CB-175: quarantine opencode model mismatches

#164 : classify a backend-error scrape as WORKER_FAILED, carrying the whole pane
main already shipped the core of #164 in 3bfa828: the MIN_TURN_NANOS floor and the hard fail on an empty or unreadable scrape. This adds the one case that was still resolving as a success -- a scrape that reads cleanly but whose content is the backend's own rejection (e.g. "API Error: 400 invalid request body"). The BACKEND_ERROR pattern is deliberately narrow. A growing list of ad-hoc error strings rots as backends change their wording, and broader backend-error surfacing is #164 point 3. Because the pattern is a heuristic, it also matches a member that forgot fleet_reply while reporting *about* a backend error. So the failure reason carries the whole pane tail, not just the matched line: a genuine backend error reads as before, and a false positive keeps its report instead of losing it. Checked before merging: 3bfa828 is an ancestor of main; the branch was current with main; mvn clean install green unpiped (1037 tests, 0 [ERROR] lines); and each of the 5 new tests fails with the fix commented out. Co-authored-by: fleetd worker <worker@ltms.dev>
2026-08-31 14:04:41 +07:00 · 2026-08-31 10:56:40 +07:00 · 2026-08-31 05:10:46 +02:00 · 2026-08-31 10:10:16 +07:00 · 2026-08-31 04:32:14 +02:00 · 2026-08-31 04:30:57 +02:00
18 changed files with 1190 additions and 47 deletions
@@ -0,0 +1,52 @@
+# CB-175 report
+
+## Change
+
+`OpenCodeLauncher` reads the newest opencode session record for the worker cwd after spawn readiness.
+It compares the requested `provider/model` selector with `model.providerID/model.id` from the record.
+`variant` is not compared because a profile selector has no variant part.
+
+An absent record, malformed record, or incomplete model object is unknown evidence. It does not log
+an error or quarantine the profile.
+
+On a real mismatch, fleetd logs an ERROR with the requested and resolved selectors. The mismatch goes
+through `ExhaustionSink` into the existing `BackendQuarantine` and uses the profile's
+`effectiveCredentialId()`.
+
+I chose a permanent, process-lifetime quarantine. A withdrawn selector cannot become correct after a
+cooldown. A timed retry could silently use the paid fallback again. `fleet_list` will show the usual
+quarantine state, with a very large remaining time, until fleetd restarts after an operator fixes the
+profile.
+
+## Tests
+
+Added tests for an exact match, a mismatch, and missing or unreadable session storage.
+
+I proved the mismatch test fails without the quarantine call. I commented out the call and ran:
+
+```text
+mvn -Dtest=OpenCodeLauncherTest#differentResolvedModelPermanentlyQuarantinesTheProfile test
+```
+
+The result was:
+
+```text
+[ERROR] Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
+org.opentest4j.AssertionFailedError: a fallback model must block later spawns ==> expected: <true> but was: <false>
+[INFO] BUILD FAILURE
+```
+
+I restored the call. I then ran `mvn clean install` in `fleetd/` without a pipe. Its result was:
+
+```text
+[INFO] Tests run: 1040, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+```
+
+## Limits and scope
+
+I could not spawn a real opencode member or restart fleetd. I did not test this end to end against a
+live opencode session database.
+
+I confirmed `ClaudeCodeLauncher` passes `--model` but does not read back the resolved model. I did
+not change it because it is outside this ticket's scope.
@@ -0,0 +1,208 @@
+# Wiki audit for #168
+
+**Source checked:** `.wiki-snapshot/` at `68e32c6` (2026-08-31). I did not use
+`wiki/`. Code references below are from the current `fleetd` source tree. A quoted
+line is a concrete claim that needs correction, unless the table says `KEEP`.
+
+| Page | Verdict | One-line reason |
+|---|---|---|
+| `Home.md` | REVISE | Good overview, but it still names the retired product. |
+| `_Sidebar.md` | REVISE | The heading still says `claude-bridge`. |
+| `1-Architecture.md` | REBUILD | Its component contract mixes current names with removed tools, routes, and planned backends. |
+| `2-Message-Server.md` | REBUILD | The claimed MCP schema, mount command, REST/SSE surface, and fallback paths are pre-build design. |
+| `3-Approaches.md` | REVISE | Useful research history, but it presents unbuilt AgentAPI as a selectable fallback. |
+| `4-Setup.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `5-Operations.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `6-Team.md` | REBUILD | It teaches role-addressed sends and a Claude-only team model that the shipped API does not have. |
+| `7-Use-Cases.md` | REBUILD | Its flagship flow depends on removed `ccs` profiles and removed send parameters. |
+| `8-Roadmap.md` | REBUILD | It is a historical plan, but it presents old implementation choices and planned work as the current stack. |
+| `9-Implementation.md` | REBUILD | Its package, class, endpoint, and outcome map has drifted from the source. |
+| `10-Cross-Host-Messaging.md` | REVISE | It labels most federation work proposed, but misses the shipped `coordinator:` lead channel. |
+| `11-Features.md` | REVISE | It is the right catalogue, but code-path names are old and it misses the second-herdr-daemon capability. |
+| `12-Claude-to-OpenCode.md` | REVISE | The porting guide is mostly current, but calls the product and spawned-member path a bridge. |
+| `13-User-Guide.md` | REVISE | It is the best operator page, but needs the product rename and the second-herdr-daemon setup. |
+
+## Pages needing work
+
+### `Home.md` — REVISE
+
+- Quote: `# claude-bridge` (line 1) and `` `claude-bridge` keeps`` (line 11).
+  The product is `fleet` / `fleetd`. The MCP server identifies itself as `fleet` in
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:313-315`.
+- Quote: `AgentAPI ... swappable fallback injector` (lines 73-76).
+  There is no AgentAPI implementation under `fleetd/src/main/java`; the actual
+  launchers are selected by `Profile.kind` in
+  `fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java:265-270`.
+
+### `_Sidebar.md` — REVISE
+
+- Quote: `### 📖 claude-bridge` (line 1).
+  Rename it to `fleet`. `FleetMcp` registers the current product-facing tool set at
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:301-326`.
+
+### `1-Architecture.md` — REBUILD
+
+- Quote: `` `claude-bridge` lets`` (line 3). The product was renamed; the MCP
+  server name is `fleet` (`FleetMcp.java:313-315`).
+- Quote: ``fleet_read`` in the tool list (line 102). No such tool is registered.
+  The complete registered list is `fleet_send` through `fleet_whoami` at
+  `FleetMcp.java:301-326`; `fleet_read` is absent.
+- Quote: `SSE (GET /events)` (line 143). `FleetApp.build()` registers no `/events`
+  route; its routes are listed at `FleetApp.java:143-159`.
+- Quote: `Redis Streams / NATS JetStream, or an embedded queue` (line 106).
+  The shipped durable inbox is AMQP, configured by `broker`, at
+  `FleetConfig.java:49-50` and `FleetConfig.java:655-714`.
+- Quote: `AgentAPI (fallback)` (line 107). No AgentAPI adapter exists; shipped
+  launcher kinds are `claude-code` and `opencode` (`FleetConfig.java:265-270`).
+
+### `2-Message-Server.md` — REBUILD
+
+- Quote: `claude mcp add --transport http bridge http://127.0.0.1:8080/mcp`
+  (line 67). The daemon defaults to port `8765` in `FleetConfig.java:183-187`,
+  and identifies its server as `fleet` at `FleetMcp.java:313-315`.
+- Quote: ``fleet_send(message, target?, {block, timeout_seconds, auto_spawn,
+  turn_id})`` (line 80). The real parameters are `sessionId`, `content`,
+  `timeoutMs`, `wait`, `turnId`, and `coordId` (`FleetMcp.java:1096-1108`).
+- Quote: ``fleet_read(target, source)`` (line 85). It is not registered; see the
+  complete registration at `FleetMcp.java:301-326`.
+- Quote: `docs/MCP-Contract.md ... normative` (lines 87-88). That is not a valid
+  reference: only §6 is current, as the current operator guide itself says at
+  `.wiki-snapshot/13-User-Guide.md:466`.
+- Quote: `SSE (GET /events)` (line 45). No route exists in the built REST surface,
+  `FleetApp.java:143-159`.
+
+### `3-Approaches.md` — REVISE
+
+- Quote: `AgentAPI ... remains a swappable fallback injector` (lines 78-84).
+  It was never built. The shipped adapter selection is only `claude-code` or
+  `opencode` (`FleetConfig.java:265-270`). Keep it as discarded research, not an
+  operational fallback.
+- Quote: `claude-bridge` (line 109). Rename the product to `fleet`; the runtime
+  package is `dev.ltms.fleet`, for example `FleetMcp.java:1`.
+
+### `4-Setup.md` — RETIRE
+
+It is a 25-line redirect and says its procedure was never written (lines 3-9).
+Chapter 13 is the maintained install procedure. Keeping a second navigation page
+adds no working documentation.
+
+### `5-Operations.md` — RETIRE
+
+It is a 35-line redirect and says its runbook was never written (lines 3-14).
+Chapter 13 now owns run and recovery instructions.
+
+### `6-Team.md` — REBUILD
+
+- Quote: `fleet_send {role: w-claude, prompt: A}` (line 98). `fleet_send` accepts
+  `sessionId` and `content`, not `role` or `prompt` (`FleetMcp.java:1096-1108`).
+- Quote: `some on Claude, some on the remote local LLM` (lines 3-5) and `Every
+  worker is ... Claude Code` (line 25). `opencode` is a first-class launcher kind,
+  not a Claude worker (`FleetConfig.java:265-270`).
+- Quote: `fleetd's concurrency policy` (line 121). The configured capacity control
+  is per-profile `maxLoad` (`FleetConfig.java:251-264`), not the role routing model
+  described here.
+
+### `7-Use-Cases.md` — REBUILD
+
+- Quote: `ccs profile` (line 10), `ccs + herdr` (line 22), and `ccs-spawn`
+  (line 45). The configuration has `profiles` and `fleet`, not `ccs`:
+  `FleetConfig.java:34-58` and `FleetConfig.java:81-101`.
+- Quote: `fleet_send({"to", "kind", "body", "block"})` (lines 55-62).
+  None of those are the shipped send parameters. The schema is
+  `FleetMcp.java:1096-1108`.
+- Quote: `fleet_list() → { "profiles": ... }` (lines 74-80). `fleet_list` is a
+  roster view; `fleet_profiles` is the configured-backend view, as registered at
+  `FleetMcp.java:307-311` and described at `FleetMcp.java:1176-1182`.
+
+### `8-Roadmap.md` — REBUILD
+
+- Quote: `Java 21+` (line 43). The current project guidance and source use Java 25;
+  the `FleetConfig` source itself uses Java 25 unnamed lambda parameters, for
+  example `FleetConfig.java:102`.
+- Quote: `herdr 0.7.0 / protocol 14` (line 46). The current REST health endpoint
+  reports the live protocol returned by herdr (`FleetApp.java:240-244`), while the
+  current operator guide records protocol 19 at
+  `.wiki-snapshot/13-User-Guide.md:76-85`.
+- Quote: `ccs <profile> claude` and `ccs env <profile>` (lines 47-48). Shipped
+  configuration uses `Profile` records and launcher `kind`,
+  `FleetConfig.java:313-330` and `FleetConfig.java:265-270`.
+- Quote: `Redis Streams via Lettuce` (line 50). The actual durable inbox is AMQP
+  `broker`, `FleetConfig.java:655-714`.
+
+### `9-Implementation.md` — REBUILD
+
+- Quote: `rest.FleetdApp` and `mcp.BridgeMcp` (lines 29-30). The classes are
+  `rest.FleetApp` and `mcp.FleetMcp` (`FleetApp.java:46`; `FleetMcp.java:67`).
+- Quote: `dev.ltms.fleetd` (line 67). The source package is `dev.ltms.fleet`
+  (`FleetMcp.java:1`).
+- Quote: `WorkerPresence` (line 110). The current class is `MemberPresence`, as
+  imported and used by `FleetMcp` at `FleetMcp.java:12` and `465-469`.
+- Quote: the outcome list ending in `STALE_TURN` (lines 128-131). The code also
+  has `BACKEND_EXHAUSTED` (`FleetMcp.java:550-554`) and async `ASKING` handling
+  (`FleetMcp.java:664-668`).
+- Quote: `FleetdApp` (line 207) and `FleetdConfig` (line 211). These names do not
+  resolve; current classes are `FleetApp` and `FleetConfig`.
+
+### `10-Cross-Host-Messaging.md` — REVISE
+
+- Quote: the chapter says the cross-host fabric is proposed except for the
+  single-host inbox (lines 3-8). Cross-host **lead-to-lead** delivery shipped:
+  `fleet_send` accepts `coordId` (`FleetMcp.java:1094-1107`) and publishes it at
+  `FleetMcp.java:616-641`; configuration has `coordinator` at
+  `FleetConfig.java:74-78` and `99-101`.
+- Quote: `bridge.dlx` (line 90). This product name is stale. The shipped lead path
+  uses `LeadChannel`, not the proposed exchange flow (`FleetMcp.java:95-96` and
+  `616-641`). Keep the proposed federation design, but add a clear shipped/proposed
+  boundary for CB-637.
+
+### `11-Features.md` — REVISE
+
+- Quote: `mcp/BridgeMcp` (line 22), `config/FleetdConfig` (lines 25-27), and other
+  index references. These paths no longer resolve; the source classes are
+  `mcp/FleetMcp` (`FleetMcp.java:67`) and `config/FleetConfig`
+  (`FleetConfig.java:81`).
+- Quote: `fleet_whoami` returns only `primary` or `worker` (lines 99-100).
+  It also returns `architect` (`FleetMcp.java:1235-1244`).
+- The page needs the missing separate member-herdr-daemon feature listed below.
+
+### `12-Claude-to-OpenCode.md` — REVISE
+
+- Quote: `same bridge mount` (line 5) and `a bridge-spawned worker` (line 94).
+  Rename the product path to `fleet`. The daemon exposes the MCP server as `fleet`
+  (`FleetMcp.java:313-315`), and profiles select OpenCode with `kind: opencode`
+  (`FleetConfig.java:332-335`).
+- Quote: the sample mount name is `fleetd` (line 67). The server name is `fleet`;
+  update the sample to avoid teaching a second product name.
+
+### `13-User-Guide.md` — REVISE
+
+- Quote: `The bridge is the only channel` (line 63). The invariant is correct, but
+  the product term needs the `fleet` rename. The daemon's MCP server name is
+  `fleet` (`FleetMcp.java:313-315`).
+- Quote: it describes one herdr socket (lines 72-85). It needs the optional
+  `memberHerdrSocket` setup and two-daemon health meaning. The config key is in
+  `FleetConfig.java:34-37`, and `/healthz` checks both daemons when configured at
+  `FleetApp.java:210-245`.
+
+## MISSING
+
+`11-Features.md` has a body section for **routing members through a separate herdr daemon**
+(`## memberHerdrSocket`, line 2174), but **no row in the index table** at the top of the page
+(lines 20-95). That table is how the page is meant to be read, so a capability absent from it is
+effectively undiscoverable. Lead note: this is my own omission — I added the section on 2026-08-31
+and did not add the matching row. Fixed in the wiki at `68e32c6`'s successor.
+
+The original audit stated the feature had no entry at all. That was wrong: the section exists. The
+gap is the index row. Recorded here rather than silently corrected, because the difference matters —
+"undocumented" and "documented but unindexed" are different jobs.
+
+Evidence for the feature itself: `FleetConfig.java:34-37` and `FleetApp.java:103-115`, `210-245`,
+and `247-263`.
+
+## Audit method and coverage
+
+I checked all 15 pages. I checked concrete tool, route, config, class, file, and
+product-name claims claim-by-claim on 11 pages: Home, Sidebar, 1, 2, 4, 5, 6, 7, 9,
+11, and 13. I skimmed the remaining four long historical or research pages (3, 8, 10,
+12), then checked their concrete claims that affect the verdict. This is an audit of
+the supplied snapshot, not a wiki rewrite.
@@ -168,6 +168,17 @@ public final class Fleetd {
                claudeProfiles.put(name, w);
            }
        });
+        // One tracker covers timed backend exhaustion and permanent model-selector mismatches. The
+        // latter cannot heal on a retry, so OpenCodeLauncher uses quarantinePermanently through the
+        // sink below rather than letting a cooldown reopen a paid fallback.
+        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
+                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
+        ExhaustionSink modelMismatchSink = (profileName, reason) -> {
+            FleetConfig.Profile profile = config.get().profiles().get(profileName);
+            if (profile != null) {
+                quarantine.quarantinePermanently(profile.effectiveCredentialId());
+            }
+        };
        List<HerdrPeerLauncher> adapters = new ArrayList<>();
        // The claude-code adapter is the always-present default; keep it even with no profiles (so a
        // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
@@ -184,15 +195,13 @@ public final class Fleetd {
                    opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                    () -> config.get().fleet(),
-                    () -> config.get().memberCredentials()));
+                    () -> config.get().memberCredentials(), modelMismatchSink));
        }
        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
        // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
        // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
        // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
        // here, at startup, and a config reload only changes it for a daemon restart.
-        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
-                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
        PeerLauncher workers = new CompositePeerLauncher(
                adapters,
                cfg.effectiveDefaultProfile(),
@@ -74,6 +74,14 @@ public final class CompletionResolver implements TurnListener {
     */
    public static final long MIN_TURN_NANOS = Duration.ofSeconds(2).toNanos();

