fleetd #669: fix fleetd.example.yaml's false scan-exclusion claims; cover the shipped shape

fleetd.example.yaml claimed member spaces are excluded from the lead-tab scan and that
a lead's workspace default is "leads" and must not match a member workspace. Both are
false: production always passes an empty excludedWorkspaceLabels set (CB-558), and a
lead's workspace defaults to the same shared "fleet" space the members use. Rewrite
both paragraphs to name the defenses that actually exist: the startup tabPrefix refusal
and CallerResolver's roster-first precedence.

Add the test nobody wrote: a lead is still discovered when its workspace label equals
the member workspace, with an empty exclusion set. Correct
aTabInAWorkerSpaceIsNeverALeadEvenWhenItsLabelMatches's javadoc, which overclaimed that
the excludedWorkspaceLabels parameter is the live production guard. Drop the stale line
number from FleetdAssemblyLeadTabScannerExclusionTest's assertion message and javadoc.

fleetd/fleetd.example.yaml

@@ -62,11 +62,12 @@ bind:
 #
 # Leads are configured under `fleet.leaders:` — see THE FLEET further down.
 #
-# Two things stop the tab-name convention from becoming a way to claim leadership: the configured
-# member spaces are excluded from the scan, so nothing fleetd places can land in a matching tab;
-# and startup REFUSES a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel`
-# override, also matches — so the two namespaces cannot overlap by accident. The label is a NAME,
-# never a capability: what a pane may do is decided by the role the daemon resolves for it.
+# Two things stop the tab-name convention from becoming a way to claim leadership: startup REFUSES
+# a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel` override, also
+# matches, so the two namespaces cannot overlap by accident; and the CallerResolver asks the live
+# spawned-member roster BEFORE any tab map, so a live member is never mistaken for a lead no matter
+# what its tab says. The label is a NAME, never a capability: what a pane may do is decided by the
+# role the daemon resolves for it.
 
 # CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
 # idle (no open fleet_send driving it) past the quiet period. The fleet is one lead + architects +
@@ -659,9 +660,10 @@ fleet:
   #     tabPrefix: "lead:"           # only used to guard against a worker tabLabel colliding with
   #                                  # this convention at startup; plays no part in matching a lead
   #     scanIntervalSeconds: 10      # rescan cadence, and the worst case before a new tab is seen
-  #     workspace: leads             # where a launched lead's tab is created (default "leads").
-  #                                  # MUST NOT be a member workspace — those are excluded from the
-  #                                  # scan, so a lead placed in one is never found again.
+  #     workspace: leads             # where a launched lead's tab is created (default "fleet",
+  #                                  # the same shared space the members use). Sharing that space
+  #                                  # with members is the normal shipped shape: the scanner tells
+  #                                  # a lead from a member by the exact tab label, not by workspace.
   #     cwd: /path/to/repo           # the launched lead's working directory (default: fleetd's own)
   #     kind: claude                 # descriptive; reported by fleet_whoami
   #   gpt-sol-5.6:
@@ -669,11 +671,18 @@ fleet:
   #     kind: opencode
   #     model: openai/gpt-5.6-terra
 
-  # A collaborator tab, keyed by name (fleetd #669). This block is parsed and validated today;
-  # nothing yet recognises or addresses the tab it names. Recognise-only, like a profile-less
-  # `leaders:` entry above: there is no `profile:`, no `instances:` and no `kind:`. `tab:` is
-  # REQUIRED and is the only field identity depends on, matched case-insensitively — the same
-  # GET-THE-VALUE-RIGHT warning above the `leaders:` block applies here too.
+  # A collaborator tab, keyed by name (fleetd #669). A pane whose tab matches resolves as the
+  # COLLABORATOR role: `fleet_whoami` answers `collaborator`, and the session may observe the fleet
+  # (`fleet_list`, `fleet_profiles`, `fleet_whoami`) and `fleet_send` to a lead or to another
+  # collaborator. It may NOT spawn, stop or drain anything, roll a lead's session, answer a
+  # member's `fleet_ask`, poll a ticket, send across hosts, or send to a spawned member's terminal.
+  # Each of those is refused at the gate rather than queued.
+  # Recognise-only, like a profile-less `leaders:` entry above: there is no `profile:`, no
+  # `instances:` and no `kind:`. `tab:` is REQUIRED and is the only field identity depends on,
+  # matched case-insensitively — the same GET-THE-VALUE-RIGHT warning above the `leaders:` block
+  # applies here too.
+  # A lead cannot discover a collaborator yet (#703): `fleet_list` has no `collaborators` key, so
+  # the collaborator must speak first, or pass on the `sessionId` its own `fleet_whoami` reports.
   # collaborators:
   #   reviewer-alex:
   #     tab: "collab: alex"

