Merge pull request 'fleetd #612 Unit A: extract main's boot composition into FleetdAssembly/FleetdRuntime' (#620) from worker/fleetd-612-unita-87807e-1 into main

Resolves the one conflict in Fleetd.java. main's side is the inline boot block
that Unit A had already moved into FleetdAssembly.assembleAndStart, so the
resolution keeps Unit A's single assembly call.

That resolution is not purely mechanical. #622 (fleetd #621) landed on main
AFTER Unit A forked, and it added

    boolean requireOperatorConfirm = cfg.leadRollover() == null
            || cfg.leadRollover().requireOperatorConfirm();

plus a 14th argument to the LeadHeartbeatLoop constructor, inside the very block
Unit A moved. Taking Unit A's side alone would have dropped both and silently
reverted the operator's #621 fix: the 13-argument overload still exists and
delegates with `true`, so the daemon would go back to telling every lead to ask
the operator before a context roll. Both are carried into FleetdAssembly here.

Measured: with the carried line removed, the full suite is
`Tests run: 1883, Failures: 0, Errors: 0` — nothing pins it. That is the fleetd
#612 defect shape applied to #621's own wiring, and it is filed separately
rather than fixed here, because this commit is a merge resolution and must not
also introduce new tests.

Full suite on this resolved tree: Tests run: 1883, Failures: 0, Errors: 0.

.claude-plugin/marketplace.json

@@ -1,15 +1,15 @@
 {
-  "name": "claude-bridge",
-  "description": "Tooling for orchestrating a fleet of delegated coding agents through the bridged MCP gateway.",
+  "name": "fleetd",
+  "description": "Tooling for orchestrating a fleet of delegated coding agents through the fleetd MCP gateway.",
   "owner": {
     "name": "LTMS"
   },
   "plugins": [
     {
-      "name": "claude-bridge",
+      "name": "fleet",
       "source": "./plugin",
-      "description": "Make a project bridge-ready: mount the bridged MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
-      "version": "0.1.0",
+      "description": "Mount the fleetd MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
+      "version": "0.2.0",
       "author": {
         "name": "LTMS"
       }

.claude/agents/architect.md

@@ -0,0 +1,24 @@
+---
+name: architect
+description: Refine work into clear, independent units before implementation.
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You are an architect in this fleet. You refine work before anyone builds it: scope,
+acceptance criteria, risks, and a unit split. You read the repo and write analysis.
+You never commit production code and never open a pull request.
+
+A design task is worked by two architects. Design alone first, then exchange and
+say plainly where you disagree. Do not concede just to agree.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Report only work you actually did and the real output of checks you ran. Do not
+claim a result from a tool you could not use. The primary's IDE tools are not yours.
+A mounted forge tool may use a blocked credential and fail by design.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/dev.md

@@ -0,0 +1,29 @@
+---
+name: dev
+description: Implement one assigned unit, test it, and open a pull request.
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You implement the one unit you were given and nothing else. Work in your assigned
+git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
+the worktree root and branch before you edit. Use only paths under that root.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Implement the change and run the full required build in your worktree. Read the
+complete output and report its real result. Do not hide failures with a pipe. State
+only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
+tool may use a blocked credential and fail by design.
+
+Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
+`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
+own pull request against `main`. Never merge.
+
+Your handoff must name the pull request or why it was not created, the branch, the
+files changed, the build result, and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/hunter.md

@@ -0,0 +1,23 @@
+---
+name: hunter
+description: Sweep one assigned scope for defects and report ranked findings without changes.
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You sweep the assigned package or scope for real defects. Read the full assigned scope before you
+judge it. Report several ranked findings when the evidence supports them. Change nothing: do not
+edit code, commit, push, or open a pull request.
+
+You may run the build or tests to check a finding. Read the complete output and report the real
+result. Do not hide failures with a pipe. State only checks you actually ran. The primary's IDE
+tools are not yours. A mounted forge tool may use a blocked credential and fail by design.
+
+Do only the assigned scope. Note anything outside it in one line and do not investigate it further.
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an unclear requirement
+or two defensible fixes. Do not ask about something you can decide by reading more code.
+
+Your handoff must name the files you read, each ranked finding or `NO FINDINGS`, the checks you ran,
+and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/reviewer.md

@@ -0,0 +1,34 @@
+---
+name: reviewer
+description: Review one assigned scope and report the most important real issue.
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You review the diff you were given. Report bugs, risks, and missing tests. You do
+not change code.
+
+Read the whole assigned scope before judging it. Review only that scope. If you see
+something outside it, note it in one line and do not investigate it further. Do not
+run the build. The owner makes changes and runs checks.
+
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
+unclear requirement or two defensible fixes. Do not ask about something you can
+decide by reading more code.
+
+Report the single most important real issue in this form:
+
+```
+1. <path>:<line>
+2. issue: <one sentence: what is wrong and why it matters>
+3. fix: <one line: the concrete change>
+4. severity: high | medium | low
+```
+
+If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
+is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
+or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
+risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
+with no current failure.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/skills/fleets-status/SKILL.md

@@ -0,0 +1,274 @@
+---
+name: fleets-status
+description: Report the status of every fleet that shares one LavinMQ instance. Use for local daemon health, broker-wide fleet presence, and cross-host lead coordination checks.
+---
+
+# Status of every fleet on the shared LavinMQ instance
+
+**The headline: always report what is missing.** This skill starts with the local fleet, then adds
+broker-wide facts when its read-only credential exists. A missing fleet must appear as `unknown` or
+`not reachable`, with the reason and the fix. Never leave it out.
+
+The known topology has one LavinMQ instance on `10.10.20.13` (`fleet01`). AMQP uses port `5672`,
+and the management API uses port `15672`. The Mac fleet owns vhost `/mac`. The fleet01 fleet owns
+vhost `/fleet01`.
+
+## 1. Protect credentials before any probe
+
+**Hard rule — never print `LAVINMQ_URI`.** It is an AMQP URI with its password inline. It only
+resolves in a login shell because `${SHARED_ENV}/tools/secrets.sh` supplies it. A non-login shell
+can make every broker probe look empty.
+
+- Never run `echo "$LAVINMQ_URI"`.
+- Never put `${LAVINMQ_URI:-something}` in output. That form expands to the secret value when set.
+- Parse the user, host, and password into shell or Python variables. Use them without printing them.
+- Prefer `resolves` or `does not resolve` over any part of the value.
+- Every command that can read `LAVINMQ_URI` must send all output through this redaction before it
+  reaches the report:
+
+```bash
+sed -E 's#://[^@]*@#://<redacted>@#g'
+```
+
+**The `g` flag is not optional.** Without it `sed` replaces only the first match on each line, so a
+line carrying two URIs leaks the second one. `scripts/redeploy-fleetd.sh --check` prints lines like
+that. Checked on 2026-08-27: without `g`, `amqp://u1:p1@h1/mac and http://u2:p2@h2:15672/api`
+redacts the first pair and prints `u2:p2` in the clear.
+
+Keep `pipefail` on when applying that filter. Otherwise the filter can hide a failed probe. Apply
+the same no-print rule to the management password below, even though it is not in an AMQP URI.
+
+## 2. Tier 1 — this fleet (always run)
+
+Start here even when the broker tier is blocked. Work from the local fleetd checkout.
+
+First run the read-only deployment check. It already checks the daemon process, deployed jar versus
+the checkout `HEAD`, launchd state, and whether each configured token resolves in a login shell.
+Do not copy those checks into new shell code. The script reads `LAVINMQ_URI`, so redact all output:
+
+```bash
+set -o pipefail
+scripts/redeploy-fleetd.sh --check 2>&1 \
+  | sed -E 's#://[^@]*@#://<redacted>@#g'
+git rev-parse HEAD
+```
+
+Treat jar drift as a top-level warning. A merge is not a deployment. State the running jar result
+as `matches HEAD`, `drift`, or `unknown`; do not turn an unclear timestamp into a match.
+
+Report the process identifier (PID) and uptime too:
+
+```bash
+PIDS="$(pgrep -f 'target/fleetd.jar' || true)"
+if [ -z "$PIDS" ]; then
+  printf '%s\n' 'fleetd: not running'
+else
+  for PID in $PIDS; do
+    ps -p "$PID" -o pid=,etime=,lstart=,command=
+  done
+fi
+```
+
+Read the full health response. Keep the HTTP status because `503` means fleetd is running but herdr
+is not reachable. Report both `herdr.version` and `herdr.protocol` when present:
+
+```bash
+curl -sS --max-time 5 -w '\nHTTP %{http_code}\n' http://127.0.0.1:8765/healthz
+```
+
+Call `fleet_whoami`, then call `fleet_list`. Preserve its sections in the report:
+
+- `leads`, including which row is this lead;
+- `members`, including state, role, profile, branch, and worktree when present;
+- every per-profile `capacity` row, including `maxLoad`, `live`, `free`, and quarantine facts;
+- the exact `healthCoverage` value.
+
+Do not describe an empty `members` list as an empty fleet. It says only that no members are spawned.
+Also do not hide a profile with `free: 0`; say whether load or credential quarantine caused it.
+
+Show only WARN, ERROR, and SEVERE lines after the last `fleetd listening` line. This anchor stops an
+old incident from looking current:
+
+```bash
+python3 - <<'PY'
+from pathlib import Path
+import re
+
+path = Path("fleetd/fleetd.out")
+if not path.exists():
+    print("cannot check current WARN/ERROR: fleetd/fleetd.out does not exist")
+else:
+    lines = path.read_text(errors="replace").splitlines()
+    starts = [i for i, line in enumerate(lines) if "fleetd listening" in line]
+    if not starts:
+        print("cannot anchor WARN/ERROR: no 'fleetd listening' line exists")
+    else:
+        current = lines[starts[-1]:]
+        alerts = [line for line in current if re.search(r"\b(?:WARN|ERROR|SEVERE)\b", line)]
+        print(f"current WARN/ERROR/SEVERE count: {len(alerts)}")
+        for line in alerts[-50:]:
+            print(line)
+PY
+```
+
+**What this tier cannot see:** it proves facts only about the Mac daemon at `127.0.0.1:8765`.
+It cannot show the fleet01 daemon, broker queue depth, or broker consumers. The fleet01 REST service
+at `10.10.20.13:8765` is not reachable from the Mac. Say this in the report rather than omitting
+fleet01.
+
+**But fleet01 IS reachable over SSH — checked 2026-08-28.** An older version of this line said SSH
+was denied. That is true only for the user `dai.ha`. The host alias `fleet01` maps to user `ltms`,
+and `ssh fleet01` works with key auth:
+
+```bash
+ssh -o BatchMode=yes -o ConnectTimeout=6 fleet01 'echo $(id -un)@$(hostname)'
+```
+
+So fleet01's daemon PID, uptime, jar and `/healthz` **can** be reported — over SSH, not over REST.
+Do that rather than writing `not reachable`. `ltms` also has passwordless sudo there.
+
+## 3. Tier 2 — the shared broker (run when management access exists)
+
+**This tier is blocked today.** The AMQP user in `LAVINMQ_URI` can connect on port `5672`, but gets
+HTTP `401` from the management API on port `15672`. An AMQP connection does not grant monitoring
+access.
+
+The operator must create a separate, read-only LavinMQ management user with the `monitoring` tag.
+It needs access to inspect both `/mac` and `/fleet01`. Store its values as
+`LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD` in
+`${SHARED_ENV}/tools/secrets.sh`. Do not reuse or print the AMQP URI. Full multi-fleet status stays
+blocked until this user exists.
+
+When both variables resolve, run this from a login shell. It calls `GET /api/overview`,
+`GET /api/vhosts`, `GET /api/queues`, and `GET /api/connections`. It prints selected status fields,
+but never the user, password, Authorization header, or AMQP URI:
+
+```bash
+zsh -lc 'python3 - "$@"' -- <<'PY'
+import base64
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+
+base = "http://10.10.20.13:15672"
+user = os.environ.get("LAVINMQ_MANAGEMENT_USER", "")
+password = os.environ.get("LAVINMQ_MANAGEMENT_PASSWORD", "")
+if not user or not password:
+    print("broker tier: BLOCKED — management credential does not resolve in a login shell")
+    sys.exit(0)
+
+token = base64.b64encode(f"{user}:{password}".encode()).decode()
+
+def get(path):
+    request = urllib.request.Request(
+        base + path,
+        headers={"Authorization": "Basic " + token, "Accept": "application/json"},
+    )
+    with urllib.request.urlopen(request, timeout=5) as response:
+        return json.load(response)
+
+try:
+    overview = get("/api/overview")
+    vhosts = get("/api/vhosts")
+    queues = get("/api/queues")
+    connections = get("/api/connections")
+except urllib.error.HTTPError as error:
+    print(f"broker tier: BLOCKED — management API returned HTTP {error.code}")
+    sys.exit(0)
+except Exception as error:
+    print(f"broker tier: BLOCKED — management API is not reachable: {type(error).__name__}")
+    sys.exit(0)
+
+fleet_names = {"/mac": "Mac fleet", "/fleet01": "fleet01 fleet"}
+print(json.dumps({
+    "overview": {
+        "lavinmq_version": overview.get("lavinmq_version"),
+        "rabbitmq_version": overview.get("rabbitmq_version"),
+        "queue_totals": overview.get("queue_totals", {}),
+        "object_totals": overview.get("object_totals", {}),
+    },
+    "fleets": [
+        {
+            "fleet": fleet_names.get(vhost.get("name"), "UNKNOWN FLEET"),
+            "vhost": vhost.get("name"),
+            "queues": [
+                {
+                    "name": queue.get("name"),
+                    "messages": queue.get("messages", 0),
+                    "messages_ready": queue.get("messages_ready", 0),
+                    "messages_unacknowledged": queue.get("messages_unacknowledged", 0),
+                    "consumers": queue.get("consumers", 0),
+                }
+                for queue in queues if queue.get("vhost") == vhost.get("name")
+            ],
+            "connections": [
+                {
+                    "name": connection.get("name"),
+                    "peer_host": connection.get("peer_host"),
+                    "state": connection.get("state"),
+                }
+                for connection in connections if connection.get("vhost") == vhost.get("name")
+            ],
+        }
+        for vhost in vhosts
+    ],
+}, indent=2, sort_keys=True))
+PY
+```
+
+Map `/mac` to the Mac fleet and `/fleet01` to the fleet01 fleet. Keep any other vhost in the
+report as `UNKNOWN FLEET`; do not drop it. For each vhost, total the ready, unacknowledged, and all
+messages. Report every queue's consumer count and each live connection.
+
+**A vhost with queues but zero consumers means that fleet's daemon is down while its durable state
+survives. Call this out as a top-level warning.** This is the main reason to use the management API
+instead of calling each remote daemon.
+
+**What this tier cannot see:** without the new `monitoring` credential it cannot enumerate any
+vhost, queue, depth, consumer, or connection. With the credential it still cannot report fleet01's
+daemon PID, uptime, jar revision, `/healthz`, herdr version, or member capacity. Those need reachable
+fleet01 REST or SSH access, which the Mac does not have today.
+
+## 4. Tier 3 — cross-fleet lead coordination
+
+Use the queue data from Tier 2. Select queues whose names match `lead.<coordId>.inbox`. Report each
+queue's vhost, depth, consumer count, and the `coordId` between the prefix and suffix.
+
+- A lead inbox with a consumer shows that a lead mailbox is live on that vhost.
+- A durable lead inbox with zero consumers shows saved coordination state, but no live receiver.
+- No lead inbox is not proof that coordination is disabled. The daemon may be down before declaring
+  its queue, or this account may not be allowed to see the vhost.
+
+This Mac fleet currently sets both `broker.uriEnv` and `coordinator.uriEnv` to the same variable,
+`LAVINMQ_URI`. Therefore its coordinator connects to `/mac`. Cross-host `fleet_send{coordId}` routes
+only when both leads share the same coordinator vhost. If the fleet01 lead uses `/fleet01` for its
+coordinator, the leads cannot see each other and the send will not route.
+
+**Open question:** the fleet01 coordinator vhost has not been checked. Surface this question in
+every report until a live `lead.<coordId>.inbox` consumer or fleet01's config proves the answer. Do
+not claim that fleet01 uses `/fleet01` just because its member queues do.
+
+Also compare these broker facts with the `leads` rows from local `fleet_list`. A missing remote lead
+is `not visible from this coordinator`, not `down`, unless the broker consumer facts prove it.
+
+**What this tier cannot see:** without Tier 2 management access it cannot list lead inboxes or their
+consumers. Even with that access, a stopped fleet01 daemon leaves only durable queue history. That
+history cannot prove which coordinator URI its current config would use after restart.
+
+## 5. Report all fleets
+
+Use one row per known or discovered fleet. Include blocked rows.
+
+| Fleet | Daemon | Deployment | Herdr | Members/capacity | Queues/consumers | Lead coordination | Cannot check |
+|---|---|---|---|---|---|---|---|
+| Mac (`/mac`) | PID + uptime | jar vs `HEAD` | health + version + protocol | `fleet_list` + `healthCoverage` | facts or blocked reason | inbox facts or open question | exact missing facts |
+| fleet01 (`/fleet01`) | reachable/down/unknown | value or `not reachable` | value or `not reachable` | value or `not reachable` | facts or blocked reason | inbox facts plus coordinator-vhost question | exact missing facts and fix |
+
+Add rows for unknown vhosts. End with three short sections: `Current warnings`, `Checks that were
+blocked`, and `Operator action`. Until the management user exists, `Operator action` must say:
+
+> Create a read-only LavinMQ management user with the `monitoring` tag and access to `/mac` and
+> `/fleet01`. Put its user and password in `${SHARED_ENV}/tools/secrets.sh` as
+> `LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD`.

.claude/skills/handover/SKILL.md

@@ -0,0 +1,266 @@
+---
+name: handover
+description: Procedure for an outgoing lead to write the handover file that a fresh lead session inherits. Load this when your context is filling up and you are about to be replaced, whether you hand off by hand or fleetd does it for you. The file is the new lead's only inheritance — follow it exactly.
+---
+
+# Handover — write the file the next lead depends on
+
+A lead session fills up its context and has to be replaced by a fresh one. The outgoing lead
+writes a handover file, and the new session reads that file and carries on.
+
+**There are two ways to hand off, and the file is the same either way.**
+
+- **By hand.** You write the file, then tell the operator where it is. The operator starts the new
+  session and points it at the file. This always works.
+- **With `fleet_handover`** (fleetd #480, merged 2026-09-11). You ask fleetd to do the swap: it
+  checks the file, clears your pane, and tells the fresh session to read it. This needs
+  `leadRollover:` in `fleetd.yaml`; without it every action answers a clean refusal naming
+  `NOT_CONFIGURED`, and you fall back to the manual path. Section 11 below is the procedure.
+
+Nothing else in this skill changes between the two. Only who performs the swap changes.
+
+**The new lead's only inheritance is that file.** It does not see your conversation, your plan,
+or your screen. If the file is thin or wrong, the new lead re-derives what you already knew, and
+that wastes hours. Writing a good handover file is real work. It is not paperwork you rush
+through at the end of a session.
+
+This skill is the procedure for writing it. Every rule below earned its place because a past
+handover got it wrong.
+
+## 1. Confirm you are the right session to write this
+
+Run `fleet_whoami` first. It must answer `primary`. Only a primary (lead) session writes a
+handover file. A worker's job ends with its own pull request, not a fleet-wide handoff.
+
+## 2. Every number needs a command, run in this turn
+
+A number is a claim: a count, a commit hash, a process id, a percentage, a queue depth. Before
+you write one, run the command that produces it — now, in this turn, against the live state.
+
+Never take a number from:
+
+- earlier in your own conversation — the state has moved since then,
+- a peer lead's report — that is their measurement, not yours,
+- your own memory of an earlier session.
+
+Put the command, or its real output, next to the number. That lets the next lead re-run it and
+check it still matches. If you cannot measure something yourself, say so instead of guessing:
+"the fleet01 lead reports 91 commits behind; I have not checked this myself."
+
+## 3. Say what you measured and what you did not
+
+Mark every claim as one of two things:
+
+- **"I checked this myself, in the code or on this host, at `<time>`."**
+- **"I did not check this myself; `<who>` reported it."**
+
+Never present someone else's measurement as your own. This matters most for cross-host claims —
+a peer lead's daemon, a worker's report, or something the operator said earlier that you cannot
+re-verify from here.
+
+## 4. Record open decisions, and who owns them
+
+List three things:
+
+- what the operator actually asked for, in their own words where you have them,
+- what is still unanswered,
+- any question you decided yourself instead of asking, with your reason.
+
+Write the decision so it cannot be mistaken for the operator's instruction. Say plainly: "the
+operator never answered X; I decided Y, because Z." Without this, the next lead either silently
+reopens a closed question or assumes the operator chose something they never did.
+
+## 5. Record live hazards
+
+List anything that will break if the next lead does the obvious thing next. This includes:
+
+- unpushed commits or unmerged branches,
+- a build, a spawn, or a redeploy still running,
+- code merged to `main` but not yet redeployed to the live daemon,
+- any trap that looks safe and is not — say what goes wrong and why, not only that something is
+  "tricky."
+
+## 6. Record what is explicitly not owed
+
+List work that is finished, and work that another party has said they do not want touched. Name
+who said so and when. Without this line, the next lead re-does closed work or reopens a question
+a peer already declined to revisit.
+
+## 7. Open the file with three re-measurement commands
+
+The file's own first section must give the next lead three concrete commands to run before
+acting on anything else in the file:
+
+1. confirm role — for example `fleet_whoami`,
+2. confirm the state of the working tree — for example `git status` and
+   `git rev-list origin/main..HEAD`,
+3. read the live fleet — for example `fleet_list`.
+
+Record what each command answered when you wrote the file, and tell the reader to run it again
+rather than trust your answer. The point of this section is that the reader checks live state
+before acting on any claim in the rest of the file, including yours.
+
+## 8. Stamp the file with time and commit
+
+Near the top of the file, write:
+
+- the date and time you wrote it,
+- the commit the tree was on (`git rev-parse HEAD`),
+- whether the tree was clean (`git status`).
+
+Without this, nobody can tell how old the file is, or which code it describes.
+
+## 9. State plainly that the file goes stale fast
+
+Say near the top: **re-measure anything you act on.** The file goes stale the moment anyone
+merges a branch, spawns a member, or restarts the daemon. Everything in the file is a snapshot
+of one moment, not a live fact.
+
+## 10. What to leave out
+
+Do not include:
+
+- narration of how the session felt, or how hard something was,
+- anything the repo already records — code structure, git history, or a rule already written in
+  `CLAUDE.md`. Point at it instead of repeating it,
+- advice that is only true for the session that is ending — a half-open terminal, a local
+  variable, a train of thought with no state behind it.
+
+A handover file is a record of state and decisions. It is not a diary.
+
+## 11. Using `fleet_handover` (only if `leadRollover:` is configured)
+
+**Run the three steps in this order. The order is not a style choice — the wrong order is
+refused.**
+
+1. **`fleet_handover{action: "open", reason: "<why now>"}`.** It returns a `token` and the
+   `handoverPath` you must write to. Nothing has happened to your pane yet.
+
+   **Write to exactly that path, and do not resolve it yourself.** It is always absolute, even when
+   the operator configured a relative `handoverPath`: fleetd resolves a relative one against your
+   own workspace before it hands it to you. The daemon and your pane can run in different
+   directories, so a path you resolve yourself can point at a different file from the one the daemon
+   will check.
+
+   **Check that the path is ignored by git before you write to it (#491).** A relative
+   `handoverPath` resolves inside YOUR workspace, which is usually a repository — and usually not
+   the `fleetd` one, so an ignore rule added to `fleetd` does not protect it. Run
+   `grep -n handover <your workspace>/.gitignore`. No output means the file you are about to write
+   will show up as untracked content in that repo. The file is a snapshot of live state and must
+   never be committed, so tell the operator rather than committing it or silently editing their
+   `.gitignore`.
+2. **Write the handover file at that path**, following sections 1–10 above.
+3. **Ask the operator, then `fleet_handover{action: "confirm", token, operatorConfirmed: true}`.**
+
+Why that order: `confirm` refuses with `HANDOVER_STALE` unless the file was modified **after** the
+`open` request. That check stops a leftover file from an earlier session being accepted as this
+one's handover. So writing the file first and then calling `open` — the obvious order — always
+fails.
+
+`{action: "cancel", token}` drops a pending request without rolling.
+
+**Things that will surprise you:**
+
+- **`accepted` does not mean your pane has been cleared.** It means every gate passed and the roll
+  is scheduled to run once your current turn ends. Say your goodbye in the same turn — you will not
+  get another one.
+- **There is no terminal or session parameter, on purpose.** The pane is always your own, resolved
+  from your connection, so you can only ever roll yourself.
+- **`operatorConfirmed` is your report of what a human told you.** Do not pass `true` because you
+  are confident. Ask, wait for the answer, then pass what they said.
+
+- **Whether you must ask at all depends on `leadRollover.requireOperatorConfirm`. Check it; do not
+  assume.** The default is `true` (`FleetConfig.java:1426`), and then `confirm` refuses unless you
+  also pass `operatorConfirmed: true`. **This host set it to `false` on 2026-09-22**, on the
+  operator's explicit grant, because they do not want to approve routine context rolls. Where it is
+  `false`, the three handover-file checks are the whole gate: the file must exist, be fresher than
+  `maxDocAgeSeconds`, and have been modified after the open request.
+
+  Read the live value rather than trusting this line:
+
+  ```bash
+  grep -A1 'requireOperatorConfirm' fleetd/fleetd.yaml
+  ```
+
+  No match means the key is unset, so the default `true` applies and you must ask. The key is
+  **deferred, not hot** — it is read once at boot, so an edit does nothing until the daemon is
+  redeployed.
+
+  **Until fleetd #621 merges, the nudge text will tell you to ask the operator even where the
+  daemon no longer requires it.** `LeadHeartbeatLoop.contextNotice()` hardcodes "ask the operator"
+  and takes no config, so it cannot know. Trust the config value over the nudge text. Once #621 is
+  merged and deployed, the nudge matches the config and this warning can be deleted.
+
+- **The roll can still refuse after `confirm` returns**, and by then there is no caller to tell.
+  Those outcomes are logged only, as `lead-rollover:` lines in the daemon log.
+- **The bootstrap prompt works end to end. Measured 2026-09-22.** This used to say the fix was
+  unproven (fleetd #489) and told you to expect a failure. That is no longer true. The daemon log
+  now holds four `lead-rollover: rolled` lines, and three of them ran on 2026-09-22 at 10:01:43,
+  10:38:28 and 11:15:47. Each one cleared the old lead and started a fresh session against the
+  handover file, with the configured `bootstrapText` arriving as its first message. No context was
+  lost. The old `Unknown command: /clearFresh` failure from 2026-09-12 does not appear in the log
+  at all. Re-measure both numbers with:
+
+  ```bash
+  grep -c "lead-rollover: rolled" fleetd/fleetd.out   # successful rolls
+  grep -c "lead-rollover:" fleetd/fleetd.out          # positive control: must be larger
+  grep -c "Unknown command" fleetd/fleetd.out         # the old failure: expect 0
+  ```
+
+  Run the control line too. A broken pattern returns a clean `0` that reads exactly like good news.
+  If the first number stops growing across rolls, or `Unknown command` returns anything above 0,
+  the bootstrap has regressed and this paragraph is stale again.
+
+  **You still write the file before you confirm, and never the other way round.** That order is not
+  about the bootstrap being unreliable. It is what the daemon checks: the handover file must have
+  been modified *after* the open request, or `confirm` refuses it as stale.
+
+- **One warning in the log is normal and is not a failure.** Every one of the three rolls above also
+  logged `/clear on term_… was never observed as WORKING after 8 consecutive IDLE/DONE polls —
+  releasing rather than wedging the roll`. The daemon could not see the pane go WORKING after
+  `/clear`, so it released instead of hanging. The roll then succeeded anyway. That is the safe
+  branch behaving correctly. Do not report it as a broken roll.
+
+## Writing style
+
+Write in plain English. Use everyday words, one idea per sentence, and active voice. Keep every
+class, method, file, flag, and config key exactly as it appears in the code — replacing a
+precise term with a vague one makes the sentence wrong, not simpler. Explain an abbreviation the
+first time you use it.
+
+If a diagram genuinely helps, put it in the `.md` file as a fenced ` ```mermaid ` block with no
+hardcoded colors, so it stays readable on light and dark backgrounds. Quote any label that has
+brackets, colons, or slashes.
+
+## Template
+
+```markdown
+# Handover — <fleet name> lead session, <date and time>
+
+Written at commit `<output of git rev-parse HEAD>`. Tree was <clean, or dirty: `<git status
+summary>`>. Re-measure anything you act on — this file goes stale the moment anyone merges,
+spawns, or restarts.
+
+## 0. Do these three things first
+
+1. Confirm your role: `fleet_whoami` — must answer `primary`. (Answered `<result>` at `<time>`.)
+2. Confirm tree state: `git status`, `git rev-list origin/main..HEAD`. (`<result>` at `<time>`.)
+3. Read the live fleet: `fleet_list`. (`<result>` at `<time>`.)
+
+## 1. What the operator asked for
+
+<the live instructions, in their words where you have them; what is still open; any decision
+you made yourself, and why>
+
+## 2. Open decisions, and who owns them
+
+<one line per decision: who owns it, what is unanswered>
+
+## 3. Live hazards
+
+<one entry per hazard: what breaks, and why, if the next lead does the obvious thing>
+
+## 4. What is not owed
+
+<finished work, and work another party has declined; name who said so and when>
+```

