fleetd #669 Unit D correction: confirm live slot role before granting a spawned architect

The new spawned-member roster step returned Principal.architect from the roster's
own MemberRole.ARCHITECT alone, never reconfirming against memberSlotRoles. A slot
revoked after the bind kept granting ARCHITECT to the already-bound session,
regressing fleetd #424's "config governs what a bound slot still grants" half. The
roster now only answers that the pane is a live spawned member; a confirmed live
slot role still decides whether that grants ARCHITECT, falling through to WORKER
otherwise — mirroring the existing architect-slot step a few lines below.

Also corrects LeadTabScanner.buildTabIndex's javadoc: a colliding lead/collaborator
key resolves to the lead because the lead entry is put last (overwriting), not
because it is put first.

fleetd/fleetd.example.yaml

@@ -669,6 +669,15 @@ fleet:
   #     kind: opencode
   #     model: openai/gpt-5.6-terra
 
+  # A collaborator tab, keyed by name (fleetd #669). This block is parsed and validated today;
+  # nothing yet recognises or addresses the tab it names. Recognise-only, like a profile-less
+  # `leaders:` entry above: there is no `profile:`, no `instances:` and no `kind:`. `tab:` is
+  # REQUIRED and is the only field identity depends on, matched case-insensitively — the same
+  # GET-THE-VALUE-RIGHT warning above the `leaders:` block applies here too.
+  # collaborators:
+  #   reviewer-alex:
+  #     tab: "collab: alex"
+
   # architects:
   #   architect-1:
   #     profile: opus                # a strong model, on the operator's subscription

fleetd/src/main/java/dev/ltms/fleet/FleetdAssembly.java

@@ -43,6 +43,7 @@ import dev.ltms.fleet.msg.MessageService;
 import dev.ltms.fleet.msg.Rendezvous;
 import dev.ltms.fleet.msg.ReplyInbox;
 import dev.ltms.fleet.msg.ReplyPushLoop;
+import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerLauncher;
 import dev.ltms.fleet.placement.BackendOutagePolicy;
 import dev.ltms.fleet.placement.BackendQuarantine;
@@ -50,6 +51,7 @@ import dev.ltms.fleet.power.CaffeinateSleepAssertionMechanism;
 import dev.ltms.fleet.power.IdleSleepGuard;
 import dev.ltms.fleet.rest.FleetApp;
 import dev.ltms.fleet.session.GitWorktrees;
+import dev.ltms.fleet.session.MemberSession;
 import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.session.SessionReaper;
 import io.javalin.Javalin;
@@ -250,24 +252,44 @@ final class FleetdAssembly {
             log.info("leads: {} panes recognised {}", leadTerminals.size(), leadTerminals.values());
         }
         // CB-531/CB-579: discover leads by the tab labels the operator writes, one scanner per
-        // configured lead's own exact `tab:` label.
+        // configured lead's own exact `tab:` label. fleetd #669: the same scan also recognises a
+        // configured collaborator's tab, so one herdr pass answers both.
         final Supplier<Map<String, String>> leads;
+        final Supplier<Map<String, String>> collaboratorTerminals;
         var leaders = cfg.fleet().leaders();
-        if (!leaders.isEmpty()) {
+        var collaboratorsConfig = cfg.fleet().collaborators();
+        if (!leaders.isEmpty() || !collaboratorsConfig.isEmpty()) {
             Map<String, String> tabToName = new LinkedHashMap<>();
             leaders.forEach((name, leader) -> {
                 if (leader != null && leader.tab() != null && !leader.tab().isBlank()) {
                     tabToName.put(leader.tab(), name);
                 }
             });
-            int scanIntervalSeconds = leaders.values().iterator().next().scanIntervalSeconds();
+            Map<String, String> collaboratorTabToName = new LinkedHashMap<>();
+            collaboratorsConfig.forEach((name, collaborator) -> {
+                if (collaborator != null && collaborator.tab() != null && !collaborator.tab().isBlank()) {
+                    collaboratorTabToName.put(collaborator.tab(), name);
+                }
+            });
+            // A collaborator-only fleet configures no `leaders:` entry to read a scan interval from
+            // — FleetConfig.Collaborator carries no scanIntervalSeconds of its own. Falling back to
+            // FleetConfig.Leader's own compact-constructor default keeps a collaborator-only
+            // deployment on the same rescan cadence as the default lead cadence, instead of
+            // inventing a second number for the same kind of scan.
+            int scanIntervalSeconds = leaders.isEmpty()
+                    ? 10
+                    : leaders.values().iterator().next().scanIntervalSeconds();
             // This must use the lead daemon: scanning member tabs would demote the lead to a worker.
-            leads = new LeadTabScanner(herdr, tabToName, Set.of(),
+            LeadTabScanner scanner = new LeadTabScanner(herdr, tabToName, collaboratorTabToName, Set.of(),
                     TimeUnit.SECONDS.toNanos(scanIntervalSeconds), ports.nanoClock());
-            log.info("lead scan: tabs {} host a lead (rescan every {}s, shared fleet space)",
-                    tabToName.keySet(), scanIntervalSeconds);
+            leads = scanner;
+            collaboratorTerminals = scanner::collaborators;
+            log.info("lead/collaborator scan: tabs {} host a lead, tabs {} host a collaborator "
+                            + "(rescan every {}s, shared fleet space)",
+                    tabToName.keySet(), collaboratorTabToName.keySet(), scanIntervalSeconds);
         } else {
             leads = () -> leadTerminals;
+            collaboratorTerminals = Map::of;
         }
         leadsRef.set(leads);
 
@@ -452,6 +474,15 @@ final class FleetdAssembly {
         ConnectionIdentity identity = new ConnectionIdentity(
                 new PaneLocator(herdr, memberHerdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
 
+        // fleetd #669 Unit D: a live spawned member resolves as its own role, whatever a tab map
+        // says about the same terminal — read from the roster meant for a hot path (SessionManager
+        // javadoc), never rosterResolved(), since resolve() runs on every request.
+        Function<String, MemberRole> spawnedMemberRole = terminal -> sessions.roster().stream()
+                .filter(s -> terminal.equals(s.terminalId()))
+                .map(MemberSession::role)
+                .findFirst()
+                .orElse(null);
+
         // CB-501: one resolver behind both entry paths. Worker identity still comes from the
         // connection and is never token-gated, so enabling token mode cannot lock the fleet out.
         final CallerResolver callers;
@@ -461,11 +492,13 @@ final class FleetdAssembly {
                 throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
                         + " is unset or empty — export it before starting fleetd");
             }
-            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
+            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members,
+                    spawnedMemberRole, collaboratorTerminals);
             log.info("auth: token mode (bearer required for non-worker callers, env {})",
                     cfg.auth().tokenEnv());
         } else {
-            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members);
+            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members,
+                    spawnedMemberRole, collaboratorTerminals);
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 

fleetd/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -1,5 +1,7 @@
 package dev.ltms.fleet.auth;
 
+import java.util.function.Predicate;
+
 /**
  * The authorization table (CB-505), stated once and enforced on both entry paths.
  *
@@ -20,16 +22,22 @@ public final class Authz {
         SPAWN,
         /** Tear a worker peer down. */
         STOP,
-        /** Deliver a turn to a session (or answer a worker's question). */
+        /** Deliver a turn to a local session, addressed by {@code sessionId}. */
         SEND,
+        /** Resolve a worker's blocked question and resume its turn, addressed by {@code turnId}. */
+        ANSWER,
+        /** Address a peer lead on another daemon over the coordination broker, by {@code coordId}. */
+        COORD_SEND,
         /** A worker's terminal reply for its own turn. */
         REPLY,
         /** A worker's mid-turn question to the primary. */
         ASK,
         /** Collect held replies from a session's inbox. */
         DRAIN,
-        /** Read-only observation: status, roster, profiles, task polling. */
+        /** Read-only roster, profile, and identity observation: no ticket, task, or turn state. */
         READ,
+        /** Poll a ticket, or read a session's status. */
+        TASK_READ,
         /**
          * Read (never ack) this daemon's own held lead-to-lead coordination mail (fleetd #421).
          *
@@ -54,43 +62,92 @@ public final class Authz {
     }
 
     /**
-     * Whether {@code caller} may perform {@code action} against {@code targetSession}.
-     *
-     * @param targetSession the session id in the request path; only consulted for the worker-scoped
-     *                      actions ({@code REPLY}, {@code ASK}), ignored otherwise, may be
-     *                      {@code null}
+     * The fail-closed classifier: answers no for every target, so a collaborator's {@code SEND}
+     * is refused unless a caller supplies a real one. {@code CallerResolver#knownLeadOrCollaborator()}
+     * is the real one, read from the same lead and collaborator maps {@code CallerResolver#resolve}
+     * consults, so a target that classifier calls known is one {@code resolve} would actually
+     * resolve as a lead or collaborator.
+     */
+    public static final Predicate<String> NO_KNOWN_LEAD_OR_COLLABORATOR = target -> false;
+
+    /**
+     * Convenience form for a caller with no classifier to supply. Fails closed: a collaborator's
+     * {@code SEND} is refused, as if no terminal were a configured lead or collaborator — the
+     * same decision {@link #NO_KNOWN_LEAD_OR_COLLABORATOR} gives explicitly. Every other action's
+     * result is identical to the four-argument form's, since none of them consult the classifier.
      */
     public static boolean permits(Principal caller, Action action, String targetSession) {
+        return permits(caller, action, targetSession, NO_KNOWN_LEAD_OR_COLLABORATOR);
+    }
+
+    /**
+     * Whether {@code caller} may perform {@code action} against {@code targetSession}.
+     *
+     * @param targetSession           the session id in the request path; only consulted for the
+     *                                worker-scoped actions ({@code REPLY}, {@code ASK}) and for a
+     *                                collaborator's {@code SEND}, ignored otherwise, may be
+     *                                {@code null}
+     * @param knownLeadOrCollaborator whether a terminal is a configured lead or collaborator —
+     *                                consulted only for a collaborator's {@code SEND}, to confine
+     *                                it to another named peer and never a spawned member's
+     *                                terminal
+     */
+    public static boolean permits(Principal caller, Action action, String targetSession,
+                                   Predicate<String> knownLeadOrCollaborator) {
         if (caller == null || caller.isAnonymous()) {
             return false; // authenticated as nothing ⇒ authorized for nothing
         }
         return switch (action) {
-            // Fleet lifecycle is the primary's alone — spawn, stop, drain. An architect
-            // deliberately does NOT get these (CB-548), so it cannot tear down or stand up workers
-            // even though it coordinates them; and a worker driving any of these would be a worker
-            // escalating into the orchestrator role.
+            // Fleet lifecycle is the primary's alone — spawn, stop, drain. An architect and a
+            // collaborator deliberately do NOT get these, so neither can tear down or stand up
+            // workers even though one of them coordinates them; and a worker driving any of these
+            // would be a worker escalating into the orchestrator role.
             case SPAWN, STOP, DRAIN, HANDOVER -> caller.isPrimary();
 
-            // Delivering a turn is open to the primary and the architect: an architect delegates
-            // to workers (that is the role's point) but still has no lifecycle rights. A worker is
-            // excluded — sending would be it escalating.
-            case SEND -> caller.isPrimary() || caller.isArchitect();
+            // Delivering a turn to a local session is open to the primary, the architect, and a
+            // collaborator whose target is itself a configured lead or collaborator: the architect
+            // delegates to workers (that is the role's point); a collaborator may reach only
+            // another named peer, never a spawned member's terminal. A worker is excluded —
+            // sending would be it escalating.
+            case SEND -> caller.isPrimary() || caller.isArchitect()
+                    || (caller.isCollaborator() && knownLeadOrCollaborator.test(targetSession));
+
+            // Resolving a worker's blocked question is part of delegating to it, open to the same
+            // two roles that may stand up that delegation in the first place. Not a collaborator:
+            // resuming another session's turn is lifecycle-adjacent, not peer messaging.
+            case ANSWER -> caller.isPrimary() || caller.isArchitect();
+
+            // Leaves the daemon over the coordination broker rather than addressing a local
+            // session, open to the same two roles as ANSWER. Not a collaborator: it is a
+            // local-tab peer with no cross-host route.
+            case COORD_SEND -> caller.isPrimary() || caller.isArchitect();
 
             // The load-bearing rule: a caller acts only as the pane it occupies. CB-532 widened who
             // that can be — a lead answering another lead is replying for its OWN terminal, which
             // this already permits — while the rule itself is unchanged, and is what stops anyone
-            // forging a reply for a rendezvous someone else is waiting on. An architect's own pane
-            // passes through the same check, so it can answer a funnel that delegated to it. An
-            // unnamed primary (token/loopback, no pane) owns nothing and is still excluded.
+            // forging a reply for a rendezvous someone else is waiting on. An architect's or a
+            // collaborator's own pane passes through the same check, so each can answer a funnel
+            // that delegated to it. An unnamed primary (token/loopback, no pane) owns nothing and
+            // is still excluded.
             case REPLY, ASK -> caller.ownsSession(targetSession);
 
-            // Observation is open to every authenticated role: a worker legitimately polls its own
-            // status, and the roster carries no secrets.
-            case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
+            // READ is roster, profile, and identity observation — fleet_list, fleet_profiles, and
+            // fleet_whoami — and carries no secrets: no ticket reply, no pending question, and no
+            // other session's turn state. Those live under TASK_READ. METRICS is the separate
+            // Prometheus scrape. Both are open to every authenticated role, including a
+            // collaborator.
+            case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect()
+                    || caller.isCollaborator();
+
+            // Ticket polling and session status, open to every role READ is open to except a
+            // collaborator: ticket ids are a sequential counter with no owner check, so a holder
+            // could walk every ticket and read another session's delegation reply.
+            case TASK_READ -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
 
             // fleetd #421: reading held lead-to-lead mail is the primary's alone. An architect
             // holds READ today (CB-548), so "not primary" must mean not-architect here too — this
-            // is coordination between leads, not observation of the roster.
+            // is coordination between leads, not observation of the roster. The same reasoning
+            // excludes a collaborator.
             case COORD_READ -> caller.isPrimary();
         };
     }

fleetd/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -7,6 +7,7 @@ import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.util.Map;
 import java.util.function.Function;
+import java.util.function.Predicate;
 import java.util.function.Supplier;
 
 /**
@@ -19,6 +20,13 @@ import java.util.function.Supplier;
  *
  * <p><strong>Resolution order</strong> — connection identity first, token second, nothing third:
  * <ol>
+ *   <li>A loopback peer PID that maps to a pane this gateway itself spawned ⇒ that member's own
+ *       role: {@link Role#WORKER} for a dev, hunter, or reviewer; {@link Role#ARCHITECT} for an
+ *       architect, but only while the live slot role still confirms it (fleetd #424 — a slot
+ *       revoked from config demotes an already-bound session on its very next request, so the
+ *       roster's own role is never granted on its word alone). No tab map is consulted — a live
+ *       spawned member's identity comes from the registry that spawned it, never from a label a
+ *       pane could also carry.</li>
  *   <li>A loopback peer PID that maps to a pane named by {@code leaders:}, by the legacy
  *       {@code primary.terminal} pin, or by an operator-labelled lead tab (CB-307, CB-530, CB-531)
  *       ⇒ {@link Role#PRIMARY}, carrying that lead's
@@ -28,8 +36,10 @@ import java.util.function.Supplier;
  *       so two leads can work as peers rather than one being demoted.</li>
  *   <li>A loopback peer PID that maps to a pane bound to a CB-548 architect slot ⇒
  *       {@link Role#ARCHITECT}, carrying the slot name. Just unforgeable as a worker's, and
- *       resolved from the <em>live</em> terminal→slot binding (never a request argument), before
- *       the generic worker fallback.</li>
+ *       resolved from the <em>live</em> terminal→slot binding (never a request argument). This is
+ *       the case the previous step does not catch: a binding with no live spawned-member session.</li>
+ *   <li>A loopback peer PID that maps to an operator-labelled collaborator tab ⇒
+ *       {@link Role#COLLABORATOR}, carrying that collaborator's name.</li>
  *   <li>A loopback peer PID that maps to any other herdr pane ⇒ {@link Role#WORKER}. This is
  *       unforgeable (the OS reports the PID, herdr owns the PID→pane map) and is honoured
  *       regardless of auth mode, so enabling auth never breaks the fleet.</li>
@@ -64,6 +74,20 @@ public final class CallerResolver {
     private final Supplier<Map<String, String>> architectTerminals;
     private final Function<String, MemberRole> memberSlotRoles;
     private final Function<String, String> memberSlotNames;
+    /**
+     * terminal_id → the role of the live spawned member occupying it, or {@code null} for a
+     * terminal no spawned member occupies. Consulted first, ahead of every tab map: a live
+     * spawned member's identity is its own, whatever a tab map says about the same terminal.
+     * A function rather than the roster itself, so a resolve on the hot path never scans a list —
+     * the lookup strategy is the caller's to choose.
+     */
+    private final Function<String, MemberRole> spawnedMemberRole;
+    /**
+     * terminal_id → collaborator name; empty when none are configured. A supplier for the same
+     * reason as {@link #leadTerminals}: a collaborator tab recognised after construction (the tab
+     * scan discovering a newly-labelled tab) takes effect without a restart.
+     */
+    private final Supplier<Map<String, String>> collaboratorTerminals;
 