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -217,25 +217,28 @@ public final class Fleetd {
 
     /**
      * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a spawned
-     * member whose agent has connected the bridge MCP, <em>or</em> a lead.
+     * member whose agent has connected the bridge MCP, a lead, <em>or</em> a collaborator.
      *
      * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> member's boot
      * window, where herdr already reports {@code idle} but the TUI would drop an injected paste. That
      * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
-     * (or labelled its tab) only once it was up, so there is no boot window to guard.
+     * (or labelled its tab) only once it was up, so there is no boot window to guard. A collaborator
+     * is the same way — a person's own tab, matched to a configured name, never spawned.
      *
-     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code FleetMcp} marks presence
-     * for every spawned member (worker and architect), deliberately, since that map doubles as the
-     * member roster's availability signal and a lead counted there would show up as an available
-     * member. So without the second disjunct a lead is permanently un-deliverable: every
-     * lead→lead send sat on the gate for {@code READINESS_GRACE_POLLS} (~60s) and then failed
-     * having never been typed into the pane.
+     * <p>Neither a lead nor a collaborator is ever enrolled in {@link MemberPresence} — {@code
+     * FleetMcp} marks presence for every spawned member (worker and architect), deliberately, since
+     * that map doubles as the member roster's availability signal and a lead or collaborator counted
+     * there would show up as an available member. So without the second and third disjuncts a lead or
+     * collaborator is permanently un-deliverable: every send to one sat on the gate for
+     * {@code READINESS_GRACE_POLLS} (~60s) and then failed having never been typed into the pane.
      *
-     * <p>The lead set is read through the supplier on each call rather than snapshotted, so a lead
-     * discovered by {@code leadScan} after startup becomes deliverable without a restart.
+     * <p>Both sets are read through their supplier on each call rather than snapshotted, so a lead or
+     * collaborator discovered by {@code leadScan} after startup becomes deliverable without a restart.
      */
-    static Predicate<String> deliverableTo(MemberPresence presence, Supplier<Map<String, String>> leads) {
-        return target -> presence.isPresent(target) || leads.get().containsKey(target);
+    static Predicate<String> deliverableTo(MemberPresence presence, Supplier<Map<String, String>> leads,
+            Supplier<Map<String, String>> collaborators) {
+        return target -> presence.isPresent(target) || leads.get().containsKey(target)
+                || collaborators.get().containsKey(target);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/FleetdAssembly.java

@@ -368,7 +368,7 @@ final class FleetdAssembly {
         // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
         MemberPresence presence = sessions.asPresence();
         TurnListener turnListener = Fleetd.turnListener(completion, sessions);
-        Predicate<String> deliverable = Fleetd.deliverableTo(presence, leads);
+        Predicate<String> deliverable = Fleetd.deliverableTo(presence, leads, collaboratorTerminals);
         // fleetd #556: registration is wired directly to `completion`, not folded into the
         // `turnListener` fan-out above — so it survives `sessions.onDelivered` (or any future
         // listener) throwing, regardless of call order.

fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -615,7 +615,7 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         // may bind to, AND what a slot already bound still grants) through its own instance of that
         // same supplier shape — see MemberRegistry.live and its class doc for the binding rule:
         // removing a slot revokes ARCHITECT on the bound pane's very next request, and only the slot
-        // OCCUPANCY survives, so the demoted session keeps its slot key until it unbinds. Only
+        // OCCUPANCY survives, so the demoted session keeps its slot key until it unbinds.
         // fleet.leaders is frozen (Fleetd.java:281 reads cfg.fleet().leaders() off the startup
         // snapshot to build both the LeadTabScanner's tab-label-to-name map, wired into
         // CallerResolver.withLeadsAndMembers at Fleetd.java:620/624, and — when herdr answered —
@@ -635,6 +635,11 @@ public final class ConfigRef implements Supplier<FleetConfig> {
                     + "live through that same supplier for placement AND through a separate supplier "
                     + "on MemberRegistry for spawn-time identity — both already applied");
         }
+        if (!Objects.equals(collaboratorsOf(old), collaboratorsOf(fresh))) {
+            changed.add("fleet: fleet.collaborators (each collaborator's tab) is read once at "
+                    + "startup to build the LeadTabScanner's identity map, which is not rebuilt on "
+                    + "reload, so a collaborator added, removed, or given a new tab: needs a restart");
+        }
         // Kept in step with SPLIT_KEYS the same way changedColdKeys is kept in step with COLD_KEYS —
         // every message here must be traceable to one of the split keys the class doc documents.
         // NOTE what this does NOT prove, per the javadoc above: it does not catch a SPLIT_KEYS
@@ -650,6 +655,11 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         return cfg.fleet() == null ? Map.of() : cfg.fleet().leaders();
     }
 