+    /**
+     * fleetd#164 (part 2): one stable, explicit backend-failure marker seen on a Claude Code pane
+     * when the backend itself rejected the turn (e.g. {@code "API Error: 400 invalid request body"}).
+     * Kept deliberately narrow — a growing list of ad-hoc error strings rots as backends change their
+     * wording; broader backend-error surfacing is out of scope here (fleetd#164 point 3).
+     */
+    private static final Pattern BACKEND_ERROR = Pattern.compile("(?i)\\bAPI Error\\s*:");
+
    private static final String CLIPPED_PANE_TAIL_MARKER =
            "[Pane tail clipped: member did not call fleet_reply.]";

@@ -278,6 +286,20 @@ public final class CompletionResolver implements TurnListener {
            }
            return;
        }
+        // fleetd#164 (part 2): a scrape that read cleanly and produced content still isn't a real
+        // reply when that content is the backend's own rejection (e.g. an HTTP 400 before the worker
+        // did any work). Classify it as a failure naming the member, rather than handing the caller a
+        // scrape that reads like a completed answer.
+        String backendError = firstMatchingLine(assistantBlock, BACKEND_ERROR);
+        if (backendError != null) {
+            // Carry the whole scrape, not just the matched line. The pattern is a heuristic: a member
+            // that forgot fleet_reply while reporting *about* a backend error matches it too. Failing
+            // is still right — the caller must not read a scrape as an answer — but dropping the rest
+            // of the pane would destroy the report, which is the same defect fleetd#164 is about.
+            fail(target, turn, "member " + target + " ended on a backend error: " + backendError
+                    + "\n--- pane tail ---\n" + tail);
+            return;
+        }
        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
        if (rendezvous.resolveCompletion(waiter, completion)) {
            inFlight.remove(target, turn);
@@ -3,6 +3,7 @@ package dev.ltms.fleet.member;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerHandle;
@@ -46,9 +47,13 @@ import java.util.stream.Collectors;
 *       the single adapter that declares it. Profiles partition cleanly across adapters: the
 *       constructor rejects a name claimed by two.</li>
 *   <li><strong>By pane id</strong> — {@link #stop} routes to the adapter that spawned that pane
- *       (recorded at spawn time). A pane the composite never spawned can use the fallback route
- *       in a one-daemon fleet. With more than one herdr daemon, its owner is unknown, so stop refuses
- *       the ambiguous id rather than closing a pane on an arbitrary herdr daemon.</li>
+ *       (recorded at spawn time). A pane the composite never spawned, or one whose record was lost
+ *       to a daemon restart (CB-185 blocker 1 — {@link #spawnedBy} is in-memory only), can use the
+ *       fallback route in a one-daemon fleet. With more than one herdr daemon, {@link #probeOwner}
+ *       asks each configured daemon which one actually knows the pane: exactly one match routes
+ *       (and caches); no match is treated as already-gone; more than one match is a genuine
+ *       ambiguity (pane ids are per-daemon counters, so two daemons really can both hold, say,
+ *       {@code w1:p1}) and stop refuses rather than closing a pane on an arbitrary herdr daemon.</li>
 *   <li><strong>Fleet-wide</strong> — {@link #reapOrphanWorkers} and {@link #capabilities} fan out
 *       and combine. {@link #list} is deduplicated by (owning daemon, pane id): delegates that share
 *       one herdr connection report the same global agent set, but two daemons can each hold a pane
@@ -440,12 +445,23 @@ public final class CompositePeerLauncher implements PeerLauncher {
    public void stop(String id) {
        HerdrPeerLauncher d = spawnedBy.get(id);
        if (d == null) {
-            if (herdrDaemonCount() != 1) {
-                throw new IllegalArgumentException("ambiguous paneId '" + id
-                        + "': no owning herdr daemon was recorded");
+            if (herdrDaemonCount() == 1) {
+                log.debug("stop({}) — no recorded owner in a single-daemon fleet", id);
+                d = delegates.getFirst();
+            } else {
+                d = probeOwner(id);
+                if (d == null) {
+                    // No configured herdr daemon has ever heard of this pane. CB-185 blocker 1: this
+                    // is the normal case right after a daemon restart empties spawnedBy for a member
+                    // that has ALREADY been torn down since — the caller retried a stop that already
+                    // succeeded. Nothing to close and no owner to cache; matching the tolerance
+                    // HerdrPeerLauncher#stop already gives an already-gone pane (agent.close swallows
+                    // that as success), stop() here is a no-op rather than a refusal.
+                    log.debug("stop({}) — no configured herdr daemon knows this pane; "
+                            + "treating as already stopped", id);
+                    return;
+                }
            }
-            log.debug("stop({}) — no recorded owner in a single-daemon fleet", id);
-            d = delegates.getFirst();
        }
        // Drop the owner record only after the delegate accepted the stop. Removing it first meant a
        // delegate that threw left the pane alive with its owner forgotten, so the retry fell into
@@ -454,6 +470,61 @@ public final class CompositePeerLauncher implements PeerLauncher {
        spawnedBy.remove(id);
    }

