#137: complete an async ticket's own reply after answer() times out

fleet_send{turnId} (MessageService.answer) blocks the primary only for its
own bounded MCP-call window (25s default, 120s max) — far shorter than a
worker's resumed turn can genuinely take. When that window expires, answer()
closes its rendezvous waiter, so the worker's eventual fleet_reply has no
live waiter to resolve and falls back to the session inbox. The async
ticket's future was never completed by that path, so fleet_poll{ticket}
stayed PENDING until fleet_stop's abandon() forced it FAILED with a
misleading "the worker session was released before it replied" reason,
even though the reply had genuinely arrived.

- MessageService.reply(): before falling to the inbox, look for the async
  task this exact turn belongs to (already answered — question cleared,
  turnId still stamped — but not yet resolved) and complete it directly
  with the real reply, so fleet_poll{ticket} returns it.
- MessageService.abandon(): defense in depth, independent of the above —
  never write a false WORKER_FAILED once a reply reached the inbox for
  this target; recover and use its real content instead.
- Two new tests drive the full delegation path (async send -> ask ->
  answer with a short timeout -> reply -> poll/abandon), not a reply sink
  directly; both fail with the fix disabled and pass with it restored.

REPORT-cb137.md

@@ -0,0 +1,166 @@
+# CB-137 / fleetd issue #137 — report
+
+## Real root cause (not the hypothesis in the ticket)
+
+I read `MessageService.java` and `Rendezvous.java` before changing anything. The mechanism is real,
+but the exact place it happens is `MessageService.answer()`, not "the reply goes to the inbox on
+purpose" in general.
+
+1. A lead delegates with `fleet_send{wait:false}` → `sendAsync()` creates a `Task` and runs `send()`
+   on a background virtual thread with a 30-minute internal budget (`ASYNC_TIMEOUT_MS`).
+2. The worker calls `fleet_ask`. That resolves the open rendezvous waiter with `Kind.QUESTION`, so
+   `send()` returns immediately and the `Task` is left open (its `future` stays unresolved — see the
+   comment in `sendAsync`'s lambda: "Keep the accepted owner until answer() finishes it").
+3. The lead answers with `fleet_send{turnId, content}`. This calls `FleetMcp.answer()` →
+   `MessageService.answer(turnId, content, timeout)`. The `timeout` here is **not** the generous
+   30-minute async budget — it is the MCP tool's own bounded wait: `DEFAULT_TIMEOUT_MS = 25_000`,
+   clamped to at most `MAX_TIMEOUT_MS = 120_000` (`FleetMcp.java:71-72,495,512`). This is the same
+   ~60–120s window every blocking `fleet_send` call is capped at (documented elsewhere as "the
+   caller's own MCP client call timeout").
+4. `answer()` opens a **fresh** rendezvous waiter for the worker session and blocks on it for at most
+   that window. If the worker's resumed turn takes longer than that to actually finish (very
+   plausible — the resumed turn can mean more edits, a build, a commit, a push, opening a PR), the
+   wait times out. On timeout, `answer()`'s `finally` block unconditionally calls
+   `rendezvous.close(workerSession, reply)`, **removing the waiter from the map**, and returns
+   `Outcome.TIMED_OUT_WORKING` to the lead.
+5. The worker keeps working, unaware anything happened, and eventually calls `fleet_reply`. That
+   reaches `MessageService.reply(session, content)`, which tries `rendezvous.resolve(session,
+   content)` — but the waiter was already closed in step 4, so `resolve` returns `false`. `reply()`
+   then falls back to `inbox.publish(...)` and marks `strandedReplies.put(session, true)`
+   (CB-640 bookkeeping) — the reply is safely held, but **the async `Task`'s `future` is never
+   completed**.
+6. `fleet_poll{ticket}` keeps returning `PENDING` forever (the `Task` never resolves) — until the
+   lead eventually calls `fleet_stop`. That fires `sessions.onRelease` → `messages.abandon(target,
+   reason)` (`Fleetd.java:481-497`), where `reason` is built with the exact text from the bug report
+   ("the worker session was released before it replied; worktree=... branch=... snapshot=...",
+   `Fleetd.java:484-487`). `abandon()`'s loop finds the still-open `Task` (`question == null`, future
+   not done) and completes it as `WORKER_FAILED` with that misleading reason — even though the
+   worker's real reply is sitting, intact, in the inbox the whole time.
+
+So: the reported behaviour is correct, and the specific trigger is `answer()`'s own bounded wait
+being shorter than the worker's real resumed-turn time — not anything to do with the ~55s
+`fleet_ask` window itself (that part, issue #61, is untouched).
+
+## Fix
+
+Two changes in `fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java`, both scoped to the
+ticket/reply routing and the terminal-state text — `fleet_ask`'s own window and mechanics are
+untouched.
+
+**1. `reply()` — priority 1 (the ticket resolves with the real reply).**
+Before falling back to the inbox, `reply()` now looks for an async `Task` that is specifically in the
+"already answered but not yet resolved" state (`question == null`, `turnId != null` — set once
+`answer()` has cleared the question but before anything completed the future, `!future.isDone()`).
+If one exists for this `target`, the worker's reply completes that `Task`'s future directly as
+`Outcome.REPLIED` with the real content, and the reply never touches the inbox at all. A task that
+was never asked has `turnId == null` and can never match, so ordinary (no-`fleet_ask`) delegations
+are unaffected — they already resolve through the pre-existing rendezvous fast path.
+
+I chose this over leaving `answer()`'s own timeout behaviour untouched and instead keeping its
+rendezvous waiter open in the background: that alternative works but reopens the "at most one
+waiter per session" invariant (`Rendezvous.open` throws on a double-open) to a new class of races
+with a fresh send arriving mid-window. The `send()` path already guards against sending into an
+answered-but-still-resolving worker via `hasAsyncQuestion(target)` (checks `asyncTasksByTurn`,
+which still holds the task until it resolves), so routing through `reply()` gets the same protection
+without touching `answer()`'s waiter lifecycle at all — the smaller, safer diff.
+
+**2. `abandon()` — priority 3 (required independently, "even if you fix (1)").**
+Before marking any of a released target's still-open tasks `WORKER_FAILED`, `abandon()` now checks
+`hasStrandedReply(target)` (the existing CB-640 fact — true whenever the *last* `reply()` for this
+target fell through to the inbox). If true, it drains the inbox (`recoverStrandedReply`) and — if it
+actually finds a message — completes the task as `REPLIED` with that real content instead of writing
+the failure. This is deliberately a **separate** check from fix 1: fix 1 already prevents the
+inbox-stranding from happening in the exact scenario this ticket describes, so by the time
+`abandon()` runs the task is normally already resolved and `abandon()`'s `complete()` call is a
+harmless no-op. This second check exists so that if some *other* future path ever strands a reply
+in the inbox without resolving its ticket, `abandon()` still refuses to report a false failure —
+"if a reply reached any sink for that turn, the terminal state is done," per the ticket. I verified
+both are required by disabling each independently and confirming the two new tests fail (see below).
+
+**Priority 4 (the snapshot/worktree hint).** Handled as a consequence of both fixes rather than a
+separate branch: once a task resolves as `REPLIED` (via either fix), `abandon()` never calls
+`new Reply(Outcome.WORKER_FAILED, reason)` for that task at all, so the "the worker session was
+released before it replied; worktree=... branch=... snapshot=..." text is never constructed or
+attached to that ticket's outcome. It still appears, correctly, for a task that never got a reply
+(the existing `abandonFailsEveryPendingAsyncTicketForTheReleasedTarget` /
+`anAbandonedAsyncTaskPollsAsFailedNotPending` tests still pass unchanged).
+
+**Priority 2** was not needed — fix 1 makes `fleet_poll{ticket}` return the actual reply (the
+higher-priority option), so I did not fall back to "the ticket merely resolves as done with no
+content."
+
+## Tests — driven through the real delegation path, not the reply sink directly
+
+Both new tests in `fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java` go through
+`sendAsync` → `injectDelivery` → `ask` → `answer` (with a short timeout, so it genuinely times out,
+mirroring the ~25–120s real MCP-call bound vs. a longer resumed turn) → `reply` → `poll`/`abandon`.
+No test constructs a `Reply` and hands it to a sink directly.
+
+- `aReplyAfterAnswerTimesOutStillCompletesTheAsyncTicket` — asserts `fleet_poll{ticket}` (via
+  `messages.poll`) reaches `Phase.DONE` with the worker's actual reply text and
+  `replySource() == "reply"`, and that `hasStrandedReply(T)` stays `false` (proves the reply never
+  touched the inbox at all — fix 1 caught it).
+- `fleetStopAfterAnOrphanedReplyDoesNotFailTheTicket` — same setup, then calls `abandon(T, "the
+  worker session was released before it replied")` (what `fleet_stop` triggers) and asserts it
+  returns `false` (no failure recorded) and the ticket still polls `DONE` with the real reply.
+
+**Proof both fail without the change.** I temporarily short-circuited both new private methods
+(`askAnsweredAsyncTask` → always `null`, `recoverStrandedReply` → always `null`) — i.e. disabled
+both fixes — and ran just these two tests:
+
+```
+[ERROR] Tests run: 2, Failures: 2, Errors: 0, Skipped: 0
+dev.ltms.fleet.msg.MessageServiceTest.aReplyAfterAnswerTimesOutStillCompletesTheAsyncTicket
+  org.opentest4j.AssertionFailedError: expected: <DONE> but was: <PENDING>
+dev.ltms.fleet.msg.MessageServiceTest.fleetStopAfterAnOrphanedReplyDoesNotFailTheTicket
+  org.opentest4j.AssertionFailedError: a reply already arrived, so nothing here is a genuine failure
+  ==> expected: <false> but was: <true>
+```
+
+This is the exact bug: the ticket stays `PENDING` forever, and `abandon()` reports `true` (a
+failure) even though a reply had already arrived. I then restored both fixes (verified with
+`grep -n "TEMP #137-proof"` finding nothing) and re-ran — both pass.
+
+## Build
+
+Ran from `fleetd/`, unpiped, full output read (not `| tail`):
+
+```
+mvn clean install
+...
+[INFO] Tests run: 1039, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+[INFO] Total time:  36.315 s
+```
+
+Main was at 1037 tests; this branch adds the 2 new tests above → 1039, all green, `exit=0`.
+
+## What I could NOT check
+
+- No IDE tooling is mounted for me (worker), so no `ide_diagnostics`/IntelliJ inspection pass — only
+  `mvn clean install` (compiler + full test suite), as the worker procedure allows.
+- I cannot restart the daemon or dogfood this live — I have no forge/daemon control. This is
+  unverified against a real herdr pane, a real MCP client's ~60s call cap, or a real worker session;
+  everything above is verified only through the JUnit fixture's simulated timing
+  (`FakeHerdr`/`injector.onStatus`/direct `messages.answer(...,150)` calls), not a live fleet.
+  A primary should still consider a short live dogfood (an async delegation that asks, gets answered,
+  and takes longer than ~2 minutes to reply) before calling this closed.
+- I did not touch, and did not re-verify, the `fleet_ask` ~55s window itself (issue #61) — out of
+  scope per the brief.
+
+## Scope note (not investigated further)
+
+`answer()`'s nested/double-`fleet_ask` case (the worker asks a second question before ever
+replying to the first answer) has some pre-existing behaviour around which `turnId` a `QUESTION`
+resolution gets attributed to that I did not fully untangle — it predates this change, my fix does
+not touch it, and it is unrelated to the reported defect. Flagging only; not investigated further.
+
+## Handoff
+
+- Branch: `worker/cb-137-ask-ticket-e7760c-2`
+- Worktree root: `/Users/dai.ha/LTMS/.bridged-worktrees/734324-2`
+- Files changed:
+  - `fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java`
+  - `fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java`
+  - `REPORT-cb137.md` (this file)
+- Build: `Tests run: 1039, Failures: 0, Errors: 0, Skipped: 0` / `BUILD SUCCESS` (verbatim above)