     /** Loopback-trust resolver: no token required, historical behaviour. Test-only. */
     CallerResolver(ConnectionIdentity identity) {
@@ -124,17 +148,42 @@ public final class CallerResolver {
     /**
      * Live registry form that can confirm a bound slot is an architect slot.
      *
-     * <p>This is the only public construction path. It keeps terminal bindings and slot roles in
-     * the same {@link MemberRegistry}, so a configured architect can resolve as an architect.
+     * <p>It keeps terminal bindings and slot roles in the same {@link MemberRegistry}, so a
+     * configured architect can resolve as an architect. No spawned-member roster or collaborator
+     * registry is consulted — equivalent to {@link #withLeadsAndMembers(ConnectionIdentity,
+     * boolean, String, Supplier, MemberRegistry, Function, Supplier)} with both absent. Kept for
+     * every caller that has neither to offer, so adding them did not churn every construction site.
      */
     public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
                                                        boolean tokenMode, String token,
                                                        Supplier<Map<String, String>> leadTerminals,
                                                        MemberRegistry members) {
+        return withLeadsAndMembers(identity, tokenMode, token, leadTerminals, members, null, null);
+    }
+
+    /**
+     * Live registry form that also resolves a live spawned member to its own role, and a
+     * configured collaborator tab to {@link Role#COLLABORATOR}.
+     *
+     * <p>This is the only public construction path that exercises the full resolution order.
+     *
+     * @param spawnedMemberRole      terminal_id → the role of the live spawned member occupying
+     *                               it, or {@code null} for a terminal no spawned member occupies.
+     *                               {@code null} here means no roster is consulted at all (every
+     *                               terminal falls through to the tab maps), not that none matches.
+     * @param collaboratorTerminals  terminal_id → collaborator name, live like {@code leadTerminals}
+     */
+    public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
+                                                       boolean tokenMode, String token,
+                                                       Supplier<Map<String, String>> leadTerminals,
+                                                       MemberRegistry members,
+                                                       Function<String, MemberRole> spawnedMemberRole,
+                                                       Supplier<Map<String, String>> collaboratorTerminals) {
         return new CallerResolver(identity, tokenMode, token, leadTerminals,
                 members == null ? null : members::snapshot,
                 members == null ? null : members::roleForSlot,
-                members == null ? null : members::nameForSlot);
+                members == null ? null : members::nameForSlot,
+                spawnedMemberRole, collaboratorTerminals);
     }
 
     private static Supplier<Map<String, String>> fixed(Map<String, String> leadTerminals) {
@@ -160,6 +209,17 @@ public final class CallerResolver {
                            Supplier<Map<String, String>> architectTerminals,
                            Function<String, MemberRole> memberSlotRoles,
                            Function<String, String> memberSlotNames) {
+        this(identity, tokenMode, token, leadTerminals, architectTerminals, memberSlotRoles,
+                memberSlotNames, null, null);
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals,
+                           Function<String, MemberRole> memberSlotRoles,
+                           Function<String, String> memberSlotNames,
+                           Function<String, MemberRole> spawnedMemberRole,
+                           Supplier<Map<String, String>> collaboratorTerminals) {
         if (tokenMode && (token == null || token.isBlank())) {
             throw new IllegalArgumentException(
                     "auth.mode=token requires a non-empty token; check that the env var named by "
@@ -172,6 +232,8 @@ public final class CallerResolver {
         this.architectTerminals = architectTerminals == null ? Map::of : architectTerminals;
         this.memberSlotRoles = memberSlotRoles == null ? _ -> null : memberSlotRoles;
         this.memberSlotNames = memberSlotNames == null ? Function.identity() : memberSlotNames;
+        this.spawnedMemberRole = spawnedMemberRole == null ? _ -> null : spawnedMemberRole;
+        this.collaboratorTerminals = collaboratorTerminals == null ? Map::of : collaboratorTerminals;
     }
 
     /**
@@ -198,6 +260,27 @@ public final class CallerResolver {
         return architectTerminals.get();
     }
 
+    /**
+     * The currently-recognised collaborator tabs, {@code terminal_id → name}.
+     *
+     * <p>Read from the same supplier {@link #resolve} consults, for the reason given in
+     * {@link #leads()}. Live for the same reason as {@link #leads()}.
+     */
+    public Map<String, String> collaborators() {
+        return collaboratorTerminals.get();
+    }
+
+    /**
+     * Whether {@code target} names a terminal this resolver would resolve as a lead or a
+     * collaborator — the classifier a collaborator's {@code SEND} is checked against, read from the
+     * exact maps {@link #resolve} consults so a target that would resolve as a lead or collaborator
+     * is never the one a collaborator is refused to reach, or the reverse.
+     */
+    public Predicate<String> knownLeadOrCollaborator() {
+        return target -> leadTerminals.get().containsKey(target)
+                || collaboratorTerminals.get().containsKey(target);
+    }
+
     /**
      * Resolve the caller of a request.
      *
@@ -208,6 +291,25 @@ public final class CallerResolver {
     public Principal resolve(String remoteAddr, int remotePort, String authorizationHeader) {
         ConnectionIdentity.Caller c = identity.resolve(remoteAddr, remotePort);
         if (c.terminal() != null) {
+            MemberRole spawnedRole = spawnedMemberRole.apply(c.terminal());
+            if (spawnedRole != null) {
+                // A live spawned member occupies this pane. Its identity is its own, whatever a tab
+                // map says about the same terminal — checked before every tab map, consulting none
+                // of them, so a tab label can never override a roster entry for the same terminal.
+                if (spawnedRole == MemberRole.ARCHITECT) {
+                    // The roster only answers THAT this pane is a live spawned member; config still
+                    // decides WHAT that member's slot grants (fleetd #424). A slot revoked after the
+                    // bind must still demote this session on its very next request, so the roster's
+                    // own ARCHITECT role is confirmed against the live slot role, exactly as the
+                    // architect-slot step below confirms a binding with no live member session.
+                    String slot = architectTerminals.get().get(c.terminal());
+                    if (slot != null && memberSlotRoles.apply(slot) == MemberRole.ARCHITECT) {
+                        return Principal.architect(memberSlotNames.apply(slot), c.terminal(), c.pid());
+                    }
+                    return Principal.worker(c.terminal(), c.pid());
+                }
+                return Principal.worker(c.terminal(), c.pid());
+            }
             String lead = leadTerminals.get().get(c.terminal());
             if (lead != null) {
                 // The config names this pane as a lead's own. The pane mapping is exactly as
@@ -221,10 +323,17 @@ public final class CallerResolver {
                 // The config/live binding names this pane as an architect slot's own. Same
                 // unforgeable pane mapping; the live binding, never a request argument, decides.
                 // Check the slot role too: this defence in depth prevents a bad lifecycle bind from
-                // escalating a dev, hunter or reviewer into an architect. Checked before
-                // the worker fallback.
+                // escalating a dev, hunter or reviewer into an architect. This is the case the
+                // spawned-member step above does not catch: a binding with no live member session.
                 return Principal.architect(memberSlotNames.apply(slot), c.terminal(), c.pid());
             }
+            String collaborator = collaboratorTerminals.get().get(c.terminal());
+            if (collaborator != null) {
+                // An operator-labelled collaborator tab, confirmed live by the same scan that
+                // confirms a lead tab. Checked last among the tab maps so a pane also matching one
+                // of the above keeps that stronger role.
+                return Principal.collaborator(collaborator, c.terminal(), c.pid());
+            }
             return Principal.worker(c.terminal(), c.pid()); // unforgeable; never token-gated
         }
 

fleetd/src/main/java/dev/ltms/fleet/auth/Principal.java

@@ -11,7 +11,9 @@ package dev.ltms.fleet.auth;
  * @param pid      the connecting process id, or {@code -1} when not resolvable (audit context)
  * @param name     for a lead resolved from the CB-530 {@code leaders:} registry, which lead it is;
  *                 for an architect resolved from the CB-548 {@code architects:} registry, which
- *                 slot it occupies; {@code null} for every other caller, including an unnamed primary
+ *                 slot it occupies; for a collaborator resolved from the {@code collaborators:}
+ *                 registry, which collaborator it is; {@code null} for every other caller,
+ *                 including an unnamed primary
  */
 public record Principal(Role role, String terminal, long pid, String name) {
 
@@ -73,6 +75,19 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return new Principal(Role.ARCHITECT, terminal, pid, slotName);
     }
 
+    /**
+     * A collaborator: a human-opened tab recognised by its exact label in the
+     * {@code collaborators:} registry.
+     *
+     * <p>Carries {@link Role#COLLABORATOR}. {@code name} is reporting only — it lets
+     * {@code fleet_whoami} say which collaborator is asking. Identity is the {@code terminal}:
+     * like a worker's it comes from the connection, so {@code ownsSession} works exactly as it
+     * does for a worker — a collaborator acts as its own pane and no other.
+     */
+    public static Principal collaborator(String name, String terminal, long pid) {
+        return new Principal(Role.COLLABORATOR, terminal, pid, name);
+    }
+
     public boolean isPrimary() {
         return role == Role.PRIMARY;
     }
@@ -81,6 +96,10 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return role == Role.ARCHITECT;
     }
 
+    public boolean isCollaborator() {
+        return role == Role.COLLABORATOR;
+    }
+
     public boolean isWorker() {
         return role == Role.WORKER;
     }
@@ -120,6 +139,7 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return switch (role) {
             case WORKER -> "worker:" + terminal;
             case ARCHITECT -> "architect:" + name;
+            case COLLABORATOR -> "collaborator:" + name;
             case PRIMARY -> name == null ? "primary" : "leader:" + name;
             case ANONYMOUS -> "anonymous";
         };

fleetd/src/main/java/dev/ltms/fleet/auth/Role.java

@@ -34,6 +34,17 @@ public enum Role {
      */
     ARCHITECT,
 
+    /**
+     * A config-declared, human-opened tab recognised by its exact label (the {@code
+     * fleet.collaborators.<name>.tab} registry). Never spawned — identity comes from the
+     * connection, never a request argument, exactly like {@link #WORKER} and {@link #ARCHITECT}.
+     * May {@code SEND} only to a configured lead or collaborator, {@code REPLY}/{@code ASK} only
+     * as its own pane, and {@code READ}/{@code METRICS}; may not {@code SPAWN}/{@code STOP}/
+     * {@code DRAIN}/{@code HANDOVER}, poll a ticket ({@code TASK_READ}), or reach the
+     * coordination broker ({@code COORD_SEND}/{@code COORD_READ}).
+     */
+    COLLABORATOR,
+
     /** Authenticated as nothing. Authorized for nothing but {@code /healthz}. */
     ANONYMOUS
 }

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -1129,11 +1129,8 @@ public record FleetConfig(
      *                            {@code tab} can never be discovered, launched or not
      * @param instances           how many of this lead should be live (default 1). The daemon
      *                            launches only the shortfall, so a restart adopts rather than doubles
-     * @param tabPrefix           no longer used to find a lead's tab — {@code tab} is matched
-     *                            exactly. Its only remaining job is the startup collision guard
-     *                            ({@link #validateLeadTabPrefixes()}), which still uses it to refuse
-     *                            a worker {@code tabLabel} template that could be misread as a lead.
-     *                            Default {@code "lead:"}
+     * @param tabPrefix           lead-tab naming convention checked against member labels. Lead
+     *                            identity uses {@code tab}. Default {@code "lead:"}
      * @param scanIntervalSeconds how long a tab scan is cached before herdr is asked again; also the
      *                            worst case before a newly-labelled tab is recognised. Default 10
      * @param kind                which agent runs there ({@code claude}, {@code opencode}, …)
@@ -1179,6 +1176,25 @@ public record FleetConfig(
         }
     }
 
+    /**
+     * A tab fleetd recognises as a collaborator, keyed by name (fleetd #669).
+     *
+     * <p>Recognise-only: there is no {@code profile}, no {@code instances} and no {@code kind}.
+     * Nothing here ever launches a pane.
+     *
+     * <p>{@code tabPrefix} is absent. Identity is matched on the exact {@code tab} alone.
+     *
+     * @param tab the exact tab label hosting this collaborator, matched case-insensitively; the
+     *            only field identity depends on. Required — an entry with no {@code tab} can
+     *            never be discovered.
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record Collaborator(String tab) {
+        public Collaborator {
+            tab = (tab == null || tab.isBlank()) ? null : tab.strip();
+        }
+    }
+
     /**
      * One entry of a {@code fleet:} role pool — a role paired with the backend it runs on.
      *
@@ -1216,15 +1232,18 @@ public record FleetConfig(
      * is exactly compatible with that. The pool is also what replaced {@code defaultProfile:} — an
      * unqualified spawn names a role, and the role's pool supplies the candidates.
      *
-     * @param leaders     panes that orchestrate rather than are orchestrated, keyed by lead name
-     * @param architects  profiles the {@code architect} role may run on
-     * @param developers  profiles the {@code dev} role may run on
-     * @param hunters     profiles the {@code hunter} role may run on
-     * @param reviewers   profiles the {@code reviewer} role may run on
-     * @param charters    optional launch-charter text keyed by singular role wire name
-     * @param tabLabel    template for a member tab's label; {@code {role}}, {@code {profile}},
-     *                    {@code {model}} and {@code {n}} (a per role+profile counter) are
-     *                    substituted. Default {@link #DEFAULT_TAB_LABEL}
+     * @param leaders       panes that orchestrate rather than are orchestrated, keyed by lead name
+     * @param architects    profiles the {@code architect} role may run on
+     * @param developers    profiles the {@code dev} role may run on
+     * @param hunters       profiles the {@code hunter} role may run on
+     * @param reviewers     profiles the {@code reviewer} role may run on
+     * @param charters      optional launch-charter text keyed by singular role wire name
+     * @param tabLabel      template for a member tab's label; {@code {role}}, {@code {profile}},
+     *                      {@code {model}} and {@code {n}} (a per role+profile counter) are
+     *                      substituted. Default {@link #DEFAULT_TAB_LABEL}
+     * @param collaborators tabs fleetd recognises as collaborators (fleetd #669), keyed by name.
+     *                      Recognise-only, exactly like a {@code profile}-less {@link Leader}:
+     *                      nothing here is ever auto-launched.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
     public record Fleet(Map<String, Leader> leaders,
@@ -1233,13 +1252,11 @@ public record FleetConfig(
                         Map<String, Slot> hunters,
                         Map<String, Slot> reviewers,
                         Map<String, String> charters,
-                        String tabLabel) {
+                        String tabLabel,
+                        Map<String, Collaborator> collaborators) {
 
         /**
-         * Role first, so the tab bar reads as the fleet and so the label shares a namespace with a
-         * lead's {@code tabPrefix}. Because {@code {role}} comes from a closed enum, a generated
-         * member label can never begin with {@code "lead:"} — the clash that
-         * {@link #validateLeadTabPrefixes()} used to have to check for is unrepresentable here.
+         * Role first, so the tab bar identifies the member's fleet role.
          */
         public static final String DEFAULT_TAB_LABEL = "{role}: {profile} #{n}";
 
@@ -1251,26 +1268,30 @@ public record FleetConfig(
             reviewers = unmodifiableOrEmpty(reviewers);
             charters = unmodifiableOrEmpty(charters);
             tabLabel = (tabLabel == null || tabLabel.isBlank()) ? DEFAULT_TAB_LABEL : tabLabel;
+            collaborators = unmodifiableOrEmpty(collaborators);
         }
 
         /**
-         * A fleet with no configured launch charters — the shape every deployment had before
-         * CB-566, and what most tests want.
+         * A fleet with no configured launch charters and no collaborators — the shape every
+         * deployment had before CB-566, and what most tests want.
          *
          * <p>Kept deliberately, even though an overload that drops a new field is normally the
          * shape to avoid. It is safe here because nothing <em>reads</em> a charter through a
          * constructor: the launcher reads {@code fleet.charters()} from the live config. Jackson
          * binds the canonical constructor, so this one cannot swallow an operator's YAML.
+         * {@code collaborators} is dropped the same way and for the same reason: no caller of
+         * this overload has ever needed to set it, so it defaults to empty here exactly as the
+         * canonical constructor would default an absent YAML key.
          */
         public Fleet(Map<String, Leader> leaders, Map<String, Slot> architects,
                      Map<String, Slot> developers, Map<String, Slot> reviewers,
                      Map<String, String> charters, String tabLabel) {
-            this(leaders, architects, developers, null, reviewers, charters, tabLabel);
+            this(leaders, architects, developers, null, reviewers, charters, tabLabel, null);
         }
 
         public Fleet(Map<String, Leader> leaders, Map<String, Slot> architects,
                      Map<String, Slot> developers, Map<String, Slot> reviewers, String tabLabel) {
-            this(leaders, architects, developers, null, reviewers, null, tabLabel);
+            this(leaders, architects, developers, null, reviewers, null, tabLabel, null);
         }
 
         /**
@@ -1916,7 +1937,7 @@ public record FleetConfig(
 
     /** The {@code fleet:} child blocks whose direct children are slot names. */
     private static final Set<String> FLEET_POOL_KEYS =
-            Set.of("leaders", "architects", "developers", "hunters", "reviewers");
+            Set.of("leaders", "architects", "developers", "hunters", "reviewers", "collaborators");
 
     /**
      * Reject a {@code fleet:} role pool whose slot names repeat (CB-548, re-homed by CB-557).
@@ -1926,7 +1947,7 @@ public record FleetConfig(
      * daemon would never know. Jackson's YAML parser does not fail on duplicate mapping keys by
      * default, so duplicates are caught here, at parse time, before the map is built.
      *
-     * <p>Only the five pools <em>directly under the top-level {@code fleet:}</em> are considered,
+     * <p>Only the six pools <em>directly under the top-level {@code fleet:}</em> are considered,
      * and only their direct child keys (the slot names). A nested field elsewhere, even one also
      * named {@code developers:}, is ignored, so parsing of the rest of the config is unaffected.
      *
@@ -2685,31 +2706,21 @@ public record FleetConfig(
     }
 
