            return List.of();
+        }
+
+        @Override
+        public int reapOrphanWorkers() {
+            return 0;
+        }
+
+        @Override
+        public void stop(String id) {
+        }
+
+        @Override
+        public boolean clearContext(String id) {
+            return false;
+        }
+    }
+}
@@ -0,0 +1,77 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.member.OpenCodeLauncher;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+/**
+ * fleetd #589 Group 2: {@link Fleetd#openCodeLauncher} is the factory that replaced {@code main}'s
+ * inline {@code new OpenCodeLauncher(...)} call — the {@code opencode} counterpart to {@link
+ * Fleetd#claudeCodeLauncher}, extracted for the identical reason. Its {@code memberCredentials}
+ * argument is the same {@code () -> config.get().memberCredentials()} supplier; replacing it with
+ * {@code () -> null} compiled with 0 errors and left every existing test green before this ticket,
+ * reopening the same CB-592 exposure gap CB-596's policy closed.
+ *
+ * <p>Same observable surface as {@code OpenCodeLauncherTest}'s own {@code memberCredentials} tests:
+ * spawn through the launcher {@code main} actually wires and inspect what {@code tab.create}
+ * carried.
+ */
+class FleetdOpenCodeLauncherCredentialWiringTest {
+
+    private static final String YAML = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              gemini:
+                kind: opencode
+                model: google/gemini-2.5-pro
+            memberCredentials:
+              policy: deny-by-default
+              known:
+                - GITEA_ACCESS_TOKEN
+            """;
+
+    @SuppressWarnings("unchecked")
+    private static Map<String, String> startEnv(FakeHerdr herdr) {
+        return (Map<String, String>) ((Map<String, Object>) herdr.lastCall("tab.create").params()).get("env");
+    }
+
+    @Test
+    @DisplayName("main's memberCredentials wiring reaches OpenCodeLauncher: a known-but-not-allowed "
+            + "name is shadowed on spawn")
+    void memberCredentialsWiringReachesOpenCodeLauncher(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, YAML);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = ConfigRef.fixed(cfg);
+        FakeHerdr herdr = new FakeHerdr();
+
+        OpenCodeLauncher launcher = Fleetd.openCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), cfg.profiles(), cfg, config, ExhaustionSink.none());
+        launcher.spawn();
+
+        String shadowed = startEnv(herdr).get("GITEA_ACCESS_TOKEN");
+        assertNotNull(shadowed,
+                "GITEA_ACCESS_TOKEN is 'known' but not 'allow'-ed in the loaded config — it must be "
+                        + "explicitly shadowed on spawn; replacing the memberCredentials supplier with "
+                        + "() -> null at the Fleetd.openCodeLauncher call site must fail this "
+                        + "assertion, since a null policy shadows nothing");
+        assertFalse(shadowed.isBlank(), "the overlay value must be non-blank");
+    }
+}
@@ -625,6 +625,149 @@ class CompletionResolverTest {
        assertEquals(Rendezvous.Kind.REPLY, waiterB.getNow(null).kind());
    }

+    @Test
+    void aSupersededDoneTurnMustNotEvictItsSuccessorsRegistration() {
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(new FakeHerdr()), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiterA = rendezvous.open("term_a");
+        var turnA = new CompletionResolver.InFlight(waiterA, null);
+        assertTrue(rendezvous.resolve("term_a", "A replied"));
+        rendezvous.close("term_a", waiterA);
+        var waiterB = rendezvous.open("term_a");
+        resolver.captureBaseline("term_a", new TurnToken("term_a", waiterB));
+
+        resolver.resolve("term_a", turnA);
+
+        assertSuccessorRegistrationSurvives(resolver, rendezvous, waiterB,
+                "a done turn must not evict B from resolve()'s early return");
+    }
+
+    @Test
+    void aSupersededExhaustedTurnMustNotEvictItsSuccessorsRegistration() {
+        FakeHerdr herdr = new FakeHerdr().readText("⏺ usage limit has been reached\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                target -> Pattern.compile("usage limit has been reached"), ExhaustionSink.none());
+
+        var waiterA = rendezvous.open("term_a");
+        var turnA = new CompletionResolver.InFlight(waiterA, null);
+        rendezvous.close("term_a", waiterA);
+        var waiterB = rendezvous.open("term_a");
+        resolver.captureBaseline("term_a", new TurnToken("term_a", waiterB));
+
+        resolver.resolve("term_a", turnA);
+
+        assertSuccessorRegistrationSurvives(resolver, rendezvous, waiterB,
+                "an exhausted turn must not evict B from resolve()'s exhausted branch");
+    }
+
+    @Test
+    void aSupersededBackendErrorTurnMustNotEvictItsSuccessorsRegistration() {
+        FakeHerdr herdr = new FakeHerdr().readText("⏺ API Error: 400 invalid request body\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiterA = rendezvous.open("term_a");
+        var turnA = new CompletionResolver.InFlight(waiterA, null);
+        rendezvous.close("term_a", waiterA);
+        var waiterB = rendezvous.open("term_a");
+        resolver.captureBaseline("term_a", new TurnToken("term_a", waiterB));
+
+        resolver.resolve("term_a", turnA);
+
+        assertSuccessorRegistrationSurvives(resolver, rendezvous, waiterB,
+                "a backend-error turn must not evict B from resolve()'s error branch");