docs/wiki-audit.md

@@ -0,0 +1,208 @@
+# Wiki audit for #168
+
+**Source checked:** `.wiki-snapshot/` at `68e32c6` (2026-08-31). I did not use
+`wiki/`. Code references below are from the current `fleetd` source tree. A quoted
+line is a concrete claim that needs correction, unless the table says `KEEP`.
+
+| Page | Verdict | One-line reason |
+|---|---|---|
+| `Home.md` | REVISE | Good overview, but it still names the retired product. |
+| `_Sidebar.md` | REVISE | The heading still says `claude-bridge`. |
+| `1-Architecture.md` | REBUILD | Its component contract mixes current names with removed tools, routes, and planned backends. |
+| `2-Message-Server.md` | REBUILD | The claimed MCP schema, mount command, REST/SSE surface, and fallback paths are pre-build design. |
+| `3-Approaches.md` | REVISE | Useful research history, but it presents unbuilt AgentAPI as a selectable fallback. |
+| `4-Setup.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `5-Operations.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `6-Team.md` | REBUILD | It teaches role-addressed sends and a Claude-only team model that the shipped API does not have. |
+| `7-Use-Cases.md` | REBUILD | Its flagship flow depends on removed `ccs` profiles and removed send parameters. |
+| `8-Roadmap.md` | REBUILD | It is a historical plan, but it presents old implementation choices and planned work as the current stack. |
+| `9-Implementation.md` | REBUILD | Its package, class, endpoint, and outcome map has drifted from the source. |
+| `10-Cross-Host-Messaging.md` | REVISE | It labels most federation work proposed, but misses the shipped `coordinator:` lead channel. |
+| `11-Features.md` | REVISE | It is the right catalogue, but code-path names are old and it misses the second-herdr-daemon capability. |
+| `12-Claude-to-OpenCode.md` | REVISE | The porting guide is mostly current, but calls the product and spawned-member path a bridge. |
+| `13-User-Guide.md` | REVISE | It is the best operator page, but needs the product rename and the second-herdr-daemon setup. |
+
+## Pages needing work
+
+### `Home.md` — REVISE
+
+- Quote: `# claude-bridge` (line 1) and `` `claude-bridge` keeps`` (line 11).
+  The product is `fleet` / `fleetd`. The MCP server identifies itself as `fleet` in
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:313-315`.
+- Quote: `AgentAPI ... swappable fallback injector` (lines 73-76).
+  There is no AgentAPI implementation under `fleetd/src/main/java`; the actual
+  launchers are selected by `Profile.kind` in
+  `fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java:265-270`.
+
+### `_Sidebar.md` — REVISE
+
+- Quote: `### 📖 claude-bridge` (line 1).
+  Rename it to `fleet`. `FleetMcp` registers the current product-facing tool set at
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:301-326`.
+
+### `1-Architecture.md` — REBUILD
+
+- Quote: `` `claude-bridge` lets`` (line 3). The product was renamed; the MCP
+  server name is `fleet` (`FleetMcp.java:313-315`).
+- Quote: ``fleet_read`` in the tool list (line 102). No such tool is registered.
+  The complete registered list is `fleet_send` through `fleet_whoami` at
+  `FleetMcp.java:301-326`; `fleet_read` is absent.
+- Quote: `SSE (GET /events)` (line 143). `FleetApp.build()` registers no `/events`
+  route; its routes are listed at `FleetApp.java:143-159`.
+- Quote: `Redis Streams / NATS JetStream, or an embedded queue` (line 106).
+  The shipped durable inbox is AMQP, configured by `broker`, at
+  `FleetConfig.java:49-50` and `FleetConfig.java:655-714`.
+- Quote: `AgentAPI (fallback)` (line 107). No AgentAPI adapter exists; shipped
+  launcher kinds are `claude-code` and `opencode` (`FleetConfig.java:265-270`).
+
+### `2-Message-Server.md` — REBUILD
+
+- Quote: `claude mcp add --transport http bridge http://127.0.0.1:8080/mcp`
+  (line 67). The daemon defaults to port `8765` in `FleetConfig.java:183-187`,
+  and identifies its server as `fleet` at `FleetMcp.java:313-315`.
+- Quote: ``fleet_send(message, target?, {block, timeout_seconds, auto_spawn,
+  turn_id})`` (line 80). The real parameters are `sessionId`, `content`,
+  `timeoutMs`, `wait`, `turnId`, and `coordId` (`FleetMcp.java:1096-1108`).
+- Quote: ``fleet_read(target, source)`` (line 85). It is not registered; see the
+  complete registration at `FleetMcp.java:301-326`.
+- Quote: `docs/MCP-Contract.md ... normative` (lines 87-88). That is not a valid
+  reference: only §6 is current, as the current operator guide itself says at
+  `.wiki-snapshot/13-User-Guide.md:466`.
+- Quote: `SSE (GET /events)` (line 45). No route exists in the built REST surface,
+  `FleetApp.java:143-159`.
+
+### `3-Approaches.md` — REVISE
+
+- Quote: `AgentAPI ... remains a swappable fallback injector` (lines 78-84).
+  It was never built. The shipped adapter selection is only `claude-code` or
+  `opencode` (`FleetConfig.java:265-270`). Keep it as discarded research, not an
+  operational fallback.
+- Quote: `claude-bridge` (line 109). Rename the product to `fleet`; the runtime
+  package is `dev.ltms.fleet`, for example `FleetMcp.java:1`.
+
+### `4-Setup.md` — RETIRE
+
+It is a 25-line redirect and says its procedure was never written (lines 3-9).
+Chapter 13 is the maintained install procedure. Keeping a second navigation page
+adds no working documentation.
+
+### `5-Operations.md` — RETIRE
+
+It is a 35-line redirect and says its runbook was never written (lines 3-14).
+Chapter 13 now owns run and recovery instructions.
+
+### `6-Team.md` — REBUILD
+
+- Quote: `fleet_send {role: w-claude, prompt: A}` (line 98). `fleet_send` accepts
+  `sessionId` and `content`, not `role` or `prompt` (`FleetMcp.java:1096-1108`).
+- Quote: `some on Claude, some on the remote local LLM` (lines 3-5) and `Every
+  worker is ... Claude Code` (line 25). `opencode` is a first-class launcher kind,
+  not a Claude worker (`FleetConfig.java:265-270`).
+- Quote: `fleetd's concurrency policy` (line 121). The configured capacity control
+  is per-profile `maxLoad` (`FleetConfig.java:251-264`), not the role routing model
+  described here.
+
+### `7-Use-Cases.md` — REBUILD
+
+- Quote: `ccs profile` (line 10), `ccs + herdr` (line 22), and `ccs-spawn`
+  (line 45). The configuration has `profiles` and `fleet`, not `ccs`:
+  `FleetConfig.java:34-58` and `FleetConfig.java:81-101`.
+- Quote: `fleet_send({"to", "kind", "body", "block"})` (lines 55-62).
+  None of those are the shipped send parameters. The schema is
+  `FleetMcp.java:1096-1108`.
+- Quote: `fleet_list() → { "profiles": ... }` (lines 74-80). `fleet_list` is a
+  roster view; `fleet_profiles` is the configured-backend view, as registered at
+  `FleetMcp.java:307-311` and described at `FleetMcp.java:1176-1182`.
+
+### `8-Roadmap.md` — REBUILD
+
+- Quote: `Java 21+` (line 43). The current project guidance and source use Java 25;
+  the `FleetConfig` source itself uses Java 25 unnamed lambda parameters, for
+  example `FleetConfig.java:102`.
+- Quote: `herdr 0.7.0 / protocol 14` (line 46). The current REST health endpoint
+  reports the live protocol returned by herdr (`FleetApp.java:240-244`), while the
+  current operator guide records protocol 19 at
+  `.wiki-snapshot/13-User-Guide.md:76-85`.
+- Quote: `ccs <profile> claude` and `ccs env <profile>` (lines 47-48). Shipped
+  configuration uses `Profile` records and launcher `kind`,
+  `FleetConfig.java:313-330` and `FleetConfig.java:265-270`.
+- Quote: `Redis Streams via Lettuce` (line 50). The actual durable inbox is AMQP
+  `broker`, `FleetConfig.java:655-714`.
+
+### `9-Implementation.md` — REBUILD
+
+- Quote: `rest.FleetdApp` and `mcp.BridgeMcp` (lines 29-30). The classes are
+  `rest.FleetApp` and `mcp.FleetMcp` (`FleetApp.java:46`; `FleetMcp.java:67`).
+- Quote: `dev.ltms.fleetd` (line 67). The source package is `dev.ltms.fleet`
+  (`FleetMcp.java:1`).
+- Quote: `WorkerPresence` (line 110). The current class is `MemberPresence`, as
+  imported and used by `FleetMcp` at `FleetMcp.java:12` and `465-469`.
+- Quote: the outcome list ending in `STALE_TURN` (lines 128-131). The code also
+  has `BACKEND_EXHAUSTED` (`FleetMcp.java:550-554`) and async `ASKING` handling
+  (`FleetMcp.java:664-668`).
+- Quote: `FleetdApp` (line 207) and `FleetdConfig` (line 211). These names do not
+  resolve; current classes are `FleetApp` and `FleetConfig`.
+
+### `10-Cross-Host-Messaging.md` — REVISE
+
+- Quote: the chapter says the cross-host fabric is proposed except for the
+  single-host inbox (lines 3-8). Cross-host **lead-to-lead** delivery shipped:
+  `fleet_send` accepts `coordId` (`FleetMcp.java:1094-1107`) and publishes it at
+  `FleetMcp.java:616-641`; configuration has `coordinator` at
+  `FleetConfig.java:74-78` and `99-101`.
+- Quote: `bridge.dlx` (line 90). This product name is stale. The shipped lead path
+  uses `LeadChannel`, not the proposed exchange flow (`FleetMcp.java:95-96` and
+  `616-641`). Keep the proposed federation design, but add a clear shipped/proposed
+  boundary for CB-637.
+
+### `11-Features.md` — REVISE
+
+- Quote: `mcp/BridgeMcp` (line 22), `config/FleetdConfig` (lines 25-27), and other
+  index references. These paths no longer resolve; the source classes are
+  `mcp/FleetMcp` (`FleetMcp.java:67`) and `config/FleetConfig`
+  (`FleetConfig.java:81`).
+- Quote: `fleet_whoami` returns only `primary` or `worker` (lines 99-100).
+  It also returns `architect` (`FleetMcp.java:1235-1244`).
+- The page needs the missing separate member-herdr-daemon feature listed below.
+
+### `12-Claude-to-OpenCode.md` — REVISE
+
+- Quote: `same bridge mount` (line 5) and `a bridge-spawned worker` (line 94).
+  Rename the product path to `fleet`. The daemon exposes the MCP server as `fleet`
+  (`FleetMcp.java:313-315`), and profiles select OpenCode with `kind: opencode`
+  (`FleetConfig.java:332-335`).
+- Quote: the sample mount name is `fleetd` (line 67). The server name is `fleet`;
+  update the sample to avoid teaching a second product name.
+
+### `13-User-Guide.md` — REVISE
+
+- Quote: `The bridge is the only channel` (line 63). The invariant is correct, but
+  the product term needs the `fleet` rename. The daemon's MCP server name is
+  `fleet` (`FleetMcp.java:313-315`).
+- Quote: it describes one herdr socket (lines 72-85). It needs the optional
+  `memberHerdrSocket` setup and two-daemon health meaning. The config key is in
+  `FleetConfig.java:34-37`, and `/healthz` checks both daemons when configured at
+  `FleetApp.java:210-245`.
+
+## MISSING
+
+`11-Features.md` has a body section for **routing members through a separate herdr daemon**
+(`## memberHerdrSocket`, line 2174), but **no row in the index table** at the top of the page
+(lines 20-95). That table is how the page is meant to be read, so a capability absent from it is
+effectively undiscoverable. Lead note: this is my own omission — I added the section on 2026-08-31
+and did not add the matching row. Fixed in the wiki at `68e32c6`'s successor.
+
+The original audit stated the feature had no entry at all. That was wrong: the section exists. The
+gap is the index row. Recorded here rather than silently corrected, because the difference matters —
+"undocumented" and "documented but unindexed" are different jobs.
+
+Evidence for the feature itself: `FleetConfig.java:34-37` and `FleetApp.java:103-115`, `210-245`,
+and `247-263`.
+
+## Audit method and coverage
+
+I checked all 15 pages. I checked concrete tool, route, config, class, file, and
+product-name claims claim-by-claim on 11 pages: Home, Sidebar, 1, 2, 4, 5, 6, 7, 9,
+11, and 13. I skimmed the remaining four long historical or research pages (3, 8, 10,
+12), then checked their concrete claims that affect the verdict. This is an audit of
+the supplied snapshot, not a wiki rewrite.

fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -74,6 +74,14 @@ public final class CompletionResolver implements TurnListener {
      */
     public static final long MIN_TURN_NANOS = Duration.ofSeconds(2).toNanos();
 
+    /**
+     * fleetd#164 (part 2): one stable, explicit backend-failure marker seen on a Claude Code pane
+     * when the backend itself rejected the turn (e.g. {@code "API Error: 400 invalid request body"}).
+     * Kept deliberately narrow — a growing list of ad-hoc error strings rots as backends change their
+     * wording; broader backend-error surfacing is out of scope here (fleetd#164 point 3).
+     */
+    private static final Pattern BACKEND_ERROR = Pattern.compile("(?i)\\bAPI Error\\s*:");
+
     private static final String CLIPPED_PANE_TAIL_MARKER =
             "[Pane tail clipped: member did not call fleet_reply.]";
 
@@ -278,6 +286,20 @@ public final class CompletionResolver implements TurnListener {
             }
             return;
         }
+        // fleetd#164 (part 2): a scrape that read cleanly and produced content still isn't a real
+        // reply when that content is the backend's own rejection (e.g. an HTTP 400 before the worker
+        // did any work). Classify it as a failure naming the member, rather than handing the caller a
+        // scrape that reads like a completed answer.
+        String backendError = firstMatchingLine(assistantBlock, BACKEND_ERROR);
+        if (backendError != null) {
+            // Carry the whole scrape, not just the matched line. The pattern is a heuristic: a member
+            // that forgot fleet_reply while reporting *about* a backend error matches it too. Failing
+            // is still right — the caller must not read a scrape as an answer — but dropping the rest
+            // of the pane would destroy the report, which is the same defect fleetd#164 is about.
+            fail(target, turn, "member " + target + " ended on a backend error: " + backendError
+                    + "\n--- pane tail ---\n" + tail);
+            return;
+        }
         String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
         if (rendezvous.resolveCompletion(waiter, completion)) {
             inFlight.remove(target, turn);

fleetd/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java

@@ -3,6 +3,7 @@ package dev.ltms.fleet.member;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerHandle;
@@ -46,9 +47,13 @@ import java.util.stream.Collectors;
  *       the single adapter that declares it. Profiles partition cleanly across adapters: the
  *       constructor rejects a name claimed by two.</li>
  *   <li><strong>By pane id</strong> — {@link #stop} routes to the adapter that spawned that pane
- *       (recorded at spawn time). A pane the composite never spawned can use the fallback route
- *       in a one-daemon fleet. With more than one herdr daemon, its owner is unknown, so stop refuses
- *       the ambiguous id rather than closing a pane on an arbitrary herdr daemon.</li>
+ *       (recorded at spawn time). A pane the composite never spawned, or one whose record was lost
+ *       to a daemon restart (CB-185 blocker 1 — {@link #spawnedBy} is in-memory only), can use the
+ *       fallback route in a one-daemon fleet. With more than one herdr daemon, {@link #probeOwner}
+ *       asks each configured daemon which one actually knows the pane: exactly one match routes
+ *       (and caches); no match is treated as already-gone; more than one match is a genuine
+ *       ambiguity (pane ids are per-daemon counters, so two daemons really can both hold, say,
+ *       {@code w1:p1}) and stop refuses rather than closing a pane on an arbitrary herdr daemon.</li>
  *   <li><strong>Fleet-wide</strong> — {@link #reapOrphanWorkers} and {@link #capabilities} fan out
  *       and combine. {@link #list} is deduplicated by (owning daemon, pane id): delegates that share
  *       one herdr connection report the same global agent set, but two daemons can each hold a pane
@@ -440,12 +445,23 @@ public final class CompositePeerLauncher implements PeerLauncher {
     public void stop(String id) {
         HerdrPeerLauncher d = spawnedBy.get(id);
         if (d == null) {
-            if (herdrDaemonCount() != 1) {
-                throw new IllegalArgumentException("ambiguous paneId '" + id
-                        + "': no owning herdr daemon was recorded");
+            if (herdrDaemonCount() == 1) {
+                log.debug("stop({}) — no recorded owner in a single-daemon fleet", id);
+                d = delegates.getFirst();
+            } else {
+                d = probeOwner(id);
+                if (d == null) {
+                    // No configured herdr daemon has ever heard of this pane. CB-185 blocker 1: this
+                    // is the normal case right after a daemon restart empties spawnedBy for a member
+                    // that has ALREADY been torn down since — the caller retried a stop that already
+                    // succeeded. Nothing to close and no owner to cache; matching the tolerance
+                    // HerdrPeerLauncher#stop already gives an already-gone pane (agent.close swallows
+                    // that as success), stop() here is a no-op rather than a refusal.
+                    log.debug("stop({}) — no configured herdr daemon knows this pane; "
+                            + "treating as already stopped", id);
+                    return;
+                }
             }
-            log.debug("stop({}) — no recorded owner in a single-daemon fleet", id);
-            d = delegates.getFirst();
         }
         // Drop the owner record only after the delegate accepted the stop. Removing it first meant a
         // delegate that threw left the pane alive with its owner forgotten, so the retry fell into
@@ -454,6 +470,61 @@ public final class CompositePeerLauncher implements PeerLauncher {
         spawnedBy.remove(id);
     }
 
+    /**
+     * CB-185 blocker 1: recover a spawnedBy cache miss by asking every distinct herdr daemon which
+     * one actually knows {@code id} — the fix for "after a restart, every surviving member becomes
+     * un-stoppable" (spawnedBy is in-memory only, so a restart empties it, and members intentionally
+     * outlive the daemon).
+     *
+     * <p>Grouped by daemon identity, not by delegate, for the same reason {@link #list()} groups
+     * that way: two adapters (claude-code, opencode) sharing one herdr connection would otherwise be
+     * probed twice, and a pane on their shared daemon would look owned by two adapters instead of
+     * one daemon.
+     *
+     * <p>A daemon that fails to answer {@code list()} (e.g. it is down) is treated as "does not know
+     * this pane" rather than aborting the whole probe — one unreachable daemon must never make a
+     * pane that a <em>different</em>, healthy daemon actually owns un-stoppable too, which would
+     * resurrect the exact bug this method exists to fix.
+     *
+     * @return the owning delegate — cached into {@link #spawnedBy} so the next call is free — or
+     *         {@code null} when no daemon knows the pane
+     * @throws IllegalArgumentException when more than one daemon claims the pane: pane ids are
+     *         per-daemon counters, so two daemons really can both hold, say, {@code w1:p1}, and there
+     *         is no way to tell which one the caller means
+     */
+    private HerdrPeerLauncher probeOwner(String id) {
+        Map<HerdrClient, HerdrPeerLauncher> byDaemon = new IdentityHashMap<>();
+        for (HerdrPeerLauncher delegate : delegates) {
+            byDaemon.putIfAbsent(delegate.herdr(), delegate);
+        }
+        List<HerdrPeerLauncher> owners = new ArrayList<>();
+        for (HerdrPeerLauncher representative : byDaemon.values()) {
+            List<Agent> agents;
+            try {
+                agents = representative.list();
+            } catch (HerdrException e) {
+                log.warn("stop({}) probe: a configured herdr daemon was unreachable ({}); "
+                        + "treating it as not knowing this pane", id, e.getClass().getSimpleName());
+                continue;
+            }
+            boolean knows = agents.stream().anyMatch(a -> id.equals(a.paneId()));
+            if (knows) {
+                owners.add(representative);
+            }
+        }
+        if (owners.size() > 1) {
+            throw new IllegalArgumentException("ambiguous paneId '" + id + "': "
+                    + owners.size() + " configured herdr daemons report this pane — "
+                    + "no way to tell which one the caller means");
+        }
+        if (owners.isEmpty()) {
+            return null;
+        }
+        HerdrPeerLauncher owner = owners.get(0);
+        spawnedBy.put(id, owner);
+        return owner;
+    }
+
     /**
      * Count actual herdr daemons, not peer adapter kinds. Identity is intentional: separate client
      * objects may represent different daemons even if a client later implements value equality.

fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -168,14 +168,23 @@ public final class MessageService {
         private final String ticket;
         private final String target;
         private final CompletableFuture<Reply> future = new CompletableFuture<>();
-        private final long createdNanos;
+        /**
+         * When {@link #future} resolved, or {@code null} while it is still pending — the clock
+         * {@link #pruneTerminalTickets} measures the TTL from (#197). Deliberately a boxed
+         * {@code Long} rather than a {@code long} with a sentinel: {@link System#nanoTime} may
+         * legitimately return any value, zero and negatives included, so no numeric sentinel can mean
+         * "not stamped yet". Stamped by a {@code whenComplete} hook registered in the constructor, so
+         * every completion path stamps it — a reply, the completion fallback, a timeout, a failure,
+         * or an abandon on teardown — without each of those having to remember to.
+         */
+        private volatile Long completedNanos;
         private volatile Reply question;
         private volatile String turnId;
 
-        private Task(String ticket, String target, long createdNanos) {
+        private Task(String ticket, String target, LongSupplier nowNanos) {
             this.ticket = ticket;
             this.target = target;
-            this.createdNanos = createdNanos;
+            future.whenComplete((reply, ex) -> completedNanos = nowNanos.getAsLong());
         }
     }
 
@@ -357,21 +366,40 @@ public final class MessageService {
     }
 
     /**
-     * Route a worker's explicit {@code fleet_reply}: resolve an open send, or queue it in the
-     * inbox if no send is currently open. Unlike the bare {@link Rendezvous#resolve}, a no-waiter
-     * result is <em>not</em> a failure — the reply is held for later drain.
+     * Route a worker's explicit {@code fleet_reply}: resolve an open send, complete an async ticket
+     * still parked waiting on this exact turn's answer, or — only once neither applies — queue it in
+     * the inbox. Unlike the bare {@link Rendezvous#resolve}, a no-waiter result is <em>not</em> a
+     * failure — the reply is held for later drain.
      *
      * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code fleet_ask} /
      * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
      * are interactive and must never be queued.
      *
-     * @return always {@code true} — the reply either resolved a live send or was queued
+     * @return always {@code true} — the reply resolved a live send, completed a parked ticket, or
+     *         was queued
      */
     public boolean reply(String session, String content) {
         if (rendezvous.resolve(session, content)) {
             count(FleetMetrics.REPLIES, "path", "rendezvous");
             return true;                       // a live send took it — unchanged fast path
         }
+        // #137: no live rendezvous waiter, but this may be the worker's real fleet_reply resuming a
+        // turn that {@link #answer} already gave up waiting on. answer()'s own bounded wait (the
+        // primary's fleet_send{turnId} call, capped well under a minute) can time out and close its
+        // waiter long before the worker — now actually resuming real work — finishes and replies. That
+        // reply used to have nowhere to land but the session inbox, leaving the async ticket's future
+        // unresolved forever: fleet_poll{ticket} stayed PENDING until fleet_stop's abandon() forced it
+        // FAILED with a misleading "session released before it replied" reason, even though the reply
+        // had, in fact, arrived. Completing the matching ticket directly here means fleet_poll{ticket}
+        // sees the real reply instead.
+        Task orphan = askAnsweredAsyncTask(session);
+        if (orphan != null && orphan.future.complete(new Reply(Outcome.REPLIED, content))) {
+            if (orphan.turnId != null) {
+                asyncTasksByTurn.remove(orphan.turnId, orphan);
+            }
+            count(FleetMetrics.REPLIES, "path", "async-recovered");
+            return true;                       // the ticket itself took it — no inbox stranding at all
+        }
         inbox.publish(session, UUID.randomUUID().toString(), content);
         // CB-640: record the stranding itself (not just the reply text) so fleet health can see a
         // worker whose replies keep missing their waiter, not only the queue depth this leaves behind.
@@ -385,6 +413,24 @@ public final class MessageService {
         return true;                           // held, not lost
     }
 
+    /**
+     * The still-open async task on {@code target} whose {@code fleet_ask} was already answered — its
+     * {@link Task#turnId} is stamped but its {@link Task#question} was cleared by {@link #answer} —
+     * yet whose future is not resolved yet (#137). {@code null} if no such task exists, including the
+     * common case where {@code target}'s worker never used {@code fleet_ask} at all (a task that was
+     * never asked has {@code turnId == null}, so it can never match here and only ever completes
+     * through the ordinary rendezvous fast path in {@link #reply}).
+     */
+    private Task askAnsweredAsyncTask(String target) {
+        for (Task task : tasks.values()) {
+            if (target.equals(task.target) && task.question == null && task.turnId != null
+                    && !task.future.isDone()) {
+                return task;
+            }
+        }
+        return null;
+    }
+
     /** Record a counter sample when a registry is wired; a no-op in unit tests. */
     private void count(String name, String... labels) {
         if (metrics != null) {
@@ -426,19 +472,43 @@ public final class MessageService {
      * <p>Resolving the waiter as a failure — rather than letting it time out — also means the
      * outcome is counted, so a torn-down delegation stops being invisible to {@code /metrics}.
      *
-     * @return true if a live waiter was failed
+     * <p><strong>#137 defence in depth.</strong> {@link #reply} already hands a worker's real
+     * {@code fleet_reply} straight to the async ticket it belongs to whenever one is still parked
+     * waiting for it (see {@link #askAnsweredAsyncTask}), so by the time a session is released its
+     * tasks are normally already resolved — this loop's {@code complete} calls are then harmless
+     * no-ops (a {@link CompletableFuture} can only resolve once). But should some other path someday
+     * strand a reply in the inbox without completing its ticket, checking
+     * {@link #hasStrandedReply(String)} here — before ever writing a failure — means a torn-down
+     * session whose worker in fact replied is still reported {@code REPLIED} with that reply's own
+     * text, never the misleading "the worker session was released before it replied" (which also
+     * means the snapshot/worktree recovery hint that follows it never prints once a reply exists).
+     *
+     * @return true if a live waiter or an async task was failed (never true for one recovered as a
+     *         reply — see the note above)
      */
     public boolean abandon(String target, String reason) {
+        boolean hadStrandedReply = hasStrandedReply(target);
         // CB-640: the session is gone — nothing will ever accept or deliver into it now.
         strandedReplies.remove(target);
         queuedDeliveries.remove(target);
         CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
         boolean failed = waiter != null && !waiter.isDone() && rendezvous.resolveFailure(waiter, reason);
         boolean asyncFailed = false;
+        Reply recovered = null; // lazily drained at most once, only if a task actually needs it
         for (Task task : tasks.values()) {
-            if (target.equals(task.target) && task.question == null
-                    && task.future.complete(new Reply(Outcome.WORKER_FAILED, reason))) {
-                asyncFailed = true;
+            if (!target.equals(task.target) || task.question != null || task.future.isDone()) {
+                continue;
+            }
+            if (hadStrandedReply && recovered == null) {
+                recovered = recoverStrandedReply(target);
+            }
+            Reply outcome = recovered != null ? recovered : new Reply(Outcome.WORKER_FAILED, reason);
+            if (task.future.complete(outcome)) {
+                if (outcome.outcome() == Outcome.WORKER_FAILED) {
+                    asyncFailed = true;
+                } else if (task.turnId != null) {
+                    asyncTasksByTurn.remove(task.turnId, task);
+                }
             }
         }
         if (failed) {
@@ -447,6 +517,21 @@ public final class MessageService {
         return failed || asyncFailed;
     }
 
+    /**
+     * Drain {@code target}'s inbox and hand its content back as a {@link Outcome#REPLIED} result
+     * (#137 defence in depth for {@link #abandon}) — {@code null} if it turned out empty (the
+     * stranding fact raced away, e.g. a lead's own {@code fleet_poll} on the raw session already
+     * drained it first). When more than one message is queued, only the newest is the worker's actual
+     * final answer ({@link #drainReplies} returns them oldest-first).
+     */
+    private Reply recoverStrandedReply(String target) {
+        var messages = drainReplies(target);
+        if (messages.isEmpty()) {
+            return null;
+        }
+        return new Reply(Outcome.REPLIED, messages.get(messages.size() - 1).content());
+    }
+
     /**
      * Acknowledge a specific reply by {@code msgId} for {@code target}. Removes it from the inbox
      * so that a subsequent drain or peek no longer returns it.
@@ -721,7 +806,7 @@ public final class MessageService {
      */
     public String sendAsync(String target, String content, Runnable onAccepted) {
         String ticket = "task-" + ticketSeq.incrementAndGet();
-        Task task = new Task(ticket, target, nowNanos.getAsLong());
+        Task task = new Task(ticket, target, nowNanos);
         tasks.put(ticket, task);
         if (pushLoop != null) {
             // CB-588: task.future only ever completes on a terminal phase (DONE or a failure) — a
@@ -821,12 +906,25 @@ public final class MessageService {
      * (or one the reminder cap already gave up on) is pruned here but never collected there, so it
      * lingers in {@code pendingTickets} forever and rides along on every later nudge to the same lead
      * — naming a ticket {@code fleet_poll} can no longer find (CB-588 follow-up).
+     *
+     * <p>The TTL runs from **completion**, not from creation (#197). It used to compare against
+     * {@code createdNanos}, which made the real collection window {@code TTL minus however long the
+     * task ran}: a delegation that took longer than the TTL had its reply destroyed on the first
+     * sweep after it landed, every time. That is the normal case here — real work runs well past ten
+     * minutes — and the reply lives only in {@code future}, so pruning it discards the worker's whole
+     * report with nothing to fall back on. Measuring from completion gives every ticket the same full
+     * window whatever its runtime, and still bounds {@code tasks}.
+     *
+     * <p>A task whose future is done but whose {@code completedNanos} is not stamped yet is left
+     * alone. That window is the few instructions between {@code complete()} and the constructor's
+     * {@code whenComplete} hook running; the next sweep collects it.
      */
     private void pruneTerminalTickets() {
         long cutoff = nowNanos.getAsLong() - TICKET_TTL_NANOS;
         tasks.entrySet().removeIf(e -> {
             Task t = e.getValue();
-            boolean expired = t.future.isDone() && t.createdNanos < cutoff;
+            Long completed = t.completedNanos;
+            boolean expired = t.future.isDone() && completed != null && completed < cutoff;
             if (expired && pushLoop != null) {
                 pushLoop.ticketCollected(e.getKey());
             }