     /**
-     * Reject a lead-scan convention that a worker tab would also satisfy (CB-531).
+     * Reject a member tab-label template that could render as a configured lead or collaborator
+     * tab or match a lead-tab naming convention, and reject two {@code fleet.leaders} or
+     * {@code fleet.collaborators} entries — across either registry — that share one exact tab.
      *
-     * <p>The scan reads a tab label and concludes "a lead lives here". fleetd also <em>writes</em>
-     * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
-     * a member template matches and the daemon starts labelling its own members as leads, promoting
-     * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
-     * {@link #validatePanePlacementAgainstLeadTabs()} is the check that stops a pane-placed member
-     * from landing inside a lead's tab in the first place; this check is a second, independent
-     * guard that catches the hazard even when every profile places members correctly, by refusing
-     * a label that a scan would still misread as a lead.
+     * <p>{@code fleet.collaborators} has no {@code tabPrefix}: identity is matched on the exact
+     * {@code tab} alone, so only the exact-render check applies there, not the prefix check.
      *
-     * <p>CB-557 shrank this check rather than removing it. The default template is
-     * {@code "{role}: {profile} #{n}"} and {@code {role}} comes from a closed enum, so a
-     * <em>generated</em> label can no longer collide by construction. What remains checkable is what
-     * an operator still writes by hand: the {@code fleet.tabLabel} template and any per-profile
-     * {@code tabLabel} override.
-     *
-     * <p>Fatal rather than a warning, unlike {@link #warnUnknownTopLevelKeys}: an unknown key means
-     * a feature does nothing, while this means a feature does the opposite of what it says.
-     *
-     * @throws IllegalStateException when the fleet template or any profile's {@code tabLabel}
-     *                               override starts with a configured lead prefix
+     * @throws IllegalStateException when the fleet template or a profile {@code tabLabel} override
+     *                               can render as a configured lead or collaborator tab or match a
+     *                               lead-tab prefix, or when two entries — of either registry, or
+     *                               one of each — carry the same exact {@code tab}
+     *                               (case-insensitively)
      */
     public void validateLeadTabPrefixes() {
-        if (fleet == null || fleet.leaders().isEmpty()) {
+        if (fleet == null) {
             return;
         }
         List<String> bad = new ArrayList<>();
@@ -2717,51 +2728,173 @@ public record FleetConfig(
             if (leader == null) {
                 return;
             }
+            String tab = leader.tab();
             String prefix = leader.tabPrefix();
-            // The fleet-wide template is checked once per prefix: it labels every member that has no
-            // override, so one bad template promotes the entire fleet, not one profile.
-            if (startsWithIgnoreCase(fleet.tabLabel(), prefix)) {
+            if (templateCanRenderAs(fleet.tabLabel(), tab)) {
+                bad.add("fleet.tabLabel=\"" + fleet.tabLabel() + "\" can render as the tab of "
+                        + "lead '" + leadName + "' (\"" + tab + "\")");
+            } else if (startsWithIgnoreCase(fleet.tabLabel(), prefix)) {
                 bad.add("fleet.tabLabel=\"" + fleet.tabLabel() + "\" starts with the tabPrefix of "
                         + "lead '" + leadName + "' (\"" + prefix + "\")");
             }
             profiles().entrySet().stream()
-                    .filter(e -> startsWithIgnoreCase(e.getValue().tabLabel(), prefix))
                     .map(Map.Entry::getKey)
                     .sorted()
-                    .forEach(p -> bad.add("profile '" + p + "' overrides tabLabel with \""
-                            + profiles().get(p).tabLabel() + "\", which starts with the tabPrefix of "
-                            + "lead '" + leadName + "' (\"" + prefix + "\")"));
+                    .forEach(p -> {
+                        String label = profiles().get(p).tabLabel();
+                        if (templateCanRenderAs(label, tab)) {
+                            bad.add("profile '" + p + "' overrides tabLabel with \"" + label
+                                    + "\", which can render as the tab of lead '" + leadName
+                                    + "' (\"" + tab + "\")");
+                        } else if (startsWithIgnoreCase(label, prefix)) {
+                            bad.add("profile '" + p + "' overrides tabLabel with \"" + label
+                                    + "\", which starts with the tabPrefix of lead '" + leadName
+                                    + "' (\"" + prefix + "\")");
+                        }
+                    });
         });
-        if (bad.isEmpty()) {
+        fleet.collaborators().forEach((collabName, collaborator) -> {
+            if (collaborator == null) {
+                return;
+            }
+            String tab = collaborator.tab();
+            if (templateCanRenderAs(fleet.tabLabel(), tab)) {
+                bad.add("fleet.tabLabel=\"" + fleet.tabLabel() + "\" can render as the tab of "
+                        + "collaborator '" + collabName + "' (\"" + tab + "\")");
+            }
+            profiles().entrySet().stream()
+                    .map(Map.Entry::getKey)
+                    .sorted()
+                    .forEach(p -> {
+                        String label = profiles().get(p).tabLabel();
+                        if (templateCanRenderAs(label, tab)) {
+                            bad.add("profile '" + p + "' overrides tabLabel with \"" + label
+                                    + "\", which can render as the tab of collaborator '"
+                                    + collabName + "' (\"" + tab + "\")");
+                        }
+                    });
+        });
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: " + String.join("; ", bad)
+                    + ". Every member labelled that way would be read back as a lead or "
+                    + "collaborator and granted that identity's authority. Change one of the two "
+                    + "so member tabs cannot be confused with a lead's or collaborator's tab.");
+        }
+
+        List<String> collisions = new ArrayList<>();
+        List<String> leadNames = fleet.leaders().keySet().stream().sorted().toList();
+        for (int i = 0; i < leadNames.size(); i++) {
+            String nameA = leadNames.get(i);
+            Leader a = fleet.leaders().get(nameA);
+            if (a == null || a.tab() == null || a.tab().isBlank()) {
+                continue;
+            }
+            for (int j = i + 1; j < leadNames.size(); j++) {
+                String nameB = leadNames.get(j);
+                Leader b = fleet.leaders().get(nameB);
+                if (b == null || b.tab() == null || b.tab().isBlank()) {
+                    continue;
+                }
+                if (a.tab().equalsIgnoreCase(b.tab())) {
+                    collisions.add("lead '" + nameA + "' and lead '" + nameB + "' both use tab \""
+                            + a.tab() + "\"");
+                }
+            }
+        }
+        List<String> collabNames = fleet.collaborators().keySet().stream().sorted().toList();
+        for (int i = 0; i < collabNames.size(); i++) {
+            String nameA = collabNames.get(i);
+            Collaborator a = fleet.collaborators().get(nameA);
+            if (a == null || a.tab() == null || a.tab().isBlank()) {
+                continue;
+            }
+            for (int j = i + 1; j < collabNames.size(); j++) {
+                String nameB = collabNames.get(j);
+                Collaborator b = fleet.collaborators().get(nameB);
+                if (b == null || b.tab() == null || b.tab().isBlank()) {
+                    continue;
+                }
+                if (a.tab().equalsIgnoreCase(b.tab())) {
+                    collisions.add("collaborator '" + nameA + "' and collaborator '" + nameB
+                            + "' both use tab \"" + a.tab() + "\"");
+                }
+            }
+        }
+        for (String leadName : leadNames) {
+            Leader lead = fleet.leaders().get(leadName);
+            if (lead == null || lead.tab() == null || lead.tab().isBlank()) {
+                continue;
+            }
+            for (String collabName : collabNames) {
+                Collaborator collaborator = fleet.collaborators().get(collabName);
+                if (collaborator == null || collaborator.tab() == null
+                        || collaborator.tab().isBlank()) {
+                    continue;
+                }
+                if (lead.tab().equalsIgnoreCase(collaborator.tab())) {
+                    collisions.add("lead '" + leadName + "' and collaborator '" + collabName
+                            + "' both use tab \"" + lead.tab() + "\"");
+                }
+            }
+        }
+        if (collisions.isEmpty()) {
             return;
         }
-        throw new IllegalStateException("refusing to start: " + String.join("; ", bad)
-                + ". Every member labelled that way would be read back as a lead and granted "
-                + "spawn/stop/send on the whole fleet. Change one of the two so member tabs and "
-                + "lead tabs cannot be confused.");
+        throw new IllegalStateException("refusing to start: " + String.join("; ", collisions)
+                + ". Tab identity is matched exactly, so only one of two entries sharing a tab can "
+                + "ever be found — the other is silently unreachable. Give each lead and "
+                + "collaborator its own exact tab.");
+    }
+
+    private static boolean templateCanRenderAs(String template, String tab) {
+        if (template == null || template.isBlank() || tab == null || tab.isBlank()) {
+            return false;
+        }
+        var placeholders = Pattern.compile("\\{(?:role|profile|model|n)}").matcher(template);
+        StringBuilder expression = new StringBuilder("^");
+        int literalStart = 0;
+        while (placeholders.find()) {
+            expression.append(Pattern.quote(template.substring(literalStart, placeholders.start())));
+            expression.append(".*");
+            literalStart = placeholders.end();
+        }
+        expression.append(Pattern.quote(template.substring(literalStart))).append("$");
+        return Pattern.compile(expression.toString(), Pattern.CASE_INSENSITIVE).matcher(tab).matches();
+    }
+
+    /** Case-insensitive prefix test that tolerates a null or blank label. */
+    private static boolean startsWithIgnoreCase(String label, String prefix) {
+        if (label == null || prefix == null || prefix.isBlank()) {
+            return false;
+        }
+        String stripped = label.strip();
+        return stripped.regionMatches(true, 0, prefix, 0, prefix.length());
     }
 
     /**
      * Reject a profile that places its members by {@code "pane"} while any {@code fleet.leaders}
-     * entry names a {@code tab}. A pane-placed member lands inside the focused tab rather than its
-     * own, so it can land inside a lead's own labelled tab. {@link
-     * dev.ltms.fleet.herdr.LeadTabScanner} identifies a lead purely by that tab's label — it does
-     * not exclude the member space — so a member that ends up there would be read back as the lead
-     * and granted spawn/stop/send on the whole fleet.
+     * or {@code fleet.collaborators} entry names a {@code tab}. A pane-placed member lands inside
+     * the focused tab rather than its own, so it can land inside a lead's or collaborator's own
+     * labelled tab. {@link dev.ltms.fleet.herdr.LeadTabScanner} identifies a lead or collaborator
+     * purely by that tab's label — it does not exclude the member space — so a member that ends up
+     * there would be read back as that lead or collaborator and granted that identity's authority.
      *
-     * <p>Only a leader with a non-blank {@code tab} is in scope: one with no {@code tab} feeds
+     * <p>Only an entry with a non-blank {@code tab} is in scope: one with no {@code tab} feeds
      * nothing into {@link dev.ltms.fleet.herdr.LeadTabScanner}, so it creates no hazard here.
      *
      * @throws IllegalStateException when any {@code profiles:} entry is pane-placed while any
-     *                               {@code fleet.leaders} entry names a non-blank {@code tab}
+     *                               {@code fleet.leaders} or {@code fleet.collaborators} entry
+     *                               names a non-blank {@code tab}
      */
     public void validatePanePlacementAgainstLeadTabs() {
-        if (fleet == null || fleet.leaders().isEmpty()) {
+        if (fleet == null) {
             return;
         }
         boolean anyLeaderHasTab = fleet.leaders().values().stream()
                 .anyMatch(leader -> leader != null && leader.tab() != null && !leader.tab().isBlank());
-        if (!anyLeaderHasTab) {
+        boolean anyCollaboratorHasTab = fleet.collaborators().values().stream()
+                .anyMatch(c -> c != null && c.tab() != null && !c.tab().isBlank());
+        if (!anyLeaderHasTab && !anyCollaboratorHasTab) {
             return;
         }
         List<String> bad = new ArrayList<>();
@@ -2774,10 +2907,11 @@ public record FleetConfig(
             return;
         }
         throw new IllegalStateException("refusing to start: profile(s) " + bad
-                + " use placement: pane while fleet.leaders names a tab. A pane-placed member can "
-                + "land inside a lead's labelled tab and be read back as the lead, granted "
-                + "spawn/stop/send on the whole fleet. Set placement: tab for each named profile, "
-                + "or remove the tab from every fleet.leaders entry.");
+                + " use placement: pane while fleet.leaders or fleet.collaborators names a tab. A "
+                + "pane-placed member can land inside that labelled tab and be read back as the "
+                + "lead or collaborator, granted that identity's authority. Set placement: tab for "
+                + "each named profile, or remove the tab from every fleet.leaders and "
+                + "fleet.collaborators entry.");
     }
 
     /**
@@ -2800,15 +2934,6 @@ public record FleetConfig(
         }
     }
 
-    /** Case-insensitive prefix test that tolerates a null/blank label. */
-    private static boolean startsWithIgnoreCase(String label, String prefix) {
-        if (label == null || prefix == null || prefix.isBlank()) {
-            return false;
-        }
-        String stripped = label.strip();
-        return stripped.regionMatches(true, 0, prefix, 0, prefix.length());
-    }
-
     /**
      * Reject a subscription profile whose {@code env:} block tries to reseat the Anthropic binding
      * (CB-542).
@@ -2893,8 +3018,14 @@ public record FleetConfig(
      * so duplicates are unrepresentable by construction once loaded — and {@link #load(Path)}
      * already rejects a duplicated slot name at parse time, before the map collapses.
      *
-     * @throws IllegalStateException when a slot names no profile or an unknown one, or when a lead
-     *                               can be neither found nor created, naming the offending entry
+     * <p>Also rejects a {@code fleet.collaborators} entry with no (or a blank) {@code tab}. A
+     * {@code profile}-less lead is still useful recognise-only — {@code tab} is the only field
+     * that matters to it either way. A collaborator carries no other field at all, so a blank
+     * {@code tab} leaves nothing for the entry to mean.
+     *
+     * @throws IllegalStateException when a slot names no profile or an unknown one, when a lead
+     *                               can be neither found nor created, or when a collaborator names
+     *                               no tab, naming the offending entry
      */
     public void validateMembers() {
         if (fleet == null) {
@@ -2932,6 +3063,16 @@ public record FleetConfig(
                         + "auto-launched, labelled) purely by its tab, so every entry must name one.");
             }
         });
+        fleet.collaborators().forEach((name, collaborator) -> {
+            if (collaborator == null) {
+                return;
+            }
+            if (collaborator.tab() == null || collaborator.tab().isBlank()) {
+                bad.add("fleet.collaborators." + name + " has no tab: — a collaborator is "
+                        + "recognised purely by its tab, and carries no other field, so every "
+                        + "entry must name one.");
+            }
+        });
         if (!bad.isEmpty()) {
             throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
         }

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -96,13 +96,19 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
 
     private static final Logger log = LoggerFactory.getLogger(LeadTabScanner.class);
 
+    /** What a matched tab names: a lead or a collaborator. */
+    private enum Kind { LEAD, COLLABORATOR }
+
+    /** One matched tab's name and what it names. */
+    private record Entry(String name, Kind kind) {}
+
     private final HerdrClient herdr;
-    private final Map<String, String> tabToName;
+    private final Map<String, Entry> tabToEntry;
     private final Set<String> excludedWorkspaceLabels;
     private final long ttlNanos;
     private final LongSupplier clock;
 
-    private Map<String, String> cached = Map.of();
+    private Map<String, Entry> cached = Map.of();
     private long scannedAtNanos;
     private boolean everScanned;
 
@@ -126,26 +132,53 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
      */
     public LeadTabScanner(HerdrClient herdr, Map<String, String> tabToName,
                           Set<String> excludedWorkspaceLabels, long ttlNanos, LongSupplier clock) {
+        this(herdr, tabToName, Map.of(), excludedWorkspaceLabels, ttlNanos, clock);
+    }
+
+    /**
+     * As {@link #LeadTabScanner(HerdrClient, Map, Set, long, LongSupplier)}, additionally scanning
+     * for configured collaborator tabs in the same pass.
+     *
+     * @param collaboratorTabToName every configured collaborator's exact tab label → its name
+     *                              ({@code fleet.collaborators.<name>.tab}), matched the same way as
+     *                              {@code tabToName}
+     */
+    public LeadTabScanner(HerdrClient herdr, Map<String, String> tabToName,
+                          Map<String, String> collaboratorTabToName,
+                          Set<String> excludedWorkspaceLabels, long ttlNanos, LongSupplier clock) {
         this.herdr = herdr;
-        this.tabToName = normalize(tabToName);
+        this.tabToEntry = buildTabIndex(tabToName, collaboratorTabToName);
         this.excludedWorkspaceLabels = excludedWorkspaceLabels == null
                 ? Set.of() : Set.copyOf(excludedWorkspaceLabels);
         this.ttlNanos = ttlNanos;
         this.clock = clock;
     }
 
-    /** Keys stripped and lower-cased once, so every lookup is a plain map hit. */
-    private static Map<String, String> normalize(Map<String, String> tabToName) {
-        if (tabToName == null || tabToName.isEmpty()) {
-            return Map.of();
+    /**
+     * Keys stripped and lower-cased once, so every lookup is a plain map hit. Leads and
+     * collaborators merge into a single index, so {@link #scan()} matches both kinds in one pass
+     * over the tab list; a label naming both a lead and a collaborator takes the lead entry —
+     * leads are put last, so a colliding key's lead entry is the one that overwrites — since a lead
+     * can already do everything a collaborator can. Config validation already refuses a lead and a
+     * collaborator sharing one exact tab, so this ordering is defence in depth, not the control.
+     */
+    private static Map<String, Entry> buildTabIndex(Map<String, String> tabToName,
+                                                     Map<String, String> collaboratorTabToName) {
+        Map<String, Entry> out = new LinkedHashMap<>();
+        putNormalized(out, collaboratorTabToName, Kind.COLLABORATOR);
+        putNormalized(out, tabToName, Kind.LEAD);
+        return Collections.unmodifiableMap(out);
+    }
+
+    private static void putNormalized(Map<String, Entry> out, Map<String, String> tabToName, Kind kind) {
+        if (tabToName == null) {
+            return;
         }
-        Map<String, String> out = new LinkedHashMap<>();
         tabToName.forEach((tab, name) -> {
             if (tab != null && !tab.isBlank() && name != null && !name.isBlank()) {
-                out.put(tab.strip().toLowerCase(Locale.ROOT), name);
+                out.put(tab.strip().toLowerCase(Locale.ROOT), new Entry(name, kind));
             }
         });
-        return Collections.unmodifiableMap(out);
     }
 
     /**
@@ -156,6 +189,29 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
      */
     @Override
     public synchronized Map<String, String> get() {
+        return byKind(refresh(), Kind.LEAD);
+    }
+
+    /**
+     * The current {@code terminal_id → collaborator name} map, sharing the same scan and cache as
+     * {@link #get()} — both kinds are matched in one pass, so this never costs a second herdr call.
+     */
+    public synchronized Map<String, String> collaborators() {
+        return byKind(refresh(), Kind.COLLABORATOR);
+    }
+
+    private static Map<String, String> byKind(Map<String, Entry> entries, Kind kind) {
+        Map<String, String> out = new LinkedHashMap<>();
+        entries.forEach((terminal, entry) -> {
+            if (entry.kind() == kind) {
+                out.put(terminal, entry.name());
+            }
+        });
+        return Collections.unmodifiableMap(out);
+    }
+
+    /** Rescans if the cache has expired, otherwise returns the cached answer. */
+    private Map<String, Entry> refresh() {
         long now = clock.getAsLong();
         if (everScanned && now - scannedAtNanos < ttlNanos) {
             return cached;
@@ -165,21 +221,21 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
         scannedAtNanos = now;
         everScanned = true;
         try {
-            Map<String, String> fresh = scan();
+            Map<String, Entry> fresh = scan();
             if (!fresh.equals(cached)) {
-                log.info("lead panes: {}", fresh);
+                log.info("lead/collaborator panes: {}", fresh);
             }
             cached = fresh;
         } catch (HerdrException e) {
-            log.warn("lead-tab scan failed, keeping the {} lead(s) already known: {}",
+            log.warn("lead-tab scan failed, keeping the {} entr(y/ies) already known: {}",
                     cached.size(), e.getMessage());
         }
         return cached;
     }
 
     /** One full pass: labelled tabs → live agents in them → those panes' terminals. */
-    private Map<String, String> scan() {
-        Map<String, String> nameByTab = new LinkedHashMap<>();
+    private Map<String, Entry> scan() {
+        Map<String, Entry> entryByTab = new LinkedHashMap<>();
         for (JsonNode w : herdr.call("workspace.list").path("workspaces")) {
             Workspace ws = Workspace.from(w);
             if (ws.workspaceId() == null || excludedWorkspaceLabels.contains(ws.label())) {
@@ -187,21 +243,22 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
             }
             for (JsonNode t : herdr.call("tab.list", Map.of("workspace_id", ws.workspaceId())).path("tabs")) {
                 Tab tab = Tab.from(t);
-                String name = leadNameOf(tab.label());
-                if (name != null && tab.tabId() != null) {
-                    nameByTab.put(tab.tabId(), name);
+                Entry entry = entryOf(tab.label());
+                if (entry != null && tab.tabId() != null) {
+                    entryByTab.put(tab.tabId(), entry);
                 }
             }
         }
 
-        if (nameByTab.isEmpty()) {
+        if (entryByTab.isEmpty()) {
             gracedTerminals = Set.of();
             return Map.of();
         }
 