+    /**
+     * CB-185 blocker 1: recover a spawnedBy cache miss by asking every distinct herdr daemon which
+     * one actually knows {@code id} — the fix for "after a restart, every surviving member becomes
+     * un-stoppable" (spawnedBy is in-memory only, so a restart empties it, and members intentionally
+     * outlive the daemon).
+     *
+     * <p>Grouped by daemon identity, not by delegate, for the same reason {@link #list()} groups
+     * that way: two adapters (claude-code, opencode) sharing one herdr connection would otherwise be
+     * probed twice, and a pane on their shared daemon would look owned by two adapters instead of
+     * one daemon.
+     *
+     * <p>A daemon that fails to answer {@code list()} (e.g. it is down) is treated as "does not know
+     * this pane" rather than aborting the whole probe — one unreachable daemon must never make a
+     * pane that a <em>different</em>, healthy daemon actually owns un-stoppable too, which would
+     * resurrect the exact bug this method exists to fix.
+     *
+     * @return the owning delegate — cached into {@link #spawnedBy} so the next call is free — or
+     *         {@code null} when no daemon knows the pane
+     * @throws IllegalArgumentException when more than one daemon claims the pane: pane ids are
+     *         per-daemon counters, so two daemons really can both hold, say, {@code w1:p1}, and there
+     *         is no way to tell which one the caller means
+     */
+    private HerdrPeerLauncher probeOwner(String id) {
+        Map<HerdrClient, HerdrPeerLauncher> byDaemon = new IdentityHashMap<>();
+        for (HerdrPeerLauncher delegate : delegates) {
+            byDaemon.putIfAbsent(delegate.herdr(), delegate);
+        }
+        List<HerdrPeerLauncher> owners = new ArrayList<>();
+        for (HerdrPeerLauncher representative : byDaemon.values()) {
+            List<Agent> agents;
+            try {
+                agents = representative.list();
+            } catch (HerdrException e) {
+                log.warn("stop({}) probe: a configured herdr daemon was unreachable ({}); "
+                        + "treating it as not knowing this pane", id, e.getClass().getSimpleName());
+                continue;
+            }
+            boolean knows = agents.stream().anyMatch(a -> id.equals(a.paneId()));
+            if (knows) {
+                owners.add(representative);
+            }
+        }
+        if (owners.size() > 1) {
+            throw new IllegalArgumentException("ambiguous paneId '" + id + "': "
+                    + owners.size() + " configured herdr daemons report this pane — "
+                    + "no way to tell which one the caller means");
+        }
+        if (owners.isEmpty()) {
+            return null;
+        }
+        HerdrPeerLauncher owner = owners.get(0);
+        spawnedBy.put(id, owner);
+        return owner;
+    }
+
    /**
     * Count actual herdr daemons, not peer adapter kinds. Identity is intentional: separate client
     * objects may represent different daemons even if a client later implements value equality.
@@ -6,6 +6,7 @@ import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.ExhaustionSink;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.CharterReceipt;
 import dev.ltms.fleet.peer.PeerHandle;
@@ -71,6 +72,9 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     */
    private final OpenCodeSessionDiscovery discovery;

+    /** Receives the profile when a resolved model differs from its requested selector. */
+    private final ExhaustionSink modelMismatchSink;
+
    /**
     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so it
     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
@@ -121,7 +125,20 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials);
+                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials, ExhaustionSink.none());
+    }
+
+    /** Production constructor with permanent-quarantine wiring for a model mismatch. */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                             Function<String, String> env,
+                             long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                             Supplier<FleetConfig.Fleet> fleet,
+                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
+                             ExhaustionSink modelMismatchSink) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
+                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
+                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials, modelMismatchSink);
    }

    /**
@@ -163,12 +180,10 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
-                            Path configRoot, Path discoveryRoot,
-                            Supplier<FleetConfig.Fleet> fleet) {
-        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
-        this.configRoot = configRoot;
-        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+                             Path configRoot, Path discoveryRoot,
+                             Supplier<FleetConfig.Fleet> fleet) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, nowMillis, sleeper,
+                configRoot, discoveryRoot, fleet, null, ExhaustionSink.none());
    }

    /**
@@ -179,13 +194,32 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
-                            Path configRoot, Path discoveryRoot,
-                            Supplier<FleetConfig.Fleet> fleet,
-                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
+                             Path configRoot, Path discoveryRoot,
+                             Supplier<FleetConfig.Fleet> fleet,
+                             Supplier<FleetConfig.MemberCredentials> memberCredentials) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, nowMillis, sleeper,
+                configRoot, discoveryRoot, fleet, memberCredentials, ExhaustionSink.none());
+    }
+
+    /**
+     * Full constructor with the model-mismatch quarantine callback. The callback is an
+     * {@link ExhaustionSink} so model mismatches use the existing quarantine path rather than a
+     * second state tracker.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                             Function<String, String> env,
+                             long spawnReadyTimeoutMs,
+                             LongSupplier nowMillis, Runnable sleeper,
+                             Path configRoot, Path discoveryRoot,
+                             Supplier<FleetConfig.Fleet> fleet,
+                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
+                             ExhaustionSink modelMismatchSink) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
        this.configRoot = configRoot;
        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+        this.modelMismatchSink = modelMismatchSink;
    }

    private static Path defaultConfigRoot() {
@@ -498,9 +532,34 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    @Override
    public PeerHandle spawn(SpawnRequest req) {
        PeerHandle inner = super.spawn(req);
+        verifyResolvedModel(requireProfile(req.profileName()), effectiveCwd(req));
        return new SessionAwareHandle(inner, discovery, effectiveCwd(req));
    }

+    /**
+     * Read the session record once after the spawn-readiness gate. opencode writes the model it
+     * actually selected there. No record, incomplete model object, or a selector without one slash
+     * is unknown evidence, so it must not quarantine a working profile.
+     */
+    private void verifyResolvedModel(FleetConfig.Profile cfg, String cwd) {
+        String[] requested = splitProviderModel(cfg.model());
+        if (requested == null) {
+            return;
+        }
+        OpenCodeSessionDiscovery.SessionRecord record = discovery.sessionForDirectory(cwd);
+        if (record == null || record.providerId() == null || record.modelId() == null) {
+            return;
+        }
+        String actual = record.providerId() + "/" + record.modelId();
+        if (cfg.model().equals(actual)) {
+            return;
+        }
+        log.error("opencode model mismatch for profile '{}': requested '{}' but resolved '{}'",
+                cfg.profile(), cfg.model(), actual);
+        modelMismatchSink.onExhausted(cfg.profile(), "opencode model mismatch: requested "
+                + cfg.model() + ", resolved " + actual);
+    }
+
    /**
     * A {@link PeerHandle} that delegates everything to the base's worker handle but resolves
     * {@link #agentSessionId()} lazily through opencode session discovery. Delegate-only, so the
@@ -58,6 +58,15 @@ final class OpenCodeSessionDiscovery {
     * @return the matching session id, or {@code null} if none is known yet
     */
    String sessionIdForDirectory(String directory) {
+        SessionRecord record = sessionForDirectory(directory);
+        return record == null ? null : record.id();
+    }
+
+    /**
+     * The newest session record for {@code directory}, or {@code null} when opencode has not written
+     * one yet. This is the single storage seam for both session identity and resolved-model checks.
+     */
+    SessionRecord sessionForDirectory(String directory) {
        if (directory == null || directory.isBlank()) {
            return null;
        }
@@ -65,20 +74,20 @@ final class OpenCodeSessionDiscovery {
        if (!Files.isDirectory(sessionRoot)) {
            return null;
        }
-        String best = null;
+        SessionRecord best = null;
        long bestMtime = Long.MIN_VALUE;
        try (Stream<Path> projectDirs = Files.list(sessionRoot)) {
            for (Path projectDir : projectDirs.filter(Files::isDirectory).toList()) {
                try (Stream<Path> records = Files.list(projectDir)) {
                    for (Path record : records.toList()) {
-                        String id = matchId(record, directory);
-                        if (id == null) {
+                        SessionRecord matched = matchRecord(record, directory);
+                        if (matched == null) {
                            continue;
                        }
                        long mtime = lastModifiedEpochMillis(record);
                        if (mtime > bestMtime) {
                            bestMtime = mtime;
-                            best = id;
+                            best = matched;
                        }
                    }
                } catch (IOException ignored) {
@@ -97,7 +106,7 @@ final class OpenCodeSessionDiscovery {
     * that is not JSON, lacks {@code id}/{@code directory}, or points at a different directory is
     * simply not our session; a malformed one is skipped, never fatal.
     */
-    private String matchId(Path record, String directory) {
+    private SessionRecord matchRecord(Path record, String directory) {
        try {
            JsonNode node = json.readTree(record.toFile());
            JsonNode id = node == null ? null : node.get("id");
@@ -105,12 +114,24 @@ final class OpenCodeSessionDiscovery {
            if (id == null || dir == null || !directory.equals(dir.asText())) {
                return null;
            }
-            return id.asText();
+            JsonNode model = node.path("model");
+            String providerId = text(model, "providerID");
+            String modelId = text(model, "id");
+            return new SessionRecord(id.asText(), providerId, modelId);
        } catch (IOException e) {
            return null;
        }
    }

+    private static String text(JsonNode node, String name) {
+        JsonNode value = node.get(name);
+        return value == null || value.isNull() || value.asText().isBlank() ? null : value.asText();
+    }
+
+    /** The opencode fields fleetd reads from one session record. Null model fields mean unknown. */
+    record SessionRecord(String id, String providerId, String modelId) {
+    }
+
    /** The record's last-modified epoch ms, or {@code Long.MIN_VALUE} if unreadable (never wins). */
    private static long lastModifiedEpochMillis(Path record) {
        try {
@@ -168,14 +168,23 @@ public final class MessageService {
        private final String ticket;
        private final String target;
        private final CompletableFuture<Reply> future = new CompletableFuture<>();
-        private final long createdNanos;
+        /**
+         * When {@link #future} resolved, or {@code null} while it is still pending — the clock
+         * {@link #pruneTerminalTickets} measures the TTL from (#197). Deliberately a boxed
+         * {@code Long} rather than a {@code long} with a sentinel: {@link System#nanoTime} may
+         * legitimately return any value, zero and negatives included, so no numeric sentinel can mean
+         * "not stamped yet". Stamped by a {@code whenComplete} hook registered in the constructor, so
+         * every completion path stamps it — a reply, the completion fallback, a timeout, a failure,
+         * or an abandon on teardown — without each of those having to remember to.
+         */
+        private volatile Long completedNanos;
        private volatile Reply question;
        private volatile String turnId;

-        private Task(String ticket, String target, long createdNanos) {
+        private Task(String ticket, String target, LongSupplier nowNanos) {
            this.ticket = ticket;
            this.target = target;
-            this.createdNanos = createdNanos;
+            future.whenComplete((reply, ex) -> completedNanos = nowNanos.getAsLong());
        }
    }