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -214,6 +214,17 @@ public final class FleetApp {
      * second daemon configured, a member daemon that is down must not be masked by a healthy lead
      * daemon — every spawn goes through the member daemon and would otherwise fail silently behind
      * a green {@code /healthz}.
+     *
+     * <p>CB-185 blocker 2: the {@code herdr} key always carries the <em>lead</em> daemon's
+     * version/protocol, unchanged, because two consumers — {@code scripts/redeploy-fleetd.sh} and
+     * {@code scripts/rename-checkout.sh} — read this endpoint already (both only check the HTTP
+     * status code and print the body verbatim; neither parses a specific field, so adding a key
+     * alongside {@code herdr} is safe). But it is the <em>member</em> daemon's protocol that decides
+     * whether a spawn works, so when a second daemon is configured its version/protocol is reported
+     * too, under a separate {@code member} key — never folded into {@code herdr}, which would make a
+     * mismatch invisible to whichever consumer only reads that key. If the two protocol numbers
+     * differ, {@code protocolMismatch: true} calls it out explicitly rather than leaving it to be
+     * spotted by comparing two numbers by eye.
      */
     private void healthz(Context ctx) {
         JsonNode pong;
@@ -226,9 +237,15 @@ public final class FleetApp {
                     "detail", e.getMessage()));
             return;
         }
+        Map<String, Object> body = new LinkedHashMap<>();
+        body.put("status", "ok");
+        body.put("herdr", Map.of(
+                "version", pong.path("version").asText(""),
+                "protocol", pong.path("protocol").asInt()));
         if (memberHerdr != herdr) {
+            JsonNode memberPong;
             try {
-                memberHerdr.call("ping");
+                memberPong = memberHerdr.call("ping");
             } catch (HerdrException e) {
                 ctx.status(503).json(Map.of(
                         "status", "degraded",
@@ -236,12 +253,16 @@ public final class FleetApp {
                         "detail", e.getMessage()));
                 return;
             }
+            int leadProtocol = pong.path("protocol").asInt();
+            int memberProtocol = memberPong.path("protocol").asInt();
+            body.put("member", Map.of(
+                    "version", memberPong.path("version").asText(""),
+                    "protocol", memberProtocol));
+            if (leadProtocol != memberProtocol) {
+                body.put("protocolMismatch", true);
+            }
         }
-        ctx.status(200).json(Map.of(
-                "status", "ok",
-                "herdr", Map.of(
-                        "version", pong.path("version").asText(""),
-                        "protocol", pong.path("protocol").asInt())));
+        ctx.status(200).json(body);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -110,6 +110,7 @@ public final class GitWorktrees implements Worktrees {
 
     @Override
     public String add(String repoRoot, String branch, String baseRef) {
+        reportRemoteUrlsWithUserInfo(repoRoot);
         String base = (baseRef == null || baseRef.isBlank()) ? "HEAD" : baseRef;
         String nonce = nonce();
         Path root = resolveRoot(repoRoot);
@@ -139,7 +140,7 @@ public final class GitWorktrees implements Worktrees {
         if (exitCode("git", "-C", repoRoot, "config", "--get", "remote.origin.url") != 0) {
             return;
         }
-        String origin = exec("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
+        String origin = execRedacted("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
         URI uri;
         try {
             uri = new URI(origin);
@@ -155,6 +156,9 @@ public final class GitWorktrees implements Worktrees {
             throw new WorktreeException("origin URL has invalid HTTPS user info; cannot provision safely");
         }
         String cleanOrigin = origin.substring(0, schemeEnd) + origin.substring(userInfoEnd + 1);
+        // Plain exec, not execRedacted, is correct here: this call WRITES cleanOrigin (already
+        // stripped of user-info above) rather than reading a URL back from stdout, so there is
+        // nothing secret left in either its argv or its stdout to redact.
         exec("git", "-C", repoRoot, "remote", "set-url", "origin", cleanOrigin);
         log.info("removed HTTPS user info from forge origin before provisioning worktree");
     }
@@ -164,7 +168,7 @@ public final class GitWorktrees implements Worktrees {
         if (exitCode("git", "-C", worktreePath, "remote", "get-url", "--all", "origin") != 0) {
             return;
         }
-        String origins = exec("git", "-C", worktreePath, "remote", "get-url", "--all", "origin");
+        String origins = execRedacted("git", "-C", worktreePath, "remote", "get-url", "--all", "origin");
         for (String origin : origins.split("\\R")) {
             try {
                 URI uri = new URI(origin);
@@ -177,6 +181,99 @@ public final class GitWorktrees implements Worktrees {
         }
     }
 
+    /**
+     * Report — never refuse — every remote whose fetch or push URL carries user-info outside SSH.
+     * A linked worktree shares its parent repository's git config, so a credential on ANY remote
+     * (not only {@code origin}) or in a {@code pushurl} is just as readable by a member as one on
+     * {@code origin}'s HTTPS fetch URL — the one case {@link #removeUserInfoFromHttpsOrigin} and
+     * {@link #requireCredentialFreeHttpsOrigin} already strip and refuse. This check is additive: it
+     * only logs a warning, it never mutates config and never refuses the provision.
+     *
+     * <p>A reporting-only check must never be able to abort a provision — PR #173 shipped one that
+     * ran unguarded at the top of {@link #add}, and every git call inside it can throw ({@link #exec}
+     * turns a non-zero exit or its 30-second timeout into a {@link WorktreeException}). Every git call
+     * here is therefore wrapped, and on failure only the exception's <em>class</em> is logged, never
+     * its message: the enumerating {@code git remote} call is not redacted, and its stderr is read
+     * from the very config that may hold the URL this check exists to find.
+     */
+    private void reportRemoteUrlsWithUserInfo(String repoRoot) {
+        List<String> remotes;
+        try {
+            remotes = exec("git", "-C", repoRoot, "remote").lines()
+                    .map(String::trim)
+                    .filter(r -> !r.isBlank())
+                    .toList();
+        } catch (RuntimeException e) {
+            log.warn("could not enumerate remotes to check for credentialed URLs in {}: {}",
+                    Path.of(repoRoot).toAbsolutePath().normalize(), e.getClass().getName());
+            return;
+        }
+        for (String remote : remotes) {
+            reportOneRemoteUrlsWithUserInfo(repoRoot, remote);
+        }
+    }
+
+    private void reportOneRemoteUrlsWithUserInfo(String repoRoot, String remote) {
+        boolean leaks = remoteUrlsLeakUserInfo(repoRoot, remote, false)
+                || remoteUrlsLeakUserInfo(repoRoot, remote, true);
+        if (leaks) {
+            log.warn("member worktree shares a remote URL containing user-info: remote={} repository={}; "
+                     + "remove credentials from the repository's git config",
+                    remote, Path.of(repoRoot).toAbsolutePath().normalize());
+        }
+    }
+
+    /**
+     * True when any resolved fetch (or, if {@code push}, push) URL for {@code remote} carries
+     * non-empty user-info outside SSH. Never throws — a git failure here is caught, logged (its
+     * class only, per the javadoc above), and treated as "nothing found", so it cannot abort or
+     * otherwise affect provisioning. Uses {@link #execRedacted} because the command's stdout is
+     * itself the URL this check exists to find.
+     */
+    private boolean remoteUrlsLeakUserInfo(String repoRoot, String remote, boolean push) {
+        try {
+            String out = push
+                    ? execRedacted("git", "-C", repoRoot, "remote", "get-url", "--push", "--all", remote)
+                    : execRedacted("git", "-C", repoRoot, "remote", "get-url", "--all", remote);
+            return out.lines().anyMatch(url -> !url.isBlank() && urlLeaksUserInfo(url.trim()));
+        } catch (RuntimeException e) {
+            log.warn("could not read the {} URL for remote {} to check for credentials: {}",
+                    push ? "push" : "fetch", remote, e.getClass().getName());
+            return false;
+        }
+    }
+
+    /**
+     * True when {@code rawUrl} parses as an absolute URI with a non-SSH-family scheme and non-empty
+     * user-info. An unparsable or scheme-less URL — including the ssh scp-like shorthand
+     * ({@code user@host:path}) — is not this check's concern and is treated as "no finding", the
+     * same way {@link #configureHttpsUrlRewriteForSshOrigin} leaves that shorthand untouched.
+     */
+    private static boolean urlLeaksUserInfo(String rawUrl) {
+        URI uri;
+        try {
+            uri = new URI(rawUrl);
+        } catch (URISyntaxException e) {
+            return false;
+        }
+        String scheme = uri.getScheme();
+        if (scheme == null || isSshLikeScheme(scheme)) {
+            return false;
+        }
+        String userInfo = uri.getUserInfo();
+        return userInfo != null && !userInfo.isEmpty();
+    }
+
+    /**
+     * SSH-family schemes deliberately excluded from {@link #urlLeaksUserInfo}: there, the user part
+     * selects an account and authentication itself happens over SSH, so it is not a credential the
+     * way HTTPS/HTTP user-info is.
+     */
+    private static boolean isSshLikeScheme(String scheme) {
+        return "ssh".equalsIgnoreCase(scheme) || "git+ssh".equalsIgnoreCase(scheme)
+                || "ssh+git".equalsIgnoreCase(scheme);
+    }
+
     /** Configure a per-worktree helper that supplies a token from the member environment at call time. */
     private void configureEnvironmentCredentialHelper(String repoRoot, String worktreePath) {
         exec("git", "-C", repoRoot, "config", "extensions.worktreeConfig", "true");
@@ -234,7 +331,7 @@ public final class GitWorktrees implements Worktrees {
         if (exitCode("git", "-C", repoRoot, "config", "--get", "remote.origin.url") != 0) {
             return;
         }
-        String origin = exec("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
+        String origin = execRedacted("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
         URI uri;
         try {
             uri = new URI(origin);
@@ -603,6 +700,31 @@ public final class GitWorktrees implements Worktrees {
 