-        // fleetd #359: a labelled tab is only a lead when herdr also reports a running agent in
-        // it — the same liveness signal LeadLauncher.countLeads trusts for the identical purpose.
-        // Without this, a tab left behind by a session that has since died reads as live forever.
+        // fleetd #359: a labelled tab is only a lead (or collaborator) when herdr also reports a
+        // running agent in it — the same liveness signal LeadLauncher.countLeads trusts for the
+        // identical purpose. Without this, a tab left behind by a session that has since died reads
+        // as live forever.
         Set<String> tabsWithAgent = new HashSet<>();
         for (JsonNode a : herdr.call("agent.list").path("agents")) {
             String tabId = a.path("tab_id").asText(null);
@@ -210,18 +267,18 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
             }
         }
 
-        Map<String, String> byTerminal = new LinkedHashMap<>();
+        Map<String, Entry> byTerminal = new LinkedHashMap<>();
         Set<String> stillGraced = new HashSet<>();
         // One pane.list for every tab: panes carry tab_id, so the join is local.
         for (JsonNode p : herdr.call("pane.list", Map.of()).path("panes")) {
             String tabId = p.path("tab_id").asText(null);
-            String name = nameByTab.get(tabId);
+            Entry entry = entryByTab.get(tabId);
             String terminal = p.path("terminal_id").asText(null);
-            if (name == null || terminal == null || terminal.isBlank()) {
+            if (entry == null || terminal == null || terminal.isBlank()) {
                 continue;
             }
             if (tabsWithAgent.contains(tabId)) {
-                byTerminal.put(terminal, name);
+                byTerminal.put(terminal, entry);
                 continue;
             }
             // No agent reported for this tab, but its tab/pane are still here — this is the
@@ -230,7 +287,7 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
             // reported as live; a terminal we never reported live gets none, so the original #359
             // fix (a genuinely dead tab is never reported) is unaffected for the common case.
             if (cached.containsKey(terminal) && !gracedTerminals.contains(terminal)) {
-                byTerminal.put(terminal, name);
+                byTerminal.put(terminal, entry);
                 stillGraced.add(terminal);
             }
         }
@@ -239,18 +296,19 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
     }
 
     /**
-     * The lead name a tab label declares, or {@code null} if it names none of the configured leads.
+     * The entry a tab label declares, or {@code null} if it names neither a configured lead nor a
+     * configured collaborator.
      *
-     * <p>Exact match (case-insensitive, ends stripped) against {@link #tabToName} — no prefix
+     * <p>Exact match (case-insensitive, ends stripped) against {@link #tabToEntry} — no prefix
      * stripping, so an operator's {@code "lead: something-else"} tab is never mistaken for a
      * configured lead just because it shares a prefix. The match strips a trailing
      * {@link PendingCloseMarker} first, so a tab {@code LeadLauncher} has flagged as maybe-dead but
      * not yet closed keeps resolving normally while that reconcile is pending.
      */
-    private String leadNameOf(String label) {
+    private Entry entryOf(String label) {
         if (label == null) {
             return null;
         }
-        return tabToName.get(PendingCloseMarker.strip(label).toLowerCase(Locale.ROOT));
+        return tabToEntry.get(PendingCloseMarker.strip(label).toLowerCase(Locale.ROOT));
     }
 }

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -114,6 +114,13 @@ public final class FleetMcp {
      * dev.ltms.fleet.herdr.PaneLocator} — that a real assembly wired up. See {@link #identity()}.
      */
     private final ConnectionIdentity identity;
+    /**
+     * Kept as a field (rather than only captured by the {@code contextExtractor} closure) so
+     * {@link #denyFor} can read {@link CallerResolver#knownLeadOrCollaborator()} — the classifier a
+     * collaborator's {@code SEND} is checked against, built from the same lead and collaborator
+     * maps {@link #identity}-based resolution reads.
+     */
+    private final CallerResolver callers;
     private final Metrics metrics;      // CB-502: null → auth failures not counted
     private final CapacitySource capacity;
     private final HealthCoverageSource healthCoverage;
@@ -409,6 +416,7 @@ public final class FleetMcp {
         this.authorizationEnforced = Objects.requireNonNull(authorizationMode, "authorizationMode")
                 == AuthorizationMode.ENFORCED;
         this.identity = identity;
+        this.callers = callers;
         this.leadChannel = leadChannel;
         this.peers = peers == null ? List.of() : List.copyOf(peers);
         this.capacity = capacity;
@@ -689,8 +697,8 @@ public final class FleetMcp {
         if (!authorizationEnforced) {
             return null; // AuthorizationMode.UNENFORCED: authorization not enforced (fleetd #518)
         }
-        if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ) {
+        if (Authz.permits(caller, action, target, callers.knownLeadOrCollaborator())) {
+            if (action != Authz.Action.READ && action != Authz.Action.TASK_READ) {
                 AuditLog.allowed(caller, action, target); // reads would drown the trail
             }
             return null;
@@ -1035,31 +1043,21 @@ public final class FleetMcp {
     }
 
     /**
-     * Which authorization action a {@code fleet_poll} call needs, decided by its arguments
-     * (fleetd #272, widened by fleetd #421).
+     * Which authorization action a {@code fleet_poll} call needs, decided by its arguments.
      *
-     * <p>{@code fleet_poll} is now <strong>three operations behind one tool name</strong>. With
+     * <p>{@code fleet_poll} is <strong>three operations behind one tool name</strong>. With
      * {@code ticket} it observes an async delegation and changes nothing, which is a {@link
-     * Authz.Action#READ}. With {@code target} it calls {@link MessageService#drainReplies} on that
-     * session -- the replies are removed from the inbox and a second call returns nothing -- so it
-     * is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for removing a
-     * single message, and the same one the REST path uses at {@code FleetApp.drainReplies}. With
-     * {@code coordId} it reads (never acks) this daemon's own held lead-to-lead mail, which is a
-     * {@link Authz.Action#COORD_READ} -- <strong>not</strong> {@code READ}, even though nothing is
-     * consumed: {@code READ}'s grant is open to every authenticated role on the premise that the
-     * roster carries no secrets, and a lead-to-lead body is not the roster. Mapping a non-destructive
-     * peer-mail read to {@code READ} would let any worker read every peer lead's mail in full.
-     *
-     * <p>Before this method existed (fleetd #272) the handler passed a constant {@code READ} for
-     * both of the original branches. {@code READ} is open to every authenticated role, so any
-     * worker could read a peer's id out of {@code fleet_list} and destroy the replies that peer had
-     * queued for the primary. The gate failed open, and it did so because the required action is a
-     * function of the arguments while the handler chose it before looking at them.
+     * Authz.Action#TASK_READ}. With {@code target} it calls {@link MessageService#drainReplies} on
+     * that session -- the replies are removed from the inbox and a second call returns nothing --
+     * so it is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for
+     * removing a single message, and the same one the REST path uses at
+     * {@code FleetApp.drainReplies}. With {@code coordId} it reads (never acks) this daemon's own
+     * held lead-to-lead mail, which is a {@link Authz.Action#COORD_READ} -- <strong>not</strong>
+     * {@code TASK_READ} or {@code READ}: a lead-to-lead body is a different inbox from either, and
+     * folding it into either would let any worker or architect read every peer lead's mail in full.
      *
      * <p>The choice lives in this method, and not inline in the handler, so that a test can assert
-     * the mapping the handler actually uses. {@code FleetMcpAuthzTest} already checked every
-     * {@link Authz.Action} against every {@link Role} and passed throughout -- it tested the policy
-     * table, which was correct, while the defect was in which action the caller handed it.
+     * the mapping the handler actually uses.
      *
      * <p>Checked first, and exclusively of {@code target}: a call naming {@code coordId} is reading
      * a different inbox entirely (this daemon's own lead channel, never a worker's), so it takes
@@ -1072,7 +1070,30 @@ public final class FleetMcp {
         if (!isBlank(coordId)) {
             return Authz.Action.COORD_READ;
         }
-        return isBlank(target) ? Authz.Action.READ : Authz.Action.DRAIN;
+        return isBlank(target) ? Authz.Action.TASK_READ : Authz.Action.DRAIN;
+    }
+
+    /**
+     * Which authorization action a {@code fleet_send} call needs, decided by its arguments.
+     *
+     * <p>{@code fleet_send} is three call shapes behind one tool name, mirroring {@link
+     * #pollAction}. With {@code coordId} it addresses a peer lead on another daemon over the
+     * coordination broker, which is {@link Authz.Action#COORD_SEND}. With {@code turnId} it
+     * resolves a worker's blocked {@code fleet_ask} and resumes that turn, which is {@link
+     * Authz.Action#ANSWER}. Otherwise it delivers to a local session by {@code sessionId}, which is
+     * the plain {@link Authz.Action#SEND}.
+     *
+     * <p>Checked in the same order the handler branches: {@code coordId} first and exclusively of
+     * {@code turnId}, matching {@link #sendToLead}'s own mutual-exclusion check.
+     *
+     * @param coordId the {@code coordId} argument of the call, or {@code null}/blank when absent
+     * @param turnId  the {@code turnId} argument of the call, or {@code null}/blank when absent
+     */
+    static Authz.Action sendAction(String coordId, String turnId) {
+        if (!isBlank(coordId)) {
+            return Authz.Action.COORD_SEND;
+        }
+        return isBlank(turnId) ? Authz.Action.SEND : Authz.Action.ANSWER;
     }
 
     /**
@@ -1097,10 +1118,11 @@ public final class FleetMcp {
      */
     private static Authz.Action authzAction(FleetTool tool, Map<String, Object> arguments) {
         return switch (tool) {
-            case SEND -> Authz.Action.SEND;
+            case SEND -> sendAction(str(arguments, "coordId"), str(arguments, "turnId"));
             case REPLY -> Authz.Action.REPLY;
             case ASK -> Authz.Action.ASK;
-            case STATUS, LIST, PROFILES, WHOAMI -> Authz.Action.READ;
+            case STATUS -> Authz.Action.TASK_READ;
+            case LIST, PROFILES, WHOAMI -> Authz.Action.READ;
             case POLL -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
             case ACK -> Authz.Action.DRAIN;
             case SPAWN -> Authz.Action.SPAWN;
@@ -1295,6 +1317,18 @@ public final class FleetMcp {
             }
             return text(json(m));
         }
+        if (caller.isCollaborator()) {
+            // A collaborator's name is its slot in the collaborators: registry; sessionId is its
+            // pane so a peer knows where to reach it. No leader key: a collaborator is not a
+            // primary for authorization, unlike a lead.
+            if (caller.name() != null) {
+                m.put("collaborator", caller.name());
+            }
+            if (caller.terminal() != null) {
+                m.put("sessionId", caller.terminal());
+            }
+            return text(json(m));
+        }
         if (!caller.isWorker()) {
             // CB-530: which lead, once more than one pane is configured as one. `role` deliberately
             // still reads "primary" — the fallback ladder in CLAUDE.md keys on it, and a lead IS a

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -49,22 +49,52 @@ import java.util.stream.Collectors;
  */
 public final class FleetApp {
 
-    /** The authorization action the matching route handler hands to {@link #allow}. */
+    /**
+     * The authorization action the matching route handler hands to {@link #allow}, for a route
+     * whose action does not depend on the request body.
+     */
     static Authz.Action routeAction(String route) {
+        return routeAction(route, null);
+    }
+
+    /**
+     * As above, plus the one route whose action depends on the body: {@code POST
+     * /sessions/{id}/message} carries a {@code turnId} (the answer-a-blocked-worker shape) or not
+     * (a plain delivery), mirroring {@code FleetMcp#sendAction}'s split of the same two call
+     * shapes over MCP. {@code turnId} is ignored by every other route.
+     *
+     * @param turnId the request body's {@code turnId}, or {@code null}/blank when absent or not
+     *               applicable to this route
+     */
+    static Authz.Action routeAction(String route, String turnId) {
         return switch (route) {
             case "GET /metrics" -> Authz.Action.METRICS;
             case "POST /members" -> Authz.Action.SPAWN;
             case "DELETE /members/{paneId}" -> Authz.Action.STOP;
-            case "POST /sessions/{id}/message" -> Authz.Action.SEND;
+            case "POST /sessions/{id}/message" -> turnId == null || turnId.isBlank()
+                    ? Authz.Action.SEND : Authz.Action.ANSWER;
             case "POST /sessions/{id}/reply" -> Authz.Action.REPLY;
             case "GET /sessions/{id}/replies" -> Authz.Action.DRAIN;
             case "POST /sessions/{id}/ask" -> Authz.Action.ASK;
             case "GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                    "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.READ;
+                    "GET /member-credentials" -> Authz.Action.READ;
+            case "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.TASK_READ;
             default -> throw new IllegalArgumentException("route has no authorization gate: " + route);
         };
     }
 
+    /**
+     * The second gate for {@code POST /sessions/{id}/message}: checked only when {@code turnId}
+     * is present and non-blank, against {@link Authz.Action#ANSWER}. A request with no {@code
+     * turnId} passes this gate unconditionally, without consulting {@code permit} at all, having
+     * already cleared the coarse {@link Authz.Action#SEND} grant checked ahead of it.
+     *
+     * @param permit reports whether the caller holds the named grant
+     */
+    static boolean answerGatePasses(String turnId, Predicate<Authz.Action> permit) {
+        return turnId == null || turnId.isBlank() || permit.test(Authz.Action.ANSWER);
+    }
+
     /** Default blocking window for a message; kept under typical HTTP idle timeouts. */
     private static final long DEFAULT_MESSAGE_TIMEOUT_MS = 25_000;
     private static final long MAX_MESSAGE_TIMEOUT_MS = 120_000;
@@ -236,6 +266,21 @@ public final class FleetApp {
         return app;
     }
 
+    /**
+     * The authorization decision behind {@link #allow}, taking the caller directly rather than
+     * pulling it from a servlet {@link Context} — unit-testable without fabricating a live
+     * request, the same reason {@code FleetMcp#denyFor} is split from {@code FleetMcp#deny}.
+     *
+     * @param knownLeadOrCollaborator the classifier a collaborator's {@code SEND} is checked
+     *                                against; pass {@link #auth}'s own {@code
+     *                                knownLeadOrCollaborator()} to exercise the real production
+     *                                gate, as {@link #allow} does
+     */
+    static boolean permitsFor(Principal caller, Authz.Action action, String target,
+                              Predicate<String> knownLeadOrCollaborator) {
+        return Authz.permits(caller, action, target, knownLeadOrCollaborator);
+    }
+
     /**
      * Gate a handler on the CB-505 authorization table. Returns {@code true} when the request may
      * proceed; otherwise writes the error response and returns {@code false}.
@@ -249,8 +294,9 @@ public final class FleetApp {
             return true; // legacy: authorization not enforced
         }
         Principal caller = ctx.attribute(CALLER);
-        if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ && action != Authz.Action.METRICS) {
+        if (permitsFor(caller, action, target, auth.knownLeadOrCollaborator())) {
+            if (action != Authz.Action.READ && action != Authz.Action.METRICS
+                    && action != Authz.Action.TASK_READ) {
                 AuditLog.allowed(caller, action, target); // reads would drown the trail
             }
             return true;
@@ -603,26 +649,37 @@ public final class FleetApp {
      * status-gated injector and block until the worker returns a structured {@code fleet_reply}.
      * Times out with a typed 202 (working / queued / busy) rather than an error — the message may
      * still land.
+     *
+     * <p>Two call shapes share this route, exactly as {@code fleet_send} does over MCP (see
+     * {@code FleetMcp#sendAction}): a plain delivery to {@code id}, and -- when the body carries
+     * {@code turnId} -- resolving a worker's blocked question. The coarse {@link
+     * Authz.Action#SEND} grant is checked first, before the body is read at all; only once that
+     * passes is the body parsed, and a present {@code turnId} is then checked again against
+     * {@link Authz.Action#ANSWER}. A body that fails to parse is rejected with 400 and reaches
+     * neither {@code messages.answer} nor {@code messages.send}.
      */
     private void sendMessage(Context ctx) {
         String id = ctx.pathParam("id");
         if (!allow(ctx, routeAction("POST /sessions/{id}/message"), id)) {
             return;
         }
-        String content;
-        String turnId;
-        long timeout;
-        boolean wait;
+        JsonNode body;
         try {
-            JsonNode body = mapper.readTree(ctx.body());
-            content = body.path("content").asText("");
-            turnId = body.path("turnId").asText(null);
-            timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
-            wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
+            body = mapper.readTree(ctx.body());
         } catch (Exception e) {
+            body = null;
+        }
+        if (body == null) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
             return;
         }
+        String turnId = body.path("turnId").asText(null);
+        if (!answerGatePasses(turnId, action -> allow(ctx, action, id))) {
+            return;
+        }
+        String content = body.path("content").asText("");
+        long timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
+        boolean wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
         if (content.isBlank()) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "content is required"));
             return;

fleetd/src/test/java/dev/ltms/fleet/auth/AuthzTest.java

@@ -14,6 +14,7 @@ class AuthzTest {
     private static final Principal ANON = Principal.anonymous();
     private static final Principal ARCH_DESIGN = Principal.architect("lead-designer", "term_design", 400);
     private static final Principal ARCH_OTHER = Principal.architect("reviewer", "term_review", 500);
+    private static final Principal COLLABORATOR = Principal.collaborator("ops", "term_collab", 600);
 
     @Test
     void anonymousIsAuthorizedForNothing() {
@@ -38,6 +39,37 @@ class AuthzTest {
         }
     }
 