@@ -721,7 +730,7 @@ public final class MessageService {
     */
    public String sendAsync(String target, String content, Runnable onAccepted) {
        String ticket = "task-" + ticketSeq.incrementAndGet();
-        Task task = new Task(ticket, target, nowNanos.getAsLong());
+        Task task = new Task(ticket, target, nowNanos);
        tasks.put(ticket, task);
        if (pushLoop != null) {
            // CB-588: task.future only ever completes on a terminal phase (DONE or a failure) — a
@@ -821,12 +830,25 @@ public final class MessageService {
     * (or one the reminder cap already gave up on) is pruned here but never collected there, so it
     * lingers in {@code pendingTickets} forever and rides along on every later nudge to the same lead
     * — naming a ticket {@code fleet_poll} can no longer find (CB-588 follow-up).
+     *
+     * <p>The TTL runs from **completion**, not from creation (#197). It used to compare against
+     * {@code createdNanos}, which made the real collection window {@code TTL minus however long the
+     * task ran}: a delegation that took longer than the TTL had its reply destroyed on the first
+     * sweep after it landed, every time. That is the normal case here — real work runs well past ten
+     * minutes — and the reply lives only in {@code future}, so pruning it discards the worker's whole
+     * report with nothing to fall back on. Measuring from completion gives every ticket the same full
+     * window whatever its runtime, and still bounds {@code tasks}.
+     *
+     * <p>A task whose future is done but whose {@code completedNanos} is not stamped yet is left
+     * alone. That window is the few instructions between {@code complete()} and the constructor's
+     * {@code whenComplete} hook running; the next sweep collects it.
     */
    private void pruneTerminalTickets() {
        long cutoff = nowNanos.getAsLong() - TICKET_TTL_NANOS;
        tasks.entrySet().removeIf(e -> {
            Task t = e.getValue();
-            boolean expired = t.future.isDone() && t.createdNanos < cutoff;
+            Long completed = t.completedNanos;
+            boolean expired = t.future.isDone() && completed != null && completed < cutoff;
            if (expired && pushLoop != null) {
                pushLoop.ticketCollected(e.getKey());
            }
@@ -76,6 +76,20 @@ public final class BackendQuarantine {
        quarantinedUntilNanos.put(credentialId, nowNanos.getAsLong() + cooldownNanos);
    }

+    /**
+     * Quarantine {@code credentialId} until the daemon restarts. This is for a configuration error
+     * that cannot heal with time, unlike an exhausted backend. A model selector that opencode silently
+     * resolves to another model stays wrong until an operator changes the profile, so a cooldown would
+     * start the same unsafe work again.
+     */
+    public void quarantinePermanently(String credentialId) {
+        Objects.requireNonNull(credentialId, "credentialId");
+        if (inert) {
+            return;
+        }
+        quarantinedUntilNanos.put(credentialId, Long.MAX_VALUE);
+    }
+
    /** Whether {@code credentialId} is quarantined right now. */
    public boolean isQuarantined(String credentialId) {
        return remainingNanos(credentialId) > 0;
@@ -110,6 +124,7 @@ public final class BackendQuarantine {
    }

    private static long toSecondsRoundedUp(long nanos) {
-        return (nanos + 999_999_999L) / 1_000_000_000L;
+        long seconds = nanos / 1_000_000_000L;
+        return seconds + (nanos % 1_000_000_000L == 0 ? 0 : 1);
    }
 }
@@ -214,6 +214,17 @@ public final class FleetApp {
     * second daemon configured, a member daemon that is down must not be masked by a healthy lead
     * daemon — every spawn goes through the member daemon and would otherwise fail silently behind
     * a green {@code /healthz}.
+     *
+     * <p>CB-185 blocker 2: the {@code herdr} key always carries the <em>lead</em> daemon's
+     * version/protocol, unchanged, because two consumers — {@code scripts/redeploy-fleetd.sh} and
+     * {@code scripts/rename-checkout.sh} — read this endpoint already (both only check the HTTP
+     * status code and print the body verbatim; neither parses a specific field, so adding a key
+     * alongside {@code herdr} is safe). But it is the <em>member</em> daemon's protocol that decides
+     * whether a spawn works, so when a second daemon is configured its version/protocol is reported
+     * too, under a separate {@code member} key — never folded into {@code herdr}, which would make a
+     * mismatch invisible to whichever consumer only reads that key. If the two protocol numbers
+     * differ, {@code protocolMismatch: true} calls it out explicitly rather than leaving it to be
+     * spotted by comparing two numbers by eye.
     */
    private void healthz(Context ctx) {
        JsonNode pong;
@@ -226,9 +237,15 @@ public final class FleetApp {
                    "detail", e.getMessage()));
            return;
        }
+        Map<String, Object> body = new LinkedHashMap<>();
+        body.put("status", "ok");
+        body.put("herdr", Map.of(
+                "version", pong.path("version").asText(""),
+                "protocol", pong.path("protocol").asInt()));
        if (memberHerdr != herdr) {
+            JsonNode memberPong;
            try {
-                memberHerdr.call("ping");
+                memberPong = memberHerdr.call("ping");
            } catch (HerdrException e) {
                ctx.status(503).json(Map.of(
                        "status", "degraded",
@@ -236,12 +253,16 @@ public final class FleetApp {
                        "detail", e.getMessage()));
                return;
            }
+            int leadProtocol = pong.path("protocol").asInt();
+            int memberProtocol = memberPong.path("protocol").asInt();
+            body.put("member", Map.of(
+                    "version", memberPong.path("version").asText(""),
+                    "protocol", memberProtocol));
+            if (leadProtocol != memberProtocol) {
+                body.put("protocolMismatch", true);
+            }
        }
-        ctx.status(200).json(Map.of(
-                "status", "ok",
-                "herdr", Map.of(
-                        "version", pong.path("version").asText(""),
-                        "protocol", pong.path("protocol").asInt())));
+        ctx.status(200).json(body);
    }

    /**
@@ -110,6 +110,7 @@ public final class GitWorktrees implements Worktrees {

    @Override
    public String add(String repoRoot, String branch, String baseRef) {
+        reportRemoteUrlsWithUserInfo(repoRoot);
        String base = (baseRef == null || baseRef.isBlank()) ? "HEAD" : baseRef;
        String nonce = nonce();
        Path root = resolveRoot(repoRoot);
@@ -139,7 +140,7 @@ public final class GitWorktrees implements Worktrees {
        if (exitCode("git", "-C", repoRoot, "config", "--get", "remote.origin.url") != 0) {
            return;
        }
-        String origin = exec("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
+        String origin = execRedacted("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
        URI uri;
        try {
            uri = new URI(origin);
@@ -155,6 +156,9 @@ public final class GitWorktrees implements Worktrees {
            throw new WorktreeException("origin URL has invalid HTTPS user info; cannot provision safely");
        }
        String cleanOrigin = origin.substring(0, schemeEnd) + origin.substring(userInfoEnd + 1);
+        // Plain exec, not execRedacted, is correct here: this call WRITES cleanOrigin (already
+        // stripped of user-info above) rather than reading a URL back from stdout, so there is
+        // nothing secret left in either its argv or its stdout to redact.
        exec("git", "-C", repoRoot, "remote", "set-url", "origin", cleanOrigin);
        log.info("removed HTTPS user info from forge origin before provisioning worktree");
    }
@@ -164,7 +168,7 @@ public final class GitWorktrees implements Worktrees {
        if (exitCode("git", "-C", worktreePath, "remote", "get-url", "--all", "origin") != 0) {
            return;
        }
-        String origins = exec("git", "-C", worktreePath, "remote", "get-url", "--all", "origin");
+        String origins = execRedacted("git", "-C", worktreePath, "remote", "get-url", "--all", "origin");
        for (String origin : origins.split("\\R")) {
            try {
                URI uri = new URI(origin);
@@ -177,6 +181,99 @@ public final class GitWorktrees implements Worktrees {
        }
    }

+    /**
+     * Report — never refuse — every remote whose fetch or push URL carries user-info outside SSH.
+     * A linked worktree shares its parent repository's git config, so a credential on ANY remote
+     * (not only {@code origin}) or in a {@code pushurl} is just as readable by a member as one on
+     * {@code origin}'s HTTPS fetch URL — the one case {@link #removeUserInfoFromHttpsOrigin} and
+     * {@link #requireCredentialFreeHttpsOrigin} already strip and refuse. This check is additive: it
+     * only logs a warning, it never mutates config and never refuses the provision.
+     *
+     * <p>A reporting-only check must never be able to abort a provision — PR #173 shipped one that
+     * ran unguarded at the top of {@link #add}, and every git call inside it can throw ({@link #exec}
+     * turns a non-zero exit or its 30-second timeout into a {@link WorktreeException}). Every git call
+     * here is therefore wrapped, and on failure only the exception's <em>class</em> is logged, never
+     * its message: the enumerating {@code git remote} call is not redacted, and its stderr is read
+     * from the very config that may hold the URL this check exists to find.
+     */
+    private void reportRemoteUrlsWithUserInfo(String repoRoot) {
+        List<String> remotes;
+        try {
+            remotes = exec("git", "-C", repoRoot, "remote").lines()
+                    .map(String::trim)
+                    .filter(r -> !r.isBlank())
+                    .toList();
+        } catch (RuntimeException e) {
+            log.warn("could not enumerate remotes to check for credentialed URLs in {}: {}",
+                    Path.of(repoRoot).toAbsolutePath().normalize(), e.getClass().getName());
+            return;
+        }
+        for (String remote : remotes) {
+            reportOneRemoteUrlsWithUserInfo(repoRoot, remote);
+        }
+    }
+
+    private void reportOneRemoteUrlsWithUserInfo(String repoRoot, String remote) {
+        boolean leaks = remoteUrlsLeakUserInfo(repoRoot, remote, false)
+                || remoteUrlsLeakUserInfo(repoRoot, remote, true);
+        if (leaks) {
+            log.warn("member worktree shares a remote URL containing user-info: remote={} repository={}; "
+                     + "remove credentials from the repository's git config",
+                    remote, Path.of(repoRoot).toAbsolutePath().normalize());
+        }
+    }
+
+    /**
+     * True when any resolved fetch (or, if {@code push}, push) URL for {@code remote} carries
+     * non-empty user-info outside SSH. Never throws — a git failure here is caught, logged (its
+     * class only, per the javadoc above), and treated as "nothing found", so it cannot abort or
+     * otherwise affect provisioning. Uses {@link #execRedacted} because the command's stdout is
+     * itself the URL this check exists to find.
+     */
+    private boolean remoteUrlsLeakUserInfo(String repoRoot, String remote, boolean push) {
+        try {
+            String out = push
+                    ? execRedacted("git", "-C", repoRoot, "remote", "get-url", "--push", "--all", remote)
+                    : execRedacted("git", "-C", repoRoot, "remote", "get-url", "--all", remote);
+            return out.lines().anyMatch(url -> !url.isBlank() && urlLeaksUserInfo(url.trim()));
+        } catch (RuntimeException e) {
+            log.warn("could not read the {} URL for remote {} to check for credentials: {}",
+                    push ? "push" : "fetch", remote, e.getClass().getName());
+            return false;
+        }
+    }
+
+    /**
+     * True when {@code rawUrl} parses as an absolute URI with a non-SSH-family scheme and non-empty
+     * user-info. An unparsable or scheme-less URL — including the ssh scp-like shorthand
+     * ({@code user@host:path}) — is not this check's concern and is treated as "no finding", the
+     * same way {@link #configureHttpsUrlRewriteForSshOrigin} leaves that shorthand untouched.
+     */
+    private static boolean urlLeaksUserInfo(String rawUrl) {
+        URI uri;
+        try {
+            uri = new URI(rawUrl);
+        } catch (URISyntaxException e) {
+            return false;
+        }
+        String scheme = uri.getScheme();
+        if (scheme == null || isSshLikeScheme(scheme)) {
+            return false;
+        }
+        String userInfo = uri.getUserInfo();
+        return userInfo != null && !userInfo.isEmpty();
+    }
+
+    /**
+     * SSH-family schemes deliberately excluded from {@link #urlLeaksUserInfo}: there, the user part
+     * selects an account and authentication itself happens over SSH, so it is not a credential the
+     * way HTTPS/HTTP user-info is.
+     */
+    private static boolean isSshLikeScheme(String scheme) {
+        return "ssh".equalsIgnoreCase(scheme) || "git+ssh".equalsIgnoreCase(scheme)
+                || "ssh+git".equalsIgnoreCase(scheme);
+    }
+
    /** Configure a per-worktree helper that supplies a token from the member environment at call time. */
    private void configureEnvironmentCredentialHelper(String repoRoot, String worktreePath) {
        exec("git", "-C", repoRoot, "config", "extensions.worktreeConfig", "true");
@@ -234,7 +331,7 @@ public final class GitWorktrees implements Worktrees {
        if (exitCode("git", "-C", repoRoot, "config", "--get", "remote.origin.url") != 0) {
            return;
        }
-        String origin = exec("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
+        String origin = execRedacted("git", "-C", repoRoot, "config", "--get", "remote.origin.url").trim();
        URI uri;
        try {
            uri = new URI(origin);
@@ -603,6 +700,31 @@ public final class GitWorktrees implements Worktrees {

