fleetd #719: make the foreign-id test reach a colliding sequence number

other.sendAsync had never been called, so other's tasks map was empty and
poll(ticket) returned null regardless of whether the nonce existed — the
test passed against an empty map, not against a colliding id. Mint once on
other so it reaches the same sequence number as the first instance, making
the test exercise the actual collision the nonce guards against.

fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -355,6 +355,14 @@ public final class MessageService {
      */
     private final ConcurrentHashMap<String, Boolean> queuedDeliveries = new ConcurrentHashMap<>();
     private final AtomicLong ticketSeq = new AtomicLong();
+    /**
+     * Minted once per {@code MessageService} instance and folded into every ticket id (see
+     * {@link #sendAsync(String, String, Runnable, String)}). {@link #ticketSeq} alone restarts at
+     * zero for every instance, so without this a ticket id can be reused across instances and
+     * resolve to an unrelated {@link Task} with no error; this nonce makes that impossible, because
+     * an id minted by one instance can never match the id space of another.
+     */
+    private final String ticketBootNonce = UUID.randomUUID().toString().substring(0, 6);
     private final ExecutorService asyncExecutor = Executors.newThreadPerTaskExecutor(
             Thread.ofVirtual().name("bridge-async-", 0).factory());
 
@@ -1321,7 +1329,7 @@ public final class MessageService {
      * @return the ticket to poll for the eventual result
      */
     public String sendAsync(String target, String content, Runnable onAccepted, String creatorTerminal) {
-        String ticket = "task-" + ticketSeq.incrementAndGet();
+        String ticket = "task-" + ticketBootNonce + "-" + ticketSeq.incrementAndGet();
         Task task = new Task(ticket, target, nowNanos, creatorTerminal);
         tasks.put(ticket, task);
         if (pushLoop != null) {

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -888,6 +888,39 @@ class MessageServiceTest {
         assertNull(messages.poll("task-999999"), "a ticket that was never minted is unknown");
     }
 
+    // --- fleetd #719: a per-boot nonce keeps one instance's ticket ids out of another's space ---
+
+    /** A second, fully independent instance — its own agents/injector/rendezvous/inbox, not shared. */
+    private MessageService newIndependentInstance() {
+        FakeHerdr otherHerdr = new FakeHerdr().readText("BUILD GREEN: 391 files");
+        AgentControl otherAgents = new AgentControl(otherHerdr);
+        Injector otherInjector = new Injector(otherAgents);
+        return new MessageService(otherAgents, otherInjector, new Rendezvous(), new InMemoryReplyInbox());
+    }
+
+    @Test
+    void twoInstancesMintDisjointTicketIds() {
+        MessageService other = newIndependentInstance();
+        String ticketFromThis = messages.sendAsync(T, "task on first instance", null, null);
+        String ticketFromOther = other.sendAsync(T, "task on second instance", null, null);
+        assertNotEquals(ticketFromThis, ticketFromOther,
+                "each instance mints its own id space, so even a first ticket from each must differ");
+    }
+
+    @Test
+    void foreignInstanceTicketDoesNotResolve() {
+        MessageService other = newIndependentInstance();
+        String ticket = messages.sendAsync(T, "task on first instance", null, null);
+        // `other` must reach the same sequence number, or this test passes against an empty map
+        // instead of against a colliding id.
+        other.sendAsync(T, "task on second instance", null, null);
+
+        // control: the id resolves in the instance that minted it, so a null below cannot be
+        // explained by broken plumbing — only by the ticket being foreign to `other`.
+        assertNotNull(messages.poll(ticket), "the minting instance must still resolve its own ticket");
+        assertNull(other.poll(ticket), "a ticket minted by a different instance must not resolve here");
+    }
+
     // --- fleetd #705: a ticket's creator terminal gates who may poll it -------------------------
 
     @Test