.claude/skills/hunter/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: hunter
+description: Defect-hunt procedure for a fleetd worker — sweep an assigned package for real bugs and report several ranked findings without fixing anything. Load this when the lead asks you to hunt or audit a scope rather than review one diff. Do NOT load `reviewer` for this; the two want different output.
+---
+
+# Hunter worker — procedure
+
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
+never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies.
+
+**This skill is not `reviewer`.** `reviewer` judges one diff and reports the *single* most
+important issue in about 90 words. A hunt sweeps a whole package and reports *several* findings
+in a long structured form. Loading both gives you two contradictory output contracts, and the
+usual result is a worker that writes a good report into its terminal and ends the turn without
+sending it. Load exactly one.
+
+## 0. Read this before you read code: how the report gets home
+
+Your terminal reaches nobody. The lead sees **only** the text inside your `fleet_reply` call.
+
+A long report is exactly the case where this goes wrong, so plan for it:
+
+- **Write the report into the `fleet_reply` argument itself.** Do not compose it in your terminal
+  and then summarise it into the call.
+- If the report is long, **send it anyway** — one `fleet_reply` with everything.
+- If you end the turn without replying, the bridge scrapes your pane instead. That scrape carries
+  at most the last 4000 characters, and on a hunt it usually captures the tail of the lead's own
+  brief rather than your findings. The lead then has nothing and has to ask you again.
+
+## 1. Change nothing
+
+A hunt is read-only. Do not edit a production file, do not "quickly fix" what you find, and do
+not run a formatter. You may run the build and tests to *check* a claim, and you should say so
+when you did.
+
+## 2. Read the whole scope first
+
+Read every file in the assigned package before you judge any of it. A defect that a caller
+elsewhere in the same package makes unreachable is not a defect, and you cannot know that from
+one file.
+
+Stay inside the scope. If a defect there depends on a class outside it, read that class to
+confirm — but the defect itself must live in the scope you were given.
+
+## 3. The bar — this matters more than the count
+
+**Name the path into the bad state.** Say which caller, in which state, reaches it. A defect on
+paper is not a reachable defect. If you cannot name that path, keep the finding but mark it
+`unproven` and say exactly what you could not check. Do not drop it, and do not dress it up.
+
+**Say which direction the harm goes.** Data loss, privilege escalation and silent wrong answers
+are worth reporting even when the window is narrow. A finding whose worst outcome is a worse log
+line is not worth a block.
+
+Two workers once ran the same scope: the one that applied the direction-of-harm filter found ten
+real defects, the one that did not found none. Fewer findings the lead can act on beat many the
+lead has to triage.
+
+## 4. Shapes that have produced real merged fixes here
+
+Read for these first:
+
+1. **A one-way gate.** A guard added after an incident closes only the direction that incident
+   came from. Do not only ask what closes the gate — ask **which states still open it**.
+2. **A value read once, then used later to authorise something destructive**, after something
+   else has had a chance to change it.
+3. **A failure downgraded to a value that looks like a legitimate result** — `-1`, `null`, an
+   empty list, `false` — which a caller then trusts.
+4. **A lock held for one half of a read-modify-write and not the other**, or two collections
+   updated under different locks.
+5. **A comment or javadoc stating an invariant the code no longer keeps.** Comments are
+   load-bearing in this repo; a stale one has already caused a bug.
+
+## 5. What you cannot check, and must not claim you did
+
+- `fleetd/fleetd.yaml` is gitignored and **absent from your worktree**. You cannot read it. If a
+  finding depends on live configuration, name the key and say you could not check it.
+- `.mcp.json`, `opencode.json` and `.autoenv` in your worktree are neutralised stubs, not the
+  repo's real files.
+- The `wiki/` submodule pointer is months old. Do not cite it.
+
+Reporting a fact you took from the lead's brief as something you measured yourself is a false
+report, even when the fact is correct. Say where each fact came from.
+
+## 6. The report — what goes in `fleet_reply`
+
+One block per finding, most severe first:
+
+```
+FINDING N — <one line>
+file:line
+Path in:        <which caller, in which state, reaches this>
+Direction:      <data loss | escalation | silent wrong answer | outage | ...>
+Window/trigger: <when it actually happens>
+Confidence:     <confirmed by reading | unproven — say what you could not check>
+Why nothing else catches it: <the guard or test you checked, and why it misses>
+```
+
+End with one line naming every file you read, so the lead knows the denominator.
+
+**Nothing clears the bar?** Reply `NO FINDINGS`, name the files you read, and say what you ruled
+out. A clean sweep is a valid result; an invented defect is worse than none.

.claude/skills/implementer/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: implementer
-description: Implementer-role procedure for a bridged worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over bridged.
+description: Implementer-role procedure for a fleetd worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over fleetd.
 ---
 
 # Implementer worker — procedure
 
-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge, never commit `.mcp.json` or `wiki/`) is in **`CLAUDE.md` → Bridge communication →
 Worker** and already applies. This skill is only the *implement-and-hand-off procedure*.
 
@@ -39,6 +39,19 @@ a worker made all 59 of its edits in the primary's tree and never noticed.
 test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-toplevel)"
 ```
 
+**Never run `git stash` (or `git stash pop`/`apply`/`drop`).** Your worktree is isolated, but the
+stash is **not**: `refs/stash` is one stack shared by the primary's checkout and every other
+worker's worktree of this repo. Measured on 2026-09-04 — `git stash list` from a worker's worktree
+and from the primary's tree returned byte-identical output. So a `git stash` you run can be popped
+into someone else's tree, and a `git stash pop` you run can drop **another worker's** uncommitted
+edits on top of yours. This has already happened here: two workers were running in parallel and one
+of them had its in-progress edit silently overwritten by the other's stash.
+
+The branch is your isolation, so use it instead. To set work aside, commit it on your own branch
+(`git commit -m "wip: ..."`) and carry on; to try something and back out, use
+`git diff > /tmp/<your-branch>.patch` then `git checkout -- <file>`. Both stay inside your worktree.
+If you find a stash entry you did not create, leave it alone and say so in your report.
+
 ## 2. Implement
 
 - Implement exactly the scope the lead named. Keep the diff focused; note anything out of scope
@@ -49,7 +62,7 @@ test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-t
 your worktree*:
 
 ```bash
-cd "$(git rev-parse --show-toplevel)/bridged" && mvn clean install
+cd "$(git rev-parse --show-toplevel)/fleetd" && mvn clean install
 echo "exit=$?"
 ```
 
@@ -85,7 +98,7 @@ host (`GITEA_HOST`) into your env for exactly this — the token can create a PR
 merge**.
 
 ```bash
-API="${GITEA_HOST%/}/api/v1/repos/lms/claude-bridge/pulls"
+API="${GITEA_HOST%/}/api/v1/repos/fleet/fleetd/pulls"
 BRANCH="$(git branch --show-current)"
 curl -sS -X POST "$API" \
   -H "Authorization: token ${GITEA_TOKEN}" \
@@ -103,7 +116,7 @@ fix it if the cause is yours (e.g. branch not pushed yet), and report the failur
 inventing a URL. If `GITEA_TOKEN` is unset your profile was not granted PR-create: push the branch
 and report its name so the lead opens the PR.
 
-## 6. Hand off — what goes in `bridge_reply`
+## 6. Hand off — what goes in `fleet_reply`
 
 The reply is the entire handoff; the lead cannot see your terminal.
 
@@ -130,7 +143,7 @@ sequenceDiagram
     I->>G: git push -u origin HEAD
     I->>G: POST /pulls (GITEA_TOKEN) — open PR to main
     G-->>I: html_url
-    I->>L: bridge_reply(PR url, branch, files, tests)
+    I->>L: fleet_reply(PR url, branch, files, tests)
     Note over L,G: the lead reviews the PR and merges on green — you never merge
 ```
 

.claude/skills/port-to-opencode/SKILL.md

@@ -53,7 +53,7 @@ Map each entry from `.mcp.json`:
   "$schema": "https://opencode.ai/config.json",
   "instructions": ["CLAUDE.md"],
   "mcp": {
-    "bridged":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
+    "fleetd":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
     "context7": { "type": "remote", "url": "https://example.dev/mcp", "enabled": true,
                   "headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" } },
     "gitea":    { "type": "local", "command": ["gitea-mcp", "-t", "stdio"], "enabled": true,
@@ -92,24 +92,32 @@ route by who launches opencode:
 
 | Launcher | Route |
 |---|---|
-| a human, from a terminal | `{file:…}` — see below |
+| a human, from a terminal | one central store, sourced by the login shell |
 | a spawner (bridge, CI, IDE) | `{env:…}`, with the spawner injecting the variable |
 
-For the human case prefer **`{file:…}` with a workspace-relative path**, kept in a gitignored
-`.secrets/` directory beside `opencode.json`:
+**For the human case, keep every credential in one file the login shell sources.** Here that file
+is `${SHARED_ENV}/tools/secrets.sh`, sourced from `${SHARED_ENV}/.ltms`, kept at mode 600 and never
+committed. `opencode.json` then names variables and holds no values:
 
