Correct the configDir note: the count was wrong, the shared dir is the defect

The previous commit compared 4 configDir lines against 8 total profiles, but
four of those are opencode and never read CLAUDE_CONFIG_DIR. Every claude-code
profile does set one, so the original claim was right and this file said
otherwise.

The real defect is narrower: opus and sonnet name the operator's own config dir,
so for those members the store is shared, and ClaudeCodeLauncher's javadoc
already records that fleetd and the operator's session write that same file.

CLAUDE.md

@@ -102,6 +102,8 @@ below are the procedure — run them in order, every task, not only the big ones
    `fleet_status`, never by reading its terminal; it also reports an open question and the `turnId`
    that answers it — but **only to the caller that created that delegation**, so a question raised
    under an architect's brief is invisible to you, and seeing none does not mean there is none.
+   **Only that same creator can answer it.** A `turnId` you came by any other way is refused, so an
+   architect's worker waits for that architect and not for you.
    **A worker's ask waits ~55 seconds, and no nudge makes that longer** — so never
    brief a worker to "ask me". Decide before you delegate, or give it an explicit default.
    **A correction cannot reach a busy member.** A `fleet_send` to a working member is *accepted* and
@@ -167,7 +169,7 @@ you decide.
 | See the fleet | `fleet_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) + `loopHealth` (`RUNNING`, `STALLED`, or `STOPPED` for `statusPoller` and `sessionReaper`) · one peer's state: `fleet_status{sessionId}` |
 | Delegate (blocking) | `fleet_send{sessionId, content}` |
 | Delegate (long task) | `fleet_send{sessionId, content, wait:false}` → ticket → `fleet_poll{ticket}` |
-| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
+| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId`, and only the caller that created that delegation |
 | Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
 | Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
 | Message a **collaborator** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` reports a `collaborators` array, and each row carries that peer's `name` and the `sessionId` you send to. It is visible to you, to an architect and to another collaborator, never to a worker. Coordination only, **never** a task |
@@ -332,10 +334,22 @@ must obey belongs in the charter, not here.
   (#362). **Read `plugin/` before designing anything about onboarding a project.** Two limits are
   structural, not bugs: a plugin cannot carry the role agent files, because
   `ClaudeCodeLauncher.java:371` requires `<cwd>/.claude/agents/<role>.md` in the member's own
-  worktree; and a plugin cannot deliver anything to members at all, because
-  `ClaudeCodeLauncher.java:285` exports `CLAUDE_CONFIG_DIR` and every Claude profile here sets it,
-  so a member never reads the operator's plugin store. **The plugin is the lead-side surface;
-  member-facing assets travel in the worktree.**
+  worktree; and a plugin reaches a member only through `CLAUDE_CONFIG_DIR`, which
+  `ClaudeCodeLauncher.java:286` exports with `putIfPresent` — so only for a profile that sets
+  `configDir`. Every `claude-code` profile does set one (the four without are `opencode`, which
+  never reads that variable). **But measured 2026-10-04: two of them point at
+  `~/.ccs/instances/ltms`, which is the operator's own `CLAUDE_CONFIG_DIR` on this host.** So for an
+  `opus` or `sonnet` member, "a member never reads the operator's plugin store" is false — it reads
+  the same store, because that store is the one its `configDir` names. It stays true for `local` and
+  `local-direct`, which point at `~/.ccs/instances/gx10`. `ClaudeCodeLauncher`'s own javadoc names
+  the related hazard: that file is rewritten on every spawn, so for those two profiles fleetd and the
+  operator's live session write the same `.claude.json`, and its compare-and-swap "narrows the
+  lost-update window, it does not close it". Re-measure which profiles share the operator's dir with
+  `awk '/^profiles:/{i=1;next} /^[a-z]/{i=0} i&&/^  [a-z-]+:$/{p=$1} i&&/configDir:/{print p,$2}'
+  fleetd/fleetd.yaml` against `echo $CLAUDE_CONFIG_DIR`; delete this note once no profile names the
+  operator's dir. **Treat the plugin as the lead-side surface and put member-facing assets in the
+  worktree** — that conclusion holds either way, because a worktree asset does not depend on which
+  config dir a member reads.
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
   (a submodule with its own remote).
 - **A provisioned worktree neutralizes `.mcp.json`, `opencode.json` and `.autoenv`** — the repo's