+    }
+
+    @Test
+    void aSupersededRawExhaustedTurnMustNotEvictItsSuccessorsRegistration() {
+        FakeHerdr herdr = new FakeHerdr().readText("╭────\nusage limit has been reached");
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                target -> Pattern.compile("usage limit has been reached"), ExhaustionSink.none());
+
+        var waiterA = rendezvous.open("term_a");
+        var turnA = new CompletionResolver.InFlight(waiterA, null);
+        rendezvous.close("term_a", waiterA);
+        var waiterB = rendezvous.open("term_a");
+        resolver.captureBaseline("term_a", new TurnToken("term_a", waiterB));
+
+        resolver.resolve("term_a", turnA);
+
+        assertSuccessorRegistrationSurvives(resolver, rendezvous, waiterB,
+                "a raw exhausted turn must not evict B from the raw-scrape exhausted branch");
+    }
+
+    @Test
+    void aSupersededRawBackendErrorTurnMustNotEvictItsSuccessorsRegistration() {
+        FakeHerdr herdr = new FakeHerdr().readText("╭────\nAPI Error: 400 invalid request body");
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiterA = rendezvous.open("term_a");
+        var turnA = new CompletionResolver.InFlight(waiterA, null);
+        rendezvous.close("term_a", waiterA);
+        var waiterB = rendezvous.open("term_a");
+        resolver.captureBaseline("term_a", new TurnToken("term_a", waiterB));
+
+        resolver.resolve("term_a", turnA);
+
+        assertSuccessorRegistrationSurvives(resolver, rendezvous, waiterB,
+                "a raw backend-error turn must not evict B from the raw-scrape error branch");
+    }
+
+    @Test
+    void aSupersededDoneFailedTurnMustNotEvictItsSuccessorsRegistration() {
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(new FakeHerdr()), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiterA = rendezvous.open("term_a");
+        var turnA = new CompletionResolver.InFlight(waiterA, null);
+        assertTrue(rendezvous.resolve("term_a", "A replied"));
+        rendezvous.close("term_a", waiterA);
+        var waiterB = rendezvous.open("term_a");
+        resolver.captureBaseline("term_a", new TurnToken("term_a", waiterB));
+
+        resolver.fail("term_a", turnA);
+
+        assertSuccessorRegistrationSurvives(resolver, rendezvous, waiterB,
+                "a done failed turn must not evict B from fail()'s early return");
+    }
+
+    @Test
+    void aSupersededTooFastBackendErrorTurnMustNotEvictItsSuccessorsRegistration() {
+        FakeHerdr herdr = new FakeHerdr().readText("⏺ API Error: 400 invalid request body\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        long[] clock = {10_000_000_000L};
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), () -> clock[0]);
+
+        var waiterA = rendezvous.open("term_a");
+        var turnA = new CompletionResolver.InFlight(waiterA, null, clock[0]);
+        rendezvous.close("term_a", waiterA);
+        var waiterB = rendezvous.open("term_a");
+        resolver.captureBaseline("term_a", new TurnToken("term_a", waiterB));
+        clock[0] += CompletionResolver.MIN_TURN_NANOS - 1;
+
+        resolver.resolve("term_a", turnA);
+
+        assertSuccessorRegistrationSurvives(resolver, rendezvous, waiterB,
+                "a too-fast backend-error turn must not evict B from failTooFast()");
+    }
+
+    private static void assertSuccessorRegistrationSurvives(CompletionResolver resolver, Rendezvous rendezvous,
+                                                             Object waiterB, String message) {
+        CompletionResolver.InFlight afterA = resolver.inFlight("term_a");
+        assertNotNull(afterA, message + " — a one-arg remove(target) would remove B");
+        assertEquals(waiterB, afterA.waiter(), message + " — the surviving record must belong to B");
+        assertTrue(rendezvous.resolve("term_a", "B replied"), message + " — B must still resolve normally");
+    }
+
    // --- CB-578 stage A: backend-exhausted classification ---------------------------------

    @Test
@@ -7,6 +7,7 @@ import dev.ltms.fleet.auth.Role;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
 import dev.ltms.fleet.herdr.FakeHerdr;
 import dev.ltms.fleet.inject.LoopWatchdog;
 import dev.ltms.fleet.herdr.PaneLocator;
@@ -58,9 +59,10 @@ class FleetMcpTest {

    private final FakeHerdr herdr = new FakeHerdr();
    private final AgentControl agents = new AgentControl(herdr);
+    private final Injector injector = new Injector(agents);
    private final Rendezvous rendezvous = new Rendezvous();
    private final InMemoryReplyInbox inbox = new InMemoryReplyInbox();
-    private final MessageService messages = new MessageService(agents, new Injector(agents), rendezvous, inbox);
+    private final MessageService messages = new MessageService(agents, injector, rendezvous, inbox);

    @BeforeEach
    void setUp() {
@@ -299,6 +301,35 @@ class FleetMcpTest {
        assertTrue(textOf(res).contains("no reply"), "got: " + textOf(res));
    }

+    /**
+     * fleetd #571 (ticket CORRECTION 5): {@code formatReply}'s {@code TIMED_OUT_UNCONFIRMED} arm is
+     * the one message whose whole job is to stop a caller retrying a delivery that may already have
+     * arrived. Pin that its wording is actually distinct from the queued/working arm's retry
+     * invitation — a mutation that swapped this arm's text for that one still passed every other
+     * test in this suite, because nothing asserted the specific wording.