    /** Same as {@link #exec(String...)}, with extra environment variables set on the child process. */
    private String exec(Map<String, String> extraEnv, String... command) {
+        return exec(extraEnv, false, command);
+    }
+
+    /**
+     * Same as {@link #exec(String...)}, for a command whose stdout may itself carry a credential
+     * (e.g. {@code git remote get-url}, whose output is a URL). Stdout is still returned normally on
+     * success — callers still get the URL to inspect — but it is suppressed from BOTH the timeout
+     * message and the non-zero-exit message, so a failing call here can never copy it into a
+     * {@link WorktreeException}, and from there into a caller's log.
+     */
+    private String execRedacted(String... command) {
+        return exec(Map.of(), true, command);
+    }
+
+    /**
+     * Shared implementation for {@link #exec(Map, String...)} and {@link #execRedacted(String...)}.
+     * {@code redactOutput} suppresses captured stdout from both failure messages below.
+     *
+     * <p>Package-private, not {@code private}: also a test seam, the same way the
+     * {@code afterWorktreeAdded} constructor parameter is. It lets a test drive the redaction
+     * guarantee directly — a synthetic failing command whose stdout carries a test marker passed
+     * through {@code extraEnv} rather than argv — without depending on finding a real git failure
+     * mode that happens to echo a URL onto stdout before exiting non-zero.
+     */
+    String exec(Map<String, String> extraEnv, boolean redactOutput, String... command) {
        String out;
        int code;
        Process p;
@@ -624,7 +746,8 @@ public final class GitWorktrees implements Worktrees {
        try {
            if (!p.waitFor(30, TimeUnit.SECONDS)) {
                p.destroyForcibly();
-                throw new WorktreeException("command timed out: " + String.join(" ", command) + "\n" + out);
+                throw new WorktreeException("command timed out: " + String.join(" ", command)
+                        + (redactOutput || out.isBlank() ? "" : "\n" + out));
            }
            code = p.exitValue();
        } catch (InterruptedException e) {
@@ -634,7 +757,7 @@ public final class GitWorktrees implements Worktrees {
        }
        if (code != 0) {
            throw new WorktreeException("exit " + code + " for: " + String.join(" ", command)
-                    + (out.isBlank() ? "" : "\n" + out));
+                    + (redactOutput || out.isBlank() ? "" : "\n" + out));
        }
        return out;
    }
@@ -31,6 +31,8 @@ public final class FakeHerdr implements HerdrClient {
     */
    public final List<Call> calls = new CopyOnWriteArrayList<>();
    private boolean healthy = true;
+    private String pingVersion = "0.8.0";
+    private int pingProtocol = 19;
    private final List<String> extraWorkspaces = new ArrayList<>();
    private final List<String> extraAgents = new ArrayList<>();
    /** workspaceId → extra tabs that {@code tab.list} reports for it (CB-558 lead scans). */
@@ -52,6 +54,16 @@ public final class FakeHerdr implements HerdrClient {
        return this;
    }

+    /**
+     * Make {@code ping} report this version/protocol instead of the default 0.8.0/19 — CB-185
+     * blocker 2's fixture for a lead and a member daemon running mismatched herdr versions.
+     */
+    public FakeHerdr pingReports(String version, int protocol) {
+        this.pingVersion = version;
+        this.pingProtocol = protocol;
+        return this;
+    }
+
    /** Reject the first {@code n} {@code agent.start} calls with {@code agent_name_taken}. */
    public FakeHerdr agentNameTakenTimes(int n) {
        this.agentNameTakenFor = n;
@@ -166,7 +178,8 @@ public final class FakeHerdr implements HerdrClient {
        try {
            return switch (method) {
                case "ping" -> mapper.readTree(
-                        "{\"type\":\"pong\",\"version\":\"0.8.0\",\"protocol\":19}");
+                        ("{\"type\":\"pong\",\"version\":\"%s\",\"protocol\":%d}")
+                                .formatted(pingVersion, pingProtocol));
                case "workspace.list" -> mapper.readTree(("""
                        {"type":"workspace_list","workspaces":[
                          {"workspace_id":"w1","label":"dev-mgnl","focused":true,"pane_count":7,"agent_status":"unknown"},
@@ -566,6 +566,73 @@ class CompletionResolverTest {
        assertEquals("The usage limit has been reached.", waiter.getNow(null).text());
    }

+    // --- fleetd#164 (part 2 addendum): narrow BACKEND_ERROR pattern classification ---------
+
+    @Test
+    void classifiesABackendErrorLineAsAFailureInsteadOfACompletedReply() {
+        String block = "⏺ API Error: 400 invalid request body\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "a backend-error scrape still resolves the blocked send");
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "a backend rejection is a failure, not a completed reply");
+    }
+
+    @Test
+    void theBackendErrorReasonNamesTheMemberAndCarriesTheMatchedLine() {
+        String block = "⏺ API Error: 400 invalid request body\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        String reason = waiter.getNow(null).text();
+        assertTrue(reason.contains("term_a"), "the failure names the member: " + reason);
+        assertTrue(reason.contains("API Error: 400 invalid request body"),
+                "the failure carries the matched backend-error line: " + reason);
+    }
+
+    @Test
+    void aCaseInsensitiveApiErrorLineIsStillClassifiedAsABackendError() {
+        String block = "⏺ api error: rate limited\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(), "the pattern is case-insensitive");
+    }
+
+    @Test
+    void aBackendErrorFailureStillCarriesTheRestOfTheScrape() {
+        // The pattern is a heuristic: a member that forgot fleet_reply while *reporting on* a backend
+        // error matches it too. Failing is still correct, but the report itself must survive — losing
+        // it would be the same information-destroying defect fleetd#164 exists to fix.
+        String block = "\u23fa I looked into the gateway problem.\n"
+                + "The log line was: API Error: 400 invalid request body\n"
+                + "The cause is a missing content-type header.\n\u276f ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        String reason = waiter.getNow(null).text();
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind());
+        assertTrue(reason.contains("The cause is a missing content-type header."),
+                "the failure carries the rest of the pane, not only the matched line: " + reason);
+    }
+
    @Test
    void coverageIsOffWhenNoProfileHasAPatternConfigured() {
        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",
@@ -346,13 +346,94 @@ class CompositePeerLauncherTest {

    @Test
    void stopRejectsAnUnownedPaneIdWhenMultipleDaemonsCouldOwnIt() {
+        // CB-185 blocker 1: genuine ambiguity — pane ids are per-daemon counters, so two daemons
+        // can each really hold an agent at "w1:p1". Neither claims ownership through spawnedBy
+        // (empty, as after a restart), so the probe must find BOTH and refuse rather than guess.
+        FakeHerdr first = new FakeHerdr().withAgent("x", "term_x", "w1:p1", "w1:t1");
+        FakeHerdr second = new FakeHerdr().withAgent("y", "term_y", "w1:p1", "w1:t1");
        PeerLauncher composite = new CompositePeerLauncher(
-                List.of(claudeAdapter(new FakeHerdr()), opencodeAdapter(new FakeHerdr())), "claude");
+                List.of(claudeAdapter(first), opencodeAdapter(second)), "claude");

        IllegalArgumentException error = assertThrows(IllegalArgumentException.class,
                () -> composite.stop("w1:p1"));