     /** Same as {@link #exec(String...)}, with extra environment variables set on the child process. */
     private String exec(Map<String, String> extraEnv, String... command) {
+        return exec(extraEnv, false, command);
+    }
+
+    /**
+     * Same as {@link #exec(String...)}, for a command whose stdout may itself carry a credential
+     * (e.g. {@code git remote get-url}, whose output is a URL). Stdout is still returned normally on
+     * success — callers still get the URL to inspect — but it is suppressed from BOTH the timeout
+     * message and the non-zero-exit message, so a failing call here can never copy it into a
+     * {@link WorktreeException}, and from there into a caller's log.
+     */
+    private String execRedacted(String... command) {
+        return exec(Map.of(), true, command);
+    }
+
+    /**
+     * Shared implementation for {@link #exec(Map, String...)} and {@link #execRedacted(String...)}.
+     * {@code redactOutput} suppresses captured stdout from both failure messages below.
+     *
+     * <p>Package-private, not {@code private}: also a test seam, the same way the
+     * {@code afterWorktreeAdded} constructor parameter is. It lets a test drive the redaction
+     * guarantee directly — a synthetic failing command whose stdout carries a test marker passed
+     * through {@code extraEnv} rather than argv — without depending on finding a real git failure
+     * mode that happens to echo a URL onto stdout before exiting non-zero.
+     */
+    String exec(Map<String, String> extraEnv, boolean redactOutput, String... command) {
         String out;
         int code;
         Process p;
@@ -624,7 +746,8 @@ public final class GitWorktrees implements Worktrees {
         try {
             if (!p.waitFor(30, TimeUnit.SECONDS)) {
                 p.destroyForcibly();
-                throw new WorktreeException("command timed out: " + String.join(" ", command) + "\n" + out);
+                throw new WorktreeException("command timed out: " + String.join(" ", command)
+                        + (redactOutput || out.isBlank() ? "" : "\n" + out));
             }
             code = p.exitValue();
         } catch (InterruptedException e) {
@@ -634,7 +757,7 @@ public final class GitWorktrees implements Worktrees {
         }
         if (code != 0) {
             throw new WorktreeException("exit " + code + " for: " + String.join(" ", command)
-                    + (out.isBlank() ? "" : "\n" + out));
+                    + (redactOutput || out.isBlank() ? "" : "\n" + out));
         }
         return out;
     }

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -31,6 +31,8 @@ public final class FakeHerdr implements HerdrClient {
      */
     public final List<Call> calls = new CopyOnWriteArrayList<>();
     private boolean healthy = true;
+    private String pingVersion = "0.8.0";
+    private int pingProtocol = 19;
     private final List<String> extraWorkspaces = new ArrayList<>();
     private final List<String> extraAgents = new ArrayList<>();
     /** workspaceId → extra tabs that {@code tab.list} reports for it (CB-558 lead scans). */
@@ -52,6 +54,16 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
+    /**
+     * Make {@code ping} report this version/protocol instead of the default 0.8.0/19 — CB-185
+     * blocker 2's fixture for a lead and a member daemon running mismatched herdr versions.
+     */
+    public FakeHerdr pingReports(String version, int protocol) {
+        this.pingVersion = version;
+        this.pingProtocol = protocol;
+        return this;
+    }
+
     /** Reject the first {@code n} {@code agent.start} calls with {@code agent_name_taken}. */
     public FakeHerdr agentNameTakenTimes(int n) {
         this.agentNameTakenFor = n;
@@ -166,7 +178,8 @@ public final class FakeHerdr implements HerdrClient {
         try {
             return switch (method) {
                 case "ping" -> mapper.readTree(
-                        "{\"type\":\"pong\",\"version\":\"0.8.0\",\"protocol\":19}");
+                        ("{\"type\":\"pong\",\"version\":\"%s\",\"protocol\":%d}")
+                                .formatted(pingVersion, pingProtocol));
                 case "workspace.list" -> mapper.readTree(("""
                         {"type":"workspace_list","workspaces":[
                           {"workspace_id":"w1","label":"dev-mgnl","focused":true,"pane_count":7,"agent_status":"unknown"},

fleetd/src/test/java/dev/ltms/fleet/inject/CompletionResolverTest.java

@@ -566,6 +566,73 @@ class CompletionResolverTest {
         assertEquals("The usage limit has been reached.", waiter.getNow(null).text());
     }
 
+    // --- fleetd#164 (part 2 addendum): narrow BACKEND_ERROR pattern classification ---------
+
+    @Test
+    void classifiesABackendErrorLineAsAFailureInsteadOfACompletedReply() {
+        String block = "⏺ API Error: 400 invalid request body\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "a backend-error scrape still resolves the blocked send");
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "a backend rejection is a failure, not a completed reply");
+    }
+
+    @Test
+    void theBackendErrorReasonNamesTheMemberAndCarriesTheMatchedLine() {
+        String block = "⏺ API Error: 400 invalid request body\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        String reason = waiter.getNow(null).text();
+        assertTrue(reason.contains("term_a"), "the failure names the member: " + reason);
+        assertTrue(reason.contains("API Error: 400 invalid request body"),
+                "the failure carries the matched backend-error line: " + reason);
+    }
+
+    @Test
+    void aCaseInsensitiveApiErrorLineIsStillClassifiedAsABackendError() {
+        String block = "⏺ api error: rate limited\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(), "the pattern is case-insensitive");
+    }
+
+    @Test
+    void aBackendErrorFailureStillCarriesTheRestOfTheScrape() {
+        // The pattern is a heuristic: a member that forgot fleet_reply while *reporting on* a backend
+        // error matches it too. Failing is still correct, but the report itself must survive — losing
+        // it would be the same information-destroying defect fleetd#164 exists to fix.
+        String block = "\u23fa I looked into the gateway problem.\n"
+                + "The log line was: API Error: 400 invalid request body\n"
+                + "The cause is a missing content-type header.\n\u276f ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        String reason = waiter.getNow(null).text();
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind());
+        assertTrue(reason.contains("The cause is a missing content-type header."),
+                "the failure carries the rest of the pane, not only the matched line: " + reason);
+    }
+
     @Test
     void coverageIsOffWhenNoProfileHasAPatternConfigured() {
         assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",

fleetd/src/test/java/dev/ltms/fleet/member/CompositePeerLauncherTest.java

@@ -346,13 +346,94 @@ class CompositePeerLauncherTest {
 
     @Test
     void stopRejectsAnUnownedPaneIdWhenMultipleDaemonsCouldOwnIt() {
+        // CB-185 blocker 1: genuine ambiguity — pane ids are per-daemon counters, so two daemons
+        // can each really hold an agent at "w1:p1". Neither claims ownership through spawnedBy
+        // (empty, as after a restart), so the probe must find BOTH and refuse rather than guess.
+        FakeHerdr first = new FakeHerdr().withAgent("x", "term_x", "w1:p1", "w1:t1");
+        FakeHerdr second = new FakeHerdr().withAgent("y", "term_y", "w1:p1", "w1:t1");
         PeerLauncher composite = new CompositePeerLauncher(
-                List.of(claudeAdapter(new FakeHerdr()), opencodeAdapter(new FakeHerdr())), "claude");
+                List.of(claudeAdapter(first), opencodeAdapter(second)), "claude");
 
         IllegalArgumentException error = assertThrows(IllegalArgumentException.class,
                 () -> composite.stop("w1:p1"));
 
-        assertEquals("ambiguous paneId 'w1:p1': no owning herdr daemon was recorded", error.getMessage());
+        assertEquals("ambiguous paneId 'w1:p1': 2 configured herdr daemons report this pane — "
+                + "no way to tell which one the caller means", error.getMessage());
+    }
+
+    @Test
+    void stopOnAPaneNoConfiguredDaemonKnowsIsTreatedAsAlreadyStopped() {
+        // CB-185 blocker 1, the zero-owner branch: spawnedBy is empty (as after a restart) and
+        // neither daemon's agent.list mentions this pane at all — it is already gone. A retried
+        // stop() on an already-gone pane must succeed quietly, not refuse forever.
+        FakeHerdr first = new FakeHerdr();
+        FakeHerdr second = new FakeHerdr();
+        PeerLauncher composite = new CompositePeerLauncher(
+                List.of(claudeAdapter(first), opencodeAdapter(second)), "claude");
+
+        assertDoesNotThrow(() -> composite.stop("w1:p1"));
+
+        assertFalse(first.called("pane.close"), "no owner was found, so no delegate is told to close anything");
+        assertFalse(second.called("pane.close"), "no owner was found, so no delegate is told to close anything");
+    }
+
+    @Test
+    void stopWithEmptySpawnedByResolvesTheOwnerThroughAProbeAndSkipsTheOtherDaemon() {
+        // CB-185 blocker 1, the main fix: after a restart spawnedBy is empty for every surviving
+        // member. stop() must still find the one daemon that actually knows the pane and route
+        // only to it — never touching the daemon that never held it.
+        FakeHerdr first = new FakeHerdr().withAgent("x", "term_x", "w1:p1", "w1:t1");
+        FakeHerdr second = new FakeHerdr();
+        PeerLauncher composite = new CompositePeerLauncher(
+                List.of(claudeAdapter(first), opencodeAdapter(second)), "claude");
+
+        composite.stop("w1:p1");
+
+        assertTrue(first.calls.stream().anyMatch(c -> c.method().equals("pane.close")
+                        && "w1:p1".equals(((Map<?, ?>) c.params()).get("pane_id"))),
+                "the daemon that actually knows the pane closes it");
+        assertFalse(second.called("pane.close"), "the daemon that never held the pane is never touched");
+    }
+
+    @Test
+    void aProbeSurvivesOneUnreachableDaemonAndStillFindsTheOwnerOnTheOtherOne() {
+        // CB-185 blocker 1 (lead review): a daemon that is DOWN while we probe must not abort the
+        // whole probe — the pane the OPERATOR actually wants stopped can live on a different,
+        // healthy daemon, and that pane must not become un-stoppable because a third one is down.
+        FakeHerdr down = new FakeHerdr().healthy(false);
+        FakeHerdr owner = new FakeHerdr().withAgent("x", "term_x", "w1:p1", "w1:t1");
+        PeerLauncher composite = new CompositePeerLauncher(
+                List.of(claudeAdapter(down), opencodeAdapter(owner)), "claude");
+
+        assertDoesNotThrow(() -> composite.stop("w1:p1"),
+                "the unreachable daemon must be skipped, not fail the whole stop");
+
+        assertTrue(owner.calls.stream().anyMatch(c -> c.method().equals("pane.close")
+                        && "w1:p1".equals(((Map<?, ?>) c.params()).get("pane_id"))),
+                "the healthy daemon that actually owns the pane still closes it");
+    }
+
+    @Test
+    void aProbedOwnerIsCachedSoARetryAfterAFailedStopNeedsNoSecondProbe() {
+        // CB-185 blocker 1: the probe's whole point is to be cheap on repeat — a failed stop (e.g.
+        // "pane_busy") must not force another agent.list() round trip on every retry.
+        FakeHerdr first = new FakeHerdr().withAgent("x", "term_x", "w1:p1", "w1:t1")
+                .paneCloseFailsWith("pane_busy");
+        FakeHerdr second = new FakeHerdr();
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(claudeAdapter(first), opencodeAdapter(second)), "claude");
+
+        assertThrows(HerdrException.class, () -> composite.stop("w1:p1"));
+        long listCallsAfterFirst = first.calls.stream().filter(c -> c.method().equals("agent.list")).count()
+                + second.calls.stream().filter(c -> c.method().equals("agent.list")).count();
+        assertTrue(listCallsAfterFirst > 0, "the first stop needed a probe");
+
+        assertThrows(HerdrException.class, () -> composite.stop("w1:p1"),
+                "still failing on the retry, but through the cached owner");
+        long listCallsAfterSecond = first.calls.stream().filter(c -> c.method().equals("agent.list")).count()
+                + second.calls.stream().filter(c -> c.method().equals("agent.list")).count();
+        assertEquals(listCallsAfterFirst, listCallsAfterSecond,
+                "the retry is served from the cache — no additional agent.list probe");
     }
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -86,6 +86,28 @@ class MessageServiceTest {
         assertTrue(reply.completed(), "a scraped completion still counts as completed");
     }
 