+     */
+    @Test
+    void sendTimesOutWithAnUnconfirmedNoteNotARetryInvitation() throws Exception {
+        herdr.agentSendFailsWith("send_failed");
+        CompletableFuture<McpSchema.CallToolResult> send = CompletableFuture.supplyAsync(
+                () -> FleetMcp.send(messages, T, "hi", 150L, null, Set.of()));
+        long deadline = System.currentTimeMillis() + 2000;
+        while (!rendezvous.isWaiting(T) && System.currentTimeMillis() < deadline) {
+            //noinspection BusyWait
+            Thread.sleep(5);
+        }
+        assertTrue(rendezvous.isWaiting(T), "send should have opened its rendezvous waiter");
+        injector.onStatus(T, AgentStatus.IDLE); // triggers the failing delivery attempt -> ATTEMPTED
+
+        McpSchema.CallToolResult res = send.get(5, TimeUnit.SECONDS);
+        String text = textOf(res);
+        assertNotEquals(Boolean.TRUE, res.isError(), "a timeout is informational, not a tool error");
+        assertTrue(text.contains("delivery unconfirmed"), "got: " + text);
+        assertFalse(text.contains("retry or poll status"),
+                "an unconfirmed delivery must not carry the queued/working arm's retry invitation — "
+                        + "a resend here can double-deliver the same brief: got " + text);
+    }
+
    @Test
    void sendRejectsMissingArgs() {
        assertTrue(FleetMcp.send(messages, null, "hi", null, null, Set.of()).isError());
@@ -8,7 +8,10 @@ import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.Timeout;

 import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.Method;
 import java.lang.reflect.Proxy;
+import java.io.IOException;
+import java.util.Map;
 import java.util.List;
 import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.CountDownLatch;
@@ -20,6 +23,7 @@ import java.util.concurrent.atomic.AtomicReference;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;

 /**
 * CB-528 follow-up: {@link AmqpReplyInbox#failPendingPublishesOnRecovery()} must not fail a publish
@@ -197,11 +201,78 @@ class AmqpReplyInboxRecoveryRaceTest {
                        + elapsedMillis.get() + "ms");
    }

+    @Test
+    void publishIOExceptionRemovesThePendingMessageId() throws Exception {
+        AtomicLong seqCounter = new AtomicLong();
+        Channel failing = fakeChannel(seqCounter, new CopyOnWriteArrayList<>(), new CopyOnWriteArrayList<>(),
+                new AtomicReference<>(), new AtomicReference<>(), true);
+        AmqpReplyInbox inbox = new AmqpReplyInbox(fakeConnection(failing, failing), AmqpReplyInbox.DEFAULT_PREFETCH);
+
+        try {
+            org.junit.jupiter.api.Assertions.assertThrows(IllegalStateException.class,
+                    () -> inbox.publish("worker", "catch", "body"));
+            assertEquals(0, pendingByMsgId(inbox).size(), "publish IOException must remove its msgId entry");
+        } finally {
+            inbox.close();
+        }
+    }
+
+    @Test
+    void interruptedPublishRemovesThePendingMessageIdInFinally() throws Exception {
+        InboxFixture fixture = new InboxFixture();
+        Thread publish = fixture.startPublish("finally");
+        fixture.awaitPublished("finally");
+        publish.interrupt();
+        publish.join(5_000);
+
+        assertEquals(0, pendingByMsgId(fixture.inbox).size(), "publish finally must remove its msgId entry");
+        fixture.inbox.close();
+    }
+
+    @Test
+    void confirmResolutionRemovesThePendingMessageId() throws Exception {
+        AmqpReplyInbox inbox = new InboxFixture().inbox;
+        try {
+            seedPending(inbox, 1, "confirm");
+            invoke(inbox, "resolveConfirm", new Class<?>[] {long.class, boolean.class, boolean.class}, 1L, false, true);
+            assertEquals(0, pendingByMsgId(inbox).size(), "confirm resolution must remove its msgId entry");
+        } finally {
+            inbox.close();
+        }
+    }
+
+    @Test
+    void recoverySweepRemovesThePendingMessageId() throws Exception {
+        AmqpReplyInbox inbox = new InboxFixture().inbox;
+        try {
+            seedPending(inbox, 1, "recovery");
+            inbox.failPendingPublishesOnRecovery();
+            assertEquals(0, pendingByMsgId(inbox).size(), "recovery sweep must remove its msgId entry");
+        } finally {
+            inbox.close();
+        }
+    }
+
+    @Test
+    void closeRemovesThePendingMessageId() throws Exception {
+        AmqpReplyInbox inbox = new InboxFixture().inbox;
+        seedPending(inbox, 1, "close");
+        inbox.close();
+
+        assertEquals(0, pendingByMsgId(inbox).size(), "close must remove its msgId entry");
+    }
+
    /** A {@link Proxy}-backed {@link Channel}: only the calls {@link AmqpReplyInbox} actually makes
     *  are meaningfully implemented; everything else returns a harmless default. */
    private static Channel fakeChannel(AtomicLong seqCounter, List<Long> seqOrder, List<String> msgIdOrder,
-                                        AtomicReference<ConfirmCallback> ackCallback,
-                                        AtomicReference<ConfirmCallback> nackCallback) {
+                                         AtomicReference<ConfirmCallback> ackCallback,
+                                         AtomicReference<ConfirmCallback> nackCallback) {