+    /** {@code cfg.fleet().collaborators()}, defensively, in case a caller hands in a non-defaulted config. */
+    private static Map<String, FleetConfig.Collaborator> collaboratorsOf(FleetConfig cfg) {
+        return cfg.fleet() == null ? Map.of() : cfg.fleet().collaborators();
+    }
+
     /**
      * {@link FleetConfig.Profile} record components deliberately left out of
      * {@link #sameLaunchSettings} because they are read <em>live</em>, not baked in at spawn — see

fleetd/src/test/java/dev/ltms/fleet/FleetDeliverabilityTest.java

@@ -14,10 +14,12 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
  * CB-534: the injector's readiness gate must open for a lead as well as for a present worker.
+ * fleetd #669 follow-up: the same gate must also open for a collaborator, which — like a lead —
+ * is never enrolled in {@link MemberPresence} and never discovered by the lead scan.
  *
- * <p>The bug these cover was silent and slow: a lead was never marked present (only workers are), so
- * every lead→lead delivery sat on the gate for the full readiness grace and failed ~60s later without
- * a keystroke ever reaching the pane.
+ * <p>The bug these cover was silent and slow: a lead (and later a collaborator) was never marked
+ * present (only workers are) and never counted as a lead, so every send to one sat on the gate for
+ * the full readiness grace and failed ~60s later without a keystroke ever reaching the pane.
  */
 class FleetDeliverabilityTest {
 
@@ -25,19 +27,25 @@ class FleetDeliverabilityTest {
         return () -> m;
     }
 
+    private static Supplier<Map<String, String>> collaborators(Map<String, String> m) {
+        return () -> m;
+    }
+
     @Test
     @DisplayName("a worker that has connected its MCP is deliverable")
     void presentWorkerIsDeliverable() {
         MemberPresence presence = new MemberPresence();
         presence.markPresent("term_worker");
 
-        assertTrue(Fleetd.deliverableTo(presence, leads(Map.of())).test("term_worker"));
+        assertTrue(Fleetd.deliverableTo(presence, leads(Map.of()), collaborators(Map.of()))
+                .test("term_worker"));
     }
 
     @Test
     @DisplayName("a worker still in its boot window is held back")
     void absentWorkerIsNotDeliverable() {
-        assertFalse(Fleetd.deliverableTo(new MemberPresence(), leads(Map.of())).test("term_booting"));
+        assertFalse(Fleetd.deliverableTo(new MemberPresence(), leads(Map.of()), collaborators(Map.of()))
+                .test("term_booting"));
     }
 
     @Test
@@ -45,19 +53,31 @@ class FleetDeliverabilityTest {
     void leadIsDeliverableWithoutPresence() {
         MemberPresence presence = new MemberPresence();
         Predicate<String> deliverable =
-                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));
+                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")), collaborators(Map.of()));
 
         assertFalse(presence.isPresent("term_lead"), "a lead is never enrolled in worker presence");
         assertTrue(deliverable.test("term_lead"), "…and must be deliverable anyway");
     }
 
     @Test
-    @DisplayName("an unknown terminal is deliverable to neither")
+    @DisplayName("a collaborator is deliverable without ever being marked present or scanned as a lead")
+    void collaboratorIsDeliverableWithoutPresenceOrLeadStatus() {
+        MemberPresence presence = new MemberPresence();
+        Predicate<String> deliverable = Fleetd.deliverableTo(presence, leads(Map.of()),
+                collaborators(Map.of("term_collab", "kevin")));
+
+        assertFalse(presence.isPresent("term_collab"), "a collaborator is never enrolled in worker presence");
+        assertTrue(deliverable.test("term_collab"), "…and must be deliverable anyway");
+    }
+
+    @Test
+    @DisplayName("an unknown terminal is deliverable to none of presence, leads, or collaborators")
     void strangerIsNotDeliverable() {
         MemberPresence presence = new MemberPresence();
         presence.markPresent("term_worker");
 
-        assertFalse(Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")))
+        assertFalse(Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")),
+                        collaborators(Map.of("term_collab", "kevin")))
                 .test("term_stranger"));
     }
 