+    @Test
+    void backendErrorScrapeThroughMessageServiceFailsInsteadOfBecomingReplyText() throws Exception {
+        // fleetd#164 (part 2 addendum): a scrape that reads cleanly but is only the backend's own
+        // rejection (e.g. an HTTP 400) must reach the caller as WORKER_FAILED, not as a completed
+        // reply whose text happens to be the error line.
+        CompletableFuture<MessageService.Reply> send = sendAsync();
+        awaitWaiting();
+
+        herdr.readText("$ prompt");
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        herdr.readText("⏺ API Error: 400 invalid request body");
+        injector.onStatus(T, AgentStatus.IDLE);
+
+        MessageService.Reply reply = send.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.WORKER_FAILED, reply.outcome(),
+                "a backend rejection must use the caller's failure outcome, not a completed reply");
+        assertFalse(reply.completed(), "plain backend errors are never fallback reply content");
+        assertTrue(reply.text().contains("API Error: 400 invalid request body"),
+                "the visible backend error is carried as the failure reason: " + reply.text());
+    }
+
     @Test
     void explicitFleetReplyResolvesAsReplied() throws Exception {
         CompletableFuture<MessageService.Reply> send = sendAsync();
@@ -688,6 +710,68 @@ class MessageServiceTest {
         assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome());
     }
 
+    // --- #137: a fleet_ask round-trip must not orphan the ticket's own reply -------------------
+    //
+    // The primary's fleet_send{turnId} answer call is itself bounded (a real MCP call, capped well
+    // under a minute) — far shorter than a resumed turn can genuinely take to finish real work. These
+    // drive the exact real delegation path (async send -> worker asks -> primary answers -> primary's
+    // own wait gives up -> worker's real fleet_reply arrives afterwards) rather than calling a reply
+    // sink directly, since the bug is specifically about which sink the resumed turn's reply reaches.
+
+    @Test
+    void aReplyAfterAnswerTimesOutStillCompletesTheAsyncTicket() throws Exception {
+        String ticket = messages.sendAsync(T, "task that asks");
+        awaitWaiting();
+        injectDelivery();
+
+        CompletableFuture<MessageService.AskResult> ask =
+                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 5000));
+        MessageService.TaskView asking = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
+
+        // The primary answers, but its own bounded wait for the worker's resumed turn is short and
+        // expires before the worker (still genuinely working) gets back to it.
+        MessageService.Reply answerReply = messages.answer(asking.turnId(), "config.yaml", 150);
+        assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
+        assertEquals(MessageService.Outcome.TIMED_OUT_WORKING, answerReply.outcome(),
+                "the primary's own bounded wait gives up before the worker finishes resuming");
+
+        // The worker keeps working past that window and only now calls fleet_reply.
+        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
+
+        MessageService.TaskView done = awaitTicketPhase(ticket, MessageService.Phase.DONE);
+        assertEquals("PR opened: https://example/pulls/42", done.reply(),
+                "fleet_poll{ticket} must return the worker's real reply, not stay pending forever");
+        assertEquals("reply", done.replySource());
+        assertFalse(messages.hasStrandedReply(T),
+                "the reply completed its own ticket directly and never touched the inbox");
+    }
+
+    @Test
+    void fleetStopAfterAnOrphanedReplyDoesNotFailTheTicket() throws Exception {
+        String ticket = messages.sendAsync(T, "task that asks");
+        awaitWaiting();
+        injectDelivery();
+
+        CompletableFuture<MessageService.AskResult> ask =
+                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 5000));
+        MessageService.TaskView asking = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
+
+        MessageService.Reply answerReply = messages.answer(asking.turnId(), "config.yaml", 150);
+        assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
+        assertEquals(MessageService.Outcome.TIMED_OUT_WORKING, answerReply.outcome());
+
+        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
+
+        // fleet_stop tears the worker's session down right after the reply landed — this must never
+        // report the misleading "the worker session was released before it replied": a reply is
+        // exactly what happened.
+        assertFalse(messages.abandon(T, "the worker session was released before it replied"),
+                "a reply already arrived, so nothing here is a genuine failure");
+
+        MessageService.TaskView view = awaitTicketPhase(ticket, MessageService.Phase.DONE);
+        assertEquals("PR opened: https://example/pulls/42", view.reply());
+    }
+
     @Test
     void unansweredAsyncQuestionReturnsTheTicketToPendingAndReleasesItsTarget() throws Exception {
         String ticket = messages.sendAsync(T, "task that asks");
@@ -1057,6 +1141,74 @@ class MessageServiceTest {
         }
     }
 
+    /**
+     * #197: the ticket TTL must run from COMPLETION, not from creation.
+     *
+     * <p>It used to compare the cutoff against {@code createdNanos}, so the real window to collect a
+     * reply was {@code TTL minus however long the task ran}. A delegation that ran longer than the
+     * TTL was already past the cutoff the moment it finished, so the very next prune destroyed its
+     * reply — and the reply lives only in the task's future, so nothing could get it back. That is
+     * the normal case for real work here, not an edge case: three workers in one session ran well
+     * past ten minutes and two of their complete reports were lost this way.
+     *
+     * <p>The task below runs for longer than the whole TTL before it replies, which is exactly the
+     * shape that used to lose everything. Remove the fix and this fails: {@code poll} returns
+     * {@code null} because the ticket was pruned on arrival.
+     */
+    @Test
+    void aTaskRunningLongerThanTheTtlStillKeepsItsReport() throws Exception {
+        java.util.concurrent.atomic.AtomicLong clock = new java.util.concurrent.atomic.AtomicLong(1_000_000_000L);
+        try (var wiring = wireWithPushLoop(1, 50, clock::get)) {
+            String slow = wiring.service().sendAsync(T, "a task that takes longer than the TTL");
+            awaitWaiting();
+            injectDelivery();
+
+            // The worker is still working, and has been for longer than the entire TTL. Nothing may
+            // be pruned yet — the ticket has not finished, so there is no report to keep or lose.
+            clock.addAndGet(MessageService.TICKET_TTL_NANOS + TimeUnit.SECONDS.toNanos(30));
+
+            // Only now does it reply. Under the old clock this reply was born already expired.
+            assertTrue(rendezvous.resolve(T, "the long report"));
+            awaitTicketPhaseOn(wiring.service(), slow, MessageService.Phase.DONE);
+
+            // A second delegation runs pruneTerminalTickets before it returns.
+            wiring.service().sendAsync(T, "an unrelated second task");
+
+            MessageService.TaskView view = wiring.service().poll(slow);
+            assertNotNull(view, "a ticket that completed just now must survive the prune, however "
+                    + "long its task ran — the TTL is the window to COLLECT the report, not the "
+                    + "budget for producing it");
+            assertEquals(MessageService.Phase.DONE, view.phase());
+            assertEquals("the long report", view.reply(),
+                    "the worker's actual report must still be there, not just the ticket");
+        }
+    }
+
+    /**
+     * The other half of #197: the TTL must still bound {@code tasks}. Measuring from completion
+     * would be a leak if a finished ticket were then kept forever, so this pins the eviction that
+     * still has to happen — the same ticket, left uncollected for longer than the TTL AFTER it
+     * finished, is gone.
+     */
+    @Test
+    void aFinishedTicketIsStillPrunedOnceTheTtlPassesSinceItFinished() throws Exception {
+        java.util.concurrent.atomic.AtomicLong clock = new java.util.concurrent.atomic.AtomicLong(1_000_000_000L);
+        try (var wiring = wireWithPushLoop(1, 50, clock::get)) {
+            String done = wiring.service().sendAsync(T, "a quick task");
+            awaitWaiting();
+            injectDelivery();
+            assertTrue(rendezvous.resolve(T, "quick result"));
+            awaitTicketPhaseOn(wiring.service(), done, MessageService.Phase.DONE);
+
+            // Nobody collected it, and the TTL has now passed since it FINISHED.
+            clock.addAndGet(MessageService.TICKET_TTL_NANOS + TimeUnit.SECONDS.toNanos(1));
+            wiring.service().sendAsync(T, "an unrelated second task");
+
+            assertNull(wiring.service().poll(done),
+                    "the TTL must still evict an uncollected finished ticket, or tasks grows forever");
+        }
+    }
+
     private MessageService.TaskView awaitTicketPhaseOn(MessageService svc, String ticket,
             MessageService.Phase phase) throws Exception {
         long deadline = System.currentTimeMillis() + 3000;