+        return fakeChannel(seqCounter, seqOrder, msgIdOrder, ackCallback, nackCallback, false);
+    }
+
+    private static Channel fakeChannel(AtomicLong seqCounter, List<Long> seqOrder, List<String> msgIdOrder,
+                                         AtomicReference<ConfirmCallback> ackCallback,
+                                         AtomicReference<ConfirmCallback> nackCallback, boolean failPublish) {
        InvocationHandler handler = (proxy, method, args) -> {
            String name = method.getName();
            if (name.equals("getNextPublishSeqNo")) {
@@ -210,6 +281,9 @@ class AmqpReplyInboxRecoveryRaceTest {
                return value;
            }
            if (name.equals("basicPublish")) {
+                if (failPublish) {
+                    throw new IOException("test publish failure");
+                }
                AMQP.BasicProperties props = (AMQP.BasicProperties) args[3];
                msgIdOrder.add(props.getMessageId());
                return null;
@@ -285,4 +359,60 @@ class AmqpReplyInboxRecoveryRaceTest {
        }
        return 0;
    }
+
+    @SuppressWarnings("unchecked")
+    private static Map<String, Object> pendingByMsgId(AmqpReplyInbox inbox) throws Exception {
+        var field = AmqpReplyInbox.class.getDeclaredField("pendingByMsgId");
+        field.setAccessible(true);
+        return (Map<String, Object>) field.get(inbox);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static void seedPending(AmqpReplyInbox inbox, long seq, String msgId) throws Exception {
+        Class<?> pendingType = Class.forName(AmqpReplyInbox.class.getName() + "$Pending");
+        var constructor = pendingType.getDeclaredConstructor(String.class);
+        constructor.setAccessible(true);
+        Object pending = constructor.newInstance(msgId);
+        var seqField = AmqpReplyInbox.class.getDeclaredField("pendingBySeq");
+        seqField.setAccessible(true);
+        ((Map<Long, Object>) seqField.get(inbox)).put(seq, pending);
+        pendingByMsgId(inbox).put(msgId, pending);
+    }
+
+    private static void invoke(AmqpReplyInbox inbox, String name, Class<?>[] types, Object... args) throws Exception {
+        Method method = AmqpReplyInbox.class.getDeclaredMethod(name, types);
+        method.setAccessible(true);
+        method.invoke(inbox, args);
+    }
+
+    private static final class InboxFixture {
+        final AtomicLong seqCounter = new AtomicLong();
+        final List<Long> seqOrder = new CopyOnWriteArrayList<>();
+        final List<String> msgIdOrder = new CopyOnWriteArrayList<>();
+        final AtomicReference<ConfirmCallback> ackCallback = new AtomicReference<>();
+        final AtomicReference<ConfirmCallback> nackCallback = new AtomicReference<>();
+        final AmqpReplyInbox inbox = new AmqpReplyInbox(
+                fakeConnection(fakeChannel(seqCounter, seqOrder, msgIdOrder, ackCallback, nackCallback),
+                        fakeChannel(seqCounter, seqOrder, msgIdOrder, ackCallback, nackCallback)),
+                AmqpReplyInbox.DEFAULT_PREFETCH);
+
+        Thread startPublish(String msgId) {
+            Thread thread = Thread.ofVirtual().start(() -> {
+                try {
+                    inbox.publish("worker", msgId, "body");
+                } catch (IllegalStateException ignored) {
+                    // Interrupting the confirm wait is the path under test.
+                }
+            });
+            return thread;
+        }
+
+        void awaitPublished(String msgId) throws InterruptedException {
+            long deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5);
+            while (!msgIdOrder.contains(msgId) && System.nanoTime() < deadline) {
+                Thread.sleep(10);
+            }
+            assertTrue(msgIdOrder.contains(msgId), "publish did not register " + msgId);
+        }
+    }
 }
@@ -12,7 +12,11 @@ import org.testcontainers.junit.jupiter.Testcontainers;
 import org.testcontainers.utility.DockerImageName;

 import java.io.IOException;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
 import java.util.List;
+import java.util.Map;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;

@@ -373,6 +377,72 @@ class LeadMailboxTest {
                () -> "expected AlreadyClosedException, got: " + thrown);
    }

+    @Test
+    void publishIOExceptionRemovesThePendingMessageId() throws Exception {
+        LeadMailbox mailbox = newMailbox(true);
+        try {
+            assertThrows(IllegalStateException.class,
+                    () -> mailbox.publish("target", new LeadMessage("catch", "from", "target", "body")));
+            assertEquals(0, pendingByMsgId(mailbox).size(), "publish IOException must remove its msgId entry");
+        } finally {
+            mailbox.close();
+        }
+    }
+
+    @Test
+    void interruptedPublishRemovesThePendingMessageIdInFinally() throws Exception {
+        LeadMailbox mailbox = newMailbox(false);
+        Thread publish = Thread.ofVirtual().start(() -> {
+            try {
+                mailbox.publish("target", new LeadMessage("finally", "from", "target", "body"));
+            } catch (IllegalStateException ignored) {
+                // Interrupting the confirm wait is the path under test.