 ```json
-"headers": { "Authorization": "Bearer {file:.secrets/api-token}" }
+"headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" }
 ```
 
-Verified: opencode resolves relative `{file:}` paths against the project root, so this needs no
-shell setup at all — no rc export leaking the secret to every process, no direnv dependency.
+Both routes end at the same syntax, and that is the point. The file does not change when a human
+launches opencode instead of the bridge.
 
-**The catch, and state it out loud:** `.secrets/` is gitignored, so a peer running in a git worktree
-does **not** get it — worktrees receive tracked files only, the same rule that makes `opencode.json`
-itself worth committing. Spawned peers must therefore be fed through `{env:…}` by whatever launches
-them. Check the variable *names* match: a spawner often injects under a different name than your
-shell uses, and the config has no fallback.
+**`{file:…}` also works, and this project moved away from it.** Opencode resolves a relative
+`{file:}` path against the project root, so a gitignored `.secrets/` beside `opencode.json` needs no
+shell setup at all. It did not fail; the problem is that it makes a second copy of the token. The
+same secret then lives in two places, and the copy you forget is the one that leaks or goes stale.
+One store with many references is easier to rotate and to audit.
+
+**One catch survives either choice, so state it out loud:** what a human's shell exports does not
+reach a spawned peer, and neither does a gitignored `.secrets/` — a git worktree receives tracked
+files only. Spawned peers must be fed through `{env:…}` by whatever launches them. Check the
+variable *names* match: a spawner often injects under a different name than your shell uses, and
+the config has no fallback. In this repo the bridge goes further: it neutralizes a worktree's
+`opencode.json`, so a member cannot inherit the primary's credentials by accident.
 
 ## 4. Do not port machine-local MCP servers
 

.claude/skills/redeploy-fleetd/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: redeploy-fleetd
+description: Rebuild and restart the live fleetd daemon after a merge (lead / primary only). Load this before redeploying — it holds the script, the drain step, the permission grant, and the five checks that have each gone wrong here before. Workers must never do this.
+---
+
+### Redeploying the daemon — the lead may do this (primary only)
+
+**A merge is not a deployment.** The running `fleetd` holds the jar it was started with, so a
+feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
+about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
+rather than hand the job back to the operator.
+
+Workers must never do this. A worker has no business restarting the daemon it is talking through,
+and stopping it kills the worker's own channel mid-turn.
+
+**Use the script — do not hand-roll the steps.**
+
+```bash
+scripts/redeploy-fleetd.sh --check   # report state, change nothing
+scripts/redeploy-fleetd.sh           # build, confirm drain, restart, verify
+scripts/redeploy-fleetd.sh --yes     # skip the drain prompt (fleet already checked)
+scripts/redeploy-fleetd.sh --no-build # restart the jar already on disk
+```
+
+`--no-build` skips the build and restarts whatever jar is at `fleetd/target/fleetd.jar`. Use it only
+when you just built and nothing changed since. It gives up the protection in the next paragraph: no
+build runs, so a stale or missing jar is not caught early. The script still checks the file is there
+and dies with `no jar at … — run without --no-build` if it is not, but it cannot tell you the jar is
+old. A `mvn clean` in the tree deletes that jar while the daemon keeps running on it, and nothing
+degrades until the next restart. Run `--check` first: it prints the jar's hash and its modification
+time, so you can see for yourself whether the jar is missing or older than the code you mean to ship.
+
+It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
+old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a
+line marker taken before the restart, so old errors cannot be misread as new ones. Run `--check`
+first — it is read-only and reports whether the forge token resolves, which nothing else tells you.
+
+The script encodes the five things below, each of which has gone wrong here before. Read them anyway:
+if the script is unavailable or a step fails, this is what it was protecting you from.
+
+1. **Login shell, or workers silently lose their forge token.** The daemon inherits
+   `WORKER_GITEA_TOKEN` from the shell that starts it, and that comes from
+   `${SHARED_ENV}/tools/secrets.sh`. Start it from a non-login shell and the variable is empty, the
+   daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
+   logs this at startup — the script's `--check` is the only thing that reports it, and it checks
+   whether the name resolves without ever printing the value.
+2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
+   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
+   rendezvous, and a member's report is not recoverable once its ticket is gone.
+3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
+   it. The startup log names which keys it accepted and which it deferred — read those lines rather
+   than assuming.
+4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
+   lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
+   demoted to worker, which refuses every orchestration call.
+5. **Prove the new jar is the one running.** Confirm a *fresh* `fleetd listening` line at the end of
+   `fleetd/fleetd.out`, dated after the restart. An old daemon that never died looks identical from
+   the outside.
+
+**Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
+refuses a bare `kill` on the daemon whatever this file says. The script is the seam that fixes that:
+it is one auditable command, so the operator allow-lists it once instead of approving a stop and a
+start every time. The rule lives in the operator's Claude Code settings:
+
+```json
+{ "permissions": { "allow": ["Bash(scripts/redeploy-fleetd.sh:*)"] } }
+```
+
+Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
+running the stop and start as separate commands — that is exactly the approval the script replaced.
+Say what you were going to run and why, and let the operator decide.
+

.claude/skills/reviewer/SKILL.md

@@ -1,15 +1,20 @@
 ---
 name: reviewer
-description: Reviewer-role procedure for a bridged worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over bridged.
+description: Reviewer-role procedure for a fleetd worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over fleetd.
 ---
 
 # Reviewer worker — procedure
 
-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies. This
 skill is only the *review procedure*: how to work the scope, and the exact shape of what you
 send back.
 
+**Wrong skill for a sweep.** This one reviews *one* diff or scope and reports the *single* most
+important issue. If the lead asked you to hunt or audit a whole package for several defects, load
+`hunter` instead and ignore this file — the two want different output, and following both is how a
+worker ends its turn with a good report that never gets sent.
+
 ## 1. Read the whole scope before you judge
 
 The delegation names your scope — a file, a diff, a PR, a function. **Read all of it first.**
@@ -24,13 +29,13 @@ wrong.
   covers what it was given.
 - Do **not** edit files or run the build. You review; the owner acts.
 
-## 3. Reach for `bridge_ask` only for a genuine fork
+## 3. Reach for `fleet_ask` only for a genuine fork
 
 Ambiguous requirement, a missing acceptance criterion, "intended or a bug?", or two defensible
 fixes with different consequences — those are the lead's call, and guessing produces a
 confident-but-wrong finding. Anything you could settle by reading more code is yours to settle.
 
-## 4. The finding — what goes in `bridge_reply`
+## 4. The finding — what goes in `fleet_reply`
 
 Report the **single most important** real issue in the scope, in these four lines, under
 ~90 words:

.gitea/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
       # does not depend on the wiki repo being reachable.
       - uses: actions/checkout@v4
 
-      # The runner image ships an older default-jdk; bridged sets maven.compiler.release=25, so
+      # The runner image ships an older default-jdk; fleetd sets maven.compiler.release=25, so
       # provision the JDK explicitly rather than apt-installing whatever "default" means today.
       - name: Set up JDK 25
         uses: actions/setup-java@v4
@@ -32,13 +32,17 @@ jobs:
           mvn -version
 
       - name: Build and test
-        working-directory: bridged
+        working-directory: fleetd
         # This IS the mock-socket surface CB-503 asks for: the pom's `default-excludes` profile
         # already sets excludedGroups=contract, so the @Tag("contract") tests — which need a live
         # herdr socket and a RabbitMQ container — are excluded without any flag here. Everything
         # that runs does so against the fake UDS herdr and fake ccs/claude stubs.
         run: mvn -B clean install
 
+      - name: javadoc reference lint
+        working-directory: fleetd
+        run: mvn -B -DskipTests javadoc:javadoc -Ddoclint=reference
+
       # Deliberately NOT actions/upload-artifact: this Gitea instance presents as GHES, and
       # @actions/artifact v2+ (i.e. upload-artifact@v4) refuses to run there —
       # "GHESNotSupportedError ... not currently supported on GHES", which red-Xes an otherwise
@@ -46,7 +50,7 @@ jobs:
       # the log instead, where they are actually readable.
       - name: Failing test output
         if: failure()
-        working-directory: bridged
+        working-directory: fleetd
         run: |
           for f in target/surefire-reports/*.txt; do
             [ -f "$f" ] || continue
@@ -54,12 +58,29 @@ jobs:
           done
           exit 0
 
+  # fleetd #550 — nothing ran scripts/test-redeploy-fleetd.sh in CI before this, on any platform,
+  # so it had run only on macOS by hand and two Linux-only bugs (this issue's items 1 and 2)
+  # survived undetected: shasum is a macOS-only tool (it ships with Perl; GNU coreutils, i.e. every
+  # mainstream Linux distro including this runner's ubuntu-latest, does not have it and ships
+  # sha256sum instead). The gate here is the step's own exit code, nothing else: a `run:` step in
+  # Gitea/GitHub Actions already fails the job on a non-zero exit with no extra scripting needed,
+  # so this deliberately does NOT grep the output for a `FAIL:` count. That is the #550 item-2
+  # lesson one level up — a suite that dies before it runs a single test prints zero FAIL lines,
+  # which is exactly what a clean pass also prints, so counting FAIL lines can never be the gate.
+  shell-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: redeploy-fleetd.sh shell suite
+        run: bash scripts/test-redeploy-fleetd.sh
+
   # CB-521 — actually run the AMQP contract test in CI, against a REAL broker. The broker is a
   # RabbitMQ SERVICE CONTAINER, not Testcontainers-with-Docker: the runner image has no Docker, so
   # AmqpReplyInboxContractTest reads AMQP_URI (set below to the service's network alias) and binds
   # straight to it — no Docker, no skipped tests. This separation (build job hermetic and
   # Docker-free; contract job broker-provided) is deliberate — see the default-excludes/contract
-  # profiles in bridged/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
+  # profiles in fleetd/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
   # exactly as in the build job above.
   contract:
     runs-on: ubuntu-latest
@@ -69,8 +90,6 @@ jobs:
         env:
           RABBITMQ_DEFAULT_USER: guest
           RABBITMQ_DEFAULT_PASS: guest
-        ports:
-          - 5672:5672
     env:
       # Service containers are reachable from the job by their network alias on their internal port.
       AMQP_URI: amqp://guest:guest@rabbitmq:5672
@@ -89,16 +108,22 @@ jobs:
           apt-get update && apt-get install -y --no-install-recommends maven
           mvn -version
 
-      # The `contract` profile clears the default-excludes group, so the @Tag("contract") AMQP test
-      # runs against the RabbitMQ service container (AMQP_URI). Pinned to the one contract test to
-      # avoid re-running the unit suite already covered by the `build` job.
+      # The `contract` profile clears the default-excludes group, so `-Dgroups=contract` runs every
+      # @Tag("contract") test and nothing from the unit suite the `build` job already covered — a
+      # tag selects the whole group, so a test added to it later runs here automatically. A prior
+      # version of this step pinned `-Dtest=AmqpReplyInboxContractTest` by class name instead: that
+      # silently excluded every other contract test (including the herdr ones) from CI, and nobody
+      # noticed until the herdr protocol drifted out from under a test that never ran here
+      # (fleetd #449). If this runner has no herdr socket, the herdr-backed tests in the group
+      # skip on their own `assumeTrue` and only the broker-backed ones actually run — check the
+      # step output rather than assuming which.
       - name: Contract tests
-        working-directory: bridged
-        run: mvn -B -Pcontract test -Dtest=AmqpReplyInboxContractTest
+        working-directory: fleetd
+        run: mvn -B -Pcontract test -Dgroups=contract
 
       - name: Failing test output
         if: failure()
-        working-directory: bridged
+        working-directory: fleetd
         run: |
           for f in target/surefire-reports/*.txt; do
             [ -f "$f" ] || continue

.gitignore

@@ -1,12 +1,27 @@
-# Workspace-scoped secrets for tools that read no settings cascade of their own
-# (opencode resolves these via {file:.secrets/...} in opencode.json).
+# No secret belongs in this repo any more: every credential lives in one shell-level store
+# (${SHARED_ENV}/tools/secrets.sh), and opencode.json reads it as {env:...}. This line stays as a
+# backstop, so a workspace-scoped copy that someone re-creates by habit still cannot be committed.
 .secrets/
 
 # Settings backups inherit the env block — and secrets with it.
 .claude/settings.local.json.bak*
 
-# Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
-# repo root and bridged/ collect one; neither belongs in git.
-bridged.out
-bridged/bridged.out
+# The default profile parityOverlay copies these primary→worktree, so they appear in EVERY worker
+# worktree. Two reasons they must be ignored. They hold environment values, which is reason enough.
+# And since CB-576 a release preserves any worktree that `git status --porcelain` calls dirty —
+# untracked files included, deliberately. An untracked overlay file would therefore make every
+# COMPLETED release preserve its worktree, and worktrees would pile up with no error to notice.
+.env
+.envrc
+
+# Daemon runtime artefacts. fleetd appends its log wherever it is launched from, so both the
+# repo root and fleetd/ collect one; neither belongs in git.
+fleetd.out
+fleetd/fleetd.out
 logs/
+
+# fleetd #480: the lead rollover handover file. `leadRollover.handoverPath` points here, and the
+# outgoing lead rewrites it on every rollover. It is a snapshot of one moment's live state —
+# unpushed branches, running builds, open questions — so it is stale the moment it is written and
+# has no business in git history.
+.handover/

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "wiki"]
 	path = wiki
-	url = ssh://git@git.ltms.dev:2224/lms/claude-bridge.wiki.git
+	url = ssh://git@git.ltms.dev:2224/fleet/fleetd.wiki.git

.opencode/agent/architect.md

@@ -0,0 +1,24 @@
+---
+description: Refine work into clear, independent units before implementation.
+mode: primary
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You are an architect in this fleet. You refine work before anyone builds it: scope,
+acceptance criteria, risks, and a unit split. You read the repo and write analysis.
+You never commit production code and never open a pull request.
+
+A design task is worked by two architects. Design alone first, then exchange and
+say plainly where you disagree. Do not concede just to agree.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Report only work you actually did and the real output of checks you ran. Do not
+claim a result from a tool you could not use. The primary's IDE tools are not yours.
+A mounted forge tool may use a blocked credential and fail by design.
+
+The launcher provides the required bridge reply instructions for every member.

.opencode/agent/dev.md

@@ -0,0 +1,29 @@
+---
+description: Implement one assigned unit, test it, and open a pull request.
+mode: primary
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You implement the one unit you were given and nothing else. Work in your assigned
+git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
+the worktree root and branch before you edit. Use only paths under that root.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Implement the change and run the full required build in your worktree. Read the
+complete output and report its real result. Do not hide failures with a pipe. State
+only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
+tool may use a blocked credential and fail by design.
+
+Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
+`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
+own pull request against `main`. Never merge.
+
+Your handoff must name the pull request or why it was not created, the branch, the
+files changed, the build result, and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.opencode/agent/reviewer.md

@@ -0,0 +1,34 @@
+---
+description: Review one assigned scope and report the most important real issue.
+mode: primary
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You review the diff you were given. Report bugs, risks, and missing tests. You do
+not change code.
+
+Read the whole assigned scope before judging it. Review only that scope. If you see
+something outside it, note it in one line and do not investigate it further. Do not
+run the build. The owner makes changes and runs checks.
+
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
+unclear requirement or two defensible fixes. Do not ask about something you can
+decide by reading more code.
+
+Report the single most important real issue in this form:
+
+```
+1. <path>:<line>
+2. issue: <one sentence: what is wrong and why it matters>
+3. fix: <one line: the concrete change>
+4. severity: high | medium | low
+```
+
+If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
+is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
+or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
+risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
+with no current failure.
+
+The launcher provides the required bridge reply instructions for every member.

CLAUDE.md

@@ -4,59 +4,72 @@
 
 > **Canonical block.** Everything down to §Layering is the portable bridge charter, copied verbatim
 > into every project that mounts the bridge MCP. Keep it byte-identical with the template in the
-> wiki ([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable
+> wiki ([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable
 > CLAUDE.md block*); improvements go to the template first, then out to each project. Anything
 > specific to *this* repo lives under §Project addendum below, never inline above it.
+>
+> **Anything you measure in an addendum is perishable.** Date it, give the command that
+> re-measures it and what each outcome means, and tell the reader to delete the section once
+> it stops reproducing. The four parts work together: deciding what would falsify a claim is
+> the expensive step, and a reader in the middle of another task will not pay it, so a bare
+> "verify before relying on this" costs the same space and does nothing. The case this is for
+> is a note that goes stale as a live restriction — it will tell a future session it cannot do
+> the thing at the moment doing it becomes the job.
 
-If no `bridge_*` MCP tools are mounted in this session, this section does not apply — skip it.
+If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.
 
-`bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
-**primary**) and every delegated peer (a **worker**) mount the *same* MCP server and talk only
-through its `bridge_*` tools. No session addresses a peer, a broker, or the network directly.
+`fleetd` is the **sole communication gateway** between agents here. The orchestrating session (the
+**primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
+through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.
 
 ### Which role am I? — settle this before acting
 
-**Both roles read this file.** A worker runs in a git worktree of this same repo, so it inherits
+**Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.
 
-**Call `bridge_whoami`.** It returns `{"role":"primary"}` or `{"role":"worker","sessionId":…,
-"profile":…,"worktree":…,"branch":…}`, resolved by the daemon from your connection — unforgeable,
-and the same resolution its authorization gate uses. Don't infer what you can ask.
+**Call `fleet_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
+your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
+carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
+was bound to. Don't infer what you can ask.
 
 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
-fires: the reply charter in your system prompt (*"You are an off-subscription worker in the
-claude-bridge fleet"*) ⇒ **worker**; bridge tools prefixed `mcp__bridge__*` ⇒ **worker** (the
-launcher fixes that mount name; a primary's mount is named by whoever wrote its `.mcp.json`, so it
-varies); `ANTHROPIC_BASE_URL` set ⇒ **worker** (Claude-model workers run on a clean env, so its
-*absence* proves nothing). **Still unsure ⇒ act as a worker.** The two mistakes are not symmetric: a
-primary acting as a worker is refused by the authorization gate — loud and self-correcting — while a
-worker acting as the primary ends its turn with no `bridge_reply`, and the sender silently receives
-nothing. Fail toward the recoverable error.
+fires: the reply charter in your system prompt (*"You are a spawned member in the
+claude-bridge fleet"*) ⇒ **spawned member**; fleet tools prefixed `mcp__fleet__*` ⇒ **spawned
+member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
+`.mcp.json`, so it varies — and a member spawned before CB-632 still says `mcp__bridge__*`); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
+on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
+only `fleet_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
+loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
+and the sender silently receives nothing. Fail toward the recoverable error.
 
 ### Invariants — both roles, no exceptions
 
 1. **Never set, export, or forward `ANTHROPIC_BASE_URL`** (or `ANTHROPIC_AUTH_TOKEN`). The primary
-   stays on subscription; only the bridge puts a worker off it, at spawn. Mounting the bridge must
+   stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
    never move a session across that boundary.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
-   side cannot see your screen. An answer that isn't in a `bridge_*` call is silently discarded.
+   side cannot see your screen. An answer that isn't in a `fleet_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
-   cannot act as another session. Spawn/stop/send/drain are lead-only; reply/ask are
-   only-as-itself — any peer may answer for its own pane, and for no other. A call outside your
-   role is refused, not queued.
+   cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
+   reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
+   outside your role is refused, not queued.
 4. **Delivery is status-gated: one message per turn.** Don't busy-poll a peer's terminal and don't
-   re-send because a call looks slow — the bridge delivers when the peer is `idle`/`blocked`.
-5. **Never drive the terminal multiplexer directly** (no `herdr` CLI, no socket). The bridge owns
-   policy; the multiplexer owns PTYs. Going around the bridge bypasses every rule above.
+   re-send because a call looks slow — the bridge delivers when the peer is `idle`, `blocked` or
+   `done`. A spawned member must **also** have mounted the bridge MCP: until it has, it is not
+   deliverable, and a send waits on that gate for ~60s and then fails without ever reaching its pane.
+5. **Never move a fleet session, pane or peer except through the bridge.** The bridge owns policy;
+   the multiplexer owns PTYs. Any route that changes fleet state without the bridge's checks
+   bypasses every rule above — the `herdr` CLI and its socket are the usual example.
 
 ### Primary (lead) — run this on every task, in order
 
 **Delegate by default — that is the job.** With the bridge mounted you are an orchestrator on a
 metered subscription, and workers are cheap, parallel, and disposable. The default answer to "who
-does this?" is **a worker**, not you. Reach for `bridge_send` before you reach for `Edit`. The steps
+does this?" is **a worker**, not you. Reach for `fleet_send` before you reach for `Edit`. The steps
 below are the procedure — run them in order, every task, not only the big ones.
 
-0. **Know your role** — `bridge_whoami`, once per session, before anything else.
+0. **Know your role** — `fleet_whoami`, once per session, before anything else.
 1. **Split.** Write the unit list. Every unit carries: scope · the files or PR in question ·
    acceptance criteria · exactly what to report back. A unit with no acceptance criteria is not
    ready to delegate — refine it or keep it.
@@ -66,20 +79,37 @@ below are the procedure — run them in order, every task, not only the big ones
    delegate. The keep-list is closed: the conversation with the user, decomposition and planning,
    the final judgment call, verification, merges, and anything that depends on context only you
    hold. Nothing else is yours by default.
-3. **Spawn every delegated unit first** — `bridge_spawn{profile, worktree:true, ticket}`, one per
-   unit, *before* sending any. Pass `profile` explicitly: profiles differ in model and cost, not in
-   tier, so the default is rarely what you want.
-4. **Then send them all** — `bridge_send{sessionId, content, wait:false}`. Line 1 of every brief is
+3. **Spawn every delegated unit first** — `fleet_spawn{profile, worktree:true, ticket}`, one per
+   unit, *before* sending any. Pass `profile` explicitly: profiles differ in model, cost and
+   LIVENESS, not in tier, so the default is rarely what you want. The default is whatever the
+   daemon reports, and on a host where it sits on an exhausted or withdrawn credential every
+   unqualified spawn fails — sometimes loudly, sometimes as a member that spawns fine and then
+   produces nothing. `fleet_profiles` reports the default; check it once per session.
+4. **Then send them all** — `fleet_send{sessionId, content, wait:false}`. Line 1 of every brief is
    `Load the <name> skill.` naming the worker's playbook; those skills are opt-in and that line is
    what makes them reliable. Where the project ships no such skill, spell the procedure out in the
    brief instead. The brief is self-contained — the worker sees your message and the repo, nothing
    of your context, your plan, or your screen.
-5. **Collect** — `bridge_poll{ticket}` → `bridge_ack{ticket, msgId}`. Answer a worker's `bridge_ask`
-   with `bridge_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
-   `bridge_status`, never by reading its terminal.
-6. **Verify yourself.** Re-run the build and the checks. A worker mounts only the bridge MCP and
-   cannot run your other tooling, and a piped command (`… | tail`) hides failures behind a zero
-   exit — never promote a worker's "clean" to a fact.
+5. **Collect** — `fleet_poll{ticket}` → `fleet_ack{target, msgId}`. Answer a worker's `fleet_ask`
+   with `fleet_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
+   `fleet_status`, never by reading its terminal; it also reports an open question and the `turnId`
+   that answers it. **A worker's ask waits ~55 seconds, and no nudge makes that longer** — so never
+   brief a worker to "ask me". Decide before you delegate, or give it an explicit default.
+   **A correction cannot reach a busy member.** A `fleet_send` to a working member is *accepted* and
+   returns a ticket, and is then never delivered — measured here three times in one session, and the
+   member was released still executing a brief that had been retracted twice. The receipt is true and
+   it is a fact about the *mailbox*; what you needed was a fact about the *pane*. **A push delivery
+   needs the recipient free at send time; a pull channel needs only that they look before acting.** So
+   put every correction on the **ticket**, which they can read whenever they look, and send as the
+   notification. That obliges you, not them: **all corrections go to the ticket, and the brief is
+   write-once.** The member cannot check which source is newer — it just always prefers the ticket —
+   so the day you revise a brief in place instead of commenting, it obeys your rule and does the wrong
+   thing. A *first* brief for a unit not yet running is not a correction, and may be the whole spec.
+6. **Verify yourself.** Re-run the build and the checks. A worker cannot run your IDE tooling, any
+   forge MCP server it appears to have holds a blocked credential and fails every call, and a piped
+   command (`… | tail`) hides failures behind a zero exit — never promote a worker's "clean" to a
+   fact. Its injected repo-scoped `GITEA_TOKEN` is a different credential and does work, so a worker
+   reporting that it opened its own PR is reporting something it really can do.
 7. **Review — fan out.** Spawn reviewers against the diff, one per dimension or per file, with
    `wait:false`. Never the implementer of the scope it reviews, and brief them from the diff — not
    from the implementer's rationale, which carries its own blind spot. Dispatch each PR's reviewers
@@ -87,40 +117,66 @@ below are the procedure — run them in order, every task, not only the big ones
    read it yourself.
 8. **Adjudicate, merge, tear down — yours alone.** Read the diff yourself: fully if it is small,
    targeted at the reported findings and the risky paths if it is large. Reviewer findings direct
-   your attention; they never substitute for it. Then merge, then `bridge_stop{paneId}`.
+   your attention; they never substitute for it. Then merge, then `fleet_stop{paneId}`.
+   **If the forge refuses you the merge** — a protected branch, a token without the grant — the
+   adjudication is still yours. Read the diff, decide, and hand the operator a merge-ready queue
+   with the refusal quoted. Never report a PR as merged, and never call one "ready to merge"
+   without having read the diff yourself. A refusal is exactly when that shortcut is tempting,
+   because no action is left that forces you to look, and taking it turns this step into
+   forwarding a reviewer's verdict — which is delegating the merge by proxy, two lines above.
+   **Test a refusal; do not read it off a permissions field.** A protected branch holds its merge
+   rights separately from the repository permissions, so that field can say yes while the merge is
+   refused, and still say no after a grant makes it work. Probe instead, with a request that cannot
+   succeed on its merits, so a rejection can only mean the refusal. Treat a transport failure as a
+   third answer that proves nothing: a timeout, a DNS error or a bad URL is not a refusal, and
+   counting it as one makes you sure of something you never measured.
 
 **Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
 silently becomes serial, and it is the most common way this layer is wasted. For the same reason,
-prefer `wait:false` + `bridge_poll` for anything non-trivial: a blocking `bridge_send` is capped by
+prefer `wait:false` + `fleet_poll` for anything non-trivial: a blocking `fleet_send` is capped by
 *your own* MCP client call timeout (~60s), well below the task's real runtime.
 
 **Delegating does not delegate responsibility.** Workers open PRs; you are the gate. Never delegate
 the merge — and merging on a reviewer's word is delegating it by proxy.
 
+**When a decision blocks you, consult architects — not the operator.** Spawn one or more architect
+members, give them the question and the evidence you have, and act on what they agree. They are
+authorized to settle it, not only to advise. Architects first form independent positions, then
+compare them. If they still disagree after that comparison, they return both positions and their
+checked evidence; the lead decides. Go to the operator only for an action the fleet has no
+authority to take, such as spending money, granting access, or making a promise to someone else.
+**Then write the decision on the ticket.** Taking the operator out of the loop also removes the
+signal they used to get, because that signal was the block itself — work stopped, so they found
+out. A ticket comment replaces it, and it reaches them whether or not they are at a terminal when
+you decide.
+
 | Intent | Tool |
 |---|---|
-| Confirm your own role | `bridge_whoami` |
-| See backends available | `bridge_profiles` |
-| Start a worker | `bridge_spawn{profile?, cwd?, worktree?, ticket?}` → `sessionId` + `paneId` |
-| See the fleet | `bridge_list` → `leads` (your peers) + `workers` · one peer's state: `bridge_status{sessionId}` |
-| Delegate (blocking) | `bridge_send{sessionId, content}` |
-| Delegate (long task) | `bridge_send{sessionId, content, wait:false}` → ticket → `bridge_poll{ticket}` |
-| Answer a worker's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
-| Message a **peer lead** | `bridge_send{sessionId: <their terminal>, content}` — `bridge_list` → `leads` reports it. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `bridge_reply{content}` — the one case a lead replies |
-| Collect a held reply | `bridge_poll{target}` · then `bridge_ack{target, msgId}` |
-| Tear down | `bridge_stop{paneId}` |
+| Confirm your own role | `fleet_whoami` |
+| See backends available | `fleet_profiles` |
+| Start a member | `fleet_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
+| See the fleet | `fleet_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) + `loopHealth` (`RUNNING`, `STALLED`, or `STOPPED` for `statusPoller` and `sessionReaper`) · one peer's state: `fleet_status{sessionId}` |
+| Delegate (blocking) | `fleet_send{sessionId, content}` |
+| Delegate (long task) | `fleet_send{sessionId, content, wait:false}` → ticket → `fleet_poll{ticket}` |
+| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
+| Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
+| Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
+| Answer a peer lead that messaged you | `fleet_send{coordId}` — or `{sessionId}` if they are on this host. **Not** `fleet_reply`: it has no peer route and the publish is refused |
+| Read your own held lead-to-lead mail (no ack) | `fleet_poll{coordId: <your own coord-id, from fleet_list's coordinator.selfId>}` — primary-only; never acks, so `fleet_list`'s `held[]` still shows it after. `fleet_list`'s `held[]` gives only a truncated preview — this is the only way to read the full body |
+| Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
+| Tear down a member | `fleet_stop{paneId}` |
+| Replace your OWN lead session when its context is full | `fleet_handover{action:"open", reason?}` → write the handover file it names → `fleet_handover{action:"confirm", token, operatorConfirmed}`. Primary-only. **In that order**: the file must be modified *after* `open`, or `confirm` refuses it as stale. There is no terminal parameter — the pane is always your own, so you can never roll another lead. `{action:"cancel", token}` drops a pending request |
 
 ### Lead ↔ lead — coordinate, never delegate
 
-`bridge_list` returns `leads` alongside `workers`; your own row carries `self: true`. Every other row
-is a peer — an orchestrator with its own context, its own workers, and its own judgment. An empty
-`workers` array means no workers are spawned; it says nothing about peers.
+`fleet_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
+is a peer — an orchestrator with its own context, its own members, and its own judgment. An empty
+`members` array means no members are spawned; it says nothing about peers.
 
-**A lead never assigns a task to another lead.** Work goes to workers — only ever downward, never
-sideways. Sending a peer a brief with acceptance criteria is a category error: a brief is a worker's
+**A lead never assigns a task to another lead.** Work goes to members — only ever downward, never
+sideways. Sending a peer a brief with acceptance criteria is a category error: a brief is a member's
 artefact, and a peer is not yours to task. If a unit needs doing and it falls in your area, spawn a
-worker and delegate it yourself; if it falls in the peer's area, say so and let the peer assign it.
+member and delegate it yourself; if it falls in the peer's area, say so and let the peer assign it.
 The traffic between leads is coordination and nothing else:
 
 1. **Divide the map, not the work.** Agree who owns which area, then each of you assigns inside your
@@ -133,53 +189,152 @@ The traffic between leads is coordination and nothing else:
 3. **Verify a peer exactly as you verify yourself.** Peer status buys nothing: check the claim
    against the code, and re-run the build. A peer's correction gets the same treatment — right or
    wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
+   **N observations are N data points only if they differ in the axis you are trusting.** This cuts
+   both ways. N *failures* blamed on one cause are one data point when the cases share what you are
+   not varying. N *agreeing measurements* are also one data point when they share an instrument —
+   two hosts, two operators and the same formula is one formula, not two confirmations.
+4. **Ask a peer to read your project addendum.** Your addendum is instruction surface: every future
+   session on your host obeys it, and a wrong one is obeyed just as faithfully as a right one. The
+   author is the worst reader of their own qualifier placement — measured here, one addendum carried
+   two defects and a non-author found both. If you have no peer, at least re-read it asking "which
+   sentence goes false first, and would a reader reach the caveat before acting?"
 
-Being messaged by a peer does not make you its worker: answer with `bridge_reply`, and push back on
-the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
-you.
+Being messaged by a peer does not make you its worker: answer the way you would open —
+`fleet_send{coordId}` for another daemon, `fleet_send{sessionId}` on this host — and push back on
+the substance if it is wrong. `fleet_reply` resolves a member's blocked `fleet_send`; a peer's
+coord-id message is durable and non-blocking, so there is nothing for it to resolve. A peer that
+simply complies has thrown away the reason there are two of you.
 
-### Worker — the turn contract
+### Member (worker or architect) — the turn contract
 
 1. **Load the playbook skill the lead named** before doing anything else.
 2. **Do the assigned scope only.** Note anything you spot outside it in one line; don't go hunt it.
-3. **`bridge_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
+3. **`fleet_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
    defensible fixes, "bug or intended?"). It blocks and you resume the *same* turn with the answer.
    Don't ask what you could decide yourself.
-4. **End the turn with exactly one `bridge_reply{content}`**, carrying your complete answer. This is
-   the whole handoff. No `bridge_reply` ⇒ the sender gets nothing and the exchange stalls.
-5. **Report honestly.** State only what you actually ran and its real output, including failures.
-   You mount **only** the bridge MCP — the primary's other servers (IDE, forge, docs) are not yours,
-   so never claim the result of a check you had no way to run.
-6. **Never merge.** Stage files explicitly — never `git add -A` — and leave alone anything the
+4. **Re-read the ticket before you act on anything you were told earlier**, and again before you
+   commit. A message reaches you only while you are free to receive it; the ticket is there whenever
+   you look. **If a ticket comment contradicts your brief, the ticket comment is newer and it wins.**
+5. **End the turn with exactly one `fleet_reply{content}`**, carrying your complete answer. This is
+   the whole handoff. No `fleet_reply` ⇒ the sender gets nothing and the exchange stalls.
+   Do **not** lean on the completion fallback to carry your answer for you: when you end a turn
+   without replying, the bridge scrapes your pane, and it can return only the last 4000 characters.
+   A clipped scrape is marked as partial, but the missing text is gone — your report reaches the
+   lead with its end cut off.
+6. **Report honestly.** State only what you actually ran and its real output, including failures,
+   and never claim the result of a check you had no way to run. **Measure your own tools; do not
+   assume them.** What you mount depends on your backend: an opencode member gets the bridge and
+   nothing else, while a Claude Code member also inherits the operator's user-scope MCP servers,
+   which the bridge never chose for you. Two rules follow. The primary's IDE tooling is still not
+   yours, whatever you see. And **a mounted tool is not a working tool** — the forge MCP server you
+   may find there holds a deliberately blocked credential and fails every call, by design. That is
+   not your only forge route, and the two must not be confused: the repo-scoped `GITEA_TOKEN` the
+   daemon injects into your environment does work, and using it to open your own PR is part of the
+   job. A blocked MCP tool is never a reason to skip that step.
+7. **Never merge.** Stage files explicitly — never `git add -A` — and leave alone anything the
    project marks as not-yours-to-commit.
 
 ### Where each rule lives (don't duplicate — extend the right layer)
 
 | Layer | Scope | Reaches |
 |---|---|---|
-| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `bridge_reply`* | every worker, at launch, every peer kind |
-| **this section** | protocol + orchestration policy | primary **and** every Claude worker — tracked in git, so worktrees inherit it |
-| role playbook skills | per-job procedure (commit/PR recipe, finding format) | a worker told to load one |
+| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `fleet_reply`* | every spawned member, at launch, every peer kind — never a lead |
+| **this section** | protocol + orchestration policy | primary **and** every member that reads the repo — tracked in git, so worktrees inherit it |
+| role agent definition files | role contract and per-job procedure | a member whose launcher binds its role to the matching file in its worktree |
+| role playbook skills | per-job procedure (commit/PR recipe, finding format) | a member told to load one |
 | the bridge's own docs | design detail, flows, error model | on demand |
 
-A rule belongs in **exactly one** layer — the outermost one that must obey it. Peers that don't read
-`CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they* must obey belongs in the
-charter, not here.
+A rule belongs in **exactly one** layer — the outermost one that must obey it. A member without a
+repo checkout still gets the launcher's reply charter, which is why that one rule stays there.
+Peers that don't read `CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they*
+must obey belongs in the charter, not here.
 
 ## Project addendum — claude-bridge (not part of the canonical block)
 
-- **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
-  and the code behind the rules above is `mcp/BridgeMcp` (tools), `auth/Authz` (the role table),
+- **This repo is the bridge.** The daemon is `fleetd`, its MCP mount is `http://127.0.0.1:8765/mcp`,
+  and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
   `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
-- **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
-  `reviewer` (scoped review → one structured finding). Name one in every delegation.
+- **Herdr socket tests (measured 2026-09-10).** In this repo, herdr is a subject under test. A
+  worker assigned to herdr code, and the lead, may let a test open the herdr socket directly in a
+  throwaway workspace that the test tears down. This only covers
+  `fleetd/src/test/java/dev/ltms/fleet/herdr/AgentControlContractTest.java`,
+  `fleetd/src/test/java/dev/ltms/fleet/herdr/HerdrContractTest.java`,
+  `fleetd/src/test/java/dev/ltms/fleet/herdr/PaneLocatorContractTest.java`, and
+  `fleetd/src/test/java/dev/ltms/fleet/herdr/WorkspacePlacementContractTest.java`. It is not a
+  general licence. Using the herdr CLI or socket to move a real fleet session, pane, or peer stays
+  banned. That is the control plane that invariant 5 protects. Re-measure with
+  `grep -rl 'UnixSocketHerdrClient.connect()' fleetd/src/test/java --include='*.java'`. A non-empty
+  result means tests still open the socket and this note still applies. An empty result means nobody
+  does this any more; delete this section. Canonical invariant 5 restatement is tracked in #458 and
+  is not part of this change.
+- **`fleet_profiles`/`fleet_list` report two separate outage states, and they are not the same
+  thing.** *Quarantined* (CB-578) means the backend told us it is out of capacity — a long,
+  1800s-default cooldown. *Cooling off* (fleetd #201/#227) means a profile's credential threw two
+  distinct backend errors (a non-exhaustion failure such as an HTTP 5xx) within 60 seconds — a
+  short, fixed 60s cooldown, not configurable per profile. Each check runs independently, so a
+  profile can show both at once. In the JSON: a cooling profile carries `credentialId` and
+  `coolingOffForSeconds`; a quarantined profile carries `quarantinedForSeconds`; a profile hit by
+  both carries all three fields, and either state alone already sets that profile's `free` to `0`.
+  A `fleet_spawn` naming a cooling-off profile is refused before it ever reaches the backend
+  adapter, with a message naming the credential and the remaining seconds ("cooling off after
+  repeated backend errors") — distinct wording from a quarantine refusal, so don't conflate the
+  two when reading a spawn failure.
+- **Skills available to delegate:** `implementer` (worktree → commit → push → own PR),
+  `reviewer` (one diff → one structured finding) and `hunter` (sweep a package → several ranked
+  findings, change nothing). Name exactly one in every delegation. **`reviewer` and `hunter` are
+  not interchangeable** — `reviewer` caps the answer at one finding in about 90 words, so naming
+  it for a multi-finding sweep hands the worker two contradictory output contracts. That has
+  already cost three workers' turns: each wrote a good report to its terminal and ended the turn
+  with no `fleet_reply`, and the scrape returned the tail of the brief instead.
+  Spawn `implementer` with role `dev`, `reviewer` with role `reviewer`, and `hunter` with role
+  `hunter`.
 - **Primary-side skills** (not delegation playbooks — a worker cannot use them):
-  `port-to-opencode` (make an OpenCode session a participant in this workspace).
+  `port-to-opencode` (make an OpenCode session a participant in this workspace),
+  `fleets-status` (report every fleet that shares one LavinMQ instance),
+  `redeploy-fleetd` (rebuild and restart the live daemon after a merge) and
+  `handover` (write the file a fresh lead session inherits when the outgoing one hands off,
+  fleetd #480).
+- **This repo is also a Claude Code marketplace, and ships a plugin.** `.claude-plugin/marketplace.json`
+  points at `plugin/`, which carries the MCP mount and the `setup` skill
+  (`/claude-bridge:setup` — make any project bridge-ready). It was added in CB-527 and then went
+  unmentioned by every instruction file, so it drifted and a later session planned it from scratch
+  (#362). **Read `plugin/` before designing anything about onboarding a project.** Two limits are
+  structural, not bugs: a plugin cannot carry the role agent files, because
+  `ClaudeCodeLauncher.java:371` requires `<cwd>/.claude/agents/<role>.md` in the member's own
+  worktree; and a plugin cannot deliver anything to members at all, because
+  `ClaudeCodeLauncher.java:285` exports `CLAUDE_CONFIG_DIR` and every Claude profile here sets it,
+  so a member never reads the operator's plugin store. **The plugin is the lead-side surface;
+  member-facing assets travel in the worktree.**
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
   (a submodule with its own remote).
-- **Flows and the error model** — rendezvous, `bridge_ask`, detached delivery, turn-done fallback —
-  are diagrammed in `docs/MCP-Contract.md` §6, kept out of this file because it loads into every
-  session's context.
+- **A provisioned worktree neutralizes `.mcp.json`, `opencode.json` and `.autoenv`** — the repo's
+  committed copies would otherwise mount the primary's IDE and forge servers (fleetd #134). The
+  worktree's copy of each is a stub, **not** the repo's real file, so a worker that reads one and
+  reports what it found is reporting on the stub. The daemon logs a per-spawn summary, but the
+  worker cannot see that log. From inside its own worktree a worker — or a lead debugging one —
+  reads the list with `git config --worktree --get-all fleet.neutralizedConfig`, and the
+  consequence with `git config --worktree --get fleet.neutralizedConfigNote`. Never brief a worker
+  to edit one of these files: the edit cannot be committed, and it will not tell you so.
+- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, the turn-done
+  fallback and status gating — are diagrammed in `docs/MCP-Contract.md`. That page is now flows
+  only: its pre-build tool catalogue, parameter tables and REST paths were deleted rather than
+  corrected, because a hand-maintained second copy of the tool surface is what drifted for a month
+  while this line pointed every session at it (CB-609 / #114). **The live MCP schema is the tool
+  reference**, with the intent→tool table above as the short form. `McpContractDocTest` fails if
+  that page names a `fleet_*` tool the server does not register. The flows are kept out of this
+  file because this file loads into every session's context.
+
+### Redeploying the daemon — the lead may do this (primary only)
+
+**A merge is not a deployment.** The running `fleetd` holds the jar it was started with, so a
+feature merged to `main` does nothing until the daemon is rebuilt and restarted. The lead **may and
+should** redeploy rather than hand the job back to the operator. **Workers must never do this** — a
+worker has no business restarting the daemon it is talking through, and stopping it kills the
+worker's own channel mid-turn.
+
+**Load the `redeploy-fleetd` skill before you redeploy.** It holds `scripts/redeploy-fleetd.sh`
+and its flags, the drain step, the operator's permission grant, and the five checks that have each
+gone wrong here before. Do not hand-roll the steps from memory.
 
 ### The prompt is part of the product — update it with the code (mandatory)
 
@@ -192,15 +347,15 @@ Before you call any work done, check the row that matches what you touched:
 
 | You changed… | Re-read and update… |
 |---|---|
-| a `bridge_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
+| a `fleet_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
 | `Authz` / the role table | invariant 3, and the primary-only vs worker-only claims |
-| `ConnectionIdentity` / how a caller is resolved | the `bridge_whoami` paragraph and the fallback ladder |
-| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__bridge__*`), and the layering table's top row |
+| `ConnectionIdentity` / how a caller is resolved | the `fleet_whoami` paragraph and the fallback ladder |
+| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__fleet__*`), and the layering table's top row |
 | the injector / status gating | invariant 4 |
 | worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
 | `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
 | a new peer kind (non-Claude adapter) | what that peer can read — anything it must obey belongs in its charter, not in the block |
-| **anything an operator can use, configure, or observe** — an MCP tool, a `bridged.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
+| **anything an operator can use, configure, or observe** — an MCP tool, a `fleetd.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
 
 That last row is not bookkeeping. Chapters 1–10 answer *how is this built* and *why this way*;
 none of them has a home for *what can it do and how do I turn it on*, so for twenty tickets a
@@ -211,7 +366,7 @@ is a Roadmap line. A change that touches none of the three earns no entry, and t
 outcome rather than an omission.
 
 Then **propagate**: the block in this file and the template in the wiki
-([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
+([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
 block*) must stay byte-identical, and other projects carrying the block need the same edit. Verify
 rather than trust:
 
@@ -227,6 +382,16 @@ print("in sync:", w[i:w.index("\n```\n", i) + 1] == block)
 PY
 ```
 
+**Only the lead can run that check (measured 2026-09-10).** A member's provisioned worktree has
+`wiki/` uninitialized, so the script dies with `FileNotFoundError: wiki/7-Use-Cases.md`. Measured
+in three worker worktrees: `git submodule status` printed a leading `-` and `wiki/` held 0
+entries; the primary's own clone printed a leading `+` and the file was there. So never make this
+check a member's acceptance criterion — it is unsatisfiable for them, and a brief that asks for it
+is asking a worker to invent a pass. A member told to check it must say it could not run it, and
+must never report it as passed. The lead runs it in the main clone before merging. Re-measure with
+`git submodule status` in a member's worktree: a leading `-` means this still applies; once it
+prints a commit with no `-`, delete this paragraph.
+
 ## IDE MCP tools & validation workflow (enforced)
 
 > **Primary only.** Workers have no IDE MCP mount — if you are a worker, skip this section and
@@ -234,10 +399,10 @@ PY
 
 Two IDE MCP servers are connected: **intellij-index** (semantic code intelligence) and
 **jetbrains** (file problems, reformat, debugger). IntelliJ has multiple projects open; our
-module is **`bridged`**. Always pass these to IDE MCP tools:
+module is **`fleetd`**. Always pass these to IDE MCP tools:
 
-- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/bridged`
-- IDE paths are relative to `bridged/` (e.g. `src/main/java/dev/ltms/bridged/...`)
+- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/fleetd`
+- IDE paths are relative to `fleetd/` (e.g. `src/main/java/dev/ltms/fleet/...`)
 
 ### After editing any file — mandatory
 
@@ -251,7 +416,7 @@ module is **`bridged`**. Always pass these to IDE MCP tools:
    whole-project gate before declaring work done or committing.
 