+    /**
+     * {@code fleet_send} is three call shapes behind one action name until {@code
+     * FleetMcp#sendAction} picks one: a plain local {@link Authz.Action#SEND}, the {@code coordId}
+     * route ({@link Authz.Action#COORD_SEND}), and the {@code turnId} answer form ({@link
+     * Authz.Action#ANSWER}). All three carry the same grant as the undivided action did — a worker
+     * is excluded from every one, exactly as it was excluded from the one combined action before.
+     */
+    @Test
+    void theThreeSendShapesCarryTheSameGrantAsTheOldUndividedAction() {
+        for (Authz.Action a : new Authz.Action[]{SEND, COORD_SEND, ANSWER}) {
+            assertTrue(Authz.permits(PRIMARY, a, "term_a"), "the primary may " + a);
+            assertTrue(Authz.permits(ARCH_DESIGN, a, "term_a"), "an architect may " + a);
+            assertFalse(Authz.permits(WORKER_A, a, "term_a"),
+                    "a worker performing " + a + " would be escalating into the orchestrator role");
+            assertFalse(Authz.permits(ANON, a, "term_a"));
+        }
+    }
+
+    /**
+     * {@code fleet_poll{ticket}} and {@code fleet_status} are {@link Authz.Action#TASK_READ}, split
+     * out of the roster-only {@link Authz.Action#READ} (fleetd #678). The grant is unchanged from
+     * what the undivided {@code READ} action gave every one of these callers.
+     */
+    @Test
+    void taskReadCarriesTheSameGrantReadDidBeforeTheSplit() {
+        assertTrue(Authz.permits(PRIMARY, TASK_READ, null));
+        assertTrue(Authz.permits(WORKER_A, TASK_READ, null));
+        assertTrue(Authz.permits(ARCH_DESIGN, TASK_READ, null));
+        assertFalse(Authz.permits(ANON, TASK_READ, null));
+    }
+
     @Test
     void aWorkerMayReplyAndAskOnlyAsItself() {
         assertTrue(Authz.permits(WORKER_A, REPLY, "term_a"));
@@ -135,4 +167,87 @@ class AuthzTest {
         assertFalse(Authz.isUnauthenticated(WORKER_A));
         assertFalse(Authz.isUnauthenticated(PRIMARY));
     }
+
+    // ── the collaborator matrix ─────────────────────────────────────────────────────────────────
+
+    /**
+     * {@code SEND} for a collaborator is the one grant that is conditional rather than fixed:
+     * flipping only the classifier's answer for the target flips only this outcome.
+     */
+    @Test
+    void aCollaboratorMaySendOnlyWhenTheClassifierAcceptsTheTarget() {
+        assertTrue(Authz.permits(COLLABORATOR, SEND, "term_lead", target -> true),
+                "the classifier accepting the target must grant SEND");
+        assertFalse(Authz.permits(COLLABORATOR, SEND, "term_lead", target -> false),
+                "the classifier refusing the target must deny SEND");
+        assertFalse(Authz.permits(COLLABORATOR, SEND, "term_lead"),
+                "the real production classifier recognises no terminal yet, so SEND is refused today");
+    }
+
+    /**
+     * Control for the test above: every other action's result for a collaborator does not move
+     * when the classifier does. Only {@code SEND} is wired to it.
+     */
+    @Test
+    void theClassifierMovesOnlySendForACollaborator() {
+        for (Authz.Action a : Authz.Action.values()) {
+            if (a == SEND) {
+                continue;
+            }
+            assertEquals(
+                    Authz.permits(COLLABORATOR, a, "term_lead"),
+                    Authz.permits(COLLABORATOR, a, "term_lead", target -> true),
+                    a + " must not depend on the classifier at all");
+        }
+    }
+
+    @Test
+    void aCollaboratorMayReadAndScrapeMetrics() {
+        assertTrue(Authz.permits(COLLABORATOR, READ, null));
+        assertTrue(Authz.permits(COLLABORATOR, METRICS, null));
+    }
+
+    @Test
+    void aCollaboratorMayReplyAndAskOnlyAsItsOwnPane() {
+        assertTrue(Authz.permits(COLLABORATOR, REPLY, "term_collab"),
+                "its own pane is its own");
+        assertTrue(Authz.permits(COLLABORATOR, ASK, "term_collab"));
+
+        assertFalse(Authz.permits(COLLABORATOR, REPLY, "term_design"),
+                "a collaborator must not reply on another pane");
+        assertFalse(Authz.permits(COLLABORATOR, REPLY, null),
+                "an absent target must not pass the own-session rule");
+    }
+
+    /**
+     * Every action denied to a collaborator, asserted denied even when the classifier would
+     * accept any target — proving none of these is actually gated on the classifier at all.
+     */
+    @Test
+    void aCollaboratorIsDeniedLifecycleCoordinationAndTicketPolling() {
+        for (Authz.Action a : new Authz.Action[]{SPAWN, STOP, DRAIN, HANDOVER, ANSWER, COORD_SEND,
+                COORD_READ, TASK_READ}) {
+            assertFalse(Authz.permits(COLLABORATOR, a, "term_lead", target -> true),
+                    "a collaborator must not " + a + " even when the classifier accepts every target");
+        }
+    }
+
+    @Test
+    void aCollaboratorIsNotCountedAsPrimaryWorkerOrArchitect() {
+        assertFalse(COLLABORATOR.isPrimary());
+        assertFalse(COLLABORATOR.isWorker());
+        assertFalse(COLLABORATOR.isArchitect());
+        assertTrue(COLLABORATOR.isCollaborator());
+    }
+
+    /**
+     * A collaborator is never spawned, so it must not be enrolled in the presence map as an
+     * available member. Control: both a worker and an architect — which ARE spawned — still are.
+     */
+    @Test
+    void isSpawnedMemberIsFalseForACollaboratorButTrueForAWorkerAndAnArchitect() {
+        assertFalse(COLLABORATOR.isSpawnedMember());
+        assertTrue(WORKER_A.isSpawnedMember());
+        assertTrue(ARCH_DESIGN.isSpawnedMember());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/auth/CallerResolverTest.java

@@ -523,4 +523,129 @@ class CallerResolverTest {
         }
     }
 
+    // ── fleetd #669 Unit D: a live spawned member outranks every tab map ────────────────────────
+
+    /**
+     * Criterion 1: a terminal present in BOTH the spawned-member roster AND the lead tab map
+     * resolves as its member role, not as a lead — the roster is checked first, consulting no tab
+     * map at all when it matches.
+     */
+    @Test
+    void aSpawnedMemberWinsOverALeadTabForTheSamePane() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
+                        () -> Map.of("term_a", "opus-5.0"), new MemberRegistry(null),
+                        t -> "term_a".equals(t) ? MemberRole.DEV : null, Map::of)
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role(),
+                "a live spawned member's own identity must win over a tab map naming the same pane a lead");
+        assertEquals("term_a", p.terminal());
+    }
+
+    /** A spawned architect in the roster resolves ARCHITECT, carrying its bound slot's name. */
+    @Test
+    void aSpawnedArchitectInTheRosterResolvesArchitectWithItsSlotName() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                        boundMembers("architect:lead-designer", MemberRole.ARCHITECT),
+                        t -> "term_a".equals(t) ? MemberRole.ARCHITECT : null, Map::of)
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.ARCHITECT, p.role());
+        assertEquals("lead-designer", p.name());
+        assertEquals("term_a", p.terminal());
+    }
+
+    /**
+     * fleetd #424 regression: the roster only answers THAT a pane is a live spawned member; config
+     * still decides WHAT that member's slot grants. A slot revoked after the bind must still demote
+     * the session on its very next request, exactly as it would for a pane with no roster entry at
+     * all — the roster's own ARCHITECT role must never be granted on its word alone.
+     *
+     * <p>{@code bind} refuses an unconfigured slot, so the revoked state can only be reached by
+     * binding while the slot is configured and then swapping the config out from under it, the way
+     * a live reload does.
+     */
+    @Test
+    void aRevokedArchitectSlotDemotesALiveSpawnedArchitectToWorker() {
+        FleetConfig.Fleet configured = new FleetConfig.Fleet(Map.of(),
+                Map.of("lead-designer", new FleetConfig.Slot("sonnet")), Map.of(), Map.of(), null);
+        java.util.concurrent.atomic.AtomicReference<FleetConfig.Fleet> live =
+                new java.util.concurrent.atomic.AtomicReference<>(configured);
+        MemberRegistry members = MemberRegistry.live(live::get);
+        assertTrue(members.bind("architect:lead-designer", "term_a"));
+
+        live.set(new FleetConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(), null)); // slot revoked
+
+        // Setup controls: the slot is really gone from config, but the occupancy is still there —
+        // otherwise this test would pass for the wrong reason.
+        assertNull(members.roleForSlot("architect:lead-designer"), "setup control: the slot must be gone from config");
+        assertEquals("architect:lead-designer", members.snapshot().get("term_a"),
+                "setup control: the binding itself must still be there");
+
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                        members, t -> "term_a".equals(t) ? MemberRole.ARCHITECT : null, Map::of)
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role(),
+                "a revoked slot must demote a live spawned architect on its very next request");
+    }
+
+    /** Criterion 3: a configured collaborator tab that is not a spawned member resolves COLLABORATOR. */
+    @Test
+    void aConfiguredCollaboratorTabResolvesToCollaboratorCarryingItsName() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                        new MemberRegistry(null), t -> null, () -> Map.of("term_a", "ops"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.COLLABORATOR, p.role());
+        assertEquals("ops", p.name());
+        assertEquals("term_a", p.terminal());
+    }
+
+    /** Regression: an empty collaborator registry leaves every pane exactly as before. */
+    @Test
+    void anEmptyCollaboratorRegistryLeavesEveryPaneAsBefore() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                        new MemberRegistry(null), t -> null, Map::of)
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role());
+        assertNull(p.name());
+    }
+
+    @Test
+    void describeNamesTheCollaborator() {
+        assertEquals("collaborator:ops", Principal.collaborator("ops", "term_a", 1).describe());
+    }
+
+    // ── fleetd #669 Unit D: knownLeadOrCollaborator() reads the same maps resolve() does ───────────
+
+    @Test
+    void knownLeadOrCollaboratorIsTrueForALeadTerminal() {
+        CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
+                () -> Map.of("term_lead", "opus-5.0"), new MemberRegistry(null), t -> null, Map::of);
+
+        assertTrue(r.knownLeadOrCollaborator().test("term_lead"));
+        assertFalse(r.knownLeadOrCollaborator().test("term_other"));
+    }
+
+    @Test
+    void knownLeadOrCollaboratorIsTrueForACollaboratorTerminal() {
+        CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                new MemberRegistry(null), t -> null, () -> Map.of("term_collab", "ops"));
+
+        assertTrue(r.knownLeadOrCollaborator().test("term_collab"));
+        assertFalse(r.knownLeadOrCollaborator().test("term_other"));
+    }
+
+    @Test
+    void knownLeadOrCollaboratorIsFalseForASpawnedMembersTerminal() {
+        // The exact scenario a collaborator's SEND must never reach: a live spawned member's own
+        // terminal, which is neither a configured lead nor a configured collaborator.
+        CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
+                new MemberRegistry(null), t -> "term_a".equals(t) ? MemberRole.DEV : null, Map::of);
+
+        assertFalse(r.knownLeadOrCollaborator().test("term_a"));
+    }
+
 }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -676,12 +676,8 @@ class FleetConfigTest {
         assertEquals(5, hb.quietNudgeCap());
     }
 
-    /**
-     * The hazard the guard exists for: fleetd writes worker tab labels and reads lead tab labels.
-     * Overlap the two and every worker it spawns is read back as a lead.
-     */
     @Test
-    void aLeadPrefixThatAProfileTabLabelOverrideAlsoMatchesRefusesToStart(@TempDir Path dir)
+    void aProfileTabLabelOverrideMatchingALeadTabRefusesToStart(@TempDir Path dir)
             throws Exception {
         Path f = dir.resolve("collide.yaml");
         Files.writeString(f, """
@@ -689,32 +685,33 @@ class FleetConfigTest {
                   port: 8080
                 profiles:
                   gx10:
-                    tabLabel: "lead: {profile} #{n}"
+                    tabLabel: "alpha"
                 fleet:
                   leaders:
                     opus:
-                      tab: "lead: opus"
-                      tabPrefix: "lead:"
+                      tab: "alpha"
                 """);
         FleetConfig cfg = FleetConfig.load(f);
 
         IllegalStateException e =
                 assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
         assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+        assertTrue(e.getMessage().contains("alpha"), "the message must name the offending label");
     }
 
-    /** A bad fleet-wide template promotes every member, not one profile — so it is checked too. */
     @Test
-    void aFleetTabLabelThatMatchesALeadPrefixRefusesToStart(@TempDir Path dir) throws Exception {
+    void aFleetTabLabelTemplateThatCanRenderAsALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("collide-template.yaml");
         Files.writeString(f, """
                 bind:
                   port: 8080
+                profiles:
+                  pha: {}
                 fleet:
-                  tabLabel: "lead: {role} {profile}"
+                  tabLabel: "al{profile}"
                   leaders:
                     opus:
-                      tab: "lead: opus"
+                      tab: "alpha"
                 """);
         FleetConfig cfg = FleetConfig.load(f);
 
@@ -723,12 +720,28 @@ class FleetConfigTest {
         assertTrue(e.getMessage().contains("fleet.tabLabel"));
     }
 
-    /**
-     * The point of making role the label's first field: {@code {role}} comes from a closed enum, so
-     * a generated label cannot begin with {@code "lead:"} however the fleet is configured.
-     */
     @Test
-    void theDefaultTabLabelCannotCollideWithTheDefaultLeadPrefix(@TempDir Path dir) throws Exception {
+    void anExactFleetTabLabelCollisionRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("exact-tab-collision.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  tabLabel: "alpha"
+                  leaders:
+                    alpha:
+                      tab: "alpha"
+                """);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                () -> FleetConfig.load(f).validateAll());
+        assertTrue(e.getMessage().contains("fleet.tabLabel"),
+                "the message must name the offending label");
+        assertTrue(e.getMessage().contains("alpha"), "the message must name the colliding lead tab");
+    }
+
+    @Test
+    void aFleetTabLabelTemplateThatCannotRenderAsALeadTabIsAllowed(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("ok.yaml");
         Files.writeString(f, """
                 bind:
@@ -737,17 +750,13 @@ class FleetConfigTest {
                   gx10:
                     baseUrl: http://gx00.gw:8000
                 fleet:
+                  tabLabel: "worker-{profile}"
                   leaders:
                     opus:
-                      tab: "lead: opus"
+                      tab: "alpha"
                 """);
 
-        assertDoesNotThrow(() -> FleetConfig.load(f).validateLeadTabPrefixes());
-        for (MemberRole role : MemberRole.values()) {
-            assertFalse(FleetConfig.Fleet.DEFAULT_TAB_LABEL
-                            .replace("{role}", role.wireName()).startsWith("lead:"),
-                    "no role renders a label that reads as a lead");
-        }
+        assertDoesNotThrow(() -> FleetConfig.load(f).validateAll());
     }
 
     @Test
@@ -765,6 +774,78 @@ class FleetConfigTest {
                 "a label that collides with a convention nobody reads is not a problem");
     }
 
+    /**
+     * fleetd #677: identity is matched on a lead's exact {@code tab} alone, so two leads sharing
+     * one tab means only one of them is ever found — the guard must catch this independently of
+     * the member-template checks above.
+     */
+    @Test
+    void twoLeadsSharingTheSameExactTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("shared-tab.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "shared tab"
+                    sonnet:
+                      tab: "shared tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("opus"), "the message must name one offending lead");
+        assertTrue(e.getMessage().contains("sonnet"), "the message must name the other offending lead");
+    }
+
+    /**
+     * fleetd #693: the guard matches tabs case-insensitively, because
+     * {@code LeadTabScanner} keys its tab map on a lowercased label — two tabs differing only in
+     * case collide there too, and the guard must catch that independently of the exact-match case
+     * above.
+     */
+    @Test
+    void twoLeadsSharingTheSameTabInDifferentCaseRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("shared-tab-case.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "Shared Tab"
+                    sonnet:
+                      tab: "shared tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("opus"), "the message must name one offending lead");
+        assertTrue(e.getMessage().contains("sonnet"), "the message must name the other offending lead");
+    }
+
+    /** Control for {@link #twoLeadsSharingTheSameExactTabRefusesToStart}: distinct tabs load cleanly. */
+    @Test
+    void twoLeadsWithDistinctExactTabsAreAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("distinct-tabs.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "opus tab"
+                    sonnet:
+                      tab: "sonnet tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateLeadTabPrefixes);
+    }
+
     // ── validatePanePlacementAgainstLeadTabs ────────────────────────────────────────────────────
 
     /**
@@ -919,6 +1000,273 @@ class FleetConfigTest {
                 "no primary.terminal pin ⇒ nothing registered, even with fleet.leaders configured");
     }
 
+    // ── fleetd #669: the collaborators registry ────────────────────────────────────────────────
+
+    /**
+     * {@code Fleet} is {@code @JsonIgnoreProperties(ignoreUnknown = true)}, so a config naming
+     * {@code fleet.collaborators.<name>.tab} loads with no exception whether or not the key is
+     * ever read into the object model. Asserting only "no exception" would pass both before and
+     * after the real fix, so this asserts the parsed value is actually reachable from the loaded
+     * {@code FleetConfig} — the one thing a vacuous "no exception" test cannot tell apart.
+     */
+    @Test
+    void collaboratorsBlockIsActuallyParsedNotSilentlyDropped(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("collaborators.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    reviewer-alex:
+                      tab: "collab: alex"
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertEquals("collab: alex", cfg.fleet().collaborators().get("reviewer-alex").tab());
+    }
+
+    /** A collaborator carries no field other than {@code tab}, so a blank one is meaningless. */
+    @Test
+    void aCollaboratorWithNoTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("useless-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    ghost: {}
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateMembers);
+        assertTrue(e.getMessage().contains("ghost"), "the message must name the useless entry");
+        assertTrue(e.getMessage().contains("tab:"), "the message must say what is missing");
+    }
+
+    /** Control for {@link #aCollaboratorWithNoTabRefusesToStart}: a named tab loads cleanly. */
+    @Test
+    void aCollaboratorWithATabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("named-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    reviewer-alex:
+                      tab: "collab: alex"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateMembers);
+    }
+
+    /**
+     * fleetd #669: the fleet-wide {@code tabLabel} template can render as a collaborator tab, the
+     * same hazard {@link #aFleetTabLabelTemplateThatCanRenderAsALeadTabRefusesToStart} covers on
+     * the lead side. Drives the fleet-wide branch directly, with no profile override involved.
+     */
+    @Test
+    void aFleetTabLabelTemplateThatCanRenderAsACollaboratorTabRefusesToStart(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("collide-template-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  tabLabel: "al{profile}"
+                  collaborators:
+                    alex:
+                      tab: "alpha"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("fleet.tabLabel"));
+        assertTrue(e.getMessage().contains("alex"), "the message must name the offending collaborator");
+    }
+
+    /**
+     * fleetd #669: a member tabLabel that can render as a configured collaborator tab is the same
+     * hazard as the lead case above — a member labelled that way is read back as the collaborator.
+     */
+    @Test
+    void aProfileTabLabelOverrideMatchingACollaboratorTabRefusesToStart(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("collide-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    tabLabel: "collab-tab"
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collab-tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+        assertTrue(e.getMessage().contains("collab-tab"), "the message must name the offending label");
+    }
+
+    /** Control: a profile tabLabel that cannot render as the collaborator tab is allowed. */
+    @Test
+    void aProfileTabLabelThatCannotRenderAsACollaboratorTabIsAllowed(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("ok-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    tabLabel: "worker-{profile}"
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collab-tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateLeadTabPrefixes);
+    }
+
+    /** fleetd #669: identity is matched on a collaborator's exact tab, so two sharing one are unreachable. */
+    @Test
+    void twoCollaboratorsSharingTheSameExactTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("shared-collaborator-tab.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "shared tab"
+                    sam:
+                      tab: "Shared Tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("alex"), "the message must name one offending collaborator");
+        assertTrue(e.getMessage().contains("sam"), "the message must name the other offending collaborator");
+    }
+
+    /** Control for {@link #twoCollaboratorsSharingTheSameExactTabRefusesToStart}: distinct tabs load cleanly. */
+    @Test
+    void twoCollaboratorsWithDistinctExactTabsAreAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("distinct-collaborator-tabs.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "alex tab"
+                    sam:
+                      tab: "sam tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateLeadTabPrefixes);
+    }
+
+    /**
+     * fleetd #669: a collaborator tab equal to a lead tab crosses a privilege boundary — the worst
+     * of the three new collisions, since only one of the two identities is ever found.
+     */
+    @Test
+    void aCollaboratorTabEqualToALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("lead-collaborator-collision.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "shared tab"
+                  collaborators:
+                    alex:
+                      tab: "Shared Tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, cfg::validateLeadTabPrefixes);
+        assertTrue(e.getMessage().contains("opus"), "the message must name the offending lead");
+        assertTrue(e.getMessage().contains("alex"), "the message must name the offending collaborator");
+    }
+
+    /** Control for {@link #aCollaboratorTabEqualToALeadTabRefusesToStart}: distinct tabs load cleanly. */
+    @Test
+    void aLeadAndACollaboratorWithDistinctTabsAreAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("lead-collaborator-ok.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead tab"
+                  collaborators:
+                    alex:
+                      tab: "collab tab"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateLeadTabPrefixes);
+    }
+
+    /**
+     * fleetd #669: a pane-placed member can land in a collaborator's labelled tab exactly as it
+     * can land in a lead's — {@code validatePanePlacementAgainstLeadTabs()} must fire even when
+     * {@code fleet.leaders} is empty, which is the early-return the brief flagged as the bug.
+     */
+    @Test
+    void aPanePlacedProfileWithACollaboratorTabRefusesToStartEvenWithNoLeaders(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("pane-hazard-collaborator.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collab: alex"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                cfg::validatePanePlacementAgainstLeadTabs);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
+    /** Control: a pane-placed profile with no lead or collaborator tab configured is allowed. */
+    @Test
+    void aPanePlacedProfileWithNoLeaderOrCollaboratorTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-no-tab-at-all.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  collaborators:
+                    alex: {}
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a collaborator with no tab feeds nothing into the scanner, so pane placement is safe");
+    }
+
     // ── CB-548: the architects registry ────────────────────────────────────────────────────────
 