+            }
+        });
+        awaitPending(mailbox, "finally");
+        publish.interrupt();
+        publish.join(5_000);
+
+        try {
+            assertEquals(0, pendingByMsgId(mailbox).size(), "publish finally must remove its msgId entry");
+        } finally {
+            mailbox.close();
+        }
+    }
+
+    @Test
+    void confirmResolutionRemovesThePendingMessageId() throws Exception {
+        LeadMailbox mailbox = newMailbox(false);
+        try {
+            seedPending(mailbox, 1, "confirm");
+            invoke(mailbox, "resolveConfirm", new Class<?>[] {long.class, boolean.class, boolean.class}, 1L, false, true);
+            assertEquals(0, pendingByMsgId(mailbox).size(), "confirm resolution must remove its msgId entry");
+        } finally {
+            mailbox.close();
+        }
+    }
+
+    @Test
+    void recoverySweepRemovesThePendingMessageId() throws Exception {
+        LeadMailbox mailbox = newMailbox(false);
+        try {
+            seedPending(mailbox, 1, "recovery");
+            mailbox.failPendingPublishesOnRecovery();
+            assertEquals(0, pendingByMsgId(mailbox).size(), "recovery sweep must remove its msgId entry");
+        } finally {
+            mailbox.close();
+        }
+    }
+
+    @Test
+    void closeRemovesThePendingMessageId() throws Exception {
+        LeadMailbox mailbox = newMailbox(false);
+        seedPending(mailbox, 1, "close");
+        mailbox.close();
+
+        assertEquals(0, pendingByMsgId(mailbox).size(), "close must remove its msgId entry");
+    }
+
    /** Poll peek until at least one message is held, or ~10s elapse (broker delivery is async). */
    @SuppressWarnings("BusyWait")
    private static List<LeadMessage> awaitPeek(LeadMailbox inbox) throws InterruptedException {
@@ -398,4 +468,108 @@ class LeadMailboxTest {
        }
        return state;
    }
+
+    private static LeadMailbox newMailbox(boolean failPublish) {
+        AtomicLong sequence = new AtomicLong();
+        Channel consume = fakeChannel(sequence, false);
+        Channel publish = fakeChannel(sequence, failPublish);
+        return new LeadMailbox(fakeConnection(consume, publish), "self");
+    }
+
+    private static Channel fakeChannel(AtomicLong sequence, boolean failPublish) {
+        InvocationHandler handler = (proxy, method, args) -> {
+            if (method.getName().equals("getNextPublishSeqNo")) {
+                return sequence.incrementAndGet();
+            }
+            if (method.getName().equals("basicPublish") && failPublish) {
+                throw new IOException("test publish failure");
+            }
+            if (method.getName().equals("equals")) {
+                return proxy == args[0];
+            }
+            if (method.getName().equals("hashCode")) {
+                return System.identityHashCode(proxy);
+            }
+            return defaultValue(method.getReturnType());
+        };
+        return (Channel) Proxy.newProxyInstance(LeadMailboxTest.class.getClassLoader(), new Class<?>[] {Channel.class}, handler);
+    }
+
+    private static Connection fakeConnection(Channel first, Channel second) {
+        AtomicLong calls = new AtomicLong();
+        InvocationHandler handler = (proxy, method, args) -> {
+            if (method.getName().equals("createChannel") && (args == null || args.length == 0)) {
+                return calls.getAndIncrement() == 0 ? first : second;
+            }
+            if (method.getName().equals("equals")) {
+                return proxy == args[0];
+            }
+            if (method.getName().equals("hashCode")) {
+                return System.identityHashCode(proxy);
+            }
+            return defaultValue(method.getReturnType());
+        };
+        return (Connection) Proxy.newProxyInstance(LeadMailboxTest.class.getClassLoader(), new Class<?>[] {Connection.class}, handler);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static Map<String, Object> pendingByMsgId(LeadMailbox mailbox) throws Exception {
+        var field = LeadMailbox.class.getDeclaredField("pendingByMsgId");
+        field.setAccessible(true);
+        return (Map<String, Object>) field.get(mailbox);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static void seedPending(LeadMailbox mailbox, long seq, String msgId) throws Exception {
+        Class<?> pendingType = Class.forName(LeadMailbox.class.getName() + "$Pending");