-        assertEquals("ambiguous paneId 'w1:p1': no owning herdr daemon was recorded", error.getMessage());
+        assertEquals("ambiguous paneId 'w1:p1': 2 configured herdr daemons report this pane — "
+                + "no way to tell which one the caller means", error.getMessage());
+    }
+
+    @Test
+    void stopOnAPaneNoConfiguredDaemonKnowsIsTreatedAsAlreadyStopped() {
+        // CB-185 blocker 1, the zero-owner branch: spawnedBy is empty (as after a restart) and
+        // neither daemon's agent.list mentions this pane at all — it is already gone. A retried
+        // stop() on an already-gone pane must succeed quietly, not refuse forever.
+        FakeHerdr first = new FakeHerdr();
+        FakeHerdr second = new FakeHerdr();
+        PeerLauncher composite = new CompositePeerLauncher(
+                List.of(claudeAdapter(first), opencodeAdapter(second)), "claude");
+
+        assertDoesNotThrow(() -> composite.stop("w1:p1"));
+
+        assertFalse(first.called("pane.close"), "no owner was found, so no delegate is told to close anything");
+        assertFalse(second.called("pane.close"), "no owner was found, so no delegate is told to close anything");
+    }
+
+    @Test
+    void stopWithEmptySpawnedByResolvesTheOwnerThroughAProbeAndSkipsTheOtherDaemon() {
+        // CB-185 blocker 1, the main fix: after a restart spawnedBy is empty for every surviving
+        // member. stop() must still find the one daemon that actually knows the pane and route
+        // only to it — never touching the daemon that never held it.
+        FakeHerdr first = new FakeHerdr().withAgent("x", "term_x", "w1:p1", "w1:t1");
+        FakeHerdr second = new FakeHerdr();
+        PeerLauncher composite = new CompositePeerLauncher(
+                List.of(claudeAdapter(first), opencodeAdapter(second)), "claude");
+
+        composite.stop("w1:p1");
+
+        assertTrue(first.calls.stream().anyMatch(c -> c.method().equals("pane.close")
+                        && "w1:p1".equals(((Map<?, ?>) c.params()).get("pane_id"))),
+                "the daemon that actually knows the pane closes it");
+        assertFalse(second.called("pane.close"), "the daemon that never held the pane is never touched");
+    }
+
+    @Test
+    void aProbeSurvivesOneUnreachableDaemonAndStillFindsTheOwnerOnTheOtherOne() {
+        // CB-185 blocker 1 (lead review): a daemon that is DOWN while we probe must not abort the
+        // whole probe — the pane the OPERATOR actually wants stopped can live on a different,
+        // healthy daemon, and that pane must not become un-stoppable because a third one is down.
+        FakeHerdr down = new FakeHerdr().healthy(false);
+        FakeHerdr owner = new FakeHerdr().withAgent("x", "term_x", "w1:p1", "w1:t1");
+        PeerLauncher composite = new CompositePeerLauncher(
+                List.of(claudeAdapter(down), opencodeAdapter(owner)), "claude");
+
+        assertDoesNotThrow(() -> composite.stop("w1:p1"),
+                "the unreachable daemon must be skipped, not fail the whole stop");
+
+        assertTrue(owner.calls.stream().anyMatch(c -> c.method().equals("pane.close")
+                        && "w1:p1".equals(((Map<?, ?>) c.params()).get("pane_id"))),
+                "the healthy daemon that actually owns the pane still closes it");
+    }
+
+    @Test
+    void aProbedOwnerIsCachedSoARetryAfterAFailedStopNeedsNoSecondProbe() {
+        // CB-185 blocker 1: the probe's whole point is to be cheap on repeat — a failed stop (e.g.
+        // "pane_busy") must not force another agent.list() round trip on every retry.
+        FakeHerdr first = new FakeHerdr().withAgent("x", "term_x", "w1:p1", "w1:t1")
+                .paneCloseFailsWith("pane_busy");
+        FakeHerdr second = new FakeHerdr();
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(claudeAdapter(first), opencodeAdapter(second)), "claude");
+
+        assertThrows(HerdrException.class, () -> composite.stop("w1:p1"));
+        long listCallsAfterFirst = first.calls.stream().filter(c -> c.method().equals("agent.list")).count()
+                + second.calls.stream().filter(c -> c.method().equals("agent.list")).count();
+        assertTrue(listCallsAfterFirst > 0, "the first stop needed a probe");
+
+        assertThrows(HerdrException.class, () -> composite.stop("w1:p1"),
+                "still failing on the retry, but through the cached owner");
+        long listCallsAfterSecond = first.calls.stream().filter(c -> c.method().equals("agent.list")).count()
+                + second.calls.stream().filter(c -> c.method().equals("agent.list")).count();
+        assertEquals(listCallsAfterFirst, listCallsAfterSecond,
+                "the retry is served from the cache — no additional agent.list probe");
    }

    @Test
@@ -12,6 +12,7 @@ import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerHandle;
 import dev.ltms.fleet.peer.PeerUnreachableException;
 import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.BackendQuarantine;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;

@@ -22,6 +23,7 @@ import java.util.Map;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
 import java.util.function.Supplier;

 import static org.junit.jupiter.api.Assertions.*;
@@ -61,6 +63,23 @@ class OpenCodeLauncherTest {
                0, System::currentTimeMillis, () -> { }, configRoot, configRoot, null, () -> creds);
    }

+    private static OpenCodeLauncher serviceWithModelMismatchSink(FakeHerdr herdr, Path root,
+                                                                  FleetConfig.Profile cfg,
+                                                                  BackendQuarantine quarantine) {
+        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
+                0, System::currentTimeMillis, () -> { }, root, root, null, null,
+                (profile, _) -> quarantine.quarantinePermanently(profile));
+    }
+
+    private static void writeResolvedModelRecord(Path root, String directory, String providerId,
+                                                 String modelId) throws Exception {
+        Path record = Files.createDirectories(root.resolve("session").resolve("p1")).resolve("ses_a.json");
+        Files.writeString(record, "{\"id\":\"ses_a\",\"directory\":\"" + directory
+                + "\",\"model\":{\"id\":\"" + modelId + "\",\"providerID\":\""
+                + providerId + "\",\"variant\":\"high\"}}");
+    }
+
    @SuppressWarnings("unchecked")
    private static Map<String, Object> lastStart(FakeHerdr herdr) {
        return (Map<String, Object>) herdr.lastCall("agent.start").params();
@@ -211,6 +230,50 @@ class OpenCodeLauncherTest {
                "--auto is unconditional: a model-less worker still must never block on approval");
    }

+    // --- CB-175: verify opencode's recorded resolved model after spawn readiness ----------------
+
+    @Test
+    void matchingResolvedModelDoesNotQuarantineTheProfile(@TempDir Path root) throws Exception {
+        FleetConfig.Profile cfg = opencodeCfg("opencode/x-preview-f-free", null, null);
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(1));
+        writeResolvedModelRecord(root, root.toString(), "opencode", "x-preview-f-free");
+
+        serviceWithModelMismatchSink(new FakeHerdr(), root, cfg, quarantine)
+                .spawn(new SpawnRequest(null, root.toString(), null, null, null, MemberRole.DEV));
+
+        assertFalse(quarantine.isQuarantined("gemini"), "the exact provider/model match is safe");
+    }
+
+    @Test
+    void differentResolvedModelPermanentlyQuarantinesTheProfile(@TempDir Path root) throws Exception {
+        FleetConfig.Profile cfg = opencodeCfg("opencode/x-preview-f-free", null, null);
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(1));
+        writeResolvedModelRecord(root, root.toString(), "openai", "gpt-5.6-sol");
+
+        serviceWithModelMismatchSink(new FakeHerdr(), root, cfg, quarantine)
+                .spawn(new SpawnRequest(null, root.toString(), null, null, null, MemberRole.DEV));
+
+        assertTrue(quarantine.isQuarantined("gemini"), "a fallback model must block later spawns");
+        assertEquals(Long.MAX_VALUE / 1_000_000_000L + 1, quarantine.remainingSeconds("gemini").orElseThrow(),
+                "a withdrawn selector cannot become safe after the normal cooldown");
+    }
+
+    @Test
+    void missingOrUnreadableSessionDatabaseDoesNotQuarantine(@TempDir Path root) throws Exception {
+        FleetConfig.Profile cfg = opencodeCfg("opencode/x-preview-f-free", null, null);
+        BackendQuarantine missing = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(1));
+        serviceWithModelMismatchSink(new FakeHerdr(), root, cfg, missing)
+                .spawn(new SpawnRequest(null, root.toString(), null, null, null, MemberRole.DEV));
+        assertFalse(missing.isQuarantined("gemini"), "a missing database is unknown evidence");
+
+        Path broken = Files.createDirectories(root.resolve("session").resolve("p1")).resolve("ses_a.json");
+        Files.writeString(broken, "not JSON");
+        BackendQuarantine unreadable = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(1));
+        serviceWithModelMismatchSink(new FakeHerdr(), root, cfg, unreadable)
+                .spawn(new SpawnRequest(null, root.toString(), null, null, null, MemberRole.DEV));
+        assertFalse(unreadable.isQuarantined("gemini"), "an unreadable database is unknown evidence");
+    }
+
    // --- CB-617: --agent <role> when the role has an agent-definition file --------------------

    @Test
@@ -86,6 +86,28 @@ class MessageServiceTest {
        assertTrue(reply.completed(), "a scraped completion still counts as completed");
    }

+    @Test
+    void backendErrorScrapeThroughMessageServiceFailsInsteadOfBecomingReplyText() throws Exception {
+        // fleetd#164 (part 2 addendum): a scrape that reads cleanly but is only the backend's own
+        // rejection (e.g. an HTTP 400) must reach the caller as WORKER_FAILED, not as a completed
+        // reply whose text happens to be the error line.
+        CompletableFuture<MessageService.Reply> send = sendAsync();
+        awaitWaiting();
+
+        herdr.readText("$ prompt");
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        herdr.readText("⏺ API Error: 400 invalid request body");
+        injector.onStatus(T, AgentStatus.IDLE);
+
+        MessageService.Reply reply = send.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.WORKER_FAILED, reply.outcome(),
+                "a backend rejection must use the caller's failure outcome, not a completed reply");
+        assertFalse(reply.completed(), "plain backend errors are never fallback reply content");
+        assertTrue(reply.text().contains("API Error: 400 invalid request body"),
+                "the visible backend error is carried as the failure reason: " + reply.text());
+    }
+
    @Test
    void explicitFleetReplyResolvesAsReplied() throws Exception {
        CompletableFuture<MessageService.Reply> send = sendAsync();
@@ -1057,6 +1079,74 @@ class MessageServiceTest {
        }
    }