@@ -65,22 +85,47 @@ class FleetDeliverabilityTest {
     @DisplayName("a lead discovered after startup becomes deliverable with no restart")
     void leadSetIsReadThroughOnEveryCall() {
         Map<String, String> discovered = new HashMap<>();
-        Predicate<String> deliverable = Fleetd.deliverableTo(new MemberPresence(), leads(discovered));
+        Predicate<String> deliverable =
+                Fleetd.deliverableTo(new MemberPresence(), leads(discovered), collaborators(Map.of()));
 
         assertFalse(deliverable.test("term_late"));
         discovered.put("term_late", "gpt-sol-5.6"); // leadScan picks up a newly labelled tab
         assertTrue(deliverable.test("term_late"), "the supplier must be re-read, not snapshotted");
     }
 
+    @Test
+    @DisplayName("a collaborator discovered after startup becomes deliverable with no restart")
+    void collaboratorSetIsReadThroughOnEveryCall() {
+        Map<String, String> discovered = new HashMap<>();
+        Predicate<String> deliverable =
+                Fleetd.deliverableTo(new MemberPresence(), leads(Map.of()), collaborators(discovered));
+
+        assertFalse(deliverable.test("term_late_collab"));
+        discovered.put("term_late_collab", "kevin"); // the same tab scan picks up a newly labelled collaborator tab
+        assertTrue(deliverable.test("term_late_collab"), "the supplier must be re-read, not snapshotted");
+    }
+
     @Test
     @DisplayName("forgetting a torn-down worker does not strip a lead of its deliverability")
     void forgetDoesNotDisarmALead() {
         MemberPresence presence = new MemberPresence();
         Predicate<String> deliverable =
-                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));
+                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")), collaborators(Map.of()));
 
         presence.forget("term_lead"); // the injector's cleanup path runs against every target
 
         assertTrue(deliverable.test("term_lead"));
     }
+
+    @Test
+    @DisplayName("forgetting a torn-down worker does not strip a collaborator of its deliverability")
+    void forgetDoesNotDisarmACollaborator() {
+        MemberPresence presence = new MemberPresence();
+        Predicate<String> deliverable = Fleetd.deliverableTo(presence, leads(Map.of()),
+                collaborators(Map.of("term_collab", "kevin")));
+
+        presence.forget("term_collab"); // the injector's cleanup path runs against every target
+
+        assertTrue(deliverable.test("term_collab"));
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyLeadTabScannerExclusionTest.java

@@ -31,8 +31,7 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
  * fleetd #670 — pins the {@code excludedWorkspaceLabels} argument {@link FleetdAssembly}'s
- * production boot path passes to {@link LeadTabScanner} at {@code FleetdAssembly.java:265}
- * ({@code Set.of()}).
+ * production boot path passes to {@link LeadTabScanner} ({@code Set.of()}).
  *
  * <p>{@code LeadTabScannerTest} already covers this constructor parameter, but it builds its own
  * {@link LeadTabScanner} with its own set, so it tests the seam and proves nothing about the
@@ -191,7 +190,7 @@ class FleetdAssemblyLeadTabScannerExclusionTest {
             Set<?> excluded = (Set<?>) excludedField.get(leads);
 
             assertTrue(excluded.isEmpty(),
-                    "FleetdAssembly.java:265 must pass an empty excludedWorkspaceLabels to "
+                    "FleetdAssembly must pass an empty excludedWorkspaceLabels to "
                             + "LeadTabScanner — scanning member tabs would demote the lead to a worker");
         } finally {
             assertNotNull(ports.shutdownHook, "control: assembly must capture its shutdown hook");

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTest.java

@@ -107,6 +107,8 @@ class ConfigRefTest {
 
         assertTrue(out.applied());
         assertTrue(out.deferred().isEmpty());
+        assertTrue(out.split().stream().noneMatch(s -> s.contains("fleet.collaborators")),
+                out.split().toString());
         assertEquals("new charter", ref.get().fleet().charterFor(
                 dev.ltms.fleet.peer.MemberRole.ARCHITECT));
     }
@@ -786,14 +788,100 @@ class ConfigRefTest {
         assertTrue(out.split().getFirst().startsWith("fleet:"), out.split().toString());
         assertTrue(out.split().getFirst().contains("restart"), out.split().toString());
         assertTrue(out.split().getFirst().contains("live"), out.split().toString());
+        assertTrue(out.split().stream().noneMatch(s -> s.contains("fleet.collaborators")),
+                out.split().toString());
         assertTrue(out.summary().contains("partially live"), out.summary());
         // The snapshot still carries the new value — the LeadTabScanner's identity map and
         // LeadLauncher's auto-launch are what wait for a restart; a reload rebuilds neither.
         assertEquals("lead: opus-b", ref.get().fleet().leaders().get("opus").tab());
     }
 