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppTwoDaemonTest.java

@@ -96,4 +96,55 @@ class FleetAppTwoDaemonTest {
         long calls = shared.calls.stream().filter(c -> c.method().equals("workspace.list")).count();
         assertEquals(1, calls, "single-daemon deployment must call workspace.list exactly once");
     }
+
+    // ── CB-185 blocker 2: /healthz must report the MEMBER daemon's protocol too ────────────────
+
+    @Test
+    void healthzReportsBothDaemonsWhenTheirProtocolsDiffer() throws Exception {
+        FakeHerdr lead = new FakeHerdr().pingReports("0.8.0", 19);
+        FakeHerdr member = new FakeHerdr().pingReports("0.7.0", 18);
+        int port = start(lead, member);
+
+        HttpResponse<String> res = get(port, "/healthz");
+
+        assertEquals(200, res.statusCode(), res.body());
+        assertTrue(res.body().contains("\"protocol\":19"),
+                "the herdr key keeps reporting the LEAD's protocol, unchanged: " + res.body());
+        assertTrue(res.body().contains("\"member\""), "a separate member key is present: " + res.body());
+        assertTrue(res.body().contains("\"protocol\":18"),
+                "the member key reports the member daemon's own protocol: " + res.body());
+        assertTrue(res.body().contains("\"protocolMismatch\":true"),
+                "a differing protocol is called out explicitly, not left to be spotted by eye: " + res.body());
+    }
+
+    @Test
+    void healthzReportsBothDaemonsWithNoMismatchWhenProtocolsMatch() throws Exception {
+        int port = start(new FakeHerdr(), new FakeHerdr());
+
+        HttpResponse<String> res = get(port, "/healthz");
+
+        assertEquals(200, res.statusCode(), res.body());
+        assertTrue(res.body().contains("\"member\""), "the member key is present whenever a second daemon "
+                + "is configured, even when the protocols happen to agree: " + res.body());
+        assertFalse(res.body().contains("protocolMismatch"),
+                "matching protocols must not raise a mismatch flag: " + res.body());
+    }
+
+    @Test
+    void healthzWithOneDaemonCarriesNoMemberOrMismatchKey() throws Exception {
+        // The single-daemon deployment (no memberHerdrSocket) must see no change at all beyond the
+        // historical body: no "member" key, no "protocolMismatch" key. (Map.of()'s own key order is
+        // JVM-salted regardless of this fix, so this checks content, not exact key order.)
+        FakeHerdr shared = new FakeHerdr();
+        int port = start(shared, shared);
+
+        HttpResponse<String> res = get(port, "/healthz");
+
+        assertEquals(200, res.statusCode());
+        assertTrue(res.body().contains("\"status\":\"ok\""), res.body());
+        assertTrue(res.body().contains("\"protocol\":19"), res.body());
+        assertTrue(res.body().contains("\"version\":\"0.8.0\""), res.body());
+        assertFalse(res.body().contains("\"member\""), "no second daemon configured, so no member key: " + res.body());
+        assertFalse(res.body().contains("protocolMismatch"), res.body());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -1,13 +1,23 @@
 package dev.ltms.fleet.session;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.LoggerContext;
+import ch.qos.logback.classic.spi.IThrowableProxy;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;
 
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
@@ -352,6 +362,151 @@ class GitWorktreesTest {
         assertEquals("worktree origin contains HTTPS user info; refusing provision", error.getMessage());
     }
 
+    // ---- CB-189: broader remote-URL coverage — every remote, both fetch and push URLs, any
+    // non-SSH scheme. Reporting only, additive to the origin/https strip-and-refuse tests above. ----
+
+    private Logger reportingLogger;
+    private ListAppender<ILoggingEvent> reportingAppender;
+
+    /** {@link GitWorktrees}'s own logger, captured fresh for each test so assertions never see a
+     *  message left over from a previous test. */
+    @BeforeEach
+    void attachReportingLogCapture() {
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        reportingLogger = ctx.getLogger(GitWorktrees.class);
+        reportingLogger.setLevel(Level.WARN);
+        reportingAppender = new ListAppender<>();
+        reportingAppender.setContext(ctx);
+        reportingAppender.start();
+        reportingLogger.addAppender(reportingAppender);
+    }
+
+    @AfterEach
+    void detachReportingLogCapture() {
+        reportingLogger.detachAppender(reportingAppender);
+    }
+
+    private List<String> capturedMessages() {
+        return reportingAppender.list.stream().map(ILoggingEvent::getFormattedMessage).toList();
+    }
+
+    /** Asserts {@code secret} appears in no captured message, and in no attached exception's
+     *  message either — the constraint is that a credential must never reach a log, however it
+     *  would have gotten there. */
+    private void assertNoLeak(String secret) {
+        for (ILoggingEvent event : reportingAppender.list) {
+            assertFalse(event.getFormattedMessage().contains(secret),
+                    "log message leaked a credential (" + secret + "): " + event.getFormattedMessage());
+            IThrowableProxy thrown = event.getThrowableProxy();
+            if (thrown != null && thrown.getMessage() != null) {
+                assertFalse(thrown.getMessage().contains(secret),
+                        "logged exception leaked a credential (" + secret + "): " + thrown.getMessage());
+            }
+        }
+    }
+
+    /** Gap 1: only {@code origin} was ever inspected. A credential on any other remote's fetch URL
+     *  must now be reported. */
+    @Test
+    void aCredentialedUrlOnANonOriginRemoteIsReported(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        git(repo, "remote", "add", "upstream", "https://leaky-upstream-token@git.ltms.dev/akb/kb.git");
+
+        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-189-a", "HEAD");
+
+        List<String> messages = capturedMessages();
+        assertTrue(messages.stream().anyMatch(m -> m.contains("remote=upstream")),
+                "expected a report naming the leaking non-origin remote:\n" + messages);
+        assertNoLeak("leaky-upstream-token");
+        assertNoLeak("https://leaky-upstream-token@git.ltms.dev/akb/kb.git");
+        assertNoLeak("git.ltms.dev");
+    }
+
+    /** Gap 2: push URLs were never inspected. A credential visible only on {@code pushurl} — the
+     *  fetch URL for the same remote stays clean — must now be reported. */
+    @Test
+    void aCredentialedPushUrlIsReported(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        git(repo, "remote", "add", "mirror", "https://git.ltms.dev/akb/mirror.git");
+        git(repo, "remote", "set-url", "--push", "mirror",
+                "https://leaky-push-token@git.ltms.dev/akb/mirror.git");
+
+        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-189-b", "HEAD");
+
+        List<String> messages = capturedMessages();
+        assertTrue(messages.stream().anyMatch(m -> m.contains("remote=mirror")),
+                "expected a report naming the remote with the leaking pushurl:\n" + messages);
+        assertNoLeak("leaky-push-token");
+        assertNoLeak("https://leaky-push-token@git.ltms.dev/akb/mirror.git");
+        assertNoLeak("git.ltms.dev");
+    }
+
+    /** Gap 3: only {@code https} was handled. A plain {@code http://user:pass@…} remote — worse
+     *  than https, not better — must now be reported. */
+    @Test
+    void anHttpUrlWithCredentialsIsReported(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        git(repo, "remote", "add", "insecure", "http://plainuser:plainpass@git.ltms.dev/akb/kb.git");
+
+        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-189-c", "HEAD");
+
+        List<String> messages = capturedMessages();
+        assertTrue(messages.stream().anyMatch(m -> m.contains("remote=insecure")),
+                "expected a report for the credentialed plain-http remote:\n" + messages);
+        assertNoLeak("plainuser");
+        assertNoLeak("plainpass");
+        assertNoLeak("plainuser:plainpass");
+        assertNoLeak("git.ltms.dev");
+    }
+
+    /** A normal {@code ssh://} remote and a credential-free {@code https://} remote must produce no
+     *  report at all — the check must not cry wolf on ordinary, safe configuration. */
+    @Test
+    void anSshRemoteAndACleanHttpsRemoteProduceNoReport(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "ssh://git@git.ltms.dev:2224/akb/kb.git");
+        git(repo, "remote", "add", "clean", "https://git.ltms.dev/akb/kb.git");
+
+        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-189-d", "HEAD");
+
+        assertTrue(reportingAppender.list.isEmpty(),
+                "expected no report for an ssh remote and a credential-free https remote, got:\n"
+                        + capturedMessages());
+    }
+
+    /**
+     * CB-189 review fix. Even a FAILING command that read a credential onto its stdout must never
+     * let that value reach the thrown {@link WorktreeException}'s message — this is gap 4 from the
+     * CB-189 issue, and the reason {@link GitWorktrees#execRedacted} exists at all. Drives the
+     * shared {@code exec}/{@code execRedacted} seam directly (it is package-private for exactly this,
+     * the same way the {@code afterWorktreeAdded} constructor parameter is a test seam) with a
+     * synthetic, non-git command whose stdout carries a marker — passed through the environment,
+     * never through argv, so the marker cannot leak via the command line that IS always printed
+     * unconditionally in the exception message — and which exits non-zero. This isolates the
+     * redaction guarantee itself rather than depending on a specific git failure mode that happens to
+     * echo a URL onto stdout before failing: none of the git subcommands this class actually runs was
+     * found to have one (a corrupted config makes {@code git config --get} fail before it ever reads
+     * the target key, so its output never carries the URL either). The marker is generated per-test
+     * run and injected only by the test, never a real-looking credential, so even a failing assertion
+     * could not itself print a secret.
+     */
+    @Test
+    void execRedactedNeverCopiesFailingCommandOutputIntoTheExceptionMessage(@TempDir Path tmp) {
+        String marker = "cb189-marker-" + System.nanoTime();
+        GitWorktrees worktrees = new GitWorktrees(tmp.toString());
+
+        WorktreeException thrown = assertThrows(WorktreeException.class, () -> worktrees.exec(
+                Map.of("MARKER", marker), true, "sh", "-c", "echo \"$MARKER\"; exit 7"));
+
+        assertNotNull(thrown.getMessage());
+        assertFalse(thrown.getMessage().contains(marker),
+                "a failing command's captured stdout leaked into the exception message: "
+                        + thrown.getMessage());
+    }
+
     /** Neutralizing must not look like work in progress, or a worker would commit it into its PR. */
     @Test
     void theNeutralizedConfigIsNotAPendingLocalModification(@TempDir Path tmp) throws Exception {