 **Whenever dependencies change (or a `pom.xml` edit), validate CVEs with
-`jetbrains get_file_problems{filePath: "bridged/pom.xml"}`** — its Mend.io check reflects the
+`jetbrains get_file_problems{filePath: "fleetd/pom.xml"}`** — its Mend.io check reflects the
 dependencies on disk. (Note: `ide_diagnostics` / intellij-index does NOT re-resolve dependencies
 after a pom edit without a full Maven reimport, so it reports stale CVE results — don't trust it
 for this.) Treat a CVE warning like any other: bump to a patched version and confirm

README.md

@@ -9,32 +9,33 @@ Sibling of [`crush-bridge`](https://git.ltms.dev/systems/vms) (which drives a he
 process*, so it inherits `CLAUDE.md`, hooks, skills, and MCP — just pointed at a
 cheaper/local model.
 
-## Leading approach — herdr-centric message server (`bridged`)
+## Leading approach — herdr-centric message server (`fleetd`)
 
-A small always-on message server, **`bridged`**, controls
+A small always-on message server, **`fleetd`**, controls
 [herdr](https://herdr.dev) (an agent multiplexer) over its Unix-socket API and exposes a
 clean 2-way messaging API as an **MCP server that both the primary and the workers mount** —
 one unified Claude setup and the **sole communication gateway** (REST/SSE stays for non-Claude
-clients; any broker is `bridged`-internal, below the gateway).
-herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `bridged` owns
+clients; any broker is `fleetd`-internal, below the gateway).
+herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `fleetd` owns
 policy (subscription boundary, session lifecycle, status-gated delivery) and the client
-contract. The worker `claude` launches with `ANTHROPIC_BASE_URL=https://ollama.ltms.dev` + a
-bearer token; the primary Opus stays env-clean and calls `bridged`'s MCP tools.
+contract. A Claude member launches with `ANTHROPIC_BASE_URL` pointed at the gateway,
+`https://llm.ltms.dev/anthropic`, plus a bearer token; the lead stays env-clean and calls
+`fleetd`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.
 
 ```mermaid
 flowchart LR
     OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["bridged — standalone daemon (not a claude process)"]
+    subgraph BD["fleetd — standalone daemon (not a claude process)"]
         SRV["SERVER face<br/>MCP · REST/SSE · policy"]
         CLI["CLIENT face<br/>status-gated injector · herdr socket"]
         SRV --> CLI
     end
     HERDR["herdr<br/>panes · agent-status"]
     W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
-    M["ollama.ltms.dev<br/>(worker model)"]
+    M["llm.ltms.dev<br/>(the one gateway)"]
 
-    OPUS -->|"MCP bridge_send (blocks)"| SRV
-    W -.->|"MCP bridge_reply"| SRV
+    OPUS -->|"MCP fleet_send (blocks)"| SRV
+    W -.->|"MCP fleet_reply"| SRV
     CLI -->|"Unix socket<br/>send_text · events.subscribe"| HERDR
     HERDR -->|"drives PTY"| W
     W -->|"inference"| M
@@ -46,24 +47,26 @@ flowchart LR
 ```
 
 - **Subscription boundary:** the *primary* never sets `ANTHROPIC_BASE_URL` (stays on
-  Pro/Max). Only the *secondary* process is off-subscription — and `bridged` itself is a
+  Pro/Max). Only the *secondary* process is off-subscription — and `fleetd` itself is a
   plain daemon (no Anthropic quota), so it may poll/subscribe freely.
-- **One gateway (unified MCP setup):** `bridged` is the **sole communication path** for every
+- **One gateway (unified MCP setup):** `fleetd` is the **sole communication path** for every
   Claude session. Primary and workers each mount it as an MCP server (one `claude mcp add`
-  line, same on both) and talk over MCP tools — `bridge_send` / `bridge_reply` /
-  `bridge_status` (with `bridge_ask` planned for the blocked-worker path). **No Claude session
-  ever addresses a broker, a peer, or the network
-  directly**; any queue is `bridged`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
-  mounting the bridge is subscription-safe by construction.
-- **How the primary consumes a reply:** a single **blocking MCP call** (`bridge_send`);
-  `bridged` holds it open until the worker calls `bridge_reply` or its turn hits
+   line, same on both) and talk over MCP tools — `fleet_send` / `fleet_reply` /
+   `fleet_status` (with `fleet_ask` planned for the blocked-worker path). **No Claude session
+   ever addresses a broker, a peer, or the network
+   directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
+   mounting the bridge is subscription-safe by construction.
+   **Tool naming:** the tools are `fleet_*` (renamed from `bridge_*` in CB-622). The old
+   `bridge_*` names were removed in CB-634 — only `fleet_*` answers now.
+- **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
+  `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
   `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so
   no quota burn. SSE is an optional side-channel for humans/dashboards watching status.
-- **Worker → primary** rides `bridged`'s **MCP rendezvous** — the reply resolves the primary's
-  blocking call (or, for detached work, `bridged` **injects the primary's idle pane** when it's
+- **Worker → primary** rides `fleetd`'s **MCP rendezvous** — the reply resolves the primary's
+  blocking call (or, for detached work, `fleetd` **injects the primary's idle pane** when it's
   ready), so *no keystroke-into-primary and no broker are involved, even single-host*. The one
   exception: a split-host primary that isn't a herdr pane wakes via its own `Stop`-hook, which
-  polls **`bridged`** (never a broker). See the wiki for the two topologies.
+  polls **`fleetd`** (never a broker). See the wiki for the two topologies.
 - **Different model per process** sidesteps Claude Code's lack of per-subagent provider
   routing — the worker isn't a subagent, it's its own configured process.
 - **AgentAPI** ([`coder/agentapi`](https://github.com/coder/agentapi)) is retained only as a
@@ -72,11 +75,11 @@ flowchart LR
 
 ## Docs
 
-Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/lms/claude-bridge/wiki)**,
+Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/fleet/fleetd/wiki)**,
 vendored here as a submodule under [`wiki/`](./wiki):
 
 ```bash
-git clone --recurse-submodules ssh://git@git.ltms.dev:2224/lms/claude-bridge.git
+git clone --recurse-submodules ssh://git@git.ltms.dev:2224/fleet/fleetd.git
 # or, after a plain clone:
 git submodule update --init
 ```
@@ -86,7 +89,7 @@ Gitea wiki.
 
 ## Status
 
-🟢 **Implemented & dogfooded** — the herdr-centric **`bridged`** message server is built and in
+🟢 **Implemented & dogfooded** — the herdr-centric **`fleetd`** message server is built and in
 real use: an Opus primary delegates tasks to off-subscription workers that reply through the
 bridge (code reviews delegated this way have produced committed bug fixes). Selected as the
 primary approach 2026-07-11, superseding the AgentAPI plan (2026-07-08); AgentAPI retained as a
@@ -97,9 +100,9 @@ tests run separately via `mvn test -Pcontract`):
 
 - **Core gateway** — herdr socket client (contract-tested vs live 0.7.0); guard-checked worker
   spawn with `ANTHROPIC_BASE_URL` injected only into the worker's env; status-gated injector;
-  blocking `bridge_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
-- **MCP tools** — `bridge_send` / `bridge_reply` / `bridge_status` (messaging) and `bridge_spawn`
-  / `bridge_list` / `bridge_stop` / `bridge_profiles` / `bridge_poll` (fleet). Caller identity is
+  blocking `fleet_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
+- **MCP tools** — `fleet_send` / `fleet_reply` / `fleet_status` (messaging) and `fleet_spawn`
+  / `fleet_list` / `fleet_stop` / `fleet_profiles` / `fleet_poll` (fleet). Caller identity is
   connection-based (loopback peer PID → herdr pane), so the same mount serves primary and workers.
 - **Delivery reliability** — completion fallback (a confirmed `working→idle` turn resolves a
   send); async fire-and-poll (beats the caller's MCP call timeout for long tasks); and failure
@@ -107,7 +110,7 @@ tests run separately via `mvn test -Pcontract`):
 - **Fleet** — multiple worker profiles, each with an independent base_url guard check; workers
   inherit the primary's working directory (never `$HOME`); a readiness gate holds delivery until
   a worker's Claude has connected the bridge MCP (no paste lost into its boot window).
-- **Blocked-worker path** — `bridge_ask` reverse rendezvous: a worker pauses its delegated turn to
+- **Blocked-worker path** — `fleet_ask` reverse rendezvous: a worker pauses its delegated turn to
   ask the primary and resumes the *same* turn with the answer (CB-205).
 - **Session lifecycle** — session manager with spawn/reuse/recycle, `idle_ttl` reaper, `context_cap`,
   and graceful drain on shutdown (CB-301/CB-303); per-worker git worktrees on their own branch with

bridged/.gitignore

@@ -1,14 +0,0 @@
-# Build output
-target/
-dependency-reduced-pom.xml
-
-# Local runtime config (copy from bridged.example.yaml)
-bridged.yaml
-
-# CB-505 audit trail + daemon stdout/stderr — runtime records, never source
-logs/
-
-# Editor / OS
-*.iml
-.idea/
-.DS_Store

bridged/bridged.example.yaml

@@ -1,286 +0,0 @@
-# bridged configuration (example). Copy to bridged.yaml and adjust.
-#
-# bridged is the sole gateway between primary/worker Claude sessions and herdr.
-# It is NOT a Claude process and must never carry ANTHROPIC_BASE_URL.
-
-# REST + MCP listen address. Keep it on loopback unless you also switch auth.mode to `token`
-# below — bridged REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
-bind:
-  host: 127.0.0.1
-  port: 8765
-
-# API authentication (CB-501). Governs how a caller that is NOT an on-host worker pane proves it
-# is the primary. Worker identity never depends on this: a loopback peer PID that maps to a herdr
-# pane is unforgeable and is always honoured, so turning auth on cannot lock the fleet out.
-#
-#   mode: loopback-trust  → DEFAULT, and the historical behaviour: any loopback caller that is not
-#                           a worker is the primary, no credential needed. Sound ONLY because the
-#                           OS refuses remote connections to a loopback socket.
-#   mode: token           → such a caller must send `Authorization: Bearer <token>`; without it it
-#                           is anonymous and authorized for nothing. REQUIRED for a non-loopback
-#                           bind — the daemon fails fast otherwise, because "unauthenticated ⇒
-#                           primary" on a reachable port would hand spawn/stop/send to anyone.
-#   tokenEnv              → host env var holding the token (never the literal value). Default
-#                           BRIDGED_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
-#
-# TLS is deliberately NOT terminated in the daemon (CB-501 D3): run a reverse proxy in front and
-# let it own certificate lifecycle, e.g.
-#     location / { proxy_pass http://127.0.0.1:8765; proxy_set_header Authorization $http_authorization; }
-# The broker link gets TLS from its own URI (amqps://…) — see `broker` below.
-# auth:
-#   mode: token
-#   tokenEnv: BRIDGED_API_TOKEN
-
-# Optional pinned primary terminal (CB-307). Names the herdr pane the PRIMARY itself runs in:
-# a caller whose connection maps to this pane resolves as the primary (no credential needed —
-# the pane mapping is as unforgeable as a worker's), and reply nudges are pushed to it.
-# REQUIRED when the primary runs inside a herdr pane — without it the pane match reads the
-# primary as a worker and refuses spawn/send/stop. Get the id from bridge_whoami; re-pin if
-# the primary moves panes.
-# primary:
-#   terminal: term_0123456789abcd
-#   pushReminders: 5      # max nudges before giving up (default 5)
-#   pushBackoffMs: 15000  # delay between nudges (default 15000)
-
-# CB-530: MORE THAN ONE LEAD. `primary:` above is singular by construction — every other pane
-# resolves as a worker — which is right for one lead driving a fleet and wrong the moment two leads
-# (say a Claude lead and an opencode lead) work as peers: the second is silently demoted and refused
-# every orchestration call. List each lead's pane here and all of them resolve as leads.
-#
-#   terminal → the ONLY field identity depends on; get it from that session's bridge_whoami
-#   kind/model → descriptive; they document what runs in the pane and are echoed by bridge_whoami
-#
-# A lead is never spawned — it pre-exists, which is exactly why it must be named rather than created.
-# `bridge_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
-# IS a primary for authorization, so nothing that keys on the role breaks.
-#
-# KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
-# destination for its nudges. If both name the same terminal, the `leaders:` entry wins.
-# leaders:
-#   opus-5.0:
-#     terminal: term_0123456789abcd
-#     kind: claude
-#   gpt-sol-5.6:
-#     terminal: term_fedcba9876543
-#     kind: opencode
-#     model: openai/gpt-5.6-terra
-
-# CB-531: FIND LEADS BY TAB NAME instead of pasting terminal ids. `leaders:` above needs an id that
-# only exists once the session is running, so adding a lead is: open a tab, start the agent, ask it
-# bridge_whoami, edit this file, restart the daemon. This block replaces all of that with a naming
-# convention — label the tab `lead: <name>` when you open it and the pane is recognised on the next
-# rescan, with no config edit and no restart. Reopen the tab later and the id changes; the label
-# does not.
-#
-# bridged NEVER writes these labels. It renames worker tabs (see `tabLabel` below) but reads lead
-# tabs read-only, so what is in the tab bar is always what you typed. Two things keep the convention
-# from being a way to claim leadership: the configured worker spaces are excluded from the scan, so
-# nothing bridged places can land in a matching tab; and startup REFUSES a `tabPrefix` that any
-# worker `tabLabel` also matches, so the two namespaces cannot overlap by accident.
-#
-# Opt-in on purpose — this widens who resolves as a lead, so upgrading the daemon must never switch
-# it on for you. Absent block = leads come only from `leaders:`/`primary:`, exactly as before.
-# leadScan:
-#   tabPrefix: "lead:"      # `lead: opus-5.0` ⇒ a lead named opus-5.0 (case-insensitive; default "lead:")
-#   intervalSeconds: 10     # rescan cadence, and the worst case before a new tab is recognised
-
-# herdr Unix socket. Omit to use the client default
-# (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
-herdrSocket: ~/.config/herdr/herdr.sock
-
-# How worker sessions are spawned. Define one or more named profiles (backends) under
-# `workers`; each key is the profile name (also the ccs profile). `defaultWorker` picks
-# which one a no-argument spawn uses (bridge_spawn with no profile / POST /workers).
-#
-# Shared knobs (placement/workspace/tabLabel) can be repeated per profile; they usually match.
-#   placement: tab   → each worker lands in its OWN tab in a dedicated worker space (default).
-#                      Use `pane` for the legacy behaviour (split the focused tab).
-#   mcpUrl           → bridged mounts the bridge MCP (--mcp-config, inline) + reply charter
-#                      (--append-system-prompt) as launch flags; nothing is written to the profile.
-#   tokenEnv         → host env var holding the worker's auth token (value never stored in config);
-#                      omit for a backend that needs no token (e.g. a local ollama).
-#   cwd              → pin this profile's working directory (CB-112). Omit to inherit the primary's
-#                      cwd on an MCP spawn, else the daemon's cwd — never $HOME. See
-#                      docs/Worker-Startup-and-Trust.md.
-#   configDir        → CLAUDE_CONFIG_DIR for the worker, so it inherits that profile's
-#                      skills/MCP/hooks. Omit to leave the worker on the host default.
-#   parityOverlay    → repo-relative paths copied primary→worktree so a worker in a provisioned
-#                      worktree sees the same local config (CB-301-ext). Omit for the default set:
-#                      [.claude/settings.local.json, .env, .envrc].
-#
-#                      Do NOT add .mcp.json (CB-525). A worker's tools are whatever its launcher
-#                      mounts — the bridge, and nothing else. Replicating the primary's MCP config
-#                      handed a worker the primary's IDE servers, which are bound to the primary's
-#                      checkout, so its navigation returned paths OUTSIDE its own worktree: one
-#                      worker made all 59 of its edits in the primary tree while compiling its
-#                      worktree, and every build it ran was of code that did not contain them.
-#                      bridged neutralizes a provisioned worktree's .mcp.json for this reason;
-#                      listing it here would copy the primary's back over that.
-#   gitTokenEnv      → host env var holding the git-forge API token. When set, its value is injected
-#                      as GITEA_TOKEN so the worker can open its OWN PR at checkpoint (CB-302).
-#                      Opt-in by design — omit and the worker gets no PR-create grant (push over
-#                      SSH is unaffected). The token value itself is never stored in this file.
-#   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
-#                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
-#   env              → extra environment for this profile's workers, as a literal key/value map
-#                      (CB-511). Use it to give workers a toolchain.
-#
-#                      A worker's environment does NOT come from your shell. bridged hands herdr an
-#                      explicit env map and herdr merges it into ITS OWN process env — so before
-#                      CB-511 a worker inherited whatever PATH the herdr server happened to be
-#                      started with, which on a long-lived herdr can predate your toolchain entirely
-#                      and leave workers unable to run `mvn` or `java` at all.
-#                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
-#                      only to override that or add more (JAVA_HOME, …). Since the default is the
-#                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
-#                      lines in deploy/dev.ltms.bridged.plist and deploy/bridged.service.
-#
-#                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
-#                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
-#                      entry cannot repoint a worker past the SubscriptionGuard — which is checked
-#                      against `baseUrl` alone.
-# Put `defaultMode: "auto"` in each ccs profile so the worker runs autonomously.
-workers:
-  gx10:                              # ccs profile name (NOT a hostname)
-    kind: claude-code                # which adapter spawns this profile (default; may omit)
-    baseUrl: http://gx01.gw:8000     # the vLLM host this profile targets (gx00.gw / gx01.gw)
-    model: coder
-    placement: tab
-    workspace: bridged-workers
-    tabLabel: "worker: {profile} #{n}"  # {profile}/{model}/{n} substituted; {n} keeps sibling tabs distinct
-    mcpUrl: http://127.0.0.1:8765/mcp
-    tokenEnv: BRIDGED_WORKER_TOKEN
-    argv: ["ccs", "gx10"]
-    weight: 0.5                       # relative selection weight for placement: weighted
-    maxLoad: 2                        # max live workers on this profile (omit for unlimited)
-    # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
-    # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
-    # configDir: /Users/me/.ccs/instances/gx10   # CLAUDE_CONFIG_DIR — inherit that profile's skills/MCP
-    # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
-    # parityOverlay: [".claude/settings.local.json", ".env", ".envrc"]   # never add .mcp.json — see above
-  gx11:                              # a second backend, so `placement: weighted` has a choice
-    baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
-    placement: tab
-    workspace: bridged-workers
-    tabLabel: "worker: {profile} #{n}"
-    mcpUrl: http://127.0.0.1:8765/mcp
-    argv: ["ccs", "gx11"]
-    weight: 0.5
-    maxLoad: 2
-    # Pin an auto-compact window BELOW the served model's context ceiling. The global
-    # ~/.claude/settings.json value is shared by every ccs instance and the primary, so the
-    # per-profile override belongs here. Equal to the ceiling means auto-compact never fires
-    # before the server rejects the prompt, which kills a worker mid-turn (CB-523).
-    env:
-      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "280000"
-  # CB-402: a second coding-agent kind, proving the PeerLauncher SPI is provider-neutral.
-  # opencode is provider-agnostic and uses NONE of Claude's private seams: no ANTHROPIC_BASE_URL /
-  # SubscriptionGuard (so it needs no `guard` host entry), no --mcp-config / --append-system-prompt.
-  # The bridge MCP + reply charter mount via a generated OPENCODE_CONFIG file, and the model is a
-  # `provider/model` selector. Placement, tabs, cwd, and the readiness gate are shared with Claude.
-  #
-  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → bridge_send →
-  # structured bridge_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
-  # and need NO credentials — check `opencode models` for the current free list, since the names
-  # change. That also makes the worker off-subscription by construction.
-  #   opencode-free:
-  #     kind: opencode
-  #     model: opencode/north-mini-code-free  # `provider/model` selector, injected as `-m`
-  #     placement: tab
-  #     workspace: bridged-workers
-  #     tabLabel: "opencode: {profile} #{n}"
-  #     mcpUrl: http://127.0.0.1:8765/mcp
-  #     argv: ["opencode"]
-  #
-  # CB-508: point an opencode profile at your OWN OpenAI-compatible endpoint (local vLLM, llama.cpp,
-  # LM Studio, TGI…) instead of opencode's gateway. Setting `baseUrl` on a `kind: opencode` profile
-  # makes the bridge emit a custom `provider` block into the generated opencode.json — opencode has
-  # no ANTHROPIC_BASE_URL seam, so this is how the endpoint is pinned.
-  #   baseUrl → a bare host:port gets `/v1` appended (where these servers mount the API); a URL that
-  #             already has a path is used verbatim, so a custom mount point still works.
-  #   model   → MUST be "<provider>/<model>". The provider half names the generated block; the model
-  #             half must match an id the server reports at /v1/models. One field drives both the
-  #             declaration and the `-m` flag, so they cannot drift apart. A bare model name with a
-  #             baseUrl set is rejected at spawn rather than silently using the default gateway.
-  #   tokenEnv → optional; its value becomes the provider apiKey. Most local servers ignore the key,
-  #             so a placeholder is used when unset (the AI SDK still requires a non-empty one).
-  # NOTE: no `guard` entry is needed even with a baseUrl set. The SubscriptionGuard exists to stop a
-  # worker borrowing the primary's Anthropic subscription, and an opencode process has no Anthropic
-  # credential path at all.
-  #   opencode-local:
-  #     kind: opencode
-  #     baseUrl: http://127.0.0.1:8000
-  #     model: local-vllm/deepseek-v4-flash
-  #     placement: tab
-  #     workspace: bridged-workers
-  #     tabLabel: "opencode: {profile} #{n}"
-  #     mcpUrl: http://127.0.0.1:8765/mcp
-  #     argv: ["opencode"]
-# How an unqualified spawn chooses a profile: fixed (default, reproduces pre-CB-518 behaviour),
-# round-robin, or weighted. Omitting this key is a strict no-op for existing configs.
-placement: weighted
-defaultWorker: gx10
-
-# Subscription boundary. A worker's base_url host MUST be one of these; the primary
-# must carry none. Every profile above must have its host listed here.
-guard:
-  offSubscriptionHosts:
-    - gx00.gw
-    - gx01.gw
-
-# Spawn-readiness gate (CB-306). The launcher blocks until the worker's herdr status is
-# injectable (IDLE/BLOCKED/DONE) or the timeout elapses. 0 disables the gate.
-# NOTE: keys are camelCase — config is bound by plain Jackson with no naming strategy and
-# unknown keys are ignored, so a snake_case key would be silently dropped (default kept).
-# spawnReadyTimeoutMs: 20000
-# spawnReadyPollMs: 300
-
-# Worktree provisioning root (CB-301-ext). Where per-worker git worktrees are checked out so
-# each worker owns an isolated branch instead of sharing the primary's tree. Omit to default
-# to a sibling directory of the repo root.
-# worktreeRoot: /Users/me/src/.bridged-worktrees
-
-# Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
-# the feature disabled. By default the daemon never reaps, caps, or drains sessions.
-#   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)
-#   contextCap         → force-release a session after this many delegated turns
-#   drainTimeoutSeconds → seconds to wait for BUSY sessions on shutdown before forced teardown
-# lifecycle:
-#   idleTtlSeconds: 300
-#   contextCap: 10
-#   drainTimeoutSeconds: 5
-
-# Durable reply delivery (CB-307 Stage 2). OMIT this block entirely to keep the default
-# in-memory, soft-state reply inbox (late worker replies are held only until a daemon bounce).
-# Set a broker uri to swap in the AMQP-backed inbox: worker replies with no open send are held
-# on a durable per-target queue (agent.<target>.inbox) and survive a restart — the broker
-# redelivers anything the primary had not yet drained. Production default is LavinMQ; a stock
-# RabbitMQ speaks the same AMQP 0-9-1, so it is a URI-only swap.
-#   uri → AMQP connection URI. No trailing slash ⇒ the default vhost "/"; an empty path ("/")
-#         is vhost "" and will NOT connect. Encode a named vhost as .../%2Fmyvhost.
-# broker:
-#   uri: amqp://guest:guest@127.0.0.1:5672
-
-# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open bridge_send,
-# the ReplyPushLoop injects a *drain nudge* (never the payload) into the primary's own herdr
-# pane — status-gated (only when injectable, never mid-turn) and bounded. Ack = drain: the loop
-# stops as soon as the primary's inbox is empty.
-#   terminal       → pin the primary's herdr terminal id. Omit to learn it from the connection on
-#                    the first orchestration-side MCP call (the normal case). An off-host or
-#                    non-herdr primary leaves this unresolved → the loop is a no-op and delivery
-#                    degrades to pull; the reply is still never lost.
-#
-#                    REQUIRED (CB-522) if the primary itself runs inside a herdr pane. Caller
-#                    identity resolves a loopback PID to its herdr pane, and PaneLocator scans
-#                    EVERY pane — not just bridged-spawned ones — so such a primary is otherwise
-#                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
-#                    self-locking: the learned terminal is populated by the very orchestration
-#                    calls being refused, so only this pinned value can break the cycle. Read the
-#                    id off bridge_whoami (it reports the current terminal even while
-#                    misclassified) and re-pin whenever the primary moves panes.
-#   pushReminders  → max nudges before giving up (default 5)
-#   pushBackoffMs  → delay between nudges in ms (default 15000)
-# primary:
-#   terminal: term_65619bd6174568
-#   pushReminders: 5
-#   pushBackoffMs: 15000