fleetd/src/main/java/dev/ltms/fleet/FleetdAssembly.java

@@ -51,7 +51,6 @@ import dev.ltms.fleet.power.CaffeinateSleepAssertionMechanism;
 import dev.ltms.fleet.power.IdleSleepGuard;
 import dev.ltms.fleet.rest.FleetApp;
 import dev.ltms.fleet.session.GitWorktrees;
-import dev.ltms.fleet.session.MemberSession;
 import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.session.SessionReaper;
 import io.javalin.Javalin;
@@ -480,13 +479,9 @@ final class FleetdAssembly {
                 new PaneLocator(herdr, memberHerdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
 
         // fleetd #669 Unit D: a live spawned member resolves as its own role, whatever a tab map
-        // says about the same terminal — read from the roster meant for a hot path (SessionManager
-        // javadoc), never rosterResolved(), since resolve() runs on every request.
-        Function<String, MemberRole> spawnedMemberRole = terminal -> sessions.roster().stream()
-                .filter(s -> terminal.equals(s.terminalId()))
-                .map(MemberSession::role)
-                .findFirst()
-                .orElse(null);
+        // says about the same terminal. fleetd #702: SessionManager.spawnedMemberRole also answers
+        // for a pane mid-teardown, not only one still in the registry — see its javadoc.
+        Function<String, MemberRole> spawnedMemberRole = sessions::spawnedMemberRole;
 
         // CB-501: one resolver behind both entry paths. Worker identity still comes from the
         // connection and is never token-gated, so enabling token mode cannot lock the fleet out.

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -26,6 +26,7 @@ import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Consumer;
 import java.util.function.LongSupplier;
+import java.util.function.Supplier;
 
 /**
  * Authoritative in-daemon registry of the worker sessions this {@code fleetd} process spawned.
@@ -57,6 +58,18 @@ public final class SessionManager implements TurnListener {
      * Populated on every spawn path, removed on {@link #release}.
      */
     private final ConcurrentHashMap<String /*paneId*/, PeerHandle> handles = new ConcurrentHashMap<>();
+    /**
+     * fleetd #702: a pane mid-teardown, keyed by paneId, held from just before its registry entry
+     * is removed until {@link #releaseRemoved} finishes. {@link #spawnedMemberRole} consults this
+     * alongside the registry, so a caller resolving the pane's terminal during that window still
+     * sees a live member and never falls through to a tab map.
+     *
+     * <p>Depth-counted rather than a plain set: two threads can be tearing down the same pane at
+     * once (the CAS in {@link #releaseIfCurrent} exists for exactly that race), and with a set the
+     * loser's {@code finally} would unmark the pane while the winner is still mid-teardown,
+     * reopening the window this exists to close.
+     */
+    private final ConcurrentHashMap<String /*paneId*/, Releasing> releasing = new ConcurrentHashMap<>();
     private final MemberPresence presence;
     private final SecureRandom nonceRandom = new SecureRandom();
     private final AtomicLong nonceSeq = new AtomicLong();
@@ -303,9 +316,11 @@ public final class SessionManager implements TurnListener {
      * is a logged path an operator can reclaim, the cost of a deleted one is unrecoverable work.
      */
     private MemberSession release(String paneId, ReleaseCause cause) {
-        MemberSession removed = registry.remove(paneId);
-        releaseRemoved(paneId, removed, handles.remove(paneId), cause);
-        return removed;
+        return releaseWindow(paneId, registry.get(paneId), () -> {
+            MemberSession removed = registry.remove(paneId);
+            releaseRemoved(paneId, removed, handles.remove(paneId), cause);
+            return removed;
+        });
     }
 