+    /**
+     * #197: the ticket TTL must run from COMPLETION, not from creation.
+     *
+     * <p>It used to compare the cutoff against {@code createdNanos}, so the real window to collect a
+     * reply was {@code TTL minus however long the task ran}. A delegation that ran longer than the
+     * TTL was already past the cutoff the moment it finished, so the very next prune destroyed its
+     * reply — and the reply lives only in the task's future, so nothing could get it back. That is
+     * the normal case for real work here, not an edge case: three workers in one session ran well
+     * past ten minutes and two of their complete reports were lost this way.
+     *
+     * <p>The task below runs for longer than the whole TTL before it replies, which is exactly the
+     * shape that used to lose everything. Remove the fix and this fails: {@code poll} returns
+     * {@code null} because the ticket was pruned on arrival.
+     */
+    @Test
+    void aTaskRunningLongerThanTheTtlStillKeepsItsReport() throws Exception {
+        java.util.concurrent.atomic.AtomicLong clock = new java.util.concurrent.atomic.AtomicLong(1_000_000_000L);
+        try (var wiring = wireWithPushLoop(1, 50, clock::get)) {
+            String slow = wiring.service().sendAsync(T, "a task that takes longer than the TTL");
+            awaitWaiting();
+            injectDelivery();
+
+            // The worker is still working, and has been for longer than the entire TTL. Nothing may
+            // be pruned yet — the ticket has not finished, so there is no report to keep or lose.
+            clock.addAndGet(MessageService.TICKET_TTL_NANOS + TimeUnit.SECONDS.toNanos(30));
+
+            // Only now does it reply. Under the old clock this reply was born already expired.
+            assertTrue(rendezvous.resolve(T, "the long report"));
+            awaitTicketPhaseOn(wiring.service(), slow, MessageService.Phase.DONE);
+
+            // A second delegation runs pruneTerminalTickets before it returns.
+            wiring.service().sendAsync(T, "an unrelated second task");
+
+            MessageService.TaskView view = wiring.service().poll(slow);
+            assertNotNull(view, "a ticket that completed just now must survive the prune, however "
+                    + "long its task ran — the TTL is the window to COLLECT the report, not the "
+                    + "budget for producing it");
+            assertEquals(MessageService.Phase.DONE, view.phase());
+            assertEquals("the long report", view.reply(),
+                    "the worker's actual report must still be there, not just the ticket");
+        }
+    }
+
+    /**
+     * The other half of #197: the TTL must still bound {@code tasks}. Measuring from completion
+     * would be a leak if a finished ticket were then kept forever, so this pins the eviction that
+     * still has to happen — the same ticket, left uncollected for longer than the TTL AFTER it
+     * finished, is gone.
+     */
+    @Test
+    void aFinishedTicketIsStillPrunedOnceTheTtlPassesSinceItFinished() throws Exception {
+        java.util.concurrent.atomic.AtomicLong clock = new java.util.concurrent.atomic.AtomicLong(1_000_000_000L);
+        try (var wiring = wireWithPushLoop(1, 50, clock::get)) {
+            String done = wiring.service().sendAsync(T, "a quick task");
+            awaitWaiting();
+            injectDelivery();
+            assertTrue(rendezvous.resolve(T, "quick result"));
+            awaitTicketPhaseOn(wiring.service(), done, MessageService.Phase.DONE);
+
+            // Nobody collected it, and the TTL has now passed since it FINISHED.
+            clock.addAndGet(MessageService.TICKET_TTL_NANOS + TimeUnit.SECONDS.toNanos(1));
+            wiring.service().sendAsync(T, "an unrelated second task");
+
+            assertNull(wiring.service().poll(done),
+                    "the TTL must still evict an uncollected finished ticket, or tasks grows forever");
+        }
+    }
+
    private MessageService.TaskView awaitTicketPhaseOn(MessageService svc, String ticket,
            MessageService.Phase phase) throws Exception {
        long deadline = System.currentTimeMillis() + 3000;
@@ -96,4 +96,55 @@ class FleetAppTwoDaemonTest {
        long calls = shared.calls.stream().filter(c -> c.method().equals("workspace.list")).count();
        assertEquals(1, calls, "single-daemon deployment must call workspace.list exactly once");
    }
+
+    // ── CB-185 blocker 2: /healthz must report the MEMBER daemon's protocol too ────────────────
+
+    @Test
+    void healthzReportsBothDaemonsWhenTheirProtocolsDiffer() throws Exception {
+        FakeHerdr lead = new FakeHerdr().pingReports("0.8.0", 19);
+        FakeHerdr member = new FakeHerdr().pingReports("0.7.0", 18);
+        int port = start(lead, member);
+
+        HttpResponse<String> res = get(port, "/healthz");
+
+        assertEquals(200, res.statusCode(), res.body());
+        assertTrue(res.body().contains("\"protocol\":19"),
+                "the herdr key keeps reporting the LEAD's protocol, unchanged: " + res.body());
+        assertTrue(res.body().contains("\"member\""), "a separate member key is present: " + res.body());
+        assertTrue(res.body().contains("\"protocol\":18"),
+                "the member key reports the member daemon's own protocol: " + res.body());
+        assertTrue(res.body().contains("\"protocolMismatch\":true"),
+                "a differing protocol is called out explicitly, not left to be spotted by eye: " + res.body());
+    }
+
+    @Test
+    void healthzReportsBothDaemonsWithNoMismatchWhenProtocolsMatch() throws Exception {
+        int port = start(new FakeHerdr(), new FakeHerdr());
+
+        HttpResponse<String> res = get(port, "/healthz");
+
+        assertEquals(200, res.statusCode(), res.body());
+        assertTrue(res.body().contains("\"member\""), "the member key is present whenever a second daemon "
+                + "is configured, even when the protocols happen to agree: " + res.body());
+        assertFalse(res.body().contains("protocolMismatch"),
+                "matching protocols must not raise a mismatch flag: " + res.body());
+    }
+
+    @Test
+    void healthzWithOneDaemonCarriesNoMemberOrMismatchKey() throws Exception {
+        // The single-daemon deployment (no memberHerdrSocket) must see no change at all beyond the
+        // historical body: no "member" key, no "protocolMismatch" key. (Map.of()'s own key order is
+        // JVM-salted regardless of this fix, so this checks content, not exact key order.)
+        FakeHerdr shared = new FakeHerdr();
+        int port = start(shared, shared);
+
+        HttpResponse<String> res = get(port, "/healthz");
+
+        assertEquals(200, res.statusCode());
+        assertTrue(res.body().contains("\"status\":\"ok\""), res.body());
+        assertTrue(res.body().contains("\"protocol\":19"), res.body());
+        assertTrue(res.body().contains("\"version\":\"0.8.0\""), res.body());
+        assertFalse(res.body().contains("\"member\""), "no second daemon configured, so no member key: " + res.body());
+        assertFalse(res.body().contains("protocolMismatch"), res.body());
+    }
 }
@@ -1,13 +1,23 @@
 package dev.ltms.fleet.session;

+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.LoggerContext;
+import ch.qos.logback.classic.spi.IThrowableProxy;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;

 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
@@ -352,6 +362,151 @@ class GitWorktreesTest {
        assertEquals("worktree origin contains HTTPS user info; refusing provision", error.getMessage());
    }