     @Test
@@ -1191,6 +1539,60 @@ class FleetConfigTest {
         assertEquals(Set.of("sonnet"), cfg.fleet().pool(MemberRole.REVIEWER).keySet());
     }
 
+    /**
+     * A duplicated name in {@code fleet.collaborators} is refused at parse time, like any other
+     * {@code fleet:} pool. See {@link #duplicateSlotNamesInOnePoolAreRejectedAtParseTime}.
+     */
+    @Test
+    void duplicateCollaboratorNamesAreRejectedAtParseTime(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("collaborator-dup.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  collaborators:
+                    alex:
+                      tab: "collab: alex"
+                    alex:
+                      tab: "collab: alex, second"
+                """);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, () -> FleetConfig.load(f));
+        assertTrue(e.getMessage().contains("alex"),
+                "the refusal names the duplicated entry, was: " + e.getMessage());
+        assertTrue(e.getMessage().contains("fleet.collaborators"),
+                "the refusal names the pool the duplicate is in, was: " + e.getMessage());
+    }
+
+    /**
+     * Control for {@link #duplicateCollaboratorNamesAreRejectedAtParseTime}: the same name reused
+     * across the collaborators registry and a member role pool is the role × profile matrix doing
+     * its job in the other pool, not a mistake — only a repeat within one pool loses an entry.
+     */
+    @Test
+    void theSameNameInCollaboratorsAndAnotherPoolIsNotADuplicate(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("collaborator-cross-pool.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                fleet:
+                  architects:
+                    alex:
+                      profile: sonnet
+                  collaborators:
+                    alex:
+                      tab: "collab: alex"
+                """);
+
+        FleetConfig cfg = assertDoesNotThrow(() -> FleetConfig.load(f));
+        assertEquals(Set.of("alex"), cfg.fleet().pool(MemberRole.ARCHITECT).keySet());
+        assertEquals(Set.of("alex"), cfg.fleet().collaborators().keySet());
+    }
+
     @Test
     void duplicateKeysOutsideTheFleetPoolsAreUnaffected(@TempDir Path dir) throws Exception {
         // The duplicate check is scoped to the fleet pools — a duplicate elsewhere is not this

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -17,63 +17,21 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
- * The gap this class exists to close: mutation testing on the fleetd ticket "central allow-list
- * of usable models" found that although {@link FleetConfig#validateModels()}'s own logic was well
- * pinned, nothing proved either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()})
- * still invoked it — deleting the call site left the full suite green (1478/0/0/0). A follow-up
- * measurement (same technique — remove one call site, run the suite, not read the code) found the
- * SAME gap for all five of {@link FleetConfig}'s other validators at startup, and for four of the
- * six inside {@link ConfigRef#reload()}. This is a class of gap, not one line's mistake: every one
- * of those thirteen tests called the validator itself directly, never the real caller that was
- * supposed to.
+ * Tests the reflective validator sweep and {@link FleetConfig#validateAll()} reachability.
  *
- * <p>The fix replaces the six individual {@code cfg.validateXxx()} calls at each of the two real
- * call sites with one {@link FleetConfig#validateAll()}, which reaches every validator by
- * reflection rather than by a hand-maintained list of names. A hand-maintained list of six names
- * would have exactly the defect it replaces: the seventh validator someone adds next month has no
- * reason to be added to it, and nothing would say so. This class proves TWO separate claims, and
- * keeps them separate on purpose:
- *
- * <ol>
- *   <li>{@link #theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames()} and its neighbours
- *       prove the reflective sweep itself ({@link FleetConfig#invokeAllValidators}) is a general
- *       mechanism — it runs whatever public, no-arg, void {@code validateXxx()} methods a class
- *       happens to declare today, including a class with more of them than {@link FleetConfig}
- *       has right now. This is the proof that a future, real seventh validator on {@link
- *       FleetConfig} would be swept automatically, without needing to add a real (unwanted)
- *       seventh validator just to exercise the claim.</li>
- *   <li>{@link #validateAllReachesEveryOneOfTodaysRealValidators()} proves {@link
- *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
- *       reaches every one of today's real validators — reusing the exact minimal failing
- *       configurations {@code FleetConfigTest} already established for each one directly, plus a
- *       dedicated fixture for {@link FleetConfig#validateLeadRollover()}, which no other test
- *       drives through {@code validateAll()} — so a single call to {@code validateAll()} is shown
- *       to reproduce every one of those failures.</li>
- * </ol>
- *
- * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
- * FleetdStartupValidationTest} (which prove the real startup call site still calls {@code
- * validateAll()}) and the {@code ConfigRefTest} reload tests (which prove the same for {@link
- * ConfigRef#reload()}), removing {@code cfg.validateAll();} from either real call site now fails
- * a test in this module.
- *
- * <p><b>What is NOT pinned, measured rather than assumed.</b> Reverting {@link
- * FleetConfig#validateAll()} to a hardcoded list of today's method calls leaves the whole
- * suite green. Nothing ties {@code validateAll()} to
- * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
- * 2 proves {@code validateAll()} reaches today's validators, and a hardcoded list satisfies both. So the
- * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
- * #fleetConfigDeclaresExactlyTheseValidatorsToday()}: it fails the moment any validator is added
- * or removed, which forces whoever changes the set to look at this file.
+ * <p>{@link #theSweepRunsEveryValidateMethodOnAnUnrelatedClass()} and its neighbours
+ * prove that {@link FleetConfig#invokeAllValidators} runs each public, no-arg, void
+ * {@code validateXxx()} method on its target. {@link #fleetConfigDeclaresExactlyTheseValidatorsToday()}
+ * is the canary for the validator set. {@link #validateAllReachesEveryOneOfTodaysRealValidators()}
+ * is the reachability check for that set.
  */
 class FleetConfigValidateAllTest {
 
-    // ── Claim 1: the reflective sweep is a general mechanism, not six names in disguise ──────────
+    // ── Claim 1: the reflective sweep is a general mechanism ─────────────────────────────────────
 
     /**
-     * A throwaway fixture class, unrelated to {@link FleetConfig} in every way except shape: three
-     * public, no-arg, void methods named {@code validateXxx}. Proves the sweep works on ANY class
-     * with this shape, not on something special-cased to {@link FleetConfig}.
+     * Fixture with public, no-arg, void methods named {@code validateXxx}. It proves the sweep uses
+     * the target's method shape rather than special handling for {@link FleetConfig}.
      */
     static class ThreeValidators {
         final List<String> ran = new ArrayList<>();
@@ -92,7 +50,7 @@ class FleetConfigValidateAllTest {
     }
 
     @Test
-    void theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames() {
+    void theSweepRunsEveryValidateMethodOnAnUnrelatedClass() {
         ThreeValidators target = new ThreeValidators();
         FleetConfig.invokeAllValidators(target);
         assertEquals(List.of("validateAlpha", "validateBeta", "validateGamma"), target.ran,
@@ -102,12 +60,8 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * The core of the "self-maintaining" requirement: the exact same class shape as {@link
-     * ThreeValidators}, plus one more method — standing in for "a developer adds a validator next
-     * month". Nothing about the sweep changes to pick it up; the new method is invoked purely
-     * because it exists and matches the shape. This is what makes adding a seventh real validator
-     * to {@link FleetConfig} safe without touching {@link FleetConfig#validateAll()} or either
-     * call site — there is no "wire it in" step left to forget.
+     * Fixture with an added valid method. It proves the sweep reaches a method because it matches
+     * the validator shape.
      */
     static class FourValidators {
         final List<String> ran = new ArrayList<>();
@@ -135,7 +89,7 @@ class FleetConfigValidateAllTest {
         FleetConfig.invokeAllValidators(target);
         assertEquals(List.of("validateAlpha", "validateBeta", "validateDelta", "validateGamma"),
                 sorted(target.ran),
-                "the fourth method must be reached automatically — proving a class can grow the "
+                "the added method must be reached automatically — proving a class can grow the "
                         + "set of things it validates with no change to the sweep itself");
     }
 
@@ -297,16 +251,16 @@ class FleetConfigValidateAllTest {
                   port: 8765
                 """, "auth.mode: token");
 
-        // validateLeadTabPrefixes: a fleet-wide tabLabel that starts with a lead's own tabPrefix.
+        // validateLeadTabPrefixes: a fleet-wide tabLabel that equals a lead tab.
         assertValidateAllRefuses(dir, "lead-tab-prefixes.yaml", """
                 bind:
                   host: 127.0.0.1
                   port: 8765
                 fleet:
-                  tabLabel: "lead: {role} {profile}"
+                  tabLabel: "alpha"
                   leaders:
                     opus:
-                      tab: "lead: opus"
+                      tab: "alpha"
                 """, "fleet.tabLabel");
 
         // validateSubscriptionProfiles: subscription: true with env: reseating ANTHROPIC_BASE_URL.

fleetd/src/test/java/dev/ltms/fleet/herdr/LeadTabScannerTest.java

@@ -163,6 +163,13 @@ class LeadTabScannerTest {
         return new LeadTabScanner(herdr, tabToName, Set.of("fleetd-workers"), TTL, clock::get);
     }
 
+    private LeadTabScanner scannerWithCollaborators(TopologyHerdr herdr, Map<String, String> tabToName,
+                                                     Map<String, String> collaboratorTabToName,
+                                                     AtomicLong clock) {
+        return new LeadTabScanner(herdr, tabToName, collaboratorTabToName,
+                Set.of("fleetd-workers"), TTL, clock::get);
+    }
+
     @Test
     void everyConfiguredTabBecomesALeadNamedByItsEntry() {
         Map<String, String> leads = scanner(twoLeads(), twoLeadsConfigured(), new AtomicLong()).get();
@@ -464,4 +471,75 @@ class LeadTabScannerTest {
 
         assertEquals(afterFirst, herdr.calls, "the failure path must be rate-limited too");
     }
+
+    // ── fleetd #669 Unit D: a collaborator tab is matched the same way as a lead tab, one pass ─────
+
+    @Test
+    void aConfiguredCollaboratorTabIsReportedByCollaboratorsNotByGet() {
+        TopologyHerdr herdr = new TopologyHerdr()
+                .workspace("w1", "main")
+                .tab("w1:t1", "w1", "collab: ops")
+                .pane("w1:p1", "w1:t1", "term_ops");
+        LeadTabScanner s = scannerWithCollaborators(herdr, Map.of(), Map.of("collab: ops", "ops"),
+                new AtomicLong());
+
+        assertEquals(Map.of("term_ops", "ops"), s.collaborators(),
+                "a collaborator tab is matched exactly like a lead tab");
+        assertEquals(Map.of(), s.get(), "a collaborator tab must never also appear as a lead");
+    }
+
+    /**
+     * Criterion 4, scanner level: a collaborator tab that is labelled but runs no agent is not
+     * reported — the same #359 liveness cross-check a lead tab gets.
+     */
+    @Test
+    void aDeadCollaboratorTabIsNotReported() {
+        TopologyHerdr herdr = new TopologyHerdr()
+                .workspace("w1", "main")
+                .tab("w1:t1", "w1", "collab: ops")
+                .pane("w1:p1", "w1:t1", "term_ops")
+                .deadAgent("w1:t1");
+        LeadTabScanner s = scannerWithCollaborators(herdr, Map.of(), Map.of("collab: ops", "ops"),
+                new AtomicLong());
+
+        assertFalse(s.collaborators().containsKey("term_ops"),
+                "a dead collaborator tab must never resolve as a live collaborator");
+    }
+
+    /**
+     * Both kinds are matched in a single pass over the same tab list — not a second scanner, not a
+     * second scan. Proven by herdr call count: scanning one lead tab and one collaborator tab in the
+     * same instance costs exactly as many calls as scanning two lead tabs in {@link #twoLeads()}.
+     */
+    @Test
+    void leadsAndCollaboratorsAreMatchedInOnePassOverTheSameScan() {
+        TopologyHerdr oneOfEach = new TopologyHerdr()
+                .workspace("w1", "main")
+                .tab("w1:t1", "w1", "lead: opus-5.0")
+                .tab("w1:t2", "w1", "collab: ops")
+                .pane("w1:p1", "w1:t1", "term_opus")
+                .pane("w1:p2", "w1:t2", "term_ops");
+        LeadTabScanner s = scannerWithCollaborators(oneOfEach, Map.of("lead: opus-5.0", "opus-5.0"),
+                Map.of("collab: ops", "ops"), new AtomicLong());
+
+        assertEquals(Map.of("term_opus", "opus-5.0"), s.get());
+        assertEquals(Map.of("term_ops", "ops"), s.collaborators());
+
+        TopologyHerdr twoLeadsBaseline = twoLeads();
+        scanner(twoLeadsBaseline, twoLeadsConfigured(), new AtomicLong()).get();
+
+        assertEquals(twoLeadsBaseline.calls, oneOfEach.calls,
+                "one lead tab + one collaborator tab must cost exactly as many herdr calls as two "
+                        + "lead tabs — proof this is one pass, not a second scan");
+    }
+
+    /** Regression: with no collaborators configured, every existing lead-only behaviour is unchanged. */
+    @Test
+    void anEmptyCollaboratorMapLeavesCollaboratorsEmptyAndGetUnaffected() {
+        LeadTabScanner s = scannerWithCollaborators(twoLeads(), twoLeadsConfigured(), Map.of(),
+                new AtomicLong());
+
+        assertEquals(Map.of(), s.collaborators());
+        assertEquals(Map.of("term_opus", "opus-5.0", "term_gpt", "gpt-sol-5.6"), s.get());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -63,6 +63,17 @@ class FleetMcpAuthzTest {
 
     /** A fully wired FleetMcp on fakes — constructing it is itself part of what is under test. */
     private FleetMcp mcp(boolean enforce) {
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> 999_999);
+        return mcp(enforce, CallerResolver.withLeadsAndMembers(identity, false, null,
+                Map::of, new MemberRegistry(null)));
+    }
+
+    /**
+     * As {@link #mcp(boolean)}, with an explicit {@link CallerResolver} — so a test can wire known
+     * leads/collaborators and drive {@code denyFor}'s real {@code knownLeadOrCollaborator()}
+     * classifier instead of the default empty one.
+     */
+    private FleetMcp mcp(boolean enforce, CallerResolver callers) {
         FleetConfig.Profile cfg = new FleetConfig.Profile(
                 "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
                 "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
@@ -83,9 +94,7 @@ class FleetMcpAuthzTest {
         // to be omitted to reach "legacy" is now always real, and AuthorizationMode is the
         // separate, explicit choice that governs enforcement.
         mcp = new FleetMcp(messages, workers, sessions, identity, sessions.asPresence(),
-                new PrimaryRegistry(null),
-                CallerResolver.withLeadsAndMembers(identity, false, null,
-                Map::of, new MemberRegistry(null)),
+                new PrimaryRegistry(null), callers,
                 enforce ? FleetMcp.AuthorizationMode.ENFORCED : FleetMcp.AuthorizationMode.UNENFORCED,
                 metrics, FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
                 FleetMcp.QuarantineSource.none(), null, FleetMcp.OutageSource.none(),
@@ -97,6 +106,7 @@ class FleetMcpAuthzTest {
     private static final Principal WORKER_A = Principal.worker("term_a", 200);
     private static final Principal ANON = Principal.anonymous();
     private static final Principal ARCH_DESIGN = Principal.architect("lead-designer", "term_design", 400);
+    private static final Principal COLLABORATOR = Principal.collaborator("ops", "term_collab", 600);
 
     // --- the table, enforced on THIS path too ---------------------------------------------------
 
@@ -156,6 +166,45 @@ class FleetMcpAuthzTest {
         }
     }
 
+    /**
+     * fleetd #669 Unit A: {@code SEND} is split into three actions ({@link Authz.Action#SEND},
+     * {@link Authz.Action#COORD_SEND}, {@link Authz.Action#ANSWER}), each carrying the same grant
+     * the one undivided action gave. An architect holds all three, exactly as it held the one.
+     */
+    @Test
+    void anArchitectMayUseAllThreeSendShapesOverMcp() {
+        FleetMcp m = mcp(true);
+        for (Authz.Action a : new Authz.Action[]{Authz.Action.SEND, Authz.Action.COORD_SEND,
+                Authz.Action.ANSWER}) {
+            assertNull(m.denyFor(ARCH_DESIGN, a, "term_a"),
+                    a + " carries the same grant the undivided SEND action gave an architect");
+        }
+    }
+
+    /** The other half of the same split: a worker is excluded from all three, as it was from one. */
+    @Test
+    void aWorkerMayNotUseAnySendShapeOverMcp() {
+        FleetMcp m = mcp(true);
+        for (Authz.Action a : new Authz.Action[]{Authz.Action.SEND, Authz.Action.COORD_SEND,
+                Authz.Action.ANSWER}) {
+            McpSchema.CallToolResult denied = m.denyFor(WORKER_A, a, "term_a");
+            assertNotNull(denied, a + " must stay refused to a worker");
+            assertTrue(denied.isError(), "a refusal is returned as an MCP tool error");
+        }
+    }
+
+    /**
+     * fleetd #669 Unit A / #678: {@code TASK_READ} (ticket polling, session status) is split out of
+     * the roster-only {@code READ}, carrying forward the grant the undivided action gave. A worker
+     * still has both — it never gained or lost anything by the split.
+     */
+    @Test
+    void aWorkerKeepsBothReadActionsAfterTheSplit() {
+        FleetMcp m = mcp(true);
+        assertNull(m.denyFor(WORKER_A, Authz.Action.READ, null));
+        assertNull(m.denyFor(WORKER_A, Authz.Action.TASK_READ, null));
+    }
+
     @Test
     void anArchitectMayReplyAndAskOnlyAsItsOwnPaneOverMcp() {
         FleetMcp m = mcp(true);
@@ -187,6 +236,39 @@ class FleetMcpAuthzTest {
                 "the caller IS authenticated — it is just not the right role");
     }
 