+        var constructor = pendingType.getDeclaredConstructor(String.class);
+        constructor.setAccessible(true);
+        Object pending = constructor.newInstance(msgId);
+        var seqField = LeadMailbox.class.getDeclaredField("pendingBySeq");
+        seqField.setAccessible(true);
+        ((Map<Long, Object>) seqField.get(mailbox)).put(seq, pending);
+        pendingByMsgId(mailbox).put(msgId, pending);
+    }
+
+    private static void invoke(LeadMailbox mailbox, String name, Class<?>[] types, Object... args) throws Exception {
+        Method method = LeadMailbox.class.getDeclaredMethod(name, types);
+        method.setAccessible(true);
+        method.invoke(mailbox, args);
+    }
+
+    private static void awaitPending(LeadMailbox mailbox, String msgId) throws Exception {
+        long deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5);
+        while (!pendingByMsgId(mailbox).containsKey(msgId) && System.nanoTime() < deadline) {
+            Thread.sleep(10);
+        }
+        assertTrue(pendingByMsgId(mailbox).containsKey(msgId), "publish did not register " + msgId);
+    }
+
+    private static Object defaultValue(Class<?> type) {
+        if (!type.isPrimitive() || type == void.class) {
+            return null;
+        }
+        if (type == boolean.class) {
+            return Boolean.FALSE;
+        }
+        if (type == long.class) {
+            return 0L;
+        }
+        if (type == short.class) {
+            return (short) 0;
+        }
+        if (type == byte.class) {
+            return (byte) 0;
+        }
+        if (type == char.class) {
+            return (char) 0;
+        }
+        if (type == double.class) {
+            return 0.0d;
+        }
+        if (type == float.class) {
+            return 0.0f;
+        }
+        return 0;
+    }
 }
@@ -601,6 +601,30 @@ class MessageServiceTest {
        }
    }

+    /**
+     * fleetd #571 (the acceptance test the ticket was filed for). The worker is idle so the injector
+     * attempts delivery, but the {@code agent.prompt} call itself fails with a herdr error that is
+     * not a confirmed absence (not a {@code *_not_found} code) — {@link Injector} marks the Pending
+     * {@code ATTEMPTED} (fleetd #551), meaning the call was made and whether it reached the pane is
+     * unknown. Before this fix, {@code send}'s {@code TimeoutException} branch collapsed
+     * {@code ATTEMPTED} into {@code TIMED_OUT_QUEUED} — a promise that the message will never arrive,
+     * which may already be false: {@code agent.prompt} pastes and submits in one call.
+     */
+    @Test
+    void sendTimesOutWithAttemptedDeliveryReportsUnconfirmedNotQueued() throws Exception {
+        herdr.agentSendFailsWith("send_failed");
+        CompletableFuture<MessageService.Reply> send =
+                CompletableFuture.supplyAsync(() -> messages.send(T, "brief", 150));
+        awaitWaiting();
+        injector.onStatus(T, AgentStatus.IDLE); // triggers the failing delivery attempt → ATTEMPTED
+
+        MessageService.Reply r = send.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.TIMED_OUT_UNCONFIRMED, r.outcome(),
+                "an ATTEMPTED delivery must not collapse into TIMED_OUT_QUEUED — the message may "
+                        + "already have arrived in full, and TIMED_OUT_QUEUED promises it never will");
+        assertNull(r.text());
+    }
+
    @Test
    void answerTimesOutWhenTheResumedWorkerNeverReplies() throws Exception {
        CompletableFuture<MessageService.Reply> send = sendAsync();
@@ -647,6 +647,28 @@ class FleetAppTest {
        assertTrue(herdr.called("agent.prompt"), "message was injected");
    }

+    /**
+     * fleetd #571: the worker is idle, so the poller attempts delivery, but the {@code agent.prompt}
+     * call itself fails with a herdr error that is not a confirmed absence — {@link
+     * dev.ltms.fleet.inject.Injector} marks this {@code ATTEMPTED}, meaning the call was made and
+     * whether it reached the pane is unknown. {@code writeReply}'s default arm must map this to its
+     * own {@code "unconfirmed"} status, not silently fall through to {@code "done"} (which would
+     * claim the delegation completed) nor collapse into {@code "queued"} (which would claim the
+     * message will never arrive, when it may already be sitting in the pane).