     /**
@@ -314,16 +329,85 @@ public final class SessionManager implements TurnListener {
      * DONE record from stopping a worker that delivery has made BUSY.
      */
     private boolean releaseIfCurrent(MemberSession expected, ReleaseCause cause) {
-        if (!registry.remove(expected.paneId(), expected)) {
-            // A lifecycle transition replaced the record between the caller's check and this remove.
-            // Log it: this race is by definition unobservable otherwise, and a reaper that silently
-            // declines to reap is the hardest kind of behaviour to diagnose after the fact.
-            log.debug("skipping reap of pane={}: its registry record changed after the idle check "
-                    + "(most likely a delivery made it BUSY)", expected.paneId());
-            return false;
+        return releaseWindow(expected.paneId(), expected, () -> {
+            if (!registry.remove(expected.paneId(), expected)) {
+                // A lifecycle transition replaced the record between the caller's check and this
+                // remove. Log it: this race is by definition unobservable otherwise, and a reaper
+                // that silently declines to reap is the hardest kind of behaviour to diagnose
+                // after the fact.
+                log.debug("skipping reap of pane={}: its registry record changed after the idle "
+                        + "check (most likely a delivery made it BUSY)", expected.paneId());
+                return false;
+            }
+            releaseRemoved(expected.paneId(), expected, handles.remove(expected.paneId()), cause);
+            return true;
+        });
+    }
+
+    /**
+     * fleetd #702: mark {@code paneId} as mid-teardown — using {@code known}'s terminal/role when
+     * it is available — for the whole of {@code teardown}, which removes the registry entry and
+     * then runs {@link #releaseRemoved}. Shared by both registry-removal sites ({@link #release}'s
+     * unconditional remove and {@link #releaseIfCurrent}'s CAS remove) so neither can leave the
+     * other's window unmarked.
+     *
+     * <p>The mark is written before {@code teardown} runs — so it covers the removal itself, not
+     * only what comes after it — and cleared in a {@code finally}, so an unchecked throw out of
+     * {@code teardown} (including one from {@link PeerLauncher#stop}, which declares nothing) can
+     * never leave the pane marked for the rest of the daemon's life.
+     */
+    private <T> T releaseWindow(String paneId, MemberSession known, Supplier<T> teardown) {
+        releasing.compute(paneId, (_, prior) -> Releasing.enter(prior, known));
+        try {
+            return teardown.get();
+        } finally {
+            releasing.compute(paneId, (_, prior) -> prior == null ? null : prior.leave());
         }
-        releaseRemoved(expected.paneId(), expected, handles.remove(expected.paneId()), cause);
-        return true;
+    }
+
+    /**
+     * Depth count plus the terminal/role a mid-teardown pane belongs to, for
+     * {@link #spawnedMemberRole}. The terminal/role come from whichever call into
+     * {@link #releaseWindow} first knew them: a call that finds the registry entry already gone
+     * passes a {@code null} session, and must not blank out what the first call recorded.
+     */
+    record Releasing(int depth, String terminalId, MemberRole role) {
+        static Releasing enter(Releasing prior, MemberSession known) {
+            int depth = (prior == null ? 0 : prior.depth()) + 1;
+            String terminalId = known != null ? known.terminalId() : prior == null ? null : prior.terminalId();
+            MemberRole role = known != null ? known.role() : prior == null ? null : prior.role();
+            return new Releasing(depth, terminalId, role);
+        }
+
+        Releasing leave() {
+            return depth <= 1 ? null : new Releasing(depth - 1, terminalId, role);
+        }
+    }
+
+    /**
+     * The role of the live spawned member occupying {@code terminal} — whether it is currently in
+     * the registry, or mid-teardown between {@link #release} removing its registry entry and
+     * {@link #releaseRemoved} actually stopping its pane (fleetd #702). {@code null} for a terminal
+     * that is neither: this method is the one reader a caller resolver consults before any tab
+     * map, so a live or releasing member's identity never falls back to a tab label.
+     *
+     * <p>Checks the registry directly via {@link #findByTerminal} rather than {@link #roster()},
+     * so this hot-path lookup (consulted on every resolve) never pays for a list copy or a stream.
+     */
+    public MemberRole spawnedMemberRole(String terminal) {
+        MemberSession session = findByTerminal(terminal);
+        if (session != null) {
+            return session.role();
+        }
+        if (terminal == null) {
+            return null;
+        }
+        for (Releasing r : releasing.values()) {
+            if (terminal.equals(r.terminalId())) {
+                return r.role();
+            }
+        }
+        return null;
     }
 