bridged/src/main/java/dev/ltms/bridged/Bridged.java

@@ -1,426 +0,0 @@
-package dev.ltms.bridged;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.LeadTabScanner;
-import dev.ltms.bridged.herdr.PaneLocator;
-import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.inject.StatusPoller;
-import dev.ltms.bridged.inject.TurnListener;
-import dev.ltms.bridged.inject.WorkerPresence;
-import dev.ltms.bridged.auth.ArchitectRegistry;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.mcp.BridgeMcp;
-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.mcp.LsofPeerPidLookup;
-import dev.ltms.bridged.mcp.LsofProcessCwdLookup;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.msg.ReplyPushLoop;
-import dev.ltms.bridged.rest.BridgedApp;
-import dev.ltms.bridged.session.GitWorktrees;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.session.SessionReaper;
-import dev.ltms.bridged.worker.ClaudeCodeLauncher;
-import dev.ltms.bridged.placement.PlacementPolicies;
-import dev.ltms.bridged.worker.CompositePeerLauncher;
-import dev.ltms.bridged.worker.HerdrPeerLauncher;
-import dev.ltms.bridged.worker.OpenCodeLauncher;
-import io.javalin.Javalin;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.Function;
-import java.util.function.Predicate;
-import java.util.function.Supplier;
-import java.util.stream.Collectors;
-
-/**
- * {@code bridged} entry point. Wires the real herdr socket client to the REST app and
- * starts listening. Before anything else it asserts its own environment is clean —
- * {@code bridged} is not a Claude process and must never carry a base_url.
- */
-public final class Bridged {
-
-    private static final Logger log = LoggerFactory.getLogger(Bridged.class);
-
-    /** How often the injector samples a busy worker's status while it has queued work. */
-    private static final long INJECT_POLL_MILLIS = 250;
-
-    /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
-    private static final long HERDR_WAIT_SECONDS = 30;
-    private static final long HERDR_WAIT_POLL_MILLIS = 500;
-
-    static void main(String[] args) {
-        Path configPath = Path.of(args.length > 0 ? args[0] : "bridged.yaml");
-        BridgedConfig cfg = BridgedConfig.load(configPath);
-
-        // The primary/host env that launched bridged must not be tainted.
-        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
-        guard.assertPrimaryClean(System.getenv());
-
-        // CB-501: refuse to start if the bind is wider than the auth mode can defend. Under
-        // loopback-trust, "not a known worker" means "the primary" — sound only because the OS
-        // refuses remote connections to a loopback socket. This throws rather than warns so the
-        // dangerous configuration cannot be reached by ignoring a log line.
-        cfg.validateAuthExposure();
-        cfg.validateLeadScan();
-        // CB-542: a subscription:true profile whose env: reseats ANTHROPIC_BASE_URL/AUTH_TOKEN would
-        // reach an unguarded endpoint (the launcher skips SubscriptionGuard for it). Refuse at load.
-        cfg.validateSubscriptionProfiles();
-        // CB-548: every architect slot must name a configured workers: profile — the strong-model
-        // backend the future spawn lifecycle would read. A stale reference dies here, not later.
-        cfg.validateArchitects();
-
-        Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
-                ? Path.of(cfg.herdrSocket())
-                : UnixSocketHerdrClient.defaultSocketPath();
-
-        UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect(socket, new com.fasterxml.jackson.databind.ObjectMapper());
-
-        AgentControl agents = new AgentControl(herdr);
-        WorkspaceControl spaces = new WorkspaceControl(herdr);
-        // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
-        // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
-        // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
-        Map<String, BridgedConfig.Worker> claudeProfiles = new LinkedHashMap<>();
-        Map<String, BridgedConfig.Worker> opencodeProfiles = new LinkedHashMap<>();
-        cfg.workerProfiles().forEach((name, w) -> {
-            if (w.isOpenCode()) {
-                opencodeProfiles.put(name, w);
-            } else {
-                claudeProfiles.put(name, w);
-            }
-        });
-        List<HerdrPeerLauncher> adapters = new ArrayList<>();
-        // The claude-code adapter is the always-present default; keep it even with no profiles (so a
-        // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
-        // unless opencode is the only kind configured.
-        if (!claudeProfiles.isEmpty() || opencodeProfiles.isEmpty()) {
-            adapters.add(new ClaudeCodeLauncher(agents, spaces, guard,
-                    claudeProfiles, cfg.defaultProfile(), System::getenv,
-                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs()));
-        }
-        if (!opencodeProfiles.isEmpty()) {
-            adapters.add(new OpenCodeLauncher(agents, spaces,
-                    opencodeProfiles, cfg.defaultProfile(), System::getenv,
-                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs()));
-        }
-        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
-        PeerLauncher workers = new CompositePeerLauncher(
-                adapters,
-                cfg.defaultProfile(),
-                cfg.workerProfiles(),
-                PlacementPolicies.fromName(cfg.placement()),
-                profileName -> liveCountRef.get().apply(profileName));
-        // CB-504: under supervision (launchd/systemd) bridged can start before herdr's socket
-        // exists. The client itself is lazy — it connects per call — but the orphan reap below is
-        // the first thing that actually talks to herdr, so without this wait a boot-order race
-        // would crash the daemon into a restart loop. Wait, then degrade rather than die: serving
-        // with /healthz reporting "degraded" is strictly more useful than exiting.
-        if (awaitHerdr(herdr)) {
-            // CB-117: herdr keeps worker panes alive across a daemon restart, and their ids died
-            // with the previous process — reap those leaked orphans now, before we start serving.
-            workers.reapOrphanWorkers();
-        } else {
-            log.warn("herdr did not answer within {}s — starting anyway; /healthz will report "
-                    + "degraded until it comes up. Orphaned worker panes (if any) were NOT reaped.",
-                    HERDR_WAIT_SECONDS);
-        }
-
-        // CB-301: authoritative session registry + lifecycle FSM on top of ClaudeCodeLauncher.
-        // CB-301-ext: worktree provisioning seam, optionally rooted at a configured directory.
-        // CB-303 part 2: context cap is opt-in and disabled (0) when absent/null.
-        int contextCap = 0;
-        if (cfg.lifecycle() != null && cfg.lifecycle().contextCap() != null
-                && cfg.lifecycle().contextCap() > 0) {
-            contextCap = cfg.lifecycle().contextCap();
-        }
-        boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
-                System::nanoTime, contextCap, clearAfterTurn);
-        liveCountRef.set(profileName -> (int) sessions.roster().stream()
-                .filter(s -> profileName.equals(s.profile()))
-                .count());
-
-        // CB-303 part 1: idle-ttl reaper — only when configured, defaults to disabled.
-        final SessionReaper reaper;
-        if (cfg.lifecycle() != null
-                && cfg.lifecycle().idleTtlSeconds() != null
-                && cfg.lifecycle().idleTtlSeconds() > 0) {
-            reaper = new SessionReaper(sessions, cfg.lifecycle().idleTtlSeconds());
-            reaper.start();
-        } else {
-            reaper = null;
-        }
-
-        // CB-530: every pane the config names as a lead, merged from `leaders:` and the legacy
-        // singular pin. PrimaryRegistry below still tracks ONE terminal — it addresses the push
-        // loop's nudges, which need a single destination — so it keeps the legacy pin.
-        Map<String, String> leadTerminals = cfg.leaderTerminals();
-        if (leadTerminals.size() > 1) {
-            log.info("leads: {} panes recognised {}", leadTerminals.size(), leadTerminals.values());
-        }
-        // CB-531: on top of the static registry, discover leads by the tab labels the operator
-        // writes. Opt-in, so a config with no `leadScan:` block resolves exactly as it did under
-        // CB-530 — the supplier is then a constant and never touches herdr.
-        final Supplier<Map<String, String>> leads;
-        if (cfg.leadScan() != null) {
-            var scan = cfg.leadScan();
-            Set<String> workerSpaces = cfg.workerProfiles().values().stream()
-                    .map(BridgedConfig.Worker::workspace)
-                    .filter(Objects::nonNull)
-                    .collect(Collectors.toSet());
-            leads = new LeadTabScanner(herdr, scan.tabPrefix(), workerSpaces, leadTerminals,
-                    TimeUnit.SECONDS.toNanos(scan.intervalSeconds()), System::nanoTime);
-            log.info("lead scan: tabs labelled '{}…' host a lead (rescan every {}s, worker spaces {} "
-                            + "excluded)",
-                    scan.tabPrefix(), scan.intervalSeconds(), workerSpaces);
-        } else {
-            leads = () -> leadTerminals;
-        }
-
-        // CB-548: config-declared architect slots. Slots live in config (name → strong-model
-        // profile); the terminal → slot binding is the live half, sourced from the slots' declared
-        // terminals today and swapped for a live binding by the later spawn lifecycle. The registry
-        // is what CallerResolver resolves against and what that lifecycle will read profiles from;
-        // nothing here spawns a slot.
-        ArchitectRegistry architects = new ArchitectRegistry(
-                cfg.architects() == null ? Map.of() : cfg.architects(),
-                () -> cfg.architectTerminals());
-        if (!architects.slots().isEmpty()) {
-            log.info("architect slots: {} configured {}, terminals {}", architects.slots().size(),
-                    architects.slots().keySet(), cfg.architectTerminals().keySet());
-        }
-
-        // Status-gated injector (CB-103): the single writer into workers, fed by a poller.
-        // The blocking message endpoint (CB-104) is the producer; the poller is inert until then.
-        // CB-106: a confirmed turn completion resolves a blocked send whose worker never replied.
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver completion = new CompletionResolver(agents, rendezvous);
-        // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
-        // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
-        WorkerPresence presence = sessions.asPresence();
-        TurnListener turnListener = new TurnListener() {
-            @Override
-            public void onTurnComplete(String target) {
-                completion.onTurnComplete(target);
-                sessions.onTurnComplete(target);
-            }
-
-            @Override
-            public boolean hasPostTurnAction(String target) {
-                return sessions.hasPostTurnAction(target);
-            }
-
-            @Override
-            public boolean onTurnCompleteWithPostAction(String target) {
-                completion.resolveBeforePostAction(target);
-                return sessions.onTurnCompleteWithPostAction(target);
-            }
-
-            @Override
-            public void onDelivered(String target) {
-                completion.onDelivered(target);
-                sessions.onDelivered(target);
-            }
-
-            @Override
-            public void onTurnFailed(String target) {
-                completion.onTurnFailed(target);
-                sessions.onTurnFailed(target);
-            }
-        };
-        Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
-                presence::forget);
-        StatusPoller poller = new StatusPoller(agents, injector, INJECT_POLL_MILLIS);
-        poller.start();
-
-        // CB-307: reply inbox. A broker: block (with a uri) selects the AMQP-backed durable adapter;
-        // absent, bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
-        // connection, so keep the reference to close it in the ordered shutdown hook.
-        final ReplyInbox replyInbox;
-        if (cfg.broker() != null && cfg.broker().isConfigured()) {
-            replyInbox = AmqpReplyInbox.open(cfg.broker().uri());
-            log.info("reply inbox: AMQP broker (durable) at {}", cfg.broker().uri());
-        } else {
-            replyInbox = new InMemoryReplyInbox();
-            log.info("reply inbox: in-memory (soft-state)");
-        }
-        // CB-307: learn the primary's terminal from orchestration tool calls (or pin from config).
-        // The pin also feeds CallerResolver below: a primary running inside a herdr pane would
-        // otherwise resolve as a worker and be refused every orchestration tool.
-        String pinnedPrimaryTerminal = cfg.primary() != null ? cfg.primary().terminal() : null;
-        PrimaryRegistry primaryRegistry = new PrimaryRegistry(pinnedPrimaryTerminal);
-        // CB-532: `primary.terminal` is superseded and no longer needed for either of its jobs —
-        // identity comes from `leaders:`/`leadScan:`, and reply nudges now follow the delegating
-        // lead. Say so once at startup rather than leaving a redundant pin to look load-bearing.
-        if (pinnedPrimaryTerminal != null && !pinnedPrimaryTerminal.isBlank()) {
-            log.warn("primary.terminal is DEPRECATED (CB-532) and can be deleted: identity now comes "
-                    + "from leaders:/leadScan:, and reply nudges follow the lead that delegated. "
-                    + "It still works, and is still the fallback nudge destination when a restart "
-                    + "has lost the delegation map. Its pushReminders/pushBackoffMs stay valid.");
-        }
-        // CB-307: active push-to-primary loop — nudge the primary when replies land without an
-        // open bridge_send. Uses its own lightweight scheduled executor, separate from the injector.
-        int maxReminders = cfg.primary() != null ? cfg.primary().remindersOrDefault() : 5;
-        long backoffMs = cfg.primary() != null ? cfg.primary().backoffMsOrDefault() : 15_000L;
-        var pushScheduler = Executors.newSingleThreadScheduledExecutor(r ->
-                Thread.ofVirtual().name("bridge-push-").unstarted(r));
-        // CB-502: the registry is built before the service and the push loop so send/reply outcomes
-        // are counted at their single funnel rather than at each of the two caller-facing surfaces.
-        // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
-        Metrics metrics = BridgedMetrics.create(sessions, replyInbox);
-        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
-                pushScheduler, maxReminders, backoffMs, metrics);
-        MessageService messages = new MessageService(agents, injector, rendezvous, replyInbox,
-                pushLoop, metrics);
-
-        // CB-520: the reply inbox only consumes for agents this gateway owns. own on acquire,
-        // release on teardown. Do this before CB-516 so the inbox is owned before any reply can land.
-        sessions.onAcquire(replyInbox::own);
-        // CB-516: releasing a worker must fail whatever send was waiting on it. Without this a
-        // torn-down delegation kept reporting PENDING until the 30-minute async timeout, and never
-        // reached /metrics — the delegation was unresolvable and nothing said so.
-        sessions.onRelease(terminal -> {
-            messages.abandon(terminal, "the worker session was released before it replied");
-            replyInbox.release(terminal);
-            primaryRegistry.forgetDelegation(terminal); // CB-532: don't leak the lead binding
-        });
-
-        // MCP server face (CB-105): bridge_send/bridge_reply/bridge_status, mounted at /mcp.
-        // Caller identity is resolved from the connection (peer PID → herdr pane), not arguments.
-        ConnectionIdentity identity = new ConnectionIdentity(
-                new PaneLocator(herdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
-
-        // CB-501: one resolver behind both entry paths. Worker identity still comes from the
-        // connection and is never token-gated, so enabling token mode cannot lock the fleet out.
-        final CallerResolver callers;
-        if (cfg.auth().tokenMode()) {
-            String token = System.getenv(cfg.auth().tokenEnv());
-            if (token == null || token.isBlank()) {
-                throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
-                        + " is unset or empty — export it before starting bridged");
-            }
-            callers = CallerResolver.withLeadsAndArchitects(identity, true, token, leads,
-                    architects::terminalBindings);
-            log.info("auth: token mode (bearer required for non-worker callers, env {})",
-                    cfg.auth().tokenEnv());
-        } else {
-            callers = CallerResolver.withLeadsAndArchitects(identity, false, null, leads,
-                    architects::terminalBindings);
-            log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
-        }
-
-        BridgeMcp mcp = new BridgeMcp(messages, workers, sessions, identity, presence,
-                primaryRegistry, callers, metrics);
-
-        // CB-303 part 3: single ordered shutdown hook. Drain sessions first while herdr is still
-        // open (so releases reach the daemon), then stop poller/message/mcp/reaper, and close herdr
-        // last. This replaces the earlier independent hooks that could race and close herdr early.
-        Runtime.getRuntime().addShutdownHook(new Thread(() -> {
-            sessions.close(cfg.lifecycle() != null ? cfg.lifecycle().drainTimeoutSeconds() : null);
-            poller.stop();
-            messages.close();
-            pushLoop.close();
-            mcp.close();
-            if (reaper != null) reaper.stop();
-            // Release the broker connection last among message resources (no-op for the in-memory inbox).
-            if (replyInbox instanceof AutoCloseable closeable) {
-                try {
-                    closeable.close();
-                } catch (Exception e) {
-                    log.debug("reply inbox close: {}", e.toString());
-                }
-            }
-            herdr.close();
-        }));
-
-        Javalin app = new BridgedApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
-                callers, metrics).build();
-        app.start(cfg.bind().host(), cfg.bind().port());
-        log.info("bridged listening on {}:{}, herdr socket {}",
-                cfg.bind().host(), cfg.bind().port(), socket);
-    }
-
-    /**
-     * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a worker whose
-     * agent has connected the bridge MCP, <em>or</em> a lead.
-     *
-     * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> worker's boot
-     * window, where herdr already reports {@code idle} but the TUI would drop an injected paste. That
-     * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
-     * (or labelled its tab) only once it was up, so there is no boot window to guard.
-     *
-     * <p>A lead is also never enrolled in {@link WorkerPresence} — {@code BridgeMcp} marks presence
-     * only for a worker, deliberately, since that map doubles as the worker roster's availability
-     * signal and a lead counted there would show up as an available worker. So without the second
-     * disjunct a lead is permanently un-deliverable: every lead→lead send sat on the gate for
-     * {@code READINESS_GRACE_POLLS} (~60s) and then failed having never been typed into the pane.
-     *
-     * <p>The lead set is read through the supplier on each call rather than snapshotted, so a lead
-     * discovered by {@code leadScan} after startup becomes deliverable without a restart.
-     */
-    static Predicate<String> deliverableTo(WorkerPresence presence, Supplier<Map<String, String>> leads) {
-        return target -> presence.isPresent(target) || leads.get().containsKey(target);
-    }
-
-    /**
-     * Poll herdr's {@code ping} until it answers or {@link #HERDR_WAIT_SECONDS} elapses (CB-504).
-     *
-     * @return true if herdr answered, false if it never did
-     */
-    private static boolean awaitHerdr(HerdrClient herdr) {
-        long deadline = System.nanoTime() + HERDR_WAIT_SECONDS * 1_000_000_000L;
-        boolean waited = false;
-        while (true) {
-            try {
-                herdr.call("ping");
-                if (waited) {
-                    log.info("herdr is up");
-                }
-                return true;
-            } catch (HerdrException e) {
-                if (System.nanoTime() >= deadline) {
-                    return false;
-                }
-                if (!waited) {
-                    log.info("waiting up to {}s for the herdr socket…", HERDR_WAIT_SECONDS);
-                    waited = true;
-                }
-                try {
-                    Thread.sleep(HERDR_WAIT_POLL_MILLIS);
-                } catch (InterruptedException ie) {
-                    Thread.currentThread().interrupt();
-                    return false;
-                }
-            }
-        }
-    }
-
-    private Bridged() {
-    }
-}

bridged/src/main/java/dev/ltms/bridged/auth/ArchitectRegistry.java

@@ -1,73 +0,0 @@
-package dev.ltms.bridged.auth;
-
-import dev.ltms.bridged.config.BridgedConfig;
-
-import java.util.Map;
-import java.util.function.Supplier;
-
-/**
- * The architect-slot registry (CB-548): every gateway-local architect name and the strong-model
- * profile it points at, plus the live binding from a live architect's herdr terminal to its slot.
- *
- * <p>Two halves, split by who owns each:
- * <ul>
- *   <li><b>slots</b> — configured once, keyed by the gateway-local unique name; each carries the
- *       {@code profile} reference the <em>future</em> spawn lifecycle will read when it stands the
- *       slot up. A read-only snapshot taken at construction.</li>
- *   <li><b>terminal bindings</b> — a {@link Supplier} consulted on every read, so a binding
- *       injected <em>after</em> startup (an operator pin, or the later lifecycle once it spawns a
- *       session) takes effect without a restart. {@link CallerResolver} reads this to turn a pane
- *       into an {@link Role#ARCHITECT}.</li>
- * </ul>
- *
- * <p>Spawning/lifecycle is deliberately a separate unit: this class only exposes the map the
- * resolver resolves against and the profile lookup that lifecycle will call. Nothing here
- * creates or manages an architect session.
- */
-public final class ArchitectRegistry {
-
-    private final Map<String, BridgedConfig.Architect> slots;
-    private final Supplier<Map<String, String>> terminalBindings;
-
-    public ArchitectRegistry(Map<String, BridgedConfig.Architect> slots,
-                             Supplier<Map<String, String>> terminalBindings) {
-        this.slots = slots == null ? Map.of() : Map.copyOf(slots);
-        this.terminalBindings = terminalBindings == null ? Map::of : terminalBindings;
-    }
-
-    /** The configured slots, keyed by gateway-local unique name. Unmodifiable snapshot. */
-    public Map<String, BridgedConfig.Architect> slots() {
-        return slots;
-    }
-
-    /**
-     * The live {@code terminal_id → slot name} bindings, re-read on every call.
-     *
-     * <p>Passed to {@link CallerResolver} as the source of architect identity, and what
-     * {@code bridge_whoami}/the roster will read to say which slot a pane hosts.
-     */
-    public Map<String, String> terminalBindings() {
-        return terminalBindings.get();
-    }
-
-    /** The slot a live terminal is bound to, or {@code null} if it is no architect slot. */
-    public String slotForTerminal(String terminal) {
-        return terminal == null ? null : terminalBindings.get().get(terminal);
-    }
-
-    /**
-     * The strong-model profile a slot runs under — what the future spawn lifecycle reads.
-     *
-     * @return the slot's configured {@code profile}, or {@code null} if the slot is unknown or
-     *         declares none
-     */
-    public String profileForSlot(String slotName) {
-        BridgedConfig.Architect a = slots.get(slotName);
-        return (a == null || a.profile() == null) ? null : a.profile();
-    }
-
-    /** True when {@code slotName} is a configured architect slot. */
-    public boolean isSlot(String slotName) {
-        return slots.containsKey(slotName);
-    }
-}