+     */
+    @Test
+    void messageTimesOutUnconfirmedWhenDeliveryAttemptFails() throws Exception {
+        FakeHerdr herdr = new FakeHerdr().agentStatus("idle").agentSendFailsWith("send_failed");
+        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
+
+        HttpResponse<String> res = postMessage(port, "{\"content\":\"hi\",\"timeoutMs\":250}");
+        assertEquals(202, res.statusCode());
+        JsonNode body = mapper.readTree(res.body());
+        assertEquals("unconfirmed", body.get("status").asText(),
+                "an ATTEMPTED delivery must report its own status, not \"queued\" or \"done\"");
+        assertTrue(herdr.called("agent.prompt"), "delivery must have been attempted");
+    }
+
    @Test
    void messageRejectsBlankContent() throws Exception {
        int port = startHealthy();
Author	SHA1	Message	Date
Dai Ha	ae7845c375	fleetd #589 (Groups 1 & 2): pin 6 main() wiring sites with named factories CI / shell-tests (pull_request) Successful in 9s Details CI / contract (pull_request) Successful in 54s Details CI / build (pull_request) Successful in 1m52s Details Extracts 6 inline wiring expressions from Fleetd.main() into named, directly-testable package-private static factories, following the FleetdLoopHealthSourceWiringTest (#584) shape, and adds one wiring test per factory: Group 1 (exhaustion/quarantine): - forwardingExhaustionSink(exhaustionSinkRef) — was inline ExhaustionSink.forwardingTo(exhaustionSinkRef::get) - publishExhaustionSink(...) — was two untested statements building the real sink and .set()-ing it into exhaustionSinkRef - liveExhaustedPatterns(config) — was inline new LiveExhaustedPatterns(() -> config.get().profiles()) - exhaustedPatternLookup(roster, liveExhaustedPatterns) — was an inline lambda resolving a herdr target to its profile's live pattern; silently losing this is the worst regression in the sweep, since a real usage-limit refusal would stop being classified as BACKEND_EXHAUSTED Group 2 (CB-596 credential policy): - claudeCodeLauncher(...) — was an inline `new ClaudeCodeLauncher(...)` whose memberCredentials supplier argument was untestable wiring - openCodeLauncher(...) — same, for OpenCodeLauncher Each new test pins its factory behaviorally (never via source-text assertions): built and confirmed RED by name against the named inert mutation, then confirmed GREEN again after restoring, and separately confirmed GREEN after a behavior-preserving reformat/local-variable extraction of the same call, to rule out a disguised source-text test. Suite: 1789 -> 1799 tests (+10, matching the 10 tests added), 0 failures, mvn -o clean install BUILD SUCCESS. Scope strictly limited to main()'s :214-:468 range per the ticket split with the concurrent worker handling Group 3 at line 500+.	2026-09-19 15:35:32 +07:00
Dai Ha	a639969a9a	CLAUDE.md: a blocked lead consults architects, not the operator CI / shell-tests (push) Successful in 6s Details CI / contract (push) Successful in 1m32s Details CI / build (push) Successful in 1m42s Details The operator set this rule on 2026-09-19: when a decision blocks a lead, it consults one or more architect members, who are authorized to agree on one decision and unblock. The operator is not asked. Escalation stays open only for things outside the fleet's authority -- money, credentials, or a promise made to someone else. The paragraph also carries the reason the ticket record is mandatory rather than optional. The operator's old notification channel was the block itself: work stopped, so they found out. Taking the operator out of the loop removes that signal with it, so the decision goes on the ticket, which reaches them whether or not they are at a terminal when it is made. The rule has a second half aimed at architects, which lives in fleet.charters.architect and is applied per daemon -- filed as #591, because a charter can never reach a lead and charters do not travel between hosts. The missing notification event is #592. Block verified byte-identical with wiki 7-Use-Cases.md at 1d9bd1b.	2026-09-19 14:57:04 +07:00
Dai Ha	17c3a69c57	docs: CB-591 gateway page had two claims that went stale CI / shell-tests (push) Successful in 5s Details CI / contract (push) Successful in 1m23s Details CI / build (push) Failing after 1m37s Details The gateway's chat model is served under the stable alias `acoder`, and the model behind that alias changed on 2026-08-28 — it is Qwen3.8-27B now, not DeepSeek-V4-Flash. The old name is still served, so nothing broke, but it names a model this is not. Two claims on the page were wrong as a result, and both were written as current facts rather than dated measurements: - `/v1/models` returns exactly `["deepseek-v4-flash"]` — it returns 6 ids now. This sat under a heading saying it needs no re-testing. - the status banner said `local` and `gx` are both at `weight: 100` — `local` is at 0. Measured today against the live gateway: /v1/models returns acoder, qwen3.8-27b-nvfp4, deepseek-v4-flash and three embedding names; a completion sent as `deepseek-v4-flash` comes back reporting `"model": "acoder"`, which is the alias in plain sight. /v1/deployment reports generation 2026-08-28-qwen3.8-27b-nvfp4. §2 and §3 are left alone. They are the August plan, and rewriting them would destroy the record of the migration. fleetd.yaml moved to `acoder` in the same change. It is not tracked here.	2026-09-13 07:01:15 +07:00