     private void releaseRemoved(String paneId, MemberSession removed, PeerHandle removedHandle,

fleetd/src/test/java/dev/ltms/fleet/auth/CallerResolverTest.java

@@ -1,13 +1,25 @@
 package dev.ltms.fleet.auth;
 
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.FakeHerdr;
 import dev.ltms.fleet.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.WorkspaceControl;
 import dev.ltms.fleet.mcp.ConnectionIdentity;
 import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
 import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.WorktreeRequest;
+import dev.ltms.fleet.session.Worktrees;
 import org.junit.jupiter.api.Test;
 
+import java.util.List;
 import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicReference;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -541,6 +553,219 @@ class CallerResolverTest {
         assertEquals("term_a", p.terminal());
     }
 
+    /**
+     * fleetd #702: between {@link SessionManager#release} removing the registry entry and the
+     * pane actually stopping, a resolve for that terminal must still see the live member and
+     * never fall through to a tab map — wired through the real {@link SessionManager}, not a
+     * hand-rolled stand-in for its {@code spawnedMemberRole}.
+     *
+     * <p>Reuses the ticket's own test idea: an injected {@code hasUncommitted} resolves the
+     * releasing terminal from inside {@code release}'s window — a real call landing inside the
+     * window, so no sleep and no race.
+     *
+     * <p>The property asserted is "no tab map is consulted", never "the same role is returned".
+     * The mandatory control is the lead tab map: it names this exact terminal, and the same
+     * resolve taken <em>outside</em> the window (before release runs) must still return the lead
+     * role — without that control, the in-window assertion would also pass on an empty map and
+     * prove nothing.
+     */
+    @Test
+    void aPaneMidTeardownResolvesAsItsOwnRoleConsultingNoTabMap() {
+        FakeHerdr herdr = new FakeHerdr().pinNextStarts(1, "term_a", "w2:p7");
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
+                "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
+
+        AtomicReference<Principal> duringWindow = new AtomicReference<>();
+        AtomicReference<CallerResolver> resolverRef = new AtomicReference<>();
+        Worktrees worktrees = new Worktrees() {
+            @Override
+            public String add(String repoRoot, String branch, String baseRef) {
+                return "/wt/" + branch.replace('/', '_');
+            }
+
+            @Override
+            public void remove(String repoRoot, String worktreePath) {
+            }
+
+            @Override
+            public void deleteBranch(String repoRoot, String branch) {
+            }
+
+            @Override
+            public boolean hasUncommitted(String worktreePath) {
+                // Runs from INSIDE release()'s git-status shell-out: the registry entry is
+                // already gone, but the pane has not stopped yet.
+                duringWindow.set(resolverRef.get().resolve("127.0.0.1", 42, null));
+                return false;
+            }
+
+            @Override
+            public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
+            }
+
+            @Override
+            public String repoRoot(String cwd) {
+                return "/repo";
+            }
+
+            @Override
+            public Optional<String> snapshot(String worktreePath, String branch, String message) {
+                return Optional.empty();
+            }
+
+            @Override
+            public WipRefStats wipRefs(String repoRoot) {
+                return new WipRefStats(0, 0L);
+            }
+
+            @Override
+            public int pruneWipRefs(String repoRoot, long minAgeMillis) {
+                return 0;
+            }
+
+            @Override
+            public void shareWithGroup(String repoRoot, String worktreePath) {
+            }
+        };
+        SessionManager sessions = new SessionManager(workers, worktrees);
+
+        // The lead tab map names "term_a" before anything is ever spawned onto it — the control
+        // this test needs. Built up front so the SAME resolver answers every resolve() call below.
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> FakeHerdr.WORKER_PID);
+        CallerResolver resolver = CallerResolver.withLeadsAndMembers(identity, false, null,
+                () -> Map.of("term_a", "the-lead"), null, sessions::spawnedMemberRole, Map::of);
+        resolverRef.set(resolver);
+
+        Principal before = resolver.resolve("127.0.0.1", 42, null);
+        assertEquals(Role.PRIMARY, before.role(),
+                "control: with no live or releasing member on this terminal, the lead tab map must "
+                        + "win — this is what proves the in-window assertion below is not passing on "
+                        + "an empty map");
+        assertEquals("the-lead", before.name());
+
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("fleetd-702", null));
+        assertEquals("term_a", s.terminalId(), "sanity: the spawn resolved to the pinned pane");
+
+        sessions.release(s.paneId());
+
+        assertNotNull(duringWindow.get(), "the dirty check must have run and captured a resolve");