+    // ---- CB-189: broader remote-URL coverage — every remote, both fetch and push URLs, any
+    // non-SSH scheme. Reporting only, additive to the origin/https strip-and-refuse tests above. ----
+
+    private Logger reportingLogger;
+    private ListAppender<ILoggingEvent> reportingAppender;
+
+    /** {@link GitWorktrees}'s own logger, captured fresh for each test so assertions never see a
+     *  message left over from a previous test. */
+    @BeforeEach
+    void attachReportingLogCapture() {
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        reportingLogger = ctx.getLogger(GitWorktrees.class);
+        reportingLogger.setLevel(Level.WARN);
+        reportingAppender = new ListAppender<>();
+        reportingAppender.setContext(ctx);
+        reportingAppender.start();
+        reportingLogger.addAppender(reportingAppender);
+    }
+
+    @AfterEach
+    void detachReportingLogCapture() {
+        reportingLogger.detachAppender(reportingAppender);
+    }
+
+    private List<String> capturedMessages() {
+        return reportingAppender.list.stream().map(ILoggingEvent::getFormattedMessage).toList();
+    }
+
+    /** Asserts {@code secret} appears in no captured message, and in no attached exception's
+     *  message either — the constraint is that a credential must never reach a log, however it
+     *  would have gotten there. */
+    private void assertNoLeak(String secret) {
+        for (ILoggingEvent event : reportingAppender.list) {
+            assertFalse(event.getFormattedMessage().contains(secret),
+                    "log message leaked a credential (" + secret + "): " + event.getFormattedMessage());
+            IThrowableProxy thrown = event.getThrowableProxy();
+            if (thrown != null && thrown.getMessage() != null) {
+                assertFalse(thrown.getMessage().contains(secret),
+                        "logged exception leaked a credential (" + secret + "): " + thrown.getMessage());
+            }
+        }
+    }
+
+    /** Gap 1: only {@code origin} was ever inspected. A credential on any other remote's fetch URL
+     *  must now be reported. */
+    @Test
+    void aCredentialedUrlOnANonOriginRemoteIsReported(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        git(repo, "remote", "add", "upstream", "https://leaky-upstream-token@git.ltms.dev/akb/kb.git");
+
+        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-189-a", "HEAD");
+
+        List<String> messages = capturedMessages();
+        assertTrue(messages.stream().anyMatch(m -> m.contains("remote=upstream")),
+                "expected a report naming the leaking non-origin remote:\n" + messages);
+        assertNoLeak("leaky-upstream-token");
+        assertNoLeak("https://leaky-upstream-token@git.ltms.dev/akb/kb.git");
+        assertNoLeak("git.ltms.dev");
+    }
+
+    /** Gap 2: push URLs were never inspected. A credential visible only on {@code pushurl} — the
+     *  fetch URL for the same remote stays clean — must now be reported. */
+    @Test
+    void aCredentialedPushUrlIsReported(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        git(repo, "remote", "add", "mirror", "https://git.ltms.dev/akb/mirror.git");
+        git(repo, "remote", "set-url", "--push", "mirror",
+                "https://leaky-push-token@git.ltms.dev/akb/mirror.git");
+
+        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-189-b", "HEAD");
+
+        List<String> messages = capturedMessages();
+        assertTrue(messages.stream().anyMatch(m -> m.contains("remote=mirror")),
+                "expected a report naming the remote with the leaking pushurl:\n" + messages);
+        assertNoLeak("leaky-push-token");
+        assertNoLeak("https://leaky-push-token@git.ltms.dev/akb/mirror.git");
+        assertNoLeak("git.ltms.dev");
+    }
+
+    /** Gap 3: only {@code https} was handled. A plain {@code http://user:pass@…} remote — worse
+     *  than https, not better — must now be reported. */
+    @Test
+    void anHttpUrlWithCredentialsIsReported(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        git(repo, "remote", "add", "insecure", "http://plainuser:plainpass@git.ltms.dev/akb/kb.git");
+
+        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-189-c", "HEAD");
+
+        List<String> messages = capturedMessages();
+        assertTrue(messages.stream().anyMatch(m -> m.contains("remote=insecure")),
+                "expected a report for the credentialed plain-http remote:\n" + messages);
+        assertNoLeak("plainuser");
+        assertNoLeak("plainpass");
+        assertNoLeak("plainuser:plainpass");
+        assertNoLeak("git.ltms.dev");
+    }
+
+    /** A normal {@code ssh://} remote and a credential-free {@code https://} remote must produce no
+     *  report at all — the check must not cry wolf on ordinary, safe configuration. */
+    @Test
+    void anSshRemoteAndACleanHttpsRemoteProduceNoReport(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "ssh://git@git.ltms.dev:2224/akb/kb.git");
+        git(repo, "remote", "add", "clean", "https://git.ltms.dev/akb/kb.git");
+
+        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-189-d", "HEAD");
+
+        assertTrue(reportingAppender.list.isEmpty(),
+                "expected no report for an ssh remote and a credential-free https remote, got:\n"
+                        + capturedMessages());
+    }
+
+    /**
+     * CB-189 review fix. Even a FAILING command that read a credential onto its stdout must never
+     * let that value reach the thrown {@link WorktreeException}'s message — this is gap 4 from the
+     * CB-189 issue, and the reason {@link GitWorktrees#execRedacted} exists at all. Drives the
+     * shared {@code exec}/{@code execRedacted} seam directly (it is package-private for exactly this,
+     * the same way the {@code afterWorktreeAdded} constructor parameter is a test seam) with a
+     * synthetic, non-git command whose stdout carries a marker — passed through the environment,
+     * never through argv, so the marker cannot leak via the command line that IS always printed
+     * unconditionally in the exception message — and which exits non-zero. This isolates the
+     * redaction guarantee itself rather than depending on a specific git failure mode that happens to
+     * echo a URL onto stdout before failing: none of the git subcommands this class actually runs was
+     * found to have one (a corrupted config makes {@code git config --get} fail before it ever reads
+     * the target key, so its output never carries the URL either). The marker is generated per-test
+     * run and injected only by the test, never a real-looking credential, so even a failing assertion
+     * could not itself print a secret.
+     */
+    @Test
+    void execRedactedNeverCopiesFailingCommandOutputIntoTheExceptionMessage(@TempDir Path tmp) {
+        String marker = "cb189-marker-" + System.nanoTime();
+        GitWorktrees worktrees = new GitWorktrees(tmp.toString());
+
+        WorktreeException thrown = assertThrows(WorktreeException.class, () -> worktrees.exec(
+                Map.of("MARKER", marker), true, "sh", "-c", "echo \"$MARKER\"; exit 7"));
+
+        assertNotNull(thrown.getMessage());
+        assertFalse(thrown.getMessage().contains(marker),
+                "a failing command's captured stdout leaked into the exception message: "
+                        + thrown.getMessage());
+    }
+
    /** Neutralizing must not look like work in progress, or a worker would commit it into its PR. */
    @Test
    void theNeutralizedConfigIsNotAPendingLocalModification(@TempDir Path tmp) throws Exception {
Author	SHA1	Message	Date
Dai Ha	fc2e26c0c5	CB-175: quarantine opencode model mismatches CI / contract (pull_request) Successful in 58s Details CI / build (pull_request) Successful in 2m7s Details	2026-08-31 14:04:41 +07:00
Dai Ha	4ac688b6d9	#164 : classify a backend-error scrape as WORKER_FAILED, carrying the whole pane CI / contract (push) Successful in 48s Details CI / build (push) Successful in 1m22s Details main already shipped the core of #164 in `3bfa828`: the MIN_TURN_NANOS floor and the hard fail on an empty or unreadable scrape. This adds the one case that was still resolving as a success -- a scrape that reads cleanly but whose content is the backend's own rejection (e.g. "API Error: 400 invalid request body"). The BACKEND_ERROR pattern is deliberately narrow. A growing list of ad-hoc error strings rots as backends change their wording, and broader backend-error surfacing is #164 point 3. Because the pattern is a heuristic, it also matches a member that forgot fleet_reply while reporting about a backend error. So the failure reason carries the whole pane tail, not just the matched line: a genuine backend error reads as before, and a false positive keeps its report instead of losing it. Checked before merging: `3bfa828` is an ancestor of main; the branch was current with main; mvn clean install green unpiped (1037 tests, 0 [ERROR] lines); and each of the 5 new tests fails with the fix commented out. Co-authored-by: fleetd worker <worker@ltms.dev>	2026-08-31 10:56:40 +07:00
ltms	a814d1ef00	#197 : measure the async ticket TTL from completion, not from creation CI / build (push) Successful in 1m15s Details CI / contract (push) Successful in 1m17s Details Lead-authored and lead-verified: full mvn clean install green at 1032 tests, and the new test proved by restoring the old comparison and watching it fail.	2026-08-31 05:10:46 +02:00
Dai Ha	ea98856130	#197 : measure the async ticket TTL from completion, not from creation CI / contract (pull_request) Successful in 54s Details CI / build (pull_request) Successful in 1m32s Details pruneTerminalTickets compared the cutoff against createdNanos, so the real window to collect a reply was "TTL minus however long the task ran". A delegation that ran longer than the 10-minute TTL was already past the cutoff the moment it finished, so the next prune destroyed its reply. That is the normal case here, not an edge case. Real delegated work runs well past ten minutes. Three workers in one session did, and two of their complete reports were lost. The reply lives only in Task.future, so pruning it discards the worker's whole report, and fleet_poll{target} returns [] rather than holding it — there is no fallback. Task now stamps completedNanos from a whenComplete hook registered in its constructor, so every completion path stamps it (a reply, the completion fallback, a timeout, a failure, an abandon on teardown) without each one having to remember to. The stamp is a boxed Long, not a long with a sentinel: System.nanoTime may return any value, so no number can mean "not stamped yet". A task that is done but not yet stamped is left for the next sweep. createdNanos had no other reader and is removed. The TTL still bounds tasks — an uncollected finished ticket is still evicted once the TTL passes since it finished. Both halves are pinned by a test, and the first one was proved by restoring the old comparison and watching it fail. Tests run: 1032, Failures: 0, Errors: 0, Skipped: 0	2026-08-31 10:10:16 +07:00
ltms	a49e96835a	CB-189: cover every remote, both URLs, and any non-SSH scheme in the credential check CI / contract (push) Successful in 44s Details CI / build (push) Successful in 1m11s Details Lead-verified: merged onto current main (which already carries #194 and #196), full `mvn clean install` green at 1030 tests. Confirmed no plain `exec` call that reads a remote URL remains. Review round 2 closed the half-fix: execRedacted was added but applied only to the new calls, leaving the three pre-existing URL readers (lines 143, 171, 334) still copying stdout into exception messages — the exact hole CB-189 named. Kept the check before the origin strip, on the worker's reasoning: the credential really is in the config at that moment, so WARN-found followed by INFO-fixed is the full audit trail, whereas moving it after would silence the origin case entirely.	2026-08-31 04:32:14 +02:00
ltms	63c19dcba7	CB-185: fix two blockers to switching on memberHerdrSocket CI / build (push) Successful in 1m31s Details CI / contract (push) Successful in 1m19s Details Lead-verified: merged with #194 onto an integration branch off main, full `mvn clean install` green at 1025 tests. Review round 2 fixed the stale ambiguous-pane message and, more importantly, a real abort: probeOwner called list() unguarded, so one unreachable daemon made panes on a different healthy daemon un-stoppable too — the same bug blocker 1 exists to fix, through a new door. Worker proved it by removing the guard and quoting the failure.	2026-08-31 04:30:57 +02:00
ltms	2823349c8e	CB-192: fix false credential-gap WARN under allow-list+zsh, split its log guard CI / contract (push) Successful in 44s Details CI / build (push) Successful in 1m11s Details Lead-verified: merged with #196 onto an integration branch off main, full `mvn clean install` green at 1025 tests. Deny-by-default WARN confirmed byte-identical to main. Review round 2 fixed a defect I found in round 1: the new INFO asserted that gap names were not on the derived allow-list without ever checking, so a name derived from a profile's tokenEnv/gitTokenEnv/env: would be reported as safe while the member actually inherited it. Now split with MemberEnvAllowList.keeps — the same predicate the generated scrub evaluates.	2026-08-31 04:30:48 +02:00
Dai Ha	6fc301d62c	CB-189 review fix: redact the three pre-existing URL-reading exec calls CI / contract (pull_request) Successful in 1m11s Details CI / build (pull_request) Successful in 1m42s Details Review found that execRedacted was applied only to the new remote-enumeration code and left three pre-existing calls reading remote.origin.url through the plain, unredacted exec: removeUserInfoFromHttpsOrigin, requireCredentialFreeHttpsOrigin, and configureHttpsUrlRewriteForSshOrigin. A non-zero exit or timeout on any of those could still have copied the credentialed URL into a WorktreeException message. Switches all three to execRedacted; the set-url write in removeUserInfoFromHttpsOrigin is left on plain exec with a comment explaining why (it writes the already-stripped URL, not a read). Widens the shared exec(Map, boolean, String...) overload to package-private, the same test-seam pattern already used by the afterWorktreeAdded constructor parameter, and adds a test that drives it directly with a synthetic failing command whose stdout carries a marker (passed via env, not argv, so the always-printed command line can't carry it) and asserts the marker never reaches the exception message.	2026-08-31 09:29:45 +07:00
Dai Ha	bc99d64786	CB-185: fix ambiguous-pane message and unreachable-daemon abort in probeOwner (review) CI / build (pull_request) Successful in 1m6s Details CI / contract (pull_request) Successful in 1m5s Details Lead review of PR #196 found two issues in CompositePeerLauncher.probeOwner: 1. The "more than one daemon claims this pane" throw kept the old pre-fix message ("no owning herdr daemon was recorded"), which was only true of the code it replaced. Reworded to say what actually happened: N configured herdr daemons report this pane, so it is genuinely ambiguous. Updated the one test pinning the old string. 2. probeOwner let list() propagate straight out of the probe loop, so one unreachable daemon aborted the whole probe and made a pane on a DIFFERENT, healthy daemon un-stoppable too — resurrecting the exact bug blocker 1 fixes. Now catches HerdrException per daemon, logs the exception class only, and treats that daemon as not knowing the pane so probing continues. New test proves this: verified it fails with the try/catch removed (HerdrException propagates and the stop that should succeed via the healthy daemon throws instead), then restored. Full mvn clean install: 1019 tests, 0 failures, 0 errors.	2026-08-31 09:28:29 +07:00
Dai Ha	045d229728	CB-185: fix two blockers to switching on memberHerdrSocket (#185 ) CI / contract (pull_request) Successful in 46s Details CI / build (pull_request) Successful in 1m39s Details 1. CompositePeerLauncher.stop() was permanently un-stoppable for any member that survived a daemon restart, because spawnedBy is in-memory only. On a cache miss with more than one configured herdr daemon, probe each distinct daemon's agent.list() for the pane instead of refusing outright: exactly one owner routes and caches; zero owners is treated as already-stopped (a no-op, matching the tolerance HerdrPeerLauncher already gives an already-gone pane); more than one owner is the genuine per-daemon-pane-id ambiguity and still throws. 2. FleetApp#healthz always reported the LEAD daemon's herdr version/ protocol even when a second (member) daemon was configured, so a member-daemon protocol mismatch was invisible behind a green /healthz while every spawn silently failed. Added a separate "member" key alongside the unchanged "herdr" key, and a "protocolMismatch" flag when the two differ. Verified scripts/redeploy-fleetd.sh and scripts/rename-checkout.sh only check the HTTP status code and print the body verbatim — neither parses a specific field — so adding a key is safe. Both fixes are covered by tests written to fail without the fix (verified by reverting each fix and watching the new tests fail, then restoring). Full `mvn clean install`: 1018 tests, 0 failures, 0 errors.	2026-08-31 09:20:14 +07:00
Dai Ha	d1fd5700f5	CB-189: cover every remote, both URLs, and any non-SSH scheme in the credential check CI / build (pull_request) Successful in 1m7s Details CI / contract (pull_request) Successful in 1m7s Details GitWorktrees only ever inspected origin's HTTPS fetch URL for embedded credentials. A credential on any other remote, on a pushurl, or on a plain http:// URL passed through unreported. Adds an additive, reporting-only check that enumerates every remote and both its fetch and push URLs, flagging non-empty user-info on any non-SSH-family scheme. The existing origin/https strip-and-refuse behaviour is untouched. The new check is wrapped so it can never abort a provision, and on failure logs only the exception's class, never its message, since the enumerating `git remote` call is not redacted. Also adds execRedacted, an exec variant that never copies captured stdout into a WorktreeException message, for commands whose stdout may itself be a credentialed URL.	2026-08-31 09:17:54 +07:00
Dai Ha	2d55b0b9a5	#168 : correct the audit's MISSING claim — the feature is documented, its index row was not CI / contract (push) Successful in 41s Details CI / build (push) Successful in 1m42s Details The memberHerdrSocket section exists at 11-Features.md:2174; what was absent was its row in the index table. My omission when I added the section. Wiki fixed at b24965c.	2026-08-31 09:17:41 +07:00
ltms	e6193c4098	Merge pull request '#168 : audit current wiki snapshot' (#193 ) from worker/cb-168-wiki-audit-3ef3d1-3 into main CI / build (push) Successful in 1m6s Details CI / contract (push) Successful in 1m5s Details	2026-08-31 04:17:07 +02:00
Dai Ha	b66f0677ed	#168 : audit current wiki snapshot CI / contract (pull_request) Successful in 44s Details CI / build (pull_request) Successful in 1m37s Details	2026-08-31 09:14:22 +07:00