bridged/src/main/java/dev/ltms/bridged/config/BridgedConfig.java

@@ -1,830 +0,0 @@
-package dev.ltms.bridged.config;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-import java.io.UncheckedIOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.Collections;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-/**
- * {@code bridged} configuration, loaded from a YAML file (see
- * {@code bridged.example.yaml}). Unknown keys are ignored so config can grow ahead
- * of the code — but an unknown <em>top-level</em> key is logged as a WARN at load (CB-530), because
- * silently dropping a whole block is indistinguishable from honouring it.
- *
- * @param bind          REST/MCP listen host:port
- * @param herdrSocket   path to herdr's Unix socket ({@code null} → client default)
- * @param worker        single worker profile (legacy; superseded by {@code workers})
- * @param workers       named worker profiles, keyed by profile name (multi-backend fleet)
- * @param defaultWorker which {@code workers} key a no-argument spawn uses ({@code null} → the
- *                      single {@code worker}, or the sole/first profile)
- * @param guard         subscription-boundary allowlist
- * @param worktreeRoot  nullable root directory for provisioned worktrees; defaults to a sibling
- *                      of the repo root
- * @param lifecycle             session lifecycle limits ({@code null} = all disabled)
- * @param spawnReadyTimeoutMs   max ms to wait for a spawned worker to reach an injectable state
- *                              ({@code null} / 0 disables the poll gate — legacy non-blocking behaviour)
- * @param spawnReadyPollMs      poll interval while waiting for the worker to become injectable
- * @param broker        external AMQP broker for durable reply delivery ({@code null} → in-memory,
- *                      soft-state {@code ReplyInbox}; present → the AMQP-backed adapter, CB-307 Stage 2)
- * @param primary       optional pinned primary terminal config ({@code null} → derived from connection);
- *                      a non-blank {@code terminal} seeds {@code PrimaryRegistry} and prevents
- *                      connection-derived overrides, CB-307
- * @param leaders       named panes that orchestrate rather than are orchestrated (CB-530), keyed by
- *                      lead name; supersedes the singular {@code primary} pin, which stays honoured.
- *                      See {@link #leaderTerminals()} for how the two merge
- * @param architects    CB-548 architect slots, keyed by gateway-local unique slot name; each points
- *                      at a strong-model profile, and the identity a live session is matched by is
- *                      its {@code terminal} binding (see {@link #architectTerminals()}). A slot is
- *                      the hook the future spawn lifecycle reads a profile back from — nothing here
- *                      spawns it.
- * @param leadScan      opt-in discovery of leads by tab label (CB-531); {@code null} ⇒ no scanning,
- *                      and only {@code leaders:}/{@code primary:} name a lead
- * @param placement     how to choose a worker profile for an unqualified spawn:
- *                      {@code fixed} (default), {@code round-robin}, or {@code weighted}
- * @param auth          API authentication mode ({@code null} → {@code loopback-trust}, the
- *                      historical behaviour), CB-501
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public record BridgedConfig(
-        Bind bind,
-        String herdrSocket,
-        Worker worker,
-        Map<String, Worker> workers,
-        String defaultWorker,
-        Guard guard,
-        String worktreeRoot,
-        Lifecycle lifecycle,
-        Integer spawnReadyTimeoutMs,
-        Integer spawnReadyPollMs,
-        Broker broker,
-        Primary primary,
-        Map<String, Leader> leaders,
-        Map<String, Architect> architects,
-        LeadScan leadScan,
-        String placement,
-        Auth auth) {
-
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Bind(String host, int port) {
-        public Bind {
-            if (host == null || host.isBlank()) host = "127.0.0.1";
-            if (port <= 0) port = 8765;
-        }
-    }
-
-    /**
-     * @param profile   ccs profile a worker is spawned under (Stage-1: {@code ltms-local})
-     * @param baseUrl   the off-subscription endpoint injected as {@code ANTHROPIC_BASE_URL}
-     * @param model     model alias, injected as {@code ANTHROPIC_MODEL} (may be {@code null})
-     * @param configDir {@code CLAUDE_CONFIG_DIR} so the worker inherits the profile's
-     *                  skills/MCP/hooks (may be {@code null})
-     * @param tokenEnv  name of the host env var holding the worker's auth token; its value
-     *                  is injected as {@code ANTHROPIC_AUTH_TOKEN} (never stored in config)
-     * @param argv      launch command; defaults to {@code ["claude"]}
-     * @param placement where a worker lands: {@code "tab"} (default — its own tab in the
-     *                  worker space) or {@code "pane"} (legacy — split the focused tab)
-     * @param workspace label of the dedicated worker space; found-or-created on first
-     *                  spawn (default {@code "bridged-workers"}). A future per-session
-     *                  layout is just a distinct label here — the shared space is default.
-     * @param tabLabel  template for a worker tab's label; {@code {profile}}/{@code {model}}
-     *                  and {@code {n}} (per-worker number, to keep sibling tabs distinct)
-     *                  are substituted (default {@code "worker: {profile} #{n}"})
-     * @param mcpUrl         bridge MCP URL to provision into the worker's {@code configDir} so it
-     *                       can call {@code bridge_reply} ({@code null}/blank → no provisioning; the
-     *                       worker won't reply, only the fallback/timeout resolves the send)
-     * @param cwd            fixed working directory for this profile's workers (CB-112 "told otherwise");
-     *                       {@code null}/blank → inherit the primary's cwd, else the daemon's
-     * @param parityOverlay  repo-relative paths copied primary→worktree for config parity; null/empty
-     *                       defaults to a sensible set of local config files
-     * @param gitTokenEnv    name of the host env var holding the git-forge API token; when set, its
-     *                       value is injected as {@code GITEA_TOKEN} so the worker can open its own PR
-     *                       at checkpoint (CB-302). {@code null}/blank ⇒ no token is injected
-     *                       (minimal-grant default — push over SSH stays free, PR-create is opt-in)
-     * @param gitHostEnv     name of the host env var holding the forge host (default {@code GITEA_HOST});
-     *                       injected as {@code GITEA_HOST} <em>only</em> when {@code gitTokenEnv} is set
-     * @param weight         relative selection weight for {@code placement: weighted}. Absent or
-     *                       non-positive ⇒ 1.0. Weights are normalised by the policy, so they need
-     *                       not sum to 1.0.
-     * @param maxLoad         max live workers allowed on this profile at one time; absent or
-     *                       non-positive ⇒ unlimited. Live means any session the registry still owns
-     *                       (acquired and not yet released), in any state.
-     * @param kind           which peer launcher spawns this profile: {@code "claude-code"} (default —
-     *                       the {@link dev.ltms.bridged.worker.ClaudeCodeLauncher}) or {@code "opencode"}.
-     *                       The {@code CompositePeerLauncher} routes {@code spawn}/reap by this value, so
-     *                       each adapter drives only its own kind. Normalised to lower-case; blank ⇒ the
-     *                       default. It selects the adapter, not the transport — placement, tabs, cwd, and
-     *                       the readiness gate are kind-independent and stay in the shared base.
-     * @param subscription  {@code true} to run this profile's workers on the operator's Claude
-     *                       subscription, on purpose (CB-539). When set, the launcher neither requires
-     *                       nor injects {@code ANTHROPIC_BASE_URL} / {@code ANTHROPIC_AUTH_TOKEN}, and the
-     *                       {@code SubscriptionGuard} base_url requirement is skipped <em>for this
-     *                       profile only</em>. Absent/{@code false} (the default) keeps today's hard
-     *                       refusal: a claude-code profile with no base_url may not spawn, because
-     *                       spawning one would bill the subscription. Mutually exclusive with
-     *                       {@code baseUrl} — setting both is a configuration error (the two state
-     *                       opposite intents). For the same reason, an {@code env:} entry naming
-     *                       {@code ANTHROPIC_BASE_URL} or {@code ANTHROPIC_AUTH_TOKEN} is refused at
-     *                       config load (CB-542): on the subscription path no guard would vet it.
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Worker(String profile, String baseUrl, String model,
-                         String configDir, String tokenEnv, List<String> argv,
-                         String placement, String workspace, String tabLabel, String mcpUrl,
-                         String cwd,
-                         List<String> parityOverlay,
-                         String gitTokenEnv, String gitHostEnv,
-                         String kind,
-                         Map<String, String> env,
-                         Float weight,
-                         Integer maxLoad,
-                         Boolean subscription) {
-
-        /** Peer kind spawned by {@link dev.ltms.bridged.worker.ClaudeCodeLauncher} (the default). */
-        public static final String KIND_CLAUDE_CODE = "claude-code";
-        /** Peer kind spawned by the opencode adapter (CB-402). */
-        public static final String KIND_OPENCODE = "opencode";
-
-        public Worker {
-            // A claude-code worker defaults its launch command to `claude`; other kinds carry their own
-            // argv (e.g. `opencode`) and must not inherit the Claude binary — so only default when unset
-            // AND this is the claude-code kind.
-            String k = (kind == null || kind.isBlank()) ? KIND_CLAUDE_CODE : kind.toLowerCase();
-            argv = (argv == null || argv.isEmpty())
-                    ? (KIND_CLAUDE_CODE.equals(k) ? List.of("claude") : List.of(k))
-                    : List.copyOf(argv);
-            kind = k;
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_WORKER_TOKEN" : tokenEnv;
-            placement = (placement == null || placement.isBlank()) ? "tab" : placement.toLowerCase();
-            workspace = (workspace == null || workspace.isBlank()) ? "bridged-workers" : workspace;
-            tabLabel = (tabLabel == null || tabLabel.isBlank()) ? "worker: {profile} #{n}" : tabLabel;
-            // CB-525: .mcp.json is deliberately NOT here. Replicating the primary's MCP config gave a
-            // worker the primary's IDE servers, which are bound to the primary's checkout — so its
-            // navigation returned paths outside its own worktree. GitWorktrees now neutralizes that
-            // file instead; a worker's tools are whatever its launcher mounts.
-            parityOverlay = (parityOverlay == null || parityOverlay.isEmpty())
-                    ? List.of(".claude/settings.local.json", ".env", ".envrc")
-                    : List.copyOf(parityOverlay);
-            // gitTokenEnv stays null when unset (opt-in). gitHostEnv defaults so operators enabling
-            // checkpoints need only set gitTokenEnv; it is injected only alongside a resolved token.
-            gitHostEnv = (gitHostEnv == null || gitHostEnv.isBlank()) ? "GITEA_HOST" : gitHostEnv;
-            env = (env == null) ? Map.of() : Map.copyOf(env);
-            weight = (weight == null || weight <= 0.0f) ? 1.0f : weight;
-            maxLoad = (maxLoad == null || maxLoad <= 0) ? null : maxLoad;
-            subscription = (subscription != null && subscription) ? Boolean.TRUE : Boolean.FALSE;
-        }
-
-        /**
-         * Backward-compatible constructor without the CB-302 git-forge fields — the worker is
-         * granted no PR-create token (push over SSH is unaffected). Keeps pre-CB-302 call sites
-         * (and any {@code workers:} YAML that omits the git keys) working unchanged.
-         */
-        public Worker(String profile, String baseUrl, String model,
-                      String configDir, String tokenEnv, List<String> argv,
-                      String placement, String workspace, String tabLabel, String mcpUrl,
-                      String cwd, List<String> parityOverlay) {
-            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, null, null, null, null, null, null, null);
-        }
-
-        /**
-         * Backward-compatible constructor with the CB-302 git-forge fields but no explicit peer
-         * {@code kind} — defaults to {@link #KIND_CLAUDE_CODE}. Keeps pre-CB-402 call sites working.
-         */
-        public Worker(String profile, String baseUrl, String model,
-                      String configDir, String tokenEnv, List<String> argv,
-                      String placement, String workspace, String tabLabel, String mcpUrl,
-                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv) {
-            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, null, null, null, null, null);
-        }
-
-        /**
-         * Backward-compatible constructor without the CB-511 {@code env:} passthrough — the worker
-         * gets the daemon's PATH and nothing else. Keeps pre-CB-511 call sites working.
-         */
-        public Worker(String profile, String baseUrl, String model,
-                      String configDir, String tokenEnv, List<String> argv,
-                      String placement, String workspace, String tabLabel, String mcpUrl,
-                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
-                      String kind) {
-            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, null, null, null, null);
-        }
-
-        /** A copy with {@code profile} set — used to default a profile to its {@code workers} key. */
-        public Worker withProfile(String p) {
-            return new Worker(p, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, subscription);
-        }
-
-        /** True when this profile is served by the Claude Code adapter (the default kind). */
-        public boolean isClaudeCode() {
-            return KIND_CLAUDE_CODE.equals(kind);
-        }
-
-        /** True when this profile is served by the opencode adapter (CB-402). */
-        public boolean isOpenCode() {
-            return KIND_OPENCODE.equals(kind);
-        }
-
-        /**
-         * True when this profile runs on the operator's Claude subscription, on purpose (CB-539).
-         * Absent/{@code false} (the default) keeps the hard refusal: a claude-code profile with no
-         * base_url may not spawn, because doing so would bill the subscription.
-         */
-        public boolean isSubscription() {
-            return Boolean.TRUE.equals(subscription);
-        }
-
-        /**
-         * Backward-compatible constructor without the CB-539 subscription flag — the worker stays on
-         * the off-subscription boundary (the default). Keeps pre-CB-539 call sites (and any YAML
-         * that omits the flag) compiling and behaving identically.
-         */
-        public Worker(String profile, String baseUrl, String model,
-                      String configDir, String tokenEnv, List<String> argv,
-                      String placement, String workspace, String tabLabel, String mcpUrl,
-                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
-                      String kind, Map<String, String> env, Float weight, Integer maxLoad) {
-            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, null);
-        }
-
-        /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */
-        public boolean hasGitToken() {
-            return gitTokenEnv != null && !gitTokenEnv.isBlank();
-        }
-
-        /**
-         * True when this profile's {@code env:} block names a worker-side Anthropic binding variable.
-         * Those two keys are the adapter's, never the operator's: on a claude-code worker
-         * {@code ANTHROPIC_BASE_URL} is the endpoint the {@code SubscriptionGuard} vetted, and
-         * {@code ANTHROPIC_AUTH_TOKEN} is injected from {@code tokenEnv}. An {@code env:} entry for
-         * either is a bypass vector — it is what the subscription path would otherwise let survive
-         * unguarded — so it is rejected at config load (see
-         * {@link BridgedConfig#validateSubscriptionProfiles()}).
-         */
-        public boolean envCarriesAnthropicBinding() {
-            return env != null
-                    && (env.containsKey("ANTHROPIC_BASE_URL") || env.containsKey("ANTHROPIC_AUTH_TOKEN"));
-        }
-
-        /** True when workers should land in their own tab in the worker space. */
-        public boolean tabPlacement() {
-            return "tab".equals(placement);
-        }
-
-        /** True when the bridge MCP should be mounted into a spawned worker (via launch flags). */
-        public boolean hasMcp() {
-            return mcpUrl != null && !mcpUrl.isBlank();
-        }
-
-        /**
-         * Render {@link #tabLabel} for the {@code n}-th worker (substitutes
-         * {@code {profile}}/{@code {model}}/{@code {n}}), so sibling worker tabs are distinct.
-         */
-        public String renderTabLabel(long n) {
-            return tabLabel
-                    .replace("{profile}", profile == null ? "" : profile)
-                    .replace("{model}", model == null ? "" : model)
-                    .replace("{n}", Long.toString(n));
-        }
-    }
-
-    /**
-     * Session lifecycle limits. All knobs are opt-in: {@code null} or {@code 0} disables the
-     * feature so existing configs keep the previous behaviour.
-     *
-     * @param idleTtlSeconds     max seconds a {@code READY}/{@code DONE} session may sit idle
-     *                           before it is reaped ({@code null} → disabled)
-     * @param contextCap          max delegated turns a session serves before force-release
-     *                           ({@code null} → disabled)
-     * @param drainTimeoutSeconds seconds to wait for {@code BUSY} sessions to finish before
-     *                           forced teardown on shutdown (default 5 when unset)
-     * @param clearAfterTurn      whether a reusable worker discards its conversation context after
-     *                           every completed delegated turn (default false)
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Lifecycle(Integer idleTtlSeconds, Integer contextCap, Integer drainTimeoutSeconds,
-                            boolean clearAfterTurn) {
-    }
-
-    /**
-     * External AMQP broker for durable, cross-restart reply delivery (CB-307 Stage 2). Its mere
-     * presence swaps the in-memory {@code ReplyInbox} for the AMQP-backed adapter; absent, bridged
-     * stays soft-state. Production default is LavinMQ; a stock RabbitMQ speaks the same AMQP 0-9-1
-     * and is a URI-only swap.
-     *
-     * @param uri AMQP connection URI, e.g. {@code amqp://guest:guest@127.0.0.1:5672/}. Blank/{@code null}
-     *            ⇒ the broker block is treated as absent (in-memory adapter).
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Broker(String uri) {
-
-        /** True when a usable broker URI is configured (an empty block does not enable AMQP). */
-        public boolean isConfigured() {
-            return uri != null && !uri.isBlank();
-        }
-    }
-
-    /**
-     * Optional pinned primary terminal config (CB-307). When present with a non-blank
-     * {@code terminal}, the bridge uses this as the primary's herdr identity instead of
-     * deriving it from the MCP connection. It feeds two consumers: the push loop (where to nudge
-     * when replies land), and caller resolution — a caller whose connection maps to this pane is
-     * the primary, where the pane match would otherwise classify it as a worker. Pin it when the
-     * primary runs <em>inside</em> a herdr pane; it also helps off-host or non-herdr primaries,
-     * where connection-derived identity is unavailable and only the nudge target matters.
-     *
-     * @param terminal       the primary's herdr {@code terminal_id} ({@code null}/blank → derive)
-     * @param pushReminders  max reminder nudges before giving up (default 5)
-     * @param pushBackoffMs  delay between reminders in ms (default 15000)
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Primary(String terminal, Integer pushReminders, Integer pushBackoffMs) {
-        /** @return configured reminder cap, or 5 */
-        public int remindersOrDefault() {
-            return pushReminders != null ? pushReminders : 5;
-        }
-
-        /** @return configured backoff in ms, or 15000 */
-        public long backoffMsOrDefault() {
-            return pushBackoffMs != null ? pushBackoffMs.longValue() : 15_000L;
-        }
-    }
-
-    /**
-     * One entry of the CB-530 {@code leaders:} registry — a pane that orchestrates rather than one
-     * that is orchestrated.
-     *
-     * <p>Why a registry and not a second {@code primary:}: {@code primary.terminal} is singular by
-     * construction, so a session in any other pane resolves as a worker. That is correct while one
-     * lead drives a fleet, and wrong the moment two leads (say an Opus lead and an opencode lead)
-     * work as peers — the second is silently demoted and refused every orchestration call.
-     *
-     * <p>{@code kind} and {@code model} are descriptive only at this stage: they document what runs
-     * in the pane and are reported back by {@code bridge_whoami}. Nothing spawns a lead — a lead
-     * pre-exists, which is precisely why it must be recognised by configuration rather than created.
-     *
-     * @param terminal the lead's herdr {@code terminal_id}; the only field identity depends on
-     * @param kind     which agent runs there ({@code claude}, {@code opencode}, …); descriptive
-     * @param model    the model or selector it runs, for operators reading the roster; descriptive
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Leader(String terminal, String kind, String model) {
-    }
-
-    /**
-     * One entry of the CB-548 {@code architects:} registry — a gateway-local named slot that points
-     * at a strong-model profile.
-     *
-     * <p>A lead and an architect differ in <em>authority</em>, not in how identity is established:
-     * both are recognised by configuration rather than spawned. A lead resolves to
-     * {@link dev.ltms.bridged.auth.Role#PRIMARY} and owns the whole lifecycle (spawn/stop/drain);
-     * an architect resolves to {@link dev.ltms.bridged.auth.Role#ARCHITECT}, which delegates turns
-     * ({@code SEND}) and replies/asks as its own pane but cannot stand up or tear down workers —
-     * lifecycle stays in one pair of hands.
-     *
-     * <p>Why a {@code profile} reference: an architect is meant to run a strong model, and the slot
-     * records which {@code workers:} profile that is — the value the future spawn lifecycle reads.
-     * It must name a configured profile, enforced by {@link #validateArchitects()} (a stale or
-     * typo'd reference fails at startup rather than silently spawning the wrong backend later).
-     *
-     * @param terminal the architect's herdr {@code terminal_id}; the field identity is matched by,
-     *                 via the live terminal→slot binding. Optional at config time — binding may be
-     *                 injected live — but a slot with no binding matches nothing yet.
-     * @param profile  the name of the strong-model {@code workers:} profile this slot runs;
-     *                 required and validated against {@link #workerProfiles()}
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Architect(String terminal, String profile) {
-    }
-
-    /**
-     * Discover leads by tab label instead of by pasted {@code terminal_id} (CB-531).
-     *
-     * <p>Why: a lead is not spawned, so its {@code terminal_id} exists only once a human has opened
-     * the tab and started the agent — which makes {@code leaders:} a three-step ritual (start it,
-     * ask it its id, edit config, restart) repeated per lead. Naming the tab is one step, done at
-     * the moment the operator is already there. The convention also survives what an id does not:
-     * close the tab and reopen it and the id changes, while the label is retyped as-is.
-     *
-     * <p>Deliberately opt-in ({@code null} ⇒ off). Turning it on widens who resolves as
-     * {@link dev.ltms.bridged.auth.Role#PRIMARY}, and a config that never asked for it must not
-     * acquire that by upgrading the daemon.
-     *
-     * <p>bridged never writes these labels — see {@link dev.ltms.bridged.herdr.LeadTabScanner} for
-     * why that one-way direction is what keeps the convention trustworthy.
-     *
-     * @param tabPrefix       label prefix marking a lead's tab, matched case-insensitively; the
-     *                        remainder is the lead's name ({@code "lead: opus-5.0"} → {@code
-     *                        opus-5.0}). Default {@code "lead:"}
-     * @param intervalSeconds how long a scan is cached before herdr is asked again; also the worst
-     *                        case before a newly-labelled tab is recognised. Default 10
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record LeadScan(String tabPrefix, Integer intervalSeconds) {
-        public LeadScan {
-            tabPrefix = (tabPrefix == null || tabPrefix.isBlank()) ? "lead:" : tabPrefix.strip();
-            intervalSeconds = (intervalSeconds == null || intervalSeconds <= 0) ? 10 : intervalSeconds;
-        }
-    }
-
-    /**
-     * The terminal → lead-name map that {@link dev.ltms.bridged.auth.CallerResolver} resolves
-     * against, merging the {@code leaders:} registry with the legacy singular {@code primary:} pin.
-     *
-     * <p>Precedence: an explicit {@code leaders:} entry wins over the {@code primary:} pin for the
-     * same terminal. The pin is the older, less expressive spelling of the same fact, so when both
-     * name a pane the named entry is the one an operator meant. The pin is still honoured on its
-     * own — a config carrying only {@code primary:} behaves exactly as it did before CB-530.
-     *
-     * @return an unmodifiable map, empty when neither block is configured (nothing is pinned, and
-     *         every pane therefore resolves as a worker — the pre-CB-307 behaviour)
-     */
-    public Map<String, String> leaderTerminals() {
-        Map<String, String> byTerminal = new LinkedHashMap<>();
-        if (leaders != null) {
-            leaders.forEach((name, leader) -> {
-                if (leader != null && leader.terminal() != null && !leader.terminal().isBlank()) {
-                    byTerminal.put(leader.terminal(), name);
-                }
-            });
-        }
-        if (primary != null && primary.terminal() != null && !primary.terminal().isBlank()) {
-            byTerminal.putIfAbsent(primary.terminal(), "primary");
-        }
-        return Collections.unmodifiableMap(byTerminal);
-    }
-
-    /**
-     * The terminal → architect-slot-name map that {@link dev.ltms.bridged.auth.CallerResolver}
-     * resolves against (CB-548), derived from the {@code architects:} registry.
-     *
-     * <p>Keyed by terminal because a live session is matched by its pane; the value is the
-     * gateway-local slot name. Slot names are inherently unique (a map key); a duplicate terminal
-     * across two slots is last-wins here (the later entry overrides), which {@code leadership} has
-     * always tolerated rather than refused. This is consumed as the <em>initial</em> live binding —
-     * the supplier that feeds the resolver may be swapped for a live one by the future lifecycle.
-     *
-     * @return an unmodifiable map, empty when no architect slot is configured
-     */
-    public Map<String, String> architectTerminals() {
-        Map<String, String> byTerminal = new LinkedHashMap<>();
-        if (architects != null) {
-            architects.forEach((name, arch) -> {
-                if (arch != null && arch.terminal() != null && !arch.terminal().isBlank()) {
-                    byTerminal.put(arch.terminal(), name);
-                }
-            });
-        }
-        return Collections.unmodifiableMap(byTerminal);
-    }
-
-    /**
-     * API authentication (CB-501). Governs how a caller that is <em>not</em> an on-host worker
-     * pane proves it is the primary.
-     *
-     * <p>Worker identity never depends on this block: a loopback peer PID that maps to a herdr
-     * pane is unforgeable and is always honoured (see
-     * {@link dev.ltms.bridged.mcp.ConnectionIdentity}). This only decides what happens for
-     * <em>everyone else</em>.
-     *
-     * @param mode     {@code "loopback-trust"} (default) — any loopback caller that is not a known
-     *                 worker is the primary, no credential needed; this is the historical
-     *                 behaviour, now chosen explicitly rather than implied. {@code "token"} — such
-     *                 a caller must present {@code Authorization: Bearer <token>} or it is
-     *                 {@code ANONYMOUS} and authorized for nothing.
-     * @param tokenEnv name of the host env var holding the bearer token; the literal value is
-     *                 never stored in config. Defaults to {@code BRIDGED_API_TOKEN}. Only read
-     *                 when {@code mode} is {@code token}.
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Auth(String mode, String tokenEnv) {
-
-        /** Historical behaviour: loopback non-worker ⇒ primary, no credential. */
-        public static final String MODE_LOOPBACK_TRUST = "loopback-trust";
-        /** A non-worker caller must present a valid bearer token to be the primary. */
-        public static final String MODE_TOKEN = "token";
-
-        public Auth {
-            mode = (mode == null || mode.isBlank()) ? MODE_LOOPBACK_TRUST : mode.toLowerCase();
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_API_TOKEN" : tokenEnv;
-        }
-
-        /** True when a bearer token is required of every non-worker caller. */
-        public boolean tokenMode() {
-            return MODE_TOKEN.equals(mode);
-        }
-    }
-
-    /**
-     * Subscription boundary. Only these hosts may back a worker's
-     * {@code ANTHROPIC_BASE_URL}; the primary must carry none.
-     *
-     * @param offSubscriptionHosts hostnames allowed for worker base_urls
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Guard(List<String> offSubscriptionHosts) {
-        public Guard {
-            offSubscriptionHosts = offSubscriptionHosts == null ? List.of() : List.copyOf(offSubscriptionHosts);
-        }
-
-        public Set<String> hostSet() {
-            return Set.copyOf(offSubscriptionHosts);
-        }
-    }
-
-    /**
-     * The effective worker profiles, keyed by profile name. Prefers the {@code workers} map (each
-     * value's {@code profile} defaulted to its key); falls back to the legacy singular {@code worker}
-     * (keyed by its own profile). Empty if neither is configured.
-     */
-    public Map<String, Worker> workerProfiles() {
-        if (workers != null && !workers.isEmpty()) {
-            Map<String, Worker> out = new LinkedHashMap<>();
-            workers.forEach((name, w) -> out.put(name,
-                    (w.profile() == null || w.profile().isBlank()) ? w.withProfile(name) : w));
-            // Deliberately NOT Map.copyOf: its iteration order is salted per JVM run, which would
-            // discard the YAML definition order built above. Placement tie-breaks on candidate
-            // order (see WeightedRoundRobinPolicy), so losing it makes equal-weight placement
-            // non-reproducible across restarts. Unmodifiable-wrap instead of copy-and-scramble.
-            return Collections.unmodifiableMap(out);
-        }
-        if (worker != null) {
-            String name = (worker.profile() == null || worker.profile().isBlank()) ? "default" : worker.profile();
-            return Map.of(name, worker);
-        }
-        return Map.of();
-    }
-
-    /**
-     * The profile a no-argument spawn uses: {@code defaultWorker} if set, else the legacy single
-     * {@code worker}'s profile, else the sole/first configured profile, else {@code null}.
-     */
-    public String defaultProfile() {
-        if (defaultWorker != null && !defaultWorker.isBlank()) {
-            return defaultWorker;
-        }
-        if (worker != null && worker.profile() != null && !worker.profile().isBlank()) {
-            return worker.profile();
-        }
-        Map<String, Worker> p = workerProfiles();
-        return p.isEmpty() ? null : p.keySet().iterator().next();
-    }
-
-    private static final Logger log = LoggerFactory.getLogger(BridgedConfig.class);
-
-    private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());
-
-    /**
-     * Top-level keys this version understands. Used only to warn about the rest — see
-     * {@link #warnUnknownTopLevelKeys}. Keep in step with the record components.
-     */
-    private static final Set<String> KNOWN_TOP_LEVEL_KEYS = Set.of(
-            "bind", "herdrSocket", "worker", "workers", "defaultWorker", "guard", "worktreeRoot",
-            "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "leaders",
-            "architects", "leadScan", "placement", "auth");
-
-    /** Load and validate config from {@code path}. */
-    public static BridgedConfig load(Path path) {
-        try {
-            String yaml = Files.readString(path);
-            warnUnknownTopLevelKeys(yaml, path);
-            BridgedConfig cfg = YAML.readValue(yaml, BridgedConfig.class);
-            return cfg.withDefaults();
-        } catch (IOException e) {
-            throw new UncheckedIOException("cannot read bridged config at " + path, e);
-        }
-    }
-
-    /**
-     * Log a WARN naming any top-level key this version does not understand (CB-530).
-     *
-     * <p>Why this exists: every record here is {@code @JsonIgnoreProperties(ignoreUnknown = true)},
-     * which is deliberate — config must be allowed to grow ahead of the code, and a rolled-back
-     * daemon must still start. The cost is that a whole block can be written, parsed, dropped, and
-     * never mentioned again. That is exactly how a hand-written {@code leaders:} registry came to
-     * look configured while being inert: the daemon started, nothing complained, and the only way
-     * to discover it was reading the config class.
-     *
-     * <p>A warning rather than a failure, on purpose. Failing closed would turn "the config names
-     * something this build has not learned yet" into a daemon that will not boot — which is the
-     * forward-compatibility this annotation was chosen to preserve. Loud, not fatal.
-     */
-    private static void warnUnknownTopLevelKeys(String yaml, Path path) {
-        List<String> unknown = unknownTopLevelKeys(yaml);
-        if (!unknown.isEmpty()) {
-            log.warn("{}: ignoring unknown top-level config key(s) {} — this build does not "
-                            + "understand them, so they have NO effect. Check for a typo, or a "
-                            + "feature not in this version.",
-                    path, unknown);
-        }
-    }
-
-    /**
-     * The top-level keys in {@code yaml} that this build does not understand, sorted. Package-private
-     * so the guardrail is asserted directly rather than through a log appender.
-     *
-     * @return empty when everything is known, or when {@code yaml} is not a mapping at all (a
-     *         malformed file is {@code readValue}'s error to report, not this method's)
-     */
-    static List<String> unknownTopLevelKeys(String yaml) {
-        Map<?, ?> raw;
-        try {
-            raw = YAML.readValue(yaml, Map.class);
-        } catch (IOException | IllegalArgumentException e) {
-            return List.of();
-        }
-        if (raw == null) {
-            return List.of();
-        }
-        return raw.keySet().stream()
-                .map(String::valueOf)
-                .filter(k -> !KNOWN_TOP_LEVEL_KEYS.contains(k))
-                .sorted()
-                .toList();
-    }
-
-    /** Fill in nested defaults so callers never see nulls for structural fields. */
-    public BridgedConfig withDefaults() {
-        Bind b = bind != null ? bind : new Bind(null, 0);
-        Guard g = guard != null ? guard : new Guard(List.of());
-        Lifecycle l = lifecycle != null ? lifecycle : new Lifecycle(null, null, null, false);
-        Integer timeout = (spawnReadyTimeoutMs != null) ? spawnReadyTimeoutMs : 20000;
-        Integer pollMs = (spawnReadyPollMs != null) ? spawnReadyPollMs : 300;
-        Auth a = auth != null ? auth : new Auth(null, null);
-        String placementOrDefault = (placement != null && !placement.isBlank()) ? placement : "fixed";
-        // broker is left as-is: null (or an empty/blank uri) keeps the in-memory soft-state inbox.
-        // primary is left as-is: null defaults to connection-derived identity.
-        // leadScan is left as-is: null is "off", and LeadScan's own compact constructor defaults the
-        // fields of a block that IS present. Defaulting it here would switch the feature on for
-        // every config that never mentioned it.
-        // architects is left as-is: null is "none configured", and Architect's fields have no
-        // defaults to fill. Defaulting it here would change nothing, so leave the call natural.
-        return new BridgedConfig(b, herdrSocket, worker, workers, defaultWorker, g, worktreeRoot, l, timeout, pollMs, broker, primary, leaders, architects, leadScan, placementOrDefault, a);
-    }
-
-    /**
-     * Reject a configuration whose network exposure outruns its authentication (CB-501).
-     *
-     * <p>{@code loopback-trust} means "any caller that is not a known worker pane is the primary" —
-     * safe only because the OS refuses non-local connections to a loopback bind. Widen
-     * {@code bind.host} without switching to {@code token} mode and that sentence becomes "any
-     * client that can reach this port is the primary", which is the most privileged role on the
-     * bus. Rather than document the hazard, make it unrepresentable: fail fast at startup.
-     *
-     * @throws IllegalStateException when a non-loopback bind is paired with {@code loopback-trust}
-     */
-    public void validateAuthExposure() {
-        String host = bind().host();
-        if (isLoopbackBind(host) || auth().tokenMode()) {
-            return;
-        }
-        throw new IllegalStateException(
-                "refusing to start: bind.host=" + host + " is not loopback, but auth.mode="
-                        + auth().mode() + ". A non-loopback bind treats every unauthenticated "
-                        + "caller as the primary (spawn/stop/send/drain on any session). Set "
-                        + "auth.mode: token (with auth.tokenEnv) before exposing this port, or "
-                        + "bind to 127.0.0.1 and put a reverse proxy in front.");
-    }
-
-    /**
-     * Reject a lead-scan convention that a worker tab would also satisfy (CB-531).
-     *
-     * <p>The scan reads a tab label and concludes "a lead lives here". bridged also <em>writes</em>
-     * tab labels — every worker gets {@code tabLabel} rendered into its tab. Choose a
-     * {@code leadScan.tabPrefix} that a worker template matches and the daemon starts labelling its
-     * own workers as leads, promoting the entire fleet to {@link dev.ltms.bridged.auth.Role#PRIMARY}
-     * with no message and no diff. The worker-space exclusion in
-     * {@link dev.ltms.bridged.herdr.LeadTabScanner} already blocks the realistic path, but defence
-     * that depends on one workspace label holding is not defence enough for a privilege boundary.
-     *
-     * <p>Fatal rather than a warning, unlike {@link #warnUnknownTopLevelKeys}: an unknown key means
-     * a feature does nothing, while this means a feature does the opposite of what it says.
-     *
-     * @throws IllegalStateException when any worker profile's {@code tabLabel} starts with the
-     *                               configured lead prefix
-     */
-    public void validateLeadScan() {
-        if (leadScan == null) {
-            return;
-        }
-        String prefix = leadScan.tabPrefix();
-        List<String> clashing = workerProfiles().entrySet().stream()
-                .filter(e -> e.getValue().tabLabel() != null
-                        && e.getValue().tabLabel().strip()
-                        .regionMatches(true, 0, prefix, 0, prefix.length()))
-                .map(Map.Entry::getKey)
-                .sorted()
-                .toList();
-        if (clashing.isEmpty()) {
-            return;
-        }
-        throw new IllegalStateException(
-                "refusing to start: leadScan.tabPrefix=\"" + prefix + "\" also matches the tabLabel "
-                        + "of worker profile(s) " + clashing + ". Every worker spawned under them "
-                        + "would be read back as a lead and granted spawn/stop/send on the whole "
-                        + "fleet. Change one of the two so worker tabs and lead tabs cannot be "
-                        + "confused.");
-    }
-
-    /**
-     * Reject a subscription profile whose {@code env:} block tries to reseat the Anthropic binding
-     * (CB-542).
-     *
-     * <p>Why this must be fatal rather than sanitised: {@code subscription: true} deliberately
-     * stops the launcher from writing {@code ANTHROPIC_BASE_URL}/{@code ANTHROPIC_AUTH_TOKEN} and
-     * skips the {@code SubscriptionGuard} for that profile. But the profile's {@code env:} map is
-     * layered into the worker environment separately, so an {@code ANTHROPIC_BASE_URL} sitting
-     * there would survive into the worker having passed no guard at all — {@code subscription: true}
-     * plus an {@code env:} repoint is a contradiction just like {@code subscription: true} plus a
-     * {@code baseUrl}. The launcher also hard-strips these two keys from the worker env as a
-     * belt-and-braces measure; this method is the loud, load-time refusal so the operator is told
-     * about the mistake instead of having it silently cleaned up.
-     *
-     * @throws IllegalStateException when any subscription profile's {@code env:} names
-     *                               {@code ANTHROPIC_BASE_URL} or {@code ANTHROPIC_AUTH_TOKEN},
-     *                               naming the profile and the offending key(s)
-     */
-    public void validateSubscriptionProfiles() {
-        List<String> bad = new java.util.ArrayList<>();
-        workerProfiles().forEach((name, w) -> {
-            if (w.isSubscription() && w.envCarriesAnthropicBinding()) {
-                List<String> keys = w.env().keySet().stream()
-                        .filter(k -> k.equals("ANTHROPIC_BASE_URL") || k.equals("ANTHROPIC_AUTH_TOKEN"))
-                        .sorted()
-                        .toList();
-                bad.add("worker profile '" + name + "' carries " + keys + " in env: — "
-                        + "subscription: true forbids ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN there, "
-                        + "because on the subscription no guard vets them (they would repoint the "
-                        + "worker past the SubscriptionGuard). Remove them from env: (or drop "
-                        + "subscription: true).");
-            }
-        });
-        if (!bad.isEmpty()) {
-            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
-        }
-    }
-
-    /**
-     * Reject an architect slot whose profile reference does not resolve (CB-548).
-     *
-     * <p>An architect's {@code profile} is the strong-model {@code workers:} profile the future
-     * spawn lifecycle will read to stand the slot up. A reference that names no configured profile
-     * is a typo or a stale config — and unlike a worker spawn (which fails loudly at its call site
-     * when it cannot resolve), an architect slot fails only when something later tries to use it.
-     * This config class <em>does</em> have access to {@link #workerProfiles()}, so the reference
-     * is validated at startup and the mistake is named then, not discovered months later by a
-     * spawn that quietly has no backend to use.
-     *
-     * <p>Slot-name uniqueness needs no check here: the registry is a {@code Map} keyed by name, so
-     * duplicates are unrepresentable by construction.
-     *
-     * @throws IllegalStateException when any architect slot is missing or names an unknown profile,
-     *                               naming the slot and the offending reference
-     */
-    public void validateArchitects() {
-        if (architects == null) {
-            return;
-        }
-        Map<String, Worker> profiles = workerProfiles();
-        List<String> bad = new java.util.ArrayList<>();
-        architects.forEach((name, arch) -> {
-            if (arch == null || arch.profile() == null || arch.profile().isBlank()) {
-                bad.add("architect slot '" + name + "' has no profile: — give it the name of a "
-                        + "workers: profile (the strong-model backend it runs).");
-                return;
-            }
-            if (!profiles.containsKey(arch.profile())) {
-                bad.add("architect slot '" + name + "' references profile '" + arch.profile()
-                        + "', which is not a configured workers: profile (have: " + profiles.keySet()
-                        + ").");
-            }
-        });
-        if (!bad.isEmpty()) {
-            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
-        }
-    }
-
-    /** True for the loopback addresses and the unspecified-but-local forms we treat as same-host. */
-    private static boolean isLoopbackBind(String host) {
-        if (host == null || host.isBlank()) {
-            return true; // Bind's own default is 127.0.0.1
-        }
-        String h = host.trim().toLowerCase();
-        return h.equals("127.0.0.1") || h.equals("::1") || h.equals("localhost")
-                || h.startsWith("127.");
-    }
-}