ltms	49a5875586	Merge #583 : fleetd #582 — assert pending message-id cleanup at every publish cleanup site CI / shell-tests (push) Successful in 9s Details CI / contract (push) Successful in 48s Details CI / build (push) Failing after 2m1s Details All ten assertions proven live: six by the implementer, the last four by the lead. One contract build with four deleted removal lines produced exactly four named failures, one per site, with the total unchanged at 1825.	2026-09-12 15:52:25 +02:00
Dai Ha	634d33b50b	Merge worker/562-loop-health-wiring-test-99611c-5 CI / shell-tests (push) Successful in 9s Details CI / contract (push) Successful in 1m17s Details CI / build (push) Successful in 1m45s Details	2026-09-12 20:28:14 +07:00
Dai Ha	1db79bcaa9	Merge worker/581-completionresolver-cas-sites-0542b7-6	2026-09-12 20:28:14 +07:00
Dai Ha	4507bc5a70	Merge worker/571-attempted-outcome-5739f7-2	2026-09-12 20:28:14 +07:00
Dai Ha	d7239ed23b	fleetd #571 : pin FleetMcp.formatReply's TIMED_OUT_UNCONFIRMED wording CI / shell-tests (pull_request) Successful in 5s Details CI / contract (pull_request) Successful in 1m14s Details CI / build (pull_request) Successful in 1m42s Details CORRECTION 5 on the ticket: mutating the new arm's message text to the queued/working arm's text survived every existing test, because nothing asserted the specific wording. This adds one test that asserts the unconfirmed-delivery message and asserts it does NOT carry the queued/working arm's retry invitation — the distinction #571 exists for. No production code changes; formatReply's TIMED_OUT_UNCONFIRMED arm was already correct.	2026-09-12 20:19:37 +07:00
Dai Ha	dfeb9340b4	fleetd #581 : cover completion CAS removals CI / shell-tests (pull_request) Successful in 5s Details CI / build (pull_request) Failing after 1m31s Details CI / contract (pull_request) Successful in 1m35s Details	2026-09-12 20:19:20 +07:00
Dai Ha	1513d4f260	fleetd #562 follow-up: extract loopHealthSource factory, pin its wiring CI / shell-tests (pull_request) Successful in 6s Details CI / contract (pull_request) Successful in 59s Details CI / build (pull_request) Successful in 1m43s Details PR #579's inline `new FleetMcp.LoopHealthSource(poller::health, ...)` in Fleetd.main had nothing a test could call directly. Measured: replacing poller::health with a constant () -> RUNNING compiled clean and left all 1771 tests green (see issue #562 comment "HOLD on PR #579"). Extracts the inline construction to a package-private Fleetd.loopHealthSource factory, the same style as the sibling capacitySource/healthCoverageSource factories, and adds FleetdLoopHealthSourceWiringTest with three separate assertions: the statusPoller half, the sessionReaper half, and the reaper == null branch (still STOPPED).	2026-09-12 20:16:23 +07:00
Dai Ha	4ca7d72303	#582 : assert pending message-id cleanup CI / shell-tests (pull_request) Successful in 5s Details CI / contract (pull_request) Successful in 50s Details CI / build (pull_request) Successful in 2m32s Details	2026-09-12 20:15:48 +07:00
Dai Ha	c0545d003d	fleetd #571 : make FleetApp.writeReply's inner Outcome switch exhaustive, no default CI / shell-tests (pull_request) Successful in 8s Details CI / contract (pull_request) Successful in 1m16s Details CI / build (pull_request) Successful in 1m48s Details Ticket comments (17126, 17127) corrected the original acceptance criterion after this unit was already in flight: a hand-listed grep for the enum's constant names goes stale silently the moment a new constant lands, so the compiler must be the enumeration instead. sendOutcomeLabel (MessageService.java) and formatReply (FleetMcp.java) were already default-free switch expressions. The one gap was writeReply's inner "status" switch, which had `default -> "done"` — the exact value that would have lied about TIMED_OUT_UNCONFIRMED. Remove the default and list every Outcome constant explicitly; REPLIED, COMPLETED_UNREPLIED, QUESTION and STALE_TURN get an arm too even though the outer switch always dispatches them first, so the inner switch stays exhaustive on its own. The outer switch (a statement, not an expression) keeps its own default — Java does not require exhaustiveness there regardless, and "everything not terminal is a 202" is an intentional catch-all. Verified with the proof the ticket asked for: added a scratch 11th Outcome constant after deleting all default arms and confirmed all three switch-expression sites (and no test file) fail to compile without an arm for it, one at a time, then removed the scratch constant.	2026-09-12 19:28:59 +07:00
Dai Ha	c1e06c9e12	fleetd #571 : add TIMED_OUT_UNCONFIRMED so an ATTEMPTED delivery is not reported as never-arriving MessageService.send's TimeoutException branch collapsed Injector.Cancellation.ATTEMPTED (fleetd #551 — the send call was made but its outcome is unknown) into Outcome.TIMED_OUT_QUEUED, which promises the caller the message will never arrive. On this route agent.prompt may already have pasted and submitted the text, so a caller's natural recovery (resend) risks a double delivery. Add Outcome.TIMED_OUT_UNCONFIRMED and route ATTEMPTED to it. Update the three readers found by searching for the enum's constant names (not `Outcome.`, which misses FleetMcp's unqualified `case REPLIED ->` switches and would false-positive on ConfigRef's unrelated Outcome record): - MessageService.sendOutcomeLabel: add it to the "timeout" metric label group. - FleetMcp.formatReply: its own case, warning against a blind retry (distinct from the generic "retry or poll status" message the other timeouts get). - FleetApp.writeReply: its own "unconfirmed" status and detail text, so it no longer falls through the switch's default -> "done" arm, which would have reported "the delegation completed" for the one case where delivery is unconfirmed.	2026-09-12 19:21:10 +07:00