+    /**
+     * {@code denyFor} passes the real production classifier, not a test-supplied one — no
+     * terminal is recognised as a configured lead or collaborator, so a collaborator's SEND is
+     * refused over MCP.
+     */
+    @Test
+    void aCollaboratorMayNotSendOverMcpWithTheRealProductionClassifier() {
+        FleetMcp m = mcp(true);
+        McpSchema.CallToolResult denied = m.denyFor(COLLABORATOR, Authz.Action.SEND, "term_lead");
+        assertNotNull(denied, "no terminal is recognised as a lead or collaborator yet");
+        assertTrue(denied.isError());
+    }
+
+    /**
+     * fleetd #669 Unit D: wires a real {@link CallerResolver} with a known lead and a known
+     * collaborator tab, and leaves a spawned member's own terminal recognised by neither map — so a
+     * collaborator's SEND reaches both named peers and is refused for the spawned member's terminal,
+     * over MCP's {@code denyFor}.
+     */
+    @Test
+    void aCollaboratorMaySendToAKnownLeadOrCollaboratorButNotToASpawnedMembersTerminal() {
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> 999_999);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, false, null,
+                () -> Map.of("term_lead_known", "lead-x"), new MemberRegistry(null),
+                t -> null, () -> Map.of("term_collab_known", "ops2"));
+        FleetMcp m = mcp(true, callers);
+
+        assertNull(m.denyFor(COLLABORATOR, Authz.Action.SEND, "term_lead_known"));
+        assertNull(m.denyFor(COLLABORATOR, Authz.Action.SEND, "term_collab_known"));
+        assertNotNull(m.denyFor(COLLABORATOR, Authz.Action.SEND, "term_a"),
+                "a spawned member's own terminal must stay unreachable, even once the classifier is real");
+    }
+
     @Test
     void theLegacyConstructorLeavesTheGateOpen() {
         // The 22 pre-existing FleetMcpTest cases rely on no authorization being enforced.
@@ -297,35 +379,53 @@ class FleetMcpAuthzTest {
      * the whole time the defect was live -- the table was right, the action fed to it was wrong.
      */
     @Test
-    void pollingByTargetIsADrainAndPollingByTicketIsARead() {
+    void pollingByTargetIsADrainAndPollingByTicketIsATaskRead() {
         assertEquals(Authz.Action.DRAIN, FleetMcp.pollAction("term_b", null),
                 "poll by target removes the replies — that is a drain, not an observation");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, null),
-                "poll by ticket changes nothing");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction("  ", null),
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction(null, null),
+                "poll by ticket changes nothing, but is not the roster-only READ action");
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction("  ", null),
                 "a blank target is an absent target");
     }
 
     /**
      * fleetd #421: a coordId branch is a THIRD operation behind fleet_poll's one name, and it must
-     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ}, even though this
-     * branch also consumes nothing. READ's grant is open to every authenticated role on the premise
-     * that the roster carries no secrets; a lead-to-lead body is not the roster, so folding this
-     * branch into READ would let any worker read every peer lead's mail in full. coordId also takes
-     * priority over target when both happen to be present — it addresses a different inbox entirely.
+     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ} or {@link
+     * Authz.Action#TASK_READ}, even though this branch also consumes nothing. A lead-to-lead body
+     * is not the roster and not a ticket/status read, so folding this branch into either would let
+     * any worker or architect read every peer lead's mail in full. coordId also takes priority over
+     * target when both happen to be present — it addresses a different inbox entirely.
      */
     @Test
-    void pollingByCoordIdIsACoordReadNeverAPlainRead() {
+    void pollingByCoordIdIsACoordReadNeverAPlainOrTaskRead() {
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction(null, "mac-opus"),
-                "reading held peer mail must not be mapped to the everyone-readable READ action");
+                "reading held peer mail must not be mapped to a widely-readable action");
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("  ", "mac-opus"),
                 "a blank target must not fall through to READ/DRAIN when coordId is present");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, "  "),
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.pollAction(null, "  "),
                 "a blank coordId is an absent coordId, same as target/ticket");
         assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("term_b", "mac-opus"),
                 "coordId takes priority over target — this is a different inbox, not a drain");
     }
 
+    /**
+     * {@code fleet_send} is three call shapes behind one tool name, exactly as {@code fleet_poll}
+     * is (fleetd #669 Unit A). {@link FleetMcp#sendAction} picks the action from the arguments, not
+     * the handler, for the same reason {@link FleetMcp#pollAction} does: a test can assert the
+     * mapping the handler actually uses.
+     */
+    @Test
+    void sendMapsToThreeDifferentActionsByItsArguments() {
+        assertEquals(Authz.Action.SEND, FleetMcp.sendAction(null, null),
+                "a plain delivery, with neither coordId nor turnId, is a local SEND");
+        assertEquals(Authz.Action.COORD_SEND, FleetMcp.sendAction("mac-opus", null),
+                "coordId addresses a peer lead over the coordination broker");
+        assertEquals(Authz.Action.ANSWER, FleetMcp.sendAction(null, "turn-1"),
+                "turnId resolves a worker's blocked question");
+        assertEquals(Authz.Action.COORD_SEND, FleetMcp.sendAction("mac-opus", "turn-1"),
+                "coordId takes priority over turnId, mirroring sendToLead's own mutual-exclusion check");
+    }
+
     @Test
     void everyRegisteredToolHasItsHandlerActionPinned() {
         // fleetd #469: this used to scrape FleetMcp.java's tool("…") calls for the registered set —
@@ -344,16 +444,22 @@ class FleetMcpAuthzTest {
                 () -> tool + " is registered but has no pinned authorization action"));
 
         assertEquals(Authz.Action.SEND, FleetMcp.toolAction("fleet_send", Map.of()));
+        assertEquals(Authz.Action.SEND,
+                FleetMcp.toolAction("fleet_send", Map.of("sessionId", "term_a", "content", "hi")));
+        assertEquals(Authz.Action.COORD_SEND,
+                FleetMcp.toolAction("fleet_send", Map.of("coordId", "mac-opus", "content", "hi")));
+        assertEquals(Authz.Action.ANSWER,
+                FleetMcp.toolAction("fleet_send", Map.of("turnId", "turn-1", "content", "hi")));
         assertEquals(Authz.Action.REPLY, FleetMcp.toolAction("fleet_reply", Map.of()));
         assertEquals(Authz.Action.ASK, FleetMcp.toolAction("fleet_ask", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_status", Map.of()));
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.toolAction("fleet_status", Map.of()));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_ack", Map.of()));
         assertEquals(Authz.Action.SPAWN, FleetMcp.toolAction("fleet_spawn", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_list", Map.of()));
         assertEquals(Authz.Action.STOP, FleetMcp.toolAction("fleet_stop", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_profiles", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_whoami", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
+        assertEquals(Authz.Action.TASK_READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_poll", Map.of("target", "term_b")));
         assertEquals(Authz.Action.COORD_READ,
                 FleetMcp.toolAction("fleet_poll", Map.of("coordId", "mac-opus")));

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -1837,6 +1837,32 @@ class FleetMcpTest {
         assertTrue(out.contains("\"sessionId\":\"term_design\""), out);
     }
 
+    /**
+     * A collaborator reports its own role and name, never the {@code leader} key a lead gets —
+     * {@code role} already reads {@code "collaborator"}, so a {@code leader} key alongside it
+     * would be self-contradicting. Control: the same call shape fed a named lead must still carry
+     * {@code leader}, so this is not passing because the key stopped being emitted for everyone.
+     */
+    @Test
+    void whoamiReportsACollaboratorWithNoLeaderKeyButALeadStillGetsOne() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw"));
+
+        McpSchema.CallToolResult collabRes = FleetMcp.whoami(
+                Principal.collaborator("ops", "term_collab", 700), sessions);
+        assertNotEquals(Boolean.TRUE, collabRes.isError());
+        String collabOut = textOf(collabRes);
+        assertTrue(collabOut.contains("\"role\":\"collaborator\""), collabOut);
+        assertTrue(collabOut.contains("\"collaborator\":\"ops\""), collabOut);
+        assertTrue(collabOut.contains("\"sessionId\":\"term_collab\""), collabOut);
+        assertFalse(collabOut.contains("leader"), collabOut);
+
+        McpSchema.CallToolResult leadRes = FleetMcp.whoami(
+                Principal.leader("opus", "term_lead", 100), sessions);
+        String leadOut = textOf(leadRes);
+        assertTrue(leadOut.contains("\"leader\":\"opus\""), leadOut);
+    }
+
     /**
      * CB-548: an architect SEND delegates as its own pane (recording the per-target delegation) but
      * must NEVER become the legacy singleton "primary" fallback — the per-target map does not cure

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -60,13 +60,25 @@ class MessageServiceTest {
         inbox.own(T);
     }
 
+    /**
+     * A send budget large enough that a test's own setup — {@link #awaitWaiting()} plus whatever
+     * status transitions it drives afterward — can never compete with it for the same clock. A test
+     * that needs {@code send.get(...)}'s own window to be the only timing bound it depends on uses
+     * {@link #sendAsync(String, long)} with this value instead of the default 5000 ms.
+     */
+    private static final long GENEROUS_SEND_BUDGET_MILLIS = 30_000;
+
     /** Run {@code send} on a background thread; the current thread drives the worker's turn. */
     private CompletableFuture<MessageService.Reply> sendAsync() {
         return sendAsync("do the task");
     }
 
     private CompletableFuture<MessageService.Reply> sendAsync(String content) {
-        return CompletableFuture.supplyAsync(() -> messages.send(T, content, 5000));
+        return sendAsync(content, 5000);
+    }
+
+    private CompletableFuture<MessageService.Reply> sendAsync(String content, long timeoutMillis) {
+        return CompletableFuture.supplyAsync(() -> messages.send(T, content, timeoutMillis));
     }
 
     private void awaitWaiting() throws InterruptedException {
@@ -80,7 +92,7 @@ class MessageServiceTest {
 
     @Test
     void completionFallbackResolvesATurnThatNeverCalledFleetReply() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
+        CompletableFuture<MessageService.Reply> send = sendAsync("do the task", GENEROUS_SEND_BUDGET_MILLIS);
         awaitWaiting();
 
         herdr.readText("$ prompt");                // pre-turn pane: no answer yet (baseline reference)
@@ -96,6 +108,32 @@ class MessageServiceTest {
         assertTrue(reply.completed(), "a scraped completion still counts as completed");
     }
 
+    /**
+     * Pins {@link #GENEROUS_SEND_BUDGET_MILLIS} as the budget {@link
+     * #completionFallbackResolvesATurnThatNeverCalledFleetReply} depends on. A 5500 ms delay between
+     * {@link #awaitWaiting()} and the status transitions that drive completion stands in for a loaded
+     * machine's setup overhead — comfortably past the 5000 ms budget this send no longer uses, and
+     * still well inside this method's own 30 000 ms budget. The only clock this test depends on is
+     * {@code send.get}'s own 10 s window.
+     */
+    @Test
+    void completionFallbackSurvivesASlowHarnessBecauseItsSendBudgetIsNotTheBindingClock() throws Exception {
+        CompletableFuture<MessageService.Reply> send = sendAsync("do the task", GENEROUS_SEND_BUDGET_MILLIS);
+        awaitWaiting();
+
+        Thread.sleep(5500);
+
+        herdr.readText("$ prompt");
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        herdr.readText("BUILD GREEN: 391 files");
+        injector.onStatus(T, AgentStatus.IDLE);
+
+        MessageService.Reply reply = send.get(10, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.COMPLETED_UNREPLIED, reply.outcome(),
+                "a slow harness must not be mistaken for a timed-out delivery");
+    }
+
     @Test
     void completionFallbackReplacesAnEchoedInjectedBriefWithNoReportOutcome() throws Exception {
         String brief = "Implement the requested change. ".repeat(20);

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppAuthTest.java

@@ -1,8 +1,12 @@
 package dev.ltms.fleet.rest;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.auth.Authz;
 import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.Principal;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -18,6 +22,7 @@ import dev.ltms.fleet.msg.Rendezvous;
 import dev.ltms.fleet.session.FakeWorktrees;
 import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.testing.CapturedLog;
 import io.javalin.Javalin;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
@@ -28,10 +33,13 @@ import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.ArrayList;
 import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
+import java.util.function.Predicate;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -122,12 +130,60 @@ class FleetAppAuthTest {
         assertEquals(Authz.Action.DRAIN, FleetApp.routeAction("GET /sessions/{id}/replies"));
         assertEquals(Authz.Action.ASK, FleetApp.routeAction("POST /sessions/{id}/ask"));
         for (String route : Set.of("GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
+                "GET /member-credentials")) {
             assertEquals(Authz.Action.READ, FleetApp.routeAction(route), route);
         }
+        for (String route : Set.of("GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
+            assertEquals(Authz.Action.TASK_READ, FleetApp.routeAction(route), route);
+        }
         assertThrows(IllegalArgumentException.class, () -> FleetApp.routeAction("GET /healthz"));
     }
 
+    /**
+     * fleetd #669 Unit A: {@code POST /sessions/{id}/message} is two call shapes behind one route,
+     * mirroring {@code fleet_send}'s MCP-side split into {@link Authz.Action#SEND} and {@link
+     * Authz.Action#ANSWER} ({@code FleetMcp#sendAction}). The route never carries a {@code coordId}
+     * shape — that peer-lead route is MCP-only — so only these two apply here.
+     */
+    @Test
+    void theMessageRouteIsASendWithNoTurnIdAndAnAnswerWithOne() {
+        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message", null));
+        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message", "  "));
+        assertEquals(Authz.Action.ANSWER, FleetApp.routeAction("POST /sessions/{id}/message", "turn-1"));
+    }
+
+    /**
+     * fleetd #689: {@code answerGatePasses} is the second, conditional gate behind {@code
+     * sendMessage}'s coarse {@link Authz.Action#SEND} check. With the {@code ANSWER} grant denied,
+     * a {@code turnId}-bearing request is refused while a plain one still passes — and the denied
+     * permit is queried only for the {@code turnId} case, never for the plain one, which is what
+     * proves this is a genuinely separate, conditional check rather than the {@code SEND} check
+     * renamed or an unconditional call whose result is ignored. Flipping only the {@code ANSWER}
+     * grant to allowed then flips only the {@code turnId} shape's outcome.
+     */
+    @Test
+    void answerGatePassesOnlyWhenTurnIdAbsentOrAnswerGranted() {
+        List<Authz.Action> queried = new ArrayList<>();
+        Predicate<Authz.Action> denyAnswer = action -> {
+            queried.add(action);
+            return false;
+        };
+
+        assertFalse(FleetApp.answerGatePasses("turn-1", denyAnswer),
+                "ANSWER denied ⇒ the turnId shape is refused");
+        assertEquals(List.of(Authz.Action.ANSWER), queried,
+                "the ANSWER grant, specifically, must be the one consulted");
+
+        queried.clear();
+        assertTrue(FleetApp.answerGatePasses(null, denyAnswer),
+                "no turnId ⇒ the plain shape passes even though ANSWER is denied");
+        assertTrue(FleetApp.answerGatePasses("  ", denyAnswer), "a blank turnId is treated as absent");
+        assertEquals(List.of(), queried, "the plain shape must never consult the permit at all");
+
+        assertTrue(FleetApp.answerGatePasses("turn-1", action -> true),
+                "flipping only the ANSWER grant to allowed flips only the turnId shape's outcome");
+    }
+
     private static Set<String> routesTheServerRegisters() {
         try {
             String source = Files.readString(REST_SOURCE).lines()
@@ -147,6 +203,74 @@ class FleetAppAuthTest {
         }
     }
 
+    /**
+     * {@code permitsFor} is the exact decision {@link FleetApp#allow} makes, passing the real
+     * production classifier rather than a test-supplied one — built from an empty {@link
+     * CallerResolver}, so no terminal is recognised as a configured lead or collaborator and a
+     * collaborator's SEND is refused through the REST gate.
+     */
+    @Test
+    void aCollaboratorMayNotSendOverRestWithTheRealProductionClassifier() {
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(new FakeHerdr()), _ -> 700L);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, false, null,
+                Map::of, new MemberRegistry(null));
+        Principal collaborator = Principal.collaborator("ops", "term_collab", 700);
+        assertFalse(FleetApp.permitsFor(collaborator, Authz.Action.SEND, "term_lead",
+                        callers.knownLeadOrCollaborator()),
+                "no terminal is recognised as a lead or collaborator yet");
+    }
+
+    /**
+     * fleetd #669 Unit D: wires a real {@link CallerResolver} with a known lead and a known
+     * collaborator tab, and a spawned member's own terminal recognised by neither map. A
+     * collaborator's SEND reaches the known lead and the known collaborator, and is refused for the
+     * spawned member's terminal — over the REST route, not just the unit-level classifier, so a
+     * test covering only MCP cannot leave this route open.
+     */
+    @Test
+    void aCollaboratorMaySendToAKnownLeadOrCollaboratorButNotToASpawnedMembersTerminalOverRest() throws Exception {
+        int port = startWithRealClassifier(FakeHerdr.WORKER_PID,
+                Map.of("term_lead_known", "lead-x"), Map.of("term_a", "ops2"));
+
+        HttpResponse<String> toLead = send(port, "POST", "/sessions/term_lead_known/message",
+                "{\"content\":\"hi\",\"wait\":false}", null);
+        assertEquals(202, toLead.statusCode(), toLead.body());
+
+        HttpResponse<String> toSpawnedMembersTerminal = send(port, "POST", "/sessions/term_worker/message",
+                "{\"content\":\"hi\",\"wait\":false}", null);
+        assertEquals(403, toSpawnedMembersTerminal.statusCode(), toSpawnedMembersTerminal.body());
+    }
+
+    /**
+     * As {@link #start}, but with explicit lead/collaborator maps and no spawned-member roster, so
+     * a test can wire the real {@link CallerResolver#knownLeadOrCollaborator()} classifier instead
+     * of the default empty one.
+     */
+    private int startWithRealClassifier(long pid, Map<String, String> leadTerminals,
+                                        Map<String, String> collaboratorTerminals) {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile wcfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        AgentControl agents = new AgentControl(herdr);
+        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(
+                agents, new WorkspaceControl(herdr), new SubscriptionGuard(Set.of("gx00.gw")),
+                Map.of(wcfg.profile(), wcfg), wcfg.profile(),
+                k -> "FLEETD_WORKER_TOKEN".equals(k) ? "tok-abc" : null);
+        SessionManager sessions = new SessionManager(workers, new FakeWorktrees());
+        Injector injector = new Injector(agents);
+        MessageService messages = new MessageService(agents, injector, new Rendezvous());
+
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> pid);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, false, null,
+                () -> leadTerminals, new MemberRegistry(null), t -> null, () -> collaboratorTerminals);
+        metrics = FleetMetrics.create(sessions, new dev.ltms.fleet.msg.InMemoryReplyInbox());
+
+        app = new FleetApp(herdr, workers, sessions, messages, sessions.asPresence(), null,
+                callers, metrics).build().start("127.0.0.1", 0);
+        return app.port();
+    }
+
     // --- loopback-trust: the caller is the primary -------------------------------------------
 