+        assertEquals(Role.WORKER, duringWindow.get().role(),
+                "inside the window the pane must resolve as its own live-member role, consulting no "
+                        + "tab map — a lead tab naming the same terminal must not win");
+        assertEquals("term_a", duringWindow.get().terminal());
+    }
+
+    /**
+     * {@link SessionManager#releaseRemoved} unbinds the architect slot before the git-status
+     * shell-out that opens the teardown window, so a resolve landing inside that window must see
+     * the slot already unbound and resolve {@link Role#WORKER} — never {@link Role#ARCHITECT},
+     * and never by checking role equality against the live session, which would hold even if the
+     * unbind ran too late.
+     *
+     * <p>The control is the same resolve taken outside the window, while the slot is still bound,
+     * which must return {@link Role#ARCHITECT} — without it this test would also pass against a
+     * slot that was never bound, and prove nothing.
+     */
+    @Test
+    void aReleasingArchitectIsDemotedToWorkerInsideTheTeardownWindow() {
+        FakeHerdr herdr = new FakeHerdr().pinNextStarts(1, "term_a", "w2:p7");
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
+                "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
+
+        AtomicReference<Principal> duringWindow = new AtomicReference<>();
+        AtomicReference<CallerResolver> resolverRef = new AtomicReference<>();
+        Worktrees worktrees = new Worktrees() {
+            @Override
+            public String add(String repoRoot, String branch, String baseRef) {
+                return "/wt/" + branch.replace('/', '_');
+            }
+
+            @Override
+            public void remove(String repoRoot, String worktreePath) {
+            }
+
+            @Override
+            public void deleteBranch(String repoRoot, String branch) {
+            }
+
+            @Override
+            public boolean hasUncommitted(String worktreePath) {
+                // Runs from INSIDE release()'s git-status shell-out: the architect slot is already
+                // unbound by this point, but the pane has not stopped yet.
+                duringWindow.set(resolverRef.get().resolve("127.0.0.1", 42, null));
+                return false;
+            }
+
+            @Override
+            public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
+            }
+
+            @Override
+            public String repoRoot(String cwd) {
+                return "/repo";
+            }
+
+            @Override
+            public Optional<String> snapshot(String worktreePath, String branch, String message) {
+                return Optional.empty();
+            }
+
+            @Override
+            public WipRefStats wipRefs(String repoRoot) {
+                return new WipRefStats(0, 0L);
+            }
+
+            @Override
+            public int pruneWipRefs(String repoRoot, long minAgeMillis) {
+                return 0;
+            }
+
+            @Override
+            public void shareWithGroup(String repoRoot, String worktreePath) {
+            }
+        };
+        SessionManager sessions = new SessionManager(workers, worktrees);
+
+        MemberRegistry members = new MemberRegistry(new FleetConfig.Fleet(Map.of(),
+                Map.of("lead-designer", new FleetConfig.Slot("ltms-local")), Map.of(), Map.of(), null));
+        sessions.setMemberLifecycle(members);
+
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> FakeHerdr.WORKER_PID);
+        CallerResolver resolver = CallerResolver.withLeadsAndMembers(identity, false, null,
+                Map::of, members, sessions::spawnedMemberRole, Map::of);
+        resolverRef.set(resolver);
+
+        MemberSession s = sessions.acquire("ltms-local", MemberRole.ARCHITECT, null, "/caller/proj", null,
+                new WorktreeRequest("fleetd-702d", null));
+        assertEquals("term_a", s.terminalId(), "sanity: the spawn resolved to the pinned pane");
+        assertEquals(MemberRole.ARCHITECT, s.role(), "sanity: the slot bind succeeded");
+
+        Principal before = resolver.resolve("127.0.0.1", 42, null);
+        assertEquals(Role.ARCHITECT, before.role(),
+                "control: with the slot still bound, the pane must resolve as an architect — this "
+                        + "is what proves the in-window assertion below is not passing against a "
+                        + "slot that was never bound");
+        assertEquals("lead-designer", before.name());
+
+        sessions.release(s.paneId());
+
+        assertNotNull(duringWindow.get(), "the dirty check must have run and captured a resolve");
+        assertEquals(Role.WORKER, duringWindow.get().role(),
+                "inside the window the architect slot is already unbound, so the result must be "
+                        + "WORKER — asserting role-equality with the live session here would tempt "
+                        + "moving the unbind earlier or later, which would be wrong either way");
+        assertEquals("term_a", duringWindow.get().terminal());
+    }
+
     /** A spawned architect in the roster resolves ARCHITECT, carrying its bound slot's name. */
     @Test
     void aSpawnedArchitectInTheRosterResolvesArchitectWithItsSlotName() {