+    @Test
+    void addingAFleetCollaboratorIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        assertCollaboratorChangeIsReported(dir, """
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex"
+                """, "add a collaborator");
+    }
+
+    @Test
+    void removingAFleetCollaboratorIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex"
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("fleet: {}\n"));
+        assertCollaboratorSplit(ref.reload(), "remove a collaborator");
+    }
+
+    @Test
+    void changingAFleetCollaboratorTabIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex-a"
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex-b"
+                """));
+        assertCollaboratorSplit(ref.reload(), "change a collaborator tab");
+    }
+
+    @Test
+    void unchangedFleetCollaboratorsProduceNoSplitReport(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        String config = yaml("""
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collaborator: alex"
+                """);
+        Files.writeString(f, config);
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, config);
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.split().isEmpty(), out.split().toString());
+    }
+
+    private static void assertCollaboratorChangeIsReported(Path dir, String changed, String action)
+            throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("fleet: {}\n"));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml(changed));
+        assertCollaboratorSplit(ref.reload(), action);
+    }
+
+    private static void assertCollaboratorSplit(ConfigRef.Outcome out, String action) {
+        assertTrue(out.applied(), action);
+        assertTrue(out.deferred().isEmpty(), out.deferred().toString());
+        assertEquals(1, out.split().size(), out.split().toString());
+        String report = out.split().getFirst();
+        assertTrue(report.startsWith("fleet: fleet.collaborators"), report);
+        assertTrue(report.contains("read once at startup"), report);
+        assertTrue(report.contains("restart"), report);
+    }
+
     /**
-     * fleetd #333: {@code fleet.leaders} is the ONLY frozen part of {@code fleet:}. A reload that
+     * fleetd #333: {@code fleet.leaders} is a frozen part of {@code fleet:}. A reload that
      * changes {@code tabLabel} (or charters, or a role pool) without touching {@code fleet.leaders}
      * must stay fully hot with nothing reported — proving {@link ConfigRef#changedSplitKeys}
      * compares {@code fleet.leaders} specifically rather than the whole {@code Fleet} record, which

fleetd/src/test/java/dev/ltms/fleet/herdr/LeadTabScannerTest.java

@@ -205,9 +205,12 @@ class LeadTabScannerTest {
     }
 
     /**
-     * The guard that matters: fleetd labels its own worker tabs, so if a worker space were scanned
-     * a naming accident would promote the fleet. The exclusion is by workspace, not by hoping the
-     * worker template never collides.
+     * Covers the {@code excludedWorkspaceLabels} parameter: a tab in an excluded workspace is never
+     * matched, whatever its label. Production always constructs this class with an empty set (CB-558,
+     * {@code FleetdAssembly}), so this parameter plays no part in the live guard against a worker
+     * tab being mistaken for a lead — that guard is {@code CallerResolver} asking the live
+     * spawned-member roster before any tab map. This test exists because the parameter still exists
+     * and is worth covering on its own terms.
      */
     @Test
     void aTabInAWorkerSpaceIsNeverALeadEvenWhenItsLabelMatches() {
@@ -219,6 +222,29 @@ class LeadTabScannerTest {
         assertFalse(scanner(herdr, tabToName, new AtomicLong()).get().containsKey("term_impostor"));
     }
 
+    /**
+     * The shipped shape (CB-558, {@code FleetdAssembly}): production always constructs this class
+     * with an empty {@code excludedWorkspaceLabels}, and a lead's {@code workspace:} default is the
+     * same shared {@code "fleet"} space the members use. A lead tab is still found when it sits in
+     * the exact same workspace as a member-labelled tab — the scanner tells them apart by the exact
+     * tab label, not by which workspace either one is in.
+     */
+    @Test
+    void aLeadIsDiscoveredWhenItsWorkspaceIsTheSameAsTheMemberWorkspace() {
+        TopologyHerdr herdr = new TopologyHerdr()
+                .workspace("w1", "fleet")
+                .tab("w1:t1", "w1", "lead: opus-5.0")
+                .tab("w1:t2", "w1", "worker: gx10 #1")
+                .pane("w1:p1", "w1:t1", "term_opus")
+                .pane("w1:p2", "w1:t2", "term_worker");
+        LeadTabScanner s = new LeadTabScanner(herdr, Map.of("lead: opus-5.0", "opus-5.0"),
+                Set.of(), TTL, new AtomicLong()::get);
+
+        assertEquals("opus-5.0", s.get().get("term_opus"),
+                "a lead sharing the members' workspace is still discovered — the label, not the "
+                        + "workspace, is what matches it");
+    }
+
     @Test
     void aLabelWithNoConfiguredEntryIsIgnored() {
         TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")