     @Test
@@ -192,6 +316,107 @@ class FleetAppAuthTest {
                 "draining an inbox is the primary's collection step");
     }
 
+    /**
+     * fleetd #669 Unit A: the {@code turnId} shape of {@code POST /sessions/{id}/message} maps to
+     * {@link Authz.Action#ANSWER}, not the plain {@link Authz.Action#SEND} the test above drives —
+     * a worker must stay refused on this shape too, exactly as it was refused on the one undivided
+     * action before the split.
+     */
+    @Test
+    void aWorkerMayNotAnswerAnotherSessionsBlockedQuestionOverRest() throws Exception {
+        int port = start(FakeHerdr.WORKER_PID, false, null);
+
+        assertEquals(403, send(port, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null).statusCode(),
+                "resolving another session's blocked question would be a worker escalating too");
+    }
+
+    /**
+     * fleetd #689: a caller refused the coarse {@link Authz.Action#SEND} grant is refused on
+     * {@code SEND} specifically, even on the {@code turnId}-bearing shape that otherwise raises
+     * the check to {@link Authz.Action#ANSWER} — proving {@code turnId} was never read from the
+     * body before the refusal (reading it would have changed which action is named in the 403).
+     * The same caller refused with no body at all gets the identical detail, which could not hold
+     * if the decision depended on anything read from the body. Control: a caller who IS granted
+     * reaches past the gate and the body is used normally.
+     */
+    @Test
+    void aDeniedCallerIsRefusedOnSendEvenWithATurnIdBodyAndNeverReadsTheBody() throws Exception {
+        int workerPort = start(FakeHerdr.WORKER_PID, false, null); // denied: not primary/architect
+
+        HttpResponse<String> withTurnId = send(workerPort, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+        assertEquals(403, withTurnId.statusCode());
+        assertTrue(withTurnId.body().contains("may not SEND"),
+                "the SEND check must be the one that fired, not ANSWER — ANSWER would only be "
+                        + "reachable by having already read turnId out of the body");
+
+        HttpResponse<String> noBody = send(workerPort, "POST", "/sessions/term_b/message", null, null);
+        assertEquals(403, noBody.statusCode());
+        assertTrue(noBody.body().contains("may not SEND"),
+                "refused identically with no body at all — the refusal cannot depend on body content");
+
+        // Control: a primary IS granted SEND, so the same turnId body is read and acted on —
+        // reaching messages.answer, which reports this unknown turnId as a stale one.
+        int primaryPort = start(999_999, false, null);
+        HttpResponse<String> granted = send(primaryPort, "POST", "/sessions/term_b/message",
+                "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+        assertEquals(409, granted.statusCode());
+        assertTrue(granted.body().contains("stale_turn"), "a granted caller's body IS read and acted on");
+    }
+
+    /**
+     * fleetd #689 (ticket comment 18353): the only place {@code sendMessage}'s call to {@code
+     * answerGatePasses} is observable is the audit trail — {@code allow()} logs an {@code
+     * "allowed"} entry for every granted action except {@code READ}/{@code METRICS}/{@code
+     * TASK_READ}, and {@code ANSWER} is none of those. A granted {@code turnId} request must
+     * therefore log both a {@code SEND} and an {@code ANSWER} entry; a granted plain request must
+     * log {@code SEND} alone. A unit test of the extracted helper pins the helper; this pins the
+     * call site — deleting the {@code answerGatePasses} call from {@code sendMessage} leaves the
+     * helper's own test green but turns this one red.
+     */
+    @Test
+    void aGrantedTurnIdRequestAuditsBothSendAndAnswerButAPlainRequestAuditsSendAlone() throws Exception {
+        int port = start(999_999, false, null); // primary: granted both SEND and ANSWER
+        ObjectMapper mapper = new ObjectMapper();
+
+        try (CapturedLog audit = CapturedLog.at("audit", Level.INFO)) {
+            send(port, "POST", "/sessions/term_b/message",
+                    "{\"turnId\":\"turn-1\",\"content\":\"hi\"}", null);
+
+            List<String> allowed = allowedActions(audit, mapper);
+            assertTrue(allowed.contains("SEND"),
+                    "a turnId request must still clear the coarse SEND grant first");
+            assertTrue(allowed.contains("ANSWER"),
+                    "a turnId request must ALSO clear the ANSWER grant — this is the call site itself");
+        }
+
+        try (CapturedLog audit = CapturedLog.at("audit", Level.INFO)) {
+            send(port, "POST", "/sessions/term_b/message",
+                    "{\"content\":\"hi\",\"timeoutMs\":50}", null);
+
+            List<String> allowed = allowedActions(audit, mapper);
+            assertEquals(List.of("SEND"), allowed,
+                    "a plain request must log SEND and nothing else — ANSWER is conditional on "
+                            + "turnId, not something every request happens to log");
+        }
+    }
+
+    private static List<String> allowedActions(CapturedLog audit, ObjectMapper mapper) {
+        return audit.events().stream()
+                .map(ILoggingEvent::getFormattedMessage)
+                .map(line -> {
+                    try {
+                        return mapper.readTree(line);
+                    } catch (Exception e) {
+                        throw new AssertionError("audit line is not valid JSON: " + line, e);
+                    }
+                })
+                .filter(n -> "allowed".equals(n.path("outcome").asText()))
+                .map(n -> n.path("action").asText())
+                .toList();
+    }
+
     // --- token mode ---------------------------------------------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppTest.java

@@ -675,6 +675,26 @@ class FleetAppTest {
         assertEquals(400, postMessage(port, "{}").statusCode());
     }
 
+    /**
+     * fleetd #689: a body that fails to parse is rejected with 400 before {@code turnId} is ever
+     * read from it, so it reaches neither {@code messages.answer} (which needs a {@code turnId})
+     * nor {@code messages.send} — confirmed here for {@code send} by the fake agent's idle status,
+     * which would otherwise make an immediate {@code agent.prompt} delivery observable.
+     */
+    @Test
+    void malformedBodyReturns400AndNeverReachesSendOrAnswer() throws Exception {
+        FakeHerdr herdr = new FakeHerdr().agentStatus("idle"); // idle ⇒ send would deliver right away if reached
+        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
+
+        HttpResponse<String> res = postMessage(port, "not json at all");
+        assertEquals(400, res.statusCode());
+        JsonNode err = mapper.readTree(res.body());
+        assertEquals("bad_request", err.get("error").asText());
+        assertEquals("body must be JSON", err.get("detail").asText());
+        assertFalse(herdr.called("agent.prompt"),
+                "a malformed body must never reach messages.send's delivery");
+    }
+
     @Test
     void sessionStatusReportsLiveAgentStatus() throws Exception {
         FakeHerdr herdr = new FakeHerdr().agentStatus("blocked");

scripts/config-edit.sh

@@ -213,6 +213,17 @@ map_masked_lines() {
   done < "$file"
 }
 
+# Masks every `scheme://user:pass@host` userinfo on one line of text, replacing just that
+# userinfo with `<redacted>` and leaving the rest of the line untouched, byte for byte. The
+# pattern stops at the first `/`, whitespace, or `@` reached after `://` — a URI's userinfo
+# component cannot contain any of those three characters — so a URI with no userinfo, followed
+# later on the same line by an unrelated `@`, never matches. The `g` flag matters: a line can
+# carry more than one URI. Shared by every caller that prints a line which may hold a
+# credentialed URI, so the bound lives in exactly one place.
+mask_url_userinfo() {
+  printf '%s\n' "$1" | sed -E 's#://[^@/[:space:]]*@#://<redacted>@#g'
+}
+
 redact() {
   local old_file="$1" new_file="$2"
   local line prefix content indent lead key old_line=0 new_line=0 in_hunk=0
@@ -270,7 +281,7 @@ redact() {
         continue
       fi
     fi
-    printf '%s\n' "$line" | sed -E 's#://[^@]*@#://<redacted>@#g'
+    mask_url_userinfo "$line"
   done
   [ "$saved_nocasematch" = 1 ] || shopt -u nocasematch
 }
@@ -580,6 +591,12 @@ install_candidate() {
 
 # -------------------------------------------------------------------------------- the report path
 #
+# Masks basic-auth userinfo (scheme://user:pass@host) in a daemon verdict line before it reaches
+# the terminal.
+mask_verdict_userinfo() {
+  mask_url_userinfo "$1"
+}
+
 # Prints the literal command the operator (or a test) can run to restore the backup by hand — the
 # absolute path to THIS script plus the overrides actually in force, so it works from any cwd.
 restore_command_line() {
@@ -599,8 +616,8 @@ restore_and_confirm() {
   ok "restored from $backup"
   if wait_for_verdict "$LOG" "$mark2" "$WAIT_SECONDS"; then
     case "$VERDICT_KIND" in
-      refused) warn "the RESTORE was also refused by the daemon: $VERDICT_LINE" ;;
-      *)       ok "restore confirmed: $VERDICT_LINE" ;;
+      refused) warn "the RESTORE was also refused by the daemon: $(mask_verdict_userinfo "$VERDICT_LINE")" ;;
+      *)       ok "restore confirmed: $(mask_verdict_userinfo "$VERDICT_LINE")" ;;
     esac
   else
     warn "the restore is on disk, but no confirming verdict line appeared within ${WAIT_SECONDS}s"
@@ -616,7 +633,7 @@ report_outcome() {
 
   say "waiting for the daemon's verdict (up to ${WAIT_SECONDS}s)"
   if wait_for_verdict "$LOG" "$mark" "$WAIT_SECONDS"; then
-    kind="$VERDICT_KIND"; line="$VERDICT_LINE"
+    kind="$VERDICT_KIND"; line="$(mask_verdict_userinfo "$VERDICT_LINE")"
   else
     kind="none"
   fi
@@ -673,7 +690,7 @@ check_mode() {
   local verdict
   verdict="$(last_verdict_line "$LOG")"
   if [ -n "$verdict" ]; then
-    ok "last verdict in log: $verdict"
+    ok "last verdict in log: $(mask_verdict_userinfo "$verdict")"
   else
     warn "no reload verdict line found in $LOG"
   fi

scripts/test-config-edit.sh

@@ -233,6 +233,66 @@ test_redaction_holds() {
   assert_contains "weight" "$RUN_OUTPUT" "a diff must have been demonstrably printed at all"
 }
 
+# redact()'s key-name filter only inspects the KEY, so a diff line whose key does not match
+# TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|URI|_KEY still reaches the final userinfo
+# sed even when its VALUE holds a credentialed URI. "note" is not a sensitive key name, so this
+# line must fall all the way through to that sed, not the earlier whole-value branch. The
+# trailing prose on both sides of the userinfo is a positive control: it proves the line reached
+# the userinfo sed (which touches only the userinfo) rather than the earlier branch (which would
+# have replaced the whole value with a bare "<redacted>" and dropped the prose).
+test_diff_line_userinfo_is_masked_with_positive_control() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note=see amqp://alice:wonderland@rabbit.local:5672/vhost for details'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-userinfo-case reload exit code"
+  assert_not_contains "alice:wonderland" "$RUN_OUTPUT" "the userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@rabbit.local:5672/vhost" "$RUN_OUTPUT" \
+    "the userinfo must be MASKED, not deleted — the rest of the value must survive"
+  assert_contains "note:" "$RUN_OUTPUT" "the key name must still reach the output"
+  assert_contains "see " "$RUN_OUTPUT" "prose BEFORE the userinfo must still reach the output"
+  assert_contains "for details" "$RUN_OUTPUT" "prose AFTER the userinfo must still reach the output"
+}
+
+# A diff line can hold a URL with no userinfo, followed later on the same line by an unrelated @
+# (free text in a string value, for example an email address). The line must pass through the
+# userinfo sed byte for byte: the match must stop at the end of the URL and must not treat the
+# later @ as a second userinfo delimiter.
+test_diff_line_uri_without_userinfo_survives_a_later_at_sign() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note2=see https://docs.local/guide and mail ops@example.com'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-no-userinfo-with-later-at-sign reload exit code"
+  assert_contains "note2: see https://docs.local/guide and mail ops@example.com" "$RUN_OUTPUT" \
+    "a URL with no userinfo plus a later @ on the same line must pass through byte for byte"
+}
+
+# Two credentialed URIs on one diff line must both be masked — the g flag matters.
+test_diff_line_masks_multiple_userinfo_with_g_flag() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.note3=amqp://u1:p1@host1/vhost1 and amqp://u2:p2@host2/vhost2'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "diff-two-userinfo-on-one-line reload exit code"
+  assert_not_contains "u1:p1" "$RUN_OUTPUT" "the first userinfo must never reach the output"
+  assert_not_contains "u2:p2" "$RUN_OUTPUT" "the second userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@host1/vhost1" "$RUN_OUTPUT" "the first URI must be masked"
+  assert_contains "amqp://<redacted>@host2/vhost2" "$RUN_OUTPUT" "the second URI must be masked"
+}
+
 # ------------------------------------------------------- acceptance criterion 9: forgotten value
 # `--set .a.b=` is a plausible typo (the value simply forgotten), and it must be refused outright
 # rather than silently nulling the field — a null numeric field falls back to its default, which
@@ -629,6 +689,65 @@ test_refusal_shape_from_parse_failure_wording_is_recognised() {
   assert_equals 4 "$RUN_RC" "the parse-failure refusal shape must also exit 4, not be read as silence"
 }
 
+# A verdict line carrying a credentialed URI has its userinfo masked, with a positive control
+# proving the rest of the line still reaches the output unchanged.
+test_verdict_userinfo_is_masked_with_positive_control() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf 'config reload from %s refused, keeping the running config: refusing to start: malformed pattern — profiles.local.errorPattern ("amqp://user:hunter2@host/vhost"): Unclosed character class near index 8\n' \
+    "$dir/fleetd.yaml" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "refusal-with-userinfo exit code"
+  assert_not_contains "user:hunter2" "$RUN_OUTPUT" "the userinfo must never reach the output"
+  assert_contains "amqp://<redacted>@host/vhost" "$RUN_OUTPUT" \
+    "the userinfo must be MASKED, not deleted — the rest of the quoted value must survive"
+  # Positive control: the diagnostic prose on both sides of the userinfo must still reach the
+  # output. Without this, a mutant that drops the whole verdict line would pass identically.
+  assert_contains "malformed pattern" "$RUN_OUTPUT" "prose BEFORE the userinfo must still reach the output"
+  assert_contains "Unclosed character class near index 8" "$RUN_OUTPUT" \
+    "prose AFTER the userinfo must still reach the output"
+}
+
+# An ordinary refusal line quotes the offending pattern, not a credential, and must survive byte
+# for byte: the rewrite is scoped to userinfo only, and the quoted pattern is the detail an
+# operator needs to fix the refusal.
+test_ordinary_refusal_line_passes_through_unchanged() {
+  local dir real_line
+  dir="$(new_fixture)"
+  real_line="config reload from $dir/fleetd.yaml refused, keeping the running config: refusing to start: malformed pattern — profiles.local.errorPattern (\"[unclosed\"): Unclosed character class near index 8"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf '%s\n' "$real_line" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "ordinary refusal exit code"
+  assert_contains "$real_line" "$RUN_OUTPUT" \
+    "an ordinary refusal with no userinfo must pass through byte for byte, unchanged"
+}
+
+# A verdict line can hold a URI with NO userinfo and a later, unrelated @ further on in the same
+# line (an email address in diagnostic prose, for example). The rewrite must stop at the end of
+# the URI and must not treat the later @ as a second userinfo delimiter.
+test_uri_without_userinfo_survives_a_later_at_sign() {
+  local dir real_line
+  dir="$(new_fixture)"
+  real_line="config reload from $dir/fleetd.yaml refused, keeping the running config: broker.uri amqp://broker.local/vhost unreachable, contact ops@example.com"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf '%s\n' "$real_line" >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 4 "$RUN_RC" "no-userinfo-with-later-at-sign exit code"
+  assert_contains "$real_line" "$RUN_OUTPUT" \
+    "a URI with no userinfo plus a later @ in the same line must pass through byte for byte"
+}
+
 # --set runs yq over the whole candidate. It warns when that changes more lines than the requested
 # pairs, but a simple file with only the intended changed line must stay quiet.
 new_fixture_reformat_sensitive() {
@@ -694,6 +813,12 @@ echo "== acceptance criterion 6: the marker works =="
 test_marker_skips_lines_before_it
 echo "== acceptance criterion 7 (+13: redaction is proven to have run) =="
 test_redaction_holds
+echo "== fleetd #692: a diff line's userinfo is masked, rest of the value survives =="
+test_diff_line_userinfo_is_masked_with_positive_control
+echo "== fleetd #692: a diff line's URI with no userinfo survives a later @ in the line =="
+test_diff_line_uri_without_userinfo_survives_a_later_at_sign
+echo "== fleetd #692: two userinfo URIs on one diff line are both masked =="
+test_diff_line_masks_multiple_userinfo_with_g_flag
 echo "== acceptance criterion 9: a forgotten value refuses and installs nothing =="
 test_forgotten_value_refuses_and_installs_nothing
 echo "== acceptance criterion 10: an explicit clear writes a bare null =="
@@ -720,6 +845,12 @@ echo "== extra: --check is read-only and always exits 0 =="
 test_check_is_read_only_and_exits_zero
 echo "== extra: the parse-failure refusal shape is also recognised =="
 test_refusal_shape_from_parse_failure_wording_is_recognised
+echo "== verdict-redaction criteria 2+3: verdict userinfo is masked, rest of line survives =="
+test_verdict_userinfo_is_masked_with_positive_control
+echo "== verdict-redaction criterion 4: an ordinary refusal passes through unchanged =="
+test_ordinary_refusal_line_passes_through_unchanged
+echo "== fleetd #638: a URI with no userinfo survives a later @ in the same line =="
+test_uri_without_userinfo_survives_a_later_at_sign
 echo "== acceptance criterion 17: --set warns about yq formatting churn =="
 test_set_warns_when_yq_reformats_extra_lines
 echo "== acceptance criterion 18: --set stays quiet without formatting churn =="