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -2436,4 +2436,160 @@ class SessionManagerTest {
             return "threw:" + e.getClass().getName() + ":" + e.getMessage();
         }
     }
+
+    // --- fleetd #702: spawnedMemberRole must still answer for a pane mid-teardown ----------------
+
+    /**
+     * A {@link Worktrees} test double whose {@code hasUncommitted} runs an injected hook before
+     * answering. This is what lets a test resolve a releasing pane's terminal from inside the
+     * window {@link SessionManager#release} opens between removing the registry entry and
+     * actually stopping the pane — the hook runs synchronously on the release call's own thread,
+     * at the exact point {@code release} shells out to {@code git status}, so there is no sleep
+     * and no race to land in it.
+     */
+    private static final class HookedWorktrees implements Worktrees {
+        private Runnable hook;
+        private boolean dirty = false;
+
+        HookedWorktrees onHasUncommitted(Runnable hook) {
+            this.hook = hook;
+            return this;
+        }
+
+        @Override
+        public String add(String repoRoot, String branch, String baseRef) {
+            return "/wt/" + branch.replace('/', '_');
+        }
+
+        @Override
+        public void remove(String repoRoot, String worktreePath) {
+        }
+
+        @Override
+        public void deleteBranch(String repoRoot, String branch) {
+        }
+
+        @Override
+        public boolean hasUncommitted(String worktreePath) {
+            if (hook != null) {
+                hook.run();
+            }
+            return dirty;
+        }
+
+        @Override
+        public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
+        }
+
+        @Override
+        public String repoRoot(String cwd) {
+            return "/repo";
+        }
+
+        @Override
+        public java.util.Optional<String> snapshot(String worktreePath, String branch, String message) {
+            return java.util.Optional.empty();
+        }
+
+        @Override
+        public WipRefStats wipRefs(String repoRoot) {
+            return new WipRefStats(0, 0L);
+        }
+
+        @Override
+        public int pruneWipRefs(String repoRoot, long minAgeMillis) {
+            return 0;
+        }
+
+        @Override
+        public void shareWithGroup(String repoRoot, String worktreePath) {
+        }
+    }
+
+    @Test
+    void spawnedMemberRoleResolvesTheLiveRegisteredRole() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller", null);
+
+        assertEquals(s.role(), sessions.spawnedMemberRole(s.terminalId()),
+                "a registered session resolves to its own role");
+        assertNull(sessions.spawnedMemberRole("term_unknown"),
+                "a terminal with no session at all resolves to null");
+    }
+
+    @Test
+    void spawnedMemberRoleIsNullOnceReleaseFullyCompletes() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr, new HookedWorktrees());
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("fleetd-702a", null));
+
+        sessions.release(s.paneId());
+
+        assertNull(sessions.spawnedMemberRole(s.terminalId()),
+                "once release has fully finished, the terminal is neither registered nor releasing");
+    }
+
+    @Test
+    void spawnedMemberRoleStillAnswersBetweenTheRegistryRemovalAndThePaneStop() {