bridged/src/main/java/dev/ltms/bridged/herdr/LeadTabScanner.java

@@ -1,164 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.Collections;
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.LongSupplier;
-import java.util.function.Supplier;
-
-/**
- * Discovers which panes host a lead by scanning herdr for tabs the operator labelled by convention
- * (CB-531), and hands {@link dev.ltms.bridged.auth.CallerResolver} the resulting
- * {@code terminal_id → lead name} map.
- *
- * <p><strong>Why scan at all.</strong> A lead is never spawned — a human opens a tab and starts an
- * agent in it — so the daemon cannot learn a lead's {@code terminal_id} at creation time the way it
- * does a worker's. CB-530 solved that by having the operator paste each id into {@code leaders:},
- * which works but costs a config edit and a daemon restart per lead, and the id is only obtainable
- * by first starting the session and asking it. Scanning closes that loop: label the tab, and the
- * pane is recognised on the next resolve.
- *
- * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
- * anything a pane could take for itself. Three properties keep that honest:
- * <ol>
- *   <li>bridged never renames a lead tab. The operator's label is read-only input, so what is in
- *       the tab bar is always what the human wrote — no round-trip where the daemon's own rename
- *       becomes the evidence for its next decision.</li>
- *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
- *       become a lead by being placed — as a split, say — inside a matching tab.</li>
- *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
- *       {@link WorkspaceControl}, which no {@code bridge_*} tool exposes. The label is writable by
- *       the human at the terminal and by nobody the bridge is defending against.</li>
- * </ol>
- * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
- * happens to start with the same prefix would promote the whole fleet — and that is refused at
- * startup by {@code BridgedConfig.validateLeadScan} rather than documented here.
- *
- * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
- * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps
- * the previous answer instead of emptying it — a herdr hiccup must not silently demote a live lead
- * mid-session.
- */
-public final class LeadTabScanner implements Supplier<Map<String, String>> {
-
-    private static final Logger log = LoggerFactory.getLogger(LeadTabScanner.class);
-
-    private final HerdrClient herdr;
-    private final String tabPrefix;
-    private final Set<String> excludedWorkspaceLabels;
-    private final Map<String, String> configuredLeads;
-    private final long ttlNanos;
-    private final LongSupplier clock;
-
-    private Map<String, String> cached;
-    private long scannedAtNanos;
-    private boolean everScanned;
-
-    /**
-     * @param herdr                   the herdr client to query ({@code workspace.list},
-     *                                {@code tab.list}, {@code pane.list} — all read-only)
-     * @param tabPrefix               a tab whose label starts with this (case-insensitively) hosts a
-     *                                lead; the rest of the label, trimmed, is the lead's name
-     * @param excludedWorkspaceLabels workspaces never scanned — the configured worker spaces
-     * @param configuredLeads         the static {@code leaders:}/{@code primary:} registry, merged
-     *                                over every scan result. Explicit config outranks the
-     *                                convention, and survives a scan that cannot run at all
-     * @param ttlNanos                how long a scan result is reused before the next one
-     * @param clock                   nanosecond time source ({@code System::nanoTime} in production)
-     */
-    public LeadTabScanner(HerdrClient herdr, String tabPrefix, Set<String> excludedWorkspaceLabels,
-                          Map<String, String> configuredLeads, long ttlNanos, LongSupplier clock) {
-        this.herdr = herdr;
-        this.tabPrefix = tabPrefix == null || tabPrefix.isBlank() ? "lead:" : tabPrefix.strip();
-        this.excludedWorkspaceLabels = excludedWorkspaceLabels == null
-                ? Set.of() : Set.copyOf(excludedWorkspaceLabels);
-        this.configuredLeads = configuredLeads == null ? Map.of() : Map.copyOf(configuredLeads);
-        this.ttlNanos = ttlNanos;
-        this.clock = clock;
-        this.cached = this.configuredLeads;
-    }
-
-    /**
-     * The current {@code terminal_id → lead name} map, rescanning when the cache has expired.
-     *
-     * <p>Synchronized so a burst of concurrent calls produces one scan rather than one each; a scan
-     * is a handful of RPCs over a Unix socket and is rate-limited to one per TTL.
-     */
-    @Override
-    public synchronized Map<String, String> get() {
-        long now = clock.getAsLong();
-        if (everScanned && now - scannedAtNanos < ttlNanos) {
-            return cached;
-        }
-        // Stamp before scanning, not after: a herdr that is down must cost one attempt per TTL, not
-        // one per request.
-        scannedAtNanos = now;
-        everScanned = true;
-        try {
-            Map<String, String> fresh = scan();
-            if (!fresh.equals(cached)) {
-                log.info("lead panes: {}", fresh);
-            }
-            cached = fresh;
-        } catch (HerdrException e) {
-            log.warn("lead-tab scan failed, keeping the {} lead(s) already known: {}",
-                    cached.size(), e.getMessage());
-        }
-        return cached;
-    }
-
-    /** One full pass: labelled tabs → their panes → those panes' terminals. */
-    private Map<String, String> scan() {
-        Map<String, String> nameByTab = new LinkedHashMap<>();
-        for (JsonNode w : herdr.call("workspace.list").path("workspaces")) {
-            Workspace ws = Workspace.from(w);
-            if (ws.workspaceId() == null || excludedWorkspaceLabels.contains(ws.label())) {
-                continue;
-            }
-            for (JsonNode t : herdr.call("tab.list", Map.of("workspace_id", ws.workspaceId())).path("tabs")) {
-                Tab tab = Tab.from(t);
-                String name = leadNameOf(tab.label());
-                if (name != null && tab.tabId() != null) {
-                    nameByTab.put(tab.tabId(), name);
-                }
-            }
-        }
-
-        Map<String, String> byTerminal = new LinkedHashMap<>();
-        if (!nameByTab.isEmpty()) {
-            // One pane.list for every tab: panes carry tab_id, so the join is local.
-            for (JsonNode p : herdr.call("pane.list", Map.of()).path("panes")) {
-                String name = nameByTab.get(p.path("tab_id").asText(null));
-                String terminal = p.path("terminal_id").asText(null);
-                if (name != null && terminal != null && !terminal.isBlank()) {
-                    byTerminal.put(terminal, name);
-                }
-            }
-        }
-        byTerminal.putAll(configuredLeads); // an explicit pin outranks a label
-        return Collections.unmodifiableMap(byTerminal);
-    }
-
-    /**
-     * The lead name a tab label declares, or {@code null} if it declares none.
-     *
-     * <p>{@code "lead: opus-5.0"} → {@code "opus-5.0"}. A bare {@code "lead:"} names nobody and is
-     * rejected: an unnamed lead would resolve as {@code PRIMARY} with nothing to attribute it to.
-     */
-    private String leadNameOf(String label) {
-        if (label == null) {
-            return null;
-        }
-        String l = label.strip();
-        if (!l.regionMatches(true, 0, tabPrefix, 0, tabPrefix.length())) {
-            return null;
-        }
-        String name = l.substring(tabPrefix.length()).strip();
-        return name.isEmpty() ? null : name;
-    }
-}

bridged/src/main/java/dev/ltms/bridged/herdr/PaneLocator.java

@@ -1,59 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-import java.util.Map;
-
-/**
- * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
- * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
- * the agent pane whose process tree contains it, so {@code bridged} can tell <em>which worker</em>
- * is calling without the worker sending anything spoofable.
- *
- * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
- * and foreground process PIDs. This scans agent panes; a spawn-time {@code pid→terminal} cache is
- * the obvious optimization once wired into {@code ClaudeCodeLauncher}.
- */
-public final class PaneLocator {
-
-    private final HerdrClient herdr;
-
-    public PaneLocator(HerdrClient herdr) {
-        this.herdr = herdr;
-    }
-
-    /**
-     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
-     * {@code null} if no agent pane owns it (e.g. the caller is the primary, or off-host).
-     */
-    public String terminalForPid(long pid) {
-        if (pid <= 0) {
-            return null;
-        }
-        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
-            String paneId = pane.path("pane_id").asText(null);
-            if (paneId != null && paneOwnsPid(paneId, pid)) {
-                return pane.path("terminal_id").asText(null);
-            }
-        }
-        return null;
-    }
-
-    private boolean paneOwnsPid(String paneId, long pid) {
-        JsonNode info;
-        try {
-            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
-        } catch (HerdrException e) {
-            return false; // pane vanished mid-scan — just skip it
-        }
-        if (info.path("shell_pid").asLong(-1) == pid) {
-            return true;
-        }
-        for (JsonNode p : info.path("foreground_processes")) {
-            if (p.path("pid").asLong(-1) == pid) {
-                return true;
-            }
-        }
-        return false;
-    }
-}

bridged/src/main/java/dev/ltms/bridged/inject/CompletionResolver.java

@@ -1,265 +0,0 @@
-package dev.ltms.bridged.inject;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.msg.Rendezvous;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ConcurrentHashMap;
-
-/**
- * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
- * {@link Rendezvous} so a blocking {@code bridge_send} resolves even when the worker finishes its
- * task without ever calling {@code bridge_reply} — the common case for a real delegated coding task.
- *
- * <p>On a confirmed {@code working → idle} boundary it scrapes the worker's recent transcript and
- * resolves the awaiting send with that tail (a {@link Rendezvous.Kind#COMPLETION} resolution, so the
- * caller can tell a scrape from a structured reply). It scrapes only when a send is actually waiting
- * — a fleet worker's own turns, or a send that already timed out, cost no herdr traffic. An explicit
- * {@code bridge_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
- *
- * <p>It also handles the CB-109 stall signal ({@link #onTurnFailed}): a worker that ran a turn then
- * wedged in an {@code unknown} state resolves the send as a failure (with the error screen as
- * context) rather than leaving it to time out.
- *
- * <p>The scrape is cleaned to the last {@code ⏺} assistant block (stripping TUI chrome) and guarded
- * against misattribution (CB-115): the pane content is baselined on delivery ({@link #onDelivered}),
- * and a completion whose scrape is unchanged from that baseline — the previous turn's wind-down
- * sampled as this turn's boundary on a rapid back-to-back send — is suppressed rather than resolving
- * the send with a stale answer.
- *
- * <p><strong>Waiter-specific resolution (CB-116).</strong> On delivery we also capture the exact
- * {@link Rendezvous} waiter this turn belongs to, and the completion/failure fallbacks resolve
- * <em>that</em> waiter — never "whatever send is waiting now". A completion fallback runs on a virtual
- * thread and can land after the worker's {@code bridge_reply} already resolved the turn and the
- * <em>next</em> send opened its own waiter on the same session; resolving the current waiter would
- * then deliver turn N's stale scrape as turn N+1's answer. Targeting the captured waiter makes a late
- * completion a harmless no-op (its waiter is already done) instead of a cross-turn stale reply.
- *
- * <p>Wired as the {@link Injector}'s {@link TurnListener}; the handlers hand off to a virtual thread
- * so the scrape's herdr round-trip never stalls the status poller. The captured waiter is read on the
- * poller thread (before any next-turn delivery can overwrite it) and passed into the virtual thread.
- */
-public final class CompletionResolver implements TurnListener {
-
-    private static final Logger log = LoggerFactory.getLogger(CompletionResolver.class);
-
-    /**
-     * herdr {@code agent.read} source for the completion scrape. {@code recent} returns the tail of
-     * the transcript (the worker's last output), which is what a delegator wants when the worker
-     * didn't structure a reply.
-     */
-    static final String SCRAPE_SOURCE = "recent";
-
-    /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
-    static final int MAX_SCRAPE_CHARS = 4000;
-
-    private final AgentControl agents;
-    private final Rendezvous rendezvous;
-
-    /**
-     * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
-     * delivering send opened, plus the assistant block present when it was delivered.
-     *
-     * <p>The {@code waiter} is what makes a late fallback safe (CB-116): we resolve it, not "whoever
-     * is waiting now", so a completion that fires after the next send has opened its own waiter is a
-     * no-op rather than a cross-turn stale reply. The {@code baseline} is the CB-115 staleness
-     * reference: a completion scrape equal to it means the worker produced no new output (the previous
-     * turn's wind-down sampled as this boundary), so it is suppressed. Overwritten on each delivery;
-     * cleared when the turn resolves. Package-private so tests can capture and replay a specific turn.
-     */
-    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
-    }
-
-    private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();
-
-    public CompletionResolver(AgentControl agents, Rendezvous rendezvous) {
-        this.agents = agents;
-        this.rendezvous = rendezvous;
-    }
-
-    @Override
-    public void onDelivered(String target) {
-        // Capture the exact waiter this turn belongs to (CB-116) and snapshot the pane's pre-turn
-        // content — what it shows *before* the just-delivered turn produces output — as the staleness
-        // reference (CB-115). Done synchronously (like the delivering send itself) so both are in
-        // place before this turn's completion can fire.
-        captureBaseline(target);
-    }
-
-    /** Capture the in-flight turn: its waiter and pre-turn baseline (the testable core of {@link #onDelivered}). */
-    void captureBaseline(String target) {
-        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
-        if (waiter == null) {
-            inFlight.remove(target); // no send is waiting on this delivery — nothing to resolve later
-            return;
-        }
-        String baseline;
-        try {
-            // Clip to the same cap resolve() applies to the tail (line ~134): the CB-115 misattribution
-            // guard compares baseline.equals(tail), so both sides must be the same capped representation.
-            // An unclipped baseline vs a clipped tail would never match for a >MAX_SCRAPE_CHARS block,
-            // defeating the guard and letting a stale completion resolve the send.
-            baseline = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
-        } catch (RuntimeException e) {
-            baseline = null; // fail open: no baseline ⇒ no suppression
-            log.debug("delivery baseline for {} failed: {}", target, e.getMessage());
-        }
-        inFlight.put(target, new InFlight(waiter, baseline));
-    }
-
-    /** The turn currently baselined for {@code target}, or {@code null} — a test hook for the captureBaseline path. */
-    InFlight inFlight(String target) {
-        return inFlight.get(target);
-    }
-
-    @Override
-    public void onTurnComplete(String target) {
-        // Read the in-flight turn on the poller thread — before any next-turn delivery can overwrite
-        // it — then off-load the scrape (a herdr round-trip we must not block polling on) to a vthread.
-        InFlight turn = inFlight.get(target);
-        Thread.ofVirtual().name("completion-" + target).start(() -> resolve(target, turn));
-    }
-
-    /**
-     * Resolve the completed turn before adapter housekeeping can erase its rendered output. This is
-     * intentionally synchronous and used only when a post-turn context reset is enabled; the normal
-     * path remains off-loaded so polling is not blocked by a scrape.
-     */
-    public void resolveBeforePostAction(String target) {
-        resolve(target, inFlight.get(target));
-    }
-
-    @Override
-    public void onTurnFailed(String target) {
-        InFlight turn = inFlight.get(target);
-        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn));
-    }
-
-    /** Synchronous resolve (the unit-testable core of {@link #onTurnComplete}). */
-    void resolve(String target, InFlight turn) {
-        CompletableFuture<Rendezvous.Resolution> waiter = turn == null ? null : turn.waiter();
-        if (waiter == null || waiter.isDone()) {
-            // Nobody is blocked on THIS turn (it had no send, or its bridge_reply already won). Skip
-            // the scrape; resolving the current waiter here would be the CB-116 cross-turn stale reply.
-            inFlight.remove(target, turn);
-            return;
-        }
-        String tail;
-        boolean scrapeFailed = false;
-        try {
-            tail = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
-        } catch (RuntimeException e) {
-            // The worker finished but we couldn't read its screen — still resolve the send so the
-            // caller unblocks; an empty tail beats hanging until the caller's timeout.
-            log.warn("completion scrape for {} failed; resolving with an empty tail: {}",
-                    target, e.getMessage());
-            tail = "";
-            scrapeFailed = true;
-        }
-        // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
-        // delivery, this turn produced no new output — the boundary belongs to the previous turn's
-        // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
-        // a stale answer; the real bridge_reply (or a later genuine completion) resolves it instead.
-        // A scrape that failed to read is exempt — an empty tail there is "couldn't see", not "no change".
-        String baseline = turn.baseline();
-        if (!scrapeFailed && baseline != null && baseline.equals(tail)) {
-            log.debug("suppressing misattributed completion for {} (no output change since delivery)",
-                    target);
-            return; // keep the in-flight record: a later genuine completion still needs it
-        }
-        if (rendezvous.resolveCompletion(waiter, tail)) {
-            inFlight.remove(target, turn);
-            log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
-                    target, tail.length());
-        }
-    }
-
-    /** Synchronous fail (the unit-testable core of {@link #onTurnFailed}). */
-    void fail(String target, InFlight turn) {
-        // A never-delivered readiness failure has no in-flight record but still has a blocked send;
-        // fall back to the currently-registered waiter (unambiguous — that send never completed, so
-        // no next turn exists to confuse it with).
-        CompletableFuture<Rendezvous.Resolution> waiter =
-                turn != null ? turn.waiter() : rendezvous.currentWaiter(target);
-        if (waiter == null || waiter.isDone()) {
-            inFlight.remove(target, turn); // nobody blocked on this worker — nothing to fail
-            return;
-        }
-        String reason;
-        try {
-            reason = clip(agents.read(target, SCRAPE_SOURCE));
-        } catch (RuntimeException e) {
-            reason = "";
-        }
-        if (reason.isBlank()) {
-            // No screen to scrape — either the worker is stuck (CB-109) or gone (CB-110).
-            reason = "worker did not reply; its turn ended in an unrecoverable state "
-                    + "(worker unreachable or stuck)";
-        }
-        if (rendezvous.resolveFailure(waiter, reason)) {
-            inFlight.remove(target, turn);
-            log.debug("failed send to {} via turn-stall fallback", target);
-        }
-    }
-
-    private static String clip(String s) {
-        if (s == null) return "";
-        String trimmed = s.strip();
-        return trimmed.length() <= MAX_SCRAPE_CHARS
-                ? trimmed
-                : trimmed.substring(trimmed.length() - MAX_SCRAPE_CHARS);
-    }
-
-    /**
-     * Extract the last assistant message from a raw Claude Code pane scrape (CB-115). Claude Code
-     * prefixes each assistant turn with {@code ⏺}; the delegator wants that answer, not the TUI
-     * chrome around it. Take everything from the final {@code ⏺} onward and stop at the <em>first</em>
-     * hard interface boundary below it — the spinner/status line, input box, {@code ❯} prompt (which
-     * may echo the <em>next</em> turn's text), footer, or tips/warnings. Stopping at the first
-     * boundary (rather than trimming only trailing chrome) is what keeps a following turn's echoed
-     * prompt out of this reply. Blank lines are not boundaries, so a multi-paragraph answer survives;
-     * trailing blanks are trimmed at the end. With no {@code ⏺} marker (an unusual render) the whole
-     * text is scanned the same way, so we never lose the reply.
-     *
-     * <p>Package-private and pure so it is unit-testable without herdr.
-     */
-    static String lastAssistantBlock(String raw) {
-        if (raw == null || raw.isBlank()) return "";
-        int marker = raw.lastIndexOf('⏺');
-        String block = marker >= 0 ? raw.substring(marker + 1) : raw;
-        StringBuilder out = new StringBuilder();
-        int kept = 0;
-        for (String line : block.split("\n", -1)) {
-            if (isBoundary(line)) break; // first TUI boundary ends the assistant message
-            if (kept++ > 0) out.append('\n');
-            out.append(line);
-        }
-        return out.toString().strip();
-    }
-
-    /**
-     * A hard TUI boundary line that marks the end of an assistant message and the start of interface
-     * chrome (input box, prompt, spinner, footer, tips/warnings). Blank lines are <em>not</em>
-     * boundaries — an answer may contain them — so they are kept and trimmed only if trailing.
-     */
-    private static boolean isBoundary(String line) {
-        String t = line.strip();
-        if (t.isEmpty()) return false;
-        // A horizontal rule / all box-drawing separators (e.g. "──────").
-        if (t.chars().allMatch(c -> c == '─' || c == '—' || c == '━' || c == '═' || c == '-')) {
-            return true;
-        }
-        String lower = t.toLowerCase();
-        return t.startsWith("╭") || t.startsWith("│") || t.startsWith("╰") || t.startsWith("┌")
-                || t.startsWith("└") || t.startsWith("❯") || t.startsWith("⏵")
-                || t.startsWith("⎿") || t.startsWith("⚠")
-                // Status/spinner lines Claude Code renders below a settled or in-flight turn,
-                // e.g. "✻ Baked for 21s", "✶ Forming…".
-                || t.startsWith("✻") || t.startsWith("✳") || t.startsWith("✽") || t.startsWith("·")
-                || t.startsWith("●") || t.startsWith("◐") || t.startsWith("✢") || t.startsWith("✶")
-                || lower.contains("auto mode") || lower.contains("for shortcuts")
-                || lower.contains("esc to interrupt") || lower.contains("bypass permissions");
-    }
-}