+        FakeHerdr herdr = new FakeHerdr();
+        java.util.concurrent.atomic.AtomicReference<MemberRole> duringWindow = new java.util.concurrent.atomic.AtomicReference<>();
+        HookedWorktrees worktrees = new HookedWorktrees();
+        SessionManager sessions = sessionManager(herdr, worktrees);
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("fleetd-702b", null));
+        worktrees.onHasUncommitted(() -> {
+            // This runs from INSIDE release()'s git-status shell-out: the registry entry is
+            // already gone, but the pane has not stopped yet — a real call landing inside the
+            // exact window fleetd #702 reports, so no sleep and no race is needed to reach it.
+            assertTrue(sessions.get(s.paneId()).isEmpty(),
+                    "sanity: the registry entry is already gone at this point");
+            duringWindow.set(sessions.spawnedMemberRole(s.terminalId()));
+        });
+
+        sessions.release(s.paneId());
+
+        assertEquals(s.role(), duringWindow.get(),
+                "spawnedMemberRole must still answer the live role while the pane is mid-teardown, "
+                        + "not only while the session is still in the registry");
+        assertNull(sessions.spawnedMemberRole(s.terminalId()),
+                "and once release has fully finished, the window is closed too");
+    }
+
+    /**
+     * {@code Releasing.enter} and {@code Releasing.leave} are called directly here, never through
+     * {@link SessionManager#release} or {@link SessionManager#spawnedMemberRole}, so a test naming
+     * one of them exercises only that one — a regression in the other can never hide behind it.
+     */
+    @Test
+    void releasingLeaveStepsDownADepthGreaterThanOneInsteadOfRemovingIt() {
+        SessionManager.Releasing depthTwo = new SessionManager.Releasing(2, "term_a", MemberRole.DEV);
+
+        SessionManager.Releasing afterLeave = depthTwo.leave();
+
+        assertNotNull(afterLeave,
+                "depth 2 means another release of the SAME pane is still mid-teardown; leave() must "
+                        + "step the depth down, never remove the marker outright — removing it here "
+                        + "is what a plain Set would do, and would reopen the window the still-in-"
+                        + "flight release is relying on staying closed");
+        assertEquals(1, afterLeave.depth());
+        assertEquals("term_a", afterLeave.terminalId());
+        assertEquals(MemberRole.DEV, afterLeave.role());
+    }
+
+    @Test
+    void releasingEnterPreservesThePriorTerminalWhenTheOverlappingCallHasNoSessionOfItsOwn() {
+        SessionManager.Releasing prior = new SessionManager.Releasing(1, "term_a", MemberRole.DEV);
+
+        SessionManager.Releasing afterEnter = SessionManager.Releasing.enter(prior, null);
+
+        assertEquals(2, afterEnter.depth(), "depth still increments whether or not this enter knows its session");
+        assertEquals("term_a", afterEnter.terminalId(),
+                "an overlapping release that finds the registry entry already gone has no session of "
+                        + "its own to pass as known, and must not blank out the terminal the first "
+                        + "call already recorded — that terminal is what spawnedMemberRole matches "
+                        + "against");
+        assertEquals(MemberRole.DEV, afterEnter.role());
+    }
 }