bridged/src/main/java/dev/ltms/bridged/inject/Injector.java

@@ -1,399 +0,0 @@
-package dev.ltms.bridged.inject;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayDeque;
-import java.util.ArrayList;
-import java.util.Deque;
-import java.util.List;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.function.Consumer;
-import java.util.function.Predicate;
-import java.util.stream.Collectors;
-
-/**
- * The status-gated injector (CB-103): the single writer that delivers a message into a
- * worker only when it is safe — {@code idle} or {@code blocked}, never mid-turn.
- *
- * <p>Per target it holds a FIFO queue and delivers <strong>at most one message per turn</strong>:
- * after a send it waits for the worker to pick the message up (go {@code working}) before
- * delivering the next, so two rapid deliveries never interleave into one turn. Each
- * status-check-then-send for a target is serialized on the target's monitor, closing the
- * TOCTOU window between "is it idle?" and "send" — one writer per worker.
- *
- * <p><strong>Polling caveat.</strong> This is driven by {@link #onStatus} sampling (a
- * {@code StatusPoller}), not by reliable status <em>edges</em>. A turn can begin and end
- * entirely between two polls, so the {@code working} pickup may never be sampled. To avoid
- * wedging a queue forever, an awaited pickup is released after {@link #PICKUP_GRACE_POLLS}
- * consecutive injectable samples (the worker has plainly moved on). Only {@code working} — not
- * a transient {@code unknown} — counts as a real pickup, so a detection glitch can't prematurely
- * release the latch. Perfectly reliable turn boundaries require a herdr {@code events.subscribe}
- * stream; that is the intended upgrade and would replace only the sampling, not this queue.
- *
- * <p><strong>Turn completion (CB-106).</strong> Beyond delivery, the injector reports when a
- * delegated turn <em>finishes</em>: after a delivery is picked up (a real {@code working} sample),
- * the next injectable sample is a confirmed {@code working → idle} boundary and fires
- * {@link TurnListener#onTurnComplete}. Completion is only ever synthesized from a <em>confirmed</em>
- * turn — the pickup-grace path (a turn too fast to sample) unwedges the queue but does not fire
- * completion, since without a sampled {@code working} there is no trustworthy "the worker just
- * finished the task" signal to act on.
- */
-public final class Injector {
-
-    private static final Logger log = LoggerFactory.getLogger(Injector.class);
-
-    /**
-     * How many consecutive injectable samples (with no {@code working} in between) after a send
-     * before we assume the turn completed unobserved and release the pickup latch. At the
-     * default 250ms poll interval this is a ~2s grace — far longer than a worker takes to start
-     * a turn, so it only fires on a genuinely missed pickup edge.
-     */
-    private static final int PICKUP_GRACE_POLLS = 8;
-
-    /**
-     * How many consecutive {@code unknown} samples while a delegation is outstanding before we
-     * declare it stalled and fire {@link TurnListener#onTurnFailed} (CB-109). A worker wedged in a
-     * state herdr can't classify (e.g. an API-error screen) stays {@code unknown} indefinitely and
-     * would otherwise never resolve; any {@code working}/{@code idle} sample resets the streak, so a
-     * transient detection glitch cannot trip it. At the 250ms poll interval this is ~30s — far longer
-     * than any real detection blip, and still vastly better than the async send's timeout.
-     */
-    private static final int TURN_STALL_GRACE_POLLS = 120;
-
-    /**
-     * How many consecutive injectable samples a queued-but-undelivered message may wait on the
-     * {@link #ready} gate before we give up and fail it (CB-114). The gate holds a message out of a
-     * worker's boot window (herdr reports {@code idle} while its Claude is still starting), but a
-     * worker whose Claude crashes during boot — or never connects the bridge MCP — stays "idle and
-     * not ready" forever: {@link #ready} never accepts it, the message is never delivered, and the
-     * target would be polled indefinitely with its caller's future never completing. After this
-     * grace the queued messages are failed and the target released. At the 250ms poll interval this
-     * is ~60s — deliberately longer than {@link #TURN_STALL_GRACE_POLLS}, since a first boot (spawn
-     * + model load + MCP connect) legitimately takes longer than an in-turn detection blip.
-     */
-    private static final int READINESS_GRACE_POLLS = 240;
-
-    private final AgentControl agents;
-    private final TurnListener turnListener;
-    private final Predicate<String> ready; // CB-113: a target is deliverable only when available
-    private final Consumer<String> forget; // CB-114: clear a gone worker's readiness/presence
-    private final ConcurrentHashMap<String, Target> targets = new ConcurrentHashMap<>();
-
-    /** Delivery only; completion signalling is a no-op and every target is treated as available. */
-    public Injector(AgentControl agents) {
-        this(agents, TurnListener.NOOP);
-    }
-
-    /** Delivery plus turn-completion signalling (CB-106); every target is treated as available. */
-    public Injector(AgentControl agents, TurnListener turnListener) {
-        this(agents, turnListener, _ -> true);
-    }
-
-    /**
-     * Delivery, completion signalling (CB-106), and a readiness gate (CB-113): a message is delivered
-     * only when {@code ready} accepts the target — i.e. the worker's Claude has connected the bridge
-     * MCP. This holds the first delivery out of the worker's boot window, where herdr already reports
-     * {@code idle} but the TUI would drop an injected paste.
-     */
-    public Injector(AgentControl agents, TurnListener turnListener, Predicate<String> ready) {
-        this(agents, turnListener, ready, _ -> {
-        });
-    }
-
-    /**
-     * Delivery, completion signalling (CB-106), a readiness gate (CB-113), and readiness cleanup
-     * (CB-114): {@code forget} is invoked with a target when its worker is gone — dropped
-     * (pane crash) or timed out on the readiness gate — so its stale presence/readiness is cleared
-     * and does not linger past the worker's life.
-     */
-    public Injector(AgentControl agents, TurnListener turnListener, Predicate<String> ready,
-                    Consumer<String> forget) {
-        this.agents = agents;
-        this.turnListener = turnListener;
-        this.ready = ready;
-        this.forget = forget;
-    }
-
-    /** A pending message and the future that completes when it has been delivered. */
-    private record Pending(String text, CompletableFuture<Void> delivered) {
-    }
-
-    /** Per-worker delivery state, guarded by its own monitor (single writer per worker). */
-    private static final class Target {
-        final Deque<Pending> queue = new ArrayDeque<>();
-        boolean awaitingPickup;    // sent a message, waiting for the worker to pick it up
-        int injectableSincePickup; // consecutive injectable samples while awaitingPickup
-        boolean awaitingCompletion; // a delivered message's turn is not yet known-complete
-        boolean turnObserved;      // saw a real `working` sample since that delivery (turn ran)
-        int unknownSinceTurn;      // consecutive `unknown` samples while a delegation is outstanding (CB-109)
-        int notReadySincePoll;     // consecutive injectable samples a queued message waited on the readiness gate (CB-114)
-        boolean postTurnPending;   // completion observed; adapter housekeeping has not started yet
-        boolean awaitingPostTurnPickup;
-        boolean postTurnObserved;
-        int injectableSincePostTurnPickup;
-
-        synchronized void add(Pending p) {
-            queue.add(p);
-        }
-    }
-
-    /**
-     * Queue {@code text} for delivery to {@code target} (a herdr {@code terminal_id}). Returns
-     * immediately with a future that completes when the message is actually sent — the worker
-     * may be mid-turn, in which case delivery waits for the next injectable window.
-     *
-     * <p>Uses an atomic map update so a concurrent {@link #drop} cannot slip between "find the
-     * target" and "queue the message" and orphan it in a target it just removed.
-     */
-    public CompletableFuture<Void> enqueue(String target, String text) {
-        CompletableFuture<Void> delivered = new CompletableFuture<>();
-        Pending p = new Pending(text, delivered);
-        targets.compute(target, (_, existing) -> {
-            Target t = (existing != null) ? existing : new Target();
-            t.add(p); // synchronized on the Target monitor — atomic with a concurrent drop
-            return t;
-        });
-        return delivered;
-    }
-
-    /**
-     * Feed a fresh status observation for {@code target}. Delivers the head of the queue iff the
-     * worker is injectable and no earlier message is still awaiting pickup. Serialized per target
-     * so the check and the send cannot race another delivery to the same worker; the delivered
-     * future is completed <em>after</em> the monitor is released so a caller's continuation never
-     * runs on the poller thread while it holds the lock.
-     */
-    public void onStatus(String target, AgentStatus status) {
-        Target t = targets.get(target);
-        if (t == null) return;
-
-        Pending sent = null;
-        RuntimeException sendError = null;
-        boolean turnCompleted = false;
-        boolean turnFailed = false;
-        boolean resubmit = false;
-        boolean startPostTurn = false;
-        List<Pending> notReady = null; // queued messages failed because the worker never became ready
-        synchronized (t) {
-            if (status == AgentStatus.WORKING) {
-                if (t.awaitingPostTurnPickup) {
-                    t.awaitingPostTurnPickup = false;
-                    t.injectableSincePostTurnPickup = 0;
-                    t.postTurnObserved = true;
-                }
-                // Definitive pickup: the worker is busy on our last message, and (if a delivery is
-                // outstanding) a real turn is now confirmed to be running.
-                t.awaitingPickup = false;
-                t.injectableSincePickup = 0;
-                t.unknownSinceTurn = 0;
-                t.notReadySincePoll = 0;
-                if (t.awaitingCompletion) t.turnObserved = true;
-            } else if (status.injectable()) { // IDLE or BLOCKED
-                t.unknownSinceTurn = 0;
-                if (t.awaitingPostTurnPickup) {
-                    if (++t.injectableSincePostTurnPickup >= PICKUP_GRACE_POLLS) {
-                        t.awaitingPostTurnPickup = false;
-                        t.injectableSincePostTurnPickup = 0;
-                    } else {
-                        resubmit = true;
-                    }
-                } else if (t.postTurnObserved) {
-                    t.postTurnObserved = false;
-                }
-                if (t.awaitingPickup) {
-                    if (++t.injectableSincePickup >= PICKUP_GRACE_POLLS) {
-                        // Pickup edge was never sampled (turn faster than the poll, or status lag).
-                        // Release the latch rather than wedge — and give up on synthesizing a
-                        // completion for this message, since without a confirmed `working` we cannot
-                        // trust that a task-processing turn actually ran.
-                        t.awaitingPickup = false;
-                        t.injectableSincePickup = 0;
-                        t.awaitingCompletion = false;
-                        t.turnObserved = false;
-                    } else {
-                        // Delivered but still idle → the worker hasn't picked it up; the submit
-                        // keystroke likely raced the paste (esp. right as the TUI became ready).
-                        // Re-nudge Enter (CB-113) until the worker starts (WORKING) or the grace ends.
-                        resubmit = true;
-                    }
-                }
-                if (!t.awaitingPickup) {
-                    // A confirmed turn (a `working` sample was seen) that has now returned to idle is
-                    // a trustworthy `working → idle` completion boundary.
-                    if (t.awaitingCompletion && t.turnObserved) {
-                        t.awaitingCompletion = false;
-                        t.turnObserved = false;
-                        turnCompleted = true;
-                        if (turnListener.hasPostTurnAction(target)) {
-                            t.postTurnPending = true;
-                            startPostTurn = true;
-                        }
-                    }
-                    // Deliver the next queued message only once the prior turn is fully settled, so a
-                    // completion is never confused with the pickup of the following message — and only
-                    // once the worker is available (CB-113), so we never paste into its boot window.
-                    if (!t.awaitingCompletion && !t.postTurnPending
-                            && !t.awaitingPostTurnPickup && !t.postTurnObserved) {
-                        Pending p = t.queue.peek();
-                        if (p != null && ready.test(target)) {
-                            t.notReadySincePoll = 0;
-                            try {
-                                agents.send(target, p.text());
-                                t.queue.poll();
-                                t.awaitingPickup = true;
-                                t.awaitingCompletion = true;
-                                t.turnObserved = false;
-                                t.injectableSincePickup = 0;
-                                sent = p;
-                            } catch (RuntimeException e) {
-                                // Delivery failed at herdr; drop the poisoned message and surface it
-                                // rather than blocking the queue behind it.
-                                t.queue.poll();
-                                sent = p;
-                                sendError = e;
-                            }
-                        } else if (p != null && ++t.notReadySincePoll >= READINESS_GRACE_POLLS) {
-                            // The worker has been idle-but-not-ready for the whole grace: its Claude
-                            // never connected the bridge MCP (crashed during boot, or wedged on a
-                            // startup prompt). The readiness gate would hold this message forever, so
-                            // fail every queued message and release the target (CB-114) instead of
-                            // polling it indefinitely with the caller's future never completing.
-                            notReady = new ArrayList<>(t.queue);
-                            t.queue.clear();
-                            t.notReadySincePoll = 0;
-                        }
-                    }
-                }
-            } else {
-                // UNKNOWN (or any other non-injectable, non-working): not a safe window nor a
-                // reliable pickup signal, so we never deliver or release the pickup latch here. But
-                // an outstanding delegation whose worker has gone unresponsive — stuck in a state
-                // herdr can't classify (CB-109) — will never yield a working→idle boundary. After a
-                // sustained streak, declare it failed so the awaiting send resolves rather than
-                // riding out the async timeout. (This also frees a delivery that wedged before it
-                // was ever picked up, which the injectable-only pickup grace could never release.)
-                if (t.awaitingCompletion && ++t.unknownSinceTurn >= TURN_STALL_GRACE_POLLS) {
-                    t.awaitingPickup = false;
-                    t.awaitingCompletion = false;
-                    t.turnObserved = false;
-                    t.unknownSinceTurn = 0;
-                    turnFailed = true;
-                }
-            }
-
-            // Reclaim the entry once the worker is fully quiescent (nothing queued, no pickup or
-            // completion awaited), so the map cannot grow without bound across short-lived workers.
-            if (t.queue.isEmpty() && !t.awaitingPickup && !t.awaitingCompletion
-                    && !t.postTurnPending && !t.awaitingPostTurnPickup && !t.postTurnObserved) {
-                targets.remove(target, t);
-            }
-        }
-
-        // Fire listeners / herdr calls after releasing the monitor so nothing runs on the poller
-        // thread while it holds the target lock.
-        if (resubmit) {
-            try {
-                agents.submit(target); // nudge a raced Enter so the pending paste submits
-            } catch (RuntimeException e) {
-                log.debug("resubmit to {} failed (will retry next poll): {}", target, e.getMessage());
-            }
-        }
-        if (notReady != null) {
-            // Worker never became available: forget its (never-set) readiness, unblock every queued
-            // caller, and route the awaiting send through the same failure path as a stalled turn so
-            // a blocking or async waiter resolves WORKER_FAILED rather than riding out the timeout.
-            forget.accept(target);
-            RuntimeException cause = new IllegalStateException(
-                    target + " never became available (no bridge MCP connection within the boot window)");
-            for (Pending p : notReady) {
-                p.delivered().completeExceptionally(cause);
-            }
-            turnListener.onTurnFailed(target);
-        }
-        if (turnCompleted) {
-            if (startPostTurn) {
-                boolean started = turnListener.onTurnCompleteWithPostAction(target);
-                synchronized (t) {
-                    t.postTurnPending = false;
-                    if (started) {
-                        t.awaitingPostTurnPickup = true;
-                        t.injectableSincePostTurnPickup = 0;
-                    }
-                    if (t.queue.isEmpty() && !t.awaitingPostTurnPickup) {
-                        targets.remove(target, t);
-                    }
-                }
-            } else {
-                turnListener.onTurnComplete(target);
-            }
-        }
-        if (turnFailed) {
-            turnListener.onTurnFailed(target);
-        }
-        if (sent != null) {
-            if (sendError != null) {
-                log.warn("inject to {} failed, dropped message: {}", target, sendError.getMessage());
-                sent.delivered().completeExceptionally(sendError);
-            } else {
-                // Baseline the pane's pre-turn content so a misattributed completion (no new output)
-                // can't resolve this send with the previous turn's stale answer (CB-115).
-                turnListener.onDelivered(target);
-                sent.delivered().complete(null);
-            }
-        }
-    }
-
-    /**
-     * Targets the poller must keep sampling: those with a queued message, an awaited pickup, or an
-     * awaited turn completion (so the {@code working → idle} boundary is observed).
-     */
-    public Set<String> activeTargets() {
-        return targets.entrySet().stream()
-                .filter(e -> {
-                    synchronized (e.getValue()) {
-                        Target t = e.getValue();
-                        return !t.queue.isEmpty() || t.awaitingPickup || t.awaitingCompletion
-                                || t.postTurnPending || t.awaitingPostTurnPickup || t.postTurnObserved;
-                    }
-                })
-                .map(java.util.Map.Entry::getKey)
-                .collect(Collectors.toSet());
-    }
-
-    /**
-     * Forget a target whose worker is gone, failing every still-queued message so awaiting callers
-     * unblock instead of hanging forever. If a message had already been <em>delivered</em> but its
-     * turn was not yet resolved (CB-110 — the worker vanished mid-turn, e.g. its pane crashed), fire
-     * {@link TurnListener#onTurnFailed} for it: a delivered message is no longer in the queue, so
-     * failing queued waiters alone would leave that send's rendezvous hanging until the async
-     * timeout. Futures and listeners are completed after the monitor is released.
-     */
-    public void drop(String target, Throwable cause) {
-        Target t = targets.remove(target);
-        if (t == null) return;
-        List<Pending> pending;
-        boolean hadDeliveredTurn;
-        synchronized (t) {
-            pending = new ArrayList<>(t.queue);
-            t.queue.clear();
-            hadDeliveredTurn = t.awaitingCompletion;
-            t.awaitingCompletion = false;
-            t.awaitingPickup = false;
-            t.postTurnPending = false;
-            t.awaitingPostTurnPickup = false;
-            t.postTurnObserved = false;
-        }
-        forget.accept(target); // the worker is gone — clear its readiness/presence too (CB-114)
-        for (Pending p : pending) {
-            p.delivered().completeExceptionally(cause);
-        }
-        if (hadDeliveredTurn) {
-            turnListener.onTurnFailed(target);
-        }
-    }
-}

bridged/src/main/java/dev/ltms/bridged/inject/StatusPoller.java

@@ -1,93 +0,0 @@
-package dev.ltms.bridged.inject;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.herdr.HerdrException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.Set;
-
-/**
- * Drives the {@link Injector} by sampling each active worker's {@code agent_status} and
- * feeding it in. A single virtual-thread loop polls only targets that have work outstanding,
- * so an idle bridge does no herdr traffic.
- *
- * <p>This is the Stage-1 gate signal. It can later be replaced (or fronted) by a herdr
- * {@code events.subscribe} stream without touching the {@link Injector} — the injector only
- * consumes {@code onStatus} calls, however they are produced.
- */
-public final class StatusPoller {
-
-    private static final Logger log = LoggerFactory.getLogger(StatusPoller.class);
-
-    private final AgentControl agents;
-    private final Injector injector;
-    private final StatusRefiner refiner;
-    private final long intervalMillis;
-    private volatile boolean running;
-    private Thread thread;
-
-    public StatusPoller(AgentControl agents, Injector injector, long intervalMillis) {
-        this(agents, injector, new StatusRefiner(agents), intervalMillis);
-    }
-
-    public StatusPoller(AgentControl agents, Injector injector, StatusRefiner refiner,
-                        long intervalMillis) {
-        this.agents = agents;
-        this.injector = injector;
-        this.refiner = refiner;
-        this.intervalMillis = intervalMillis;
-    }
-
-    /** Start the polling loop on a virtual thread. Idempotent. */
-    public synchronized void start() {
-        if (running) return;
-        running = true;
-        thread = Thread.ofVirtual().name("status-poller").start(this::loop);
-        log.info("status poller started (interval {}ms)", intervalMillis);
-    }
-
-    private void loop() {
-        while (running) {
-            Set<String> active = injector.activeTargets();
-            for (String target : active) {
-                if (!running) return;
-                try {
-                    // herdr's agent_status can misreport a settled worker as `unknown`; refine it
-                    // against the pane content before it drives delivery/completion (CB-115).
-                    AgentStatus status = refiner.refine(target, agents.status(target));
-                    injector.onStatus(target, status);
-                } catch (HerdrException e) {
-                    // The worker's agent is gone — stop trying and unblock its waiters.
-                    if (e.code() != null && e.code().endsWith("_not_found")) {
-                        log.debug("target {} gone; dropping its queue", target);
-                        injector.drop(target, e);
-                    } else {
-                        log.debug("status poll for {} failed (will retry): {}", target, e.getMessage());
-                    }
-                } catch (RuntimeException e) {
-                    // Never let one target's unexpected error (e.g. an odd agent.get shape) kill
-                    // the single poller thread and stall injection for every worker.
-                    log.warn("unexpected error polling {}; skipping this round", target, e);
-                }
-            }
-            sleep();
-        }
-    }
-
-    private void sleep() {
-        try {
-            Thread.sleep(intervalMillis);
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            running = false;
-        }
-    }
-
-    /** Stop the polling loop. Idempotent. */
-    public synchronized void stop() {
-        running = false;
-        if (thread != null) thread.interrupt();
-    }
-}

bridged/src/main/java/dev/ltms/bridged/mcp/BridgeMcp.java

@@ -1,892 +0,0 @@
-package dev.ltms.bridged.mcp;
-
-import dev.ltms.bridged.auth.AuditLog;
-import dev.ltms.bridged.auth.Authz;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.Principal;
-import dev.ltms.bridged.auth.Role;
-import dev.ltms.bridged.guard.GuardException;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.inject.WorkerPresence;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.WorkerSession;
-import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.peer.PeerLauncher;
-import io.modelcontextprotocol.common.McpTransportContext;
-import io.modelcontextprotocol.json.McpJsonMapper;
-import io.modelcontextprotocol.json.jackson3.JacksonMcpJsonMapperSupplier;
-import io.modelcontextprotocol.server.McpServer;
-import io.modelcontextprotocol.server.McpSyncServer;
-import io.modelcontextprotocol.server.McpSyncServerExchange;
-import io.modelcontextprotocol.server.transport.HttpServletStreamableServerTransportProvider;
-import io.modelcontextprotocol.spec.McpSchema;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import jakarta.servlet.http.HttpServlet;
-
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-import java.util.stream.Collectors;
-
-/**
- * The MCP SERVER face (CB-105): a Streamable-HTTP MCP server whose tools are <em>thin adapters</em>
- * over the same {@link MessageService}/{@link Rendezvous} the REST routes use — so the two are
- * validated by parity, not by re-implementing behaviour. The primary Opus calls {@code bridge_send}
- * / {@code bridge_status}; the worker calls {@code bridge_reply}.
- *
- * <p>Beyond delegation the primary also manages the fleet here (CB-108): {@code bridge_spawn} /
- * {@code bridge_list} / {@code bridge_stop} drive the {@link PeerLauncher} SPI so a worker's whole
- * lifecycle is managed through MCP, with each adapter's subscription boundary enforced inside it.
- *
- * <p>The tool <em>logic</em> lives in package-private static methods returning a
- * {@link McpSchema.CallToolResult}, so it is unit-testable without standing up the HTTP transport;
- * the SDK owns the wire protocol. Mount {@link #servlet()} at {@code /mcp} on the daemon's Jetty.
- */
-public final class BridgeMcp {
-
-    private static final long DEFAULT_TIMEOUT_MS = 25_000;
-    private static final long MAX_TIMEOUT_MS = 120_000;
-    // bridge_ask blocks the WORKER's own MCP call, which its client caps near 60s — default under
-    // that so the bridge returns a clean timeout before the client severs the call (CB-205).
-    private static final long ASK_DEFAULT_TIMEOUT_MS = 55_000;
-    private static final long ASK_MAX_TIMEOUT_MS = 115_000;
-    private static final ObjectMapper MAPPER = new ObjectMapper(); // worker-view JSON projections
-
-    /** Transport-context key under which the extractor stashes the resolved caller identity. */
-    static final String CALLER_TERMINAL = "callerTerminal";
-    /** Transport-context key under which the extractor stashes the caller's PID (for cwd inherit). */
-    static final String CALLER_PID = "callerPid";
-    /** Transport-context key under which the extractor stashes the resolved {@link Role} (CB-501). */
-    static final String CALLER_ROLE = "callerRole";
-    /** Transport-context key for the lead's configured name, when the caller is one (CB-530). */
-    static final String CALLER_NAME = "callerName";
-
-    private final HttpServletStreamableServerTransportProvider transport;
-    private final McpSyncServer server;
-    private final CallerResolver authz; // CB-501: null → authorization not enforced (legacy)
-    private final Metrics metrics;      // CB-502: null → auth failures not counted
-
-    /**
-     * Legacy constructor — no authorization. Retained so existing tests exercise tool behaviour
-     * without an auth fixture.
-     */
-    public BridgeMcp(MessageService messages, PeerLauncher workers,
-                     SessionManager sessions, ConnectionIdentity identity, WorkerPresence presence,
-                     PrimaryRegistry primaryRegistry) {
-        this(messages, workers, sessions, identity, presence, primaryRegistry, null, null);
-    }
-
-    /**
-     * @param callers resolves each call's {@link Principal}; {@code null} disables authorization.
-     *                This surface needs its own enforcement: {@code /mcp} is a raw servlet on
-     *                Jetty's context handler and never passes through Javalin's {@code before}
-     *                filter, so the REST guard does not cover it.
-     * @param metrics registry for auth-failure counting; may be {@code null}
-     */
-    public BridgeMcp(MessageService messages, PeerLauncher workers,
-                     SessionManager sessions, ConnectionIdentity identity, WorkerPresence presence,
-                     PrimaryRegistry primaryRegistry, CallerResolver callers, Metrics metrics) {
-        McpJsonMapper json = new JacksonMcpJsonMapperSupplier().get();
-        this.transport = HttpServletStreamableServerTransportProvider.builder()
-                .jsonMapper(json)
-                .mcpEndpoint("/mcp")
-                // Resolve the caller from the connection (peer PID → herdr pane) in one lookup: the
-                // worker terminal for bridge_reply (no spoofable arg), and the PID so bridge_spawn can
-                // inherit the primary's cwd (CB-112). Any contact from a worker marks it available
-                // (CB-113) — its MCP initialize is the reliable "the agent is up" signal.
-                .contextExtractor(req -> {
-                    // One resolution per call, shared with the REST surface via CallerResolver so
-                    // the two paths cannot drift on who a caller is.
-                    Principal p = callers != null
-                            ? callers.resolve(req.getRemoteAddr(), req.getRemotePort(),
-                                    req.getHeader("Authorization"))
-                            : legacyPrincipal(identity, req.getRemoteAddr(), req.getRemotePort());
-                    // CB-532: guard on the ROLE, not on the terminal being null. A named lead now
-                    // carries its pane too, and enrolling a lead in the worker presence map would
-                    // have it counted as an available worker.
-                    if (p.isWorker()) presence.markPresent(p.terminal());
-                    return McpTransportContext.create(Map.of(
-                            CALLER_TERMINAL, orEmpty(p.terminal()),
-                            CALLER_PID, Long.toString(p.pid()),
-                            CALLER_ROLE, p.role().name(),
-                            CALLER_NAME, orEmpty(p.name())));
-                })
-                .build();
-        this.server = McpServer.sync(transport)
-                .serverInfo("bridge", "0.1.0")
-                .capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
-                .toolCall(sendTool(), (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SEND,
-                            str(req.arguments(), "sessionId"));
-                    if (denied != null) return denied;
-                    String caller = callerTerminal(exchange);
-                    if (caller != null) primaryRegistry.record(caller);
-                    Map<String, Object> a = req.arguments();
-                    // CB-532: remember WHICH lead is waiting on this worker, so its reply nudge goes
-                    // back to that lead rather than to whichever one happened to send first.
-                    primaryRegistry.recordDelegation(str(a, "sessionId"), caller);
-                    String turnId = str(a, "turnId");
-                    if (turnId != null && !turnId.isBlank()) {
-                        // Answering a worker's bridge_ask (CB-205): resolve its blocked question and
-                        // block for the worker's reply as it resumes the same turn.
-                        return answer(messages, turnId, str(a, "content"), timeoutMs(a));
-                    }
-                    // wait defaults to true (block for the reply); wait:false is fire-and-poll.
-                    return Boolean.FALSE.equals(a.get("wait"))
-                            ? sendAsync(messages, str(a, "sessionId"), str(a, "content"))
-                            : send(messages, str(a, "sessionId"), str(a, "content"), timeoutMs(a));
-                })
-                // bridge_reply's identity is the CONNECTION, never an argument — so the authz check
-                // is "is this caller a worker at all", and it can only ever reply as itself.
-                .toolCall(replyTool(), (exchange, req) -> {
-                    String self = callerTerminal(exchange);
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.REPLY, self);
-                    if (denied != null) return denied;
-                    return reply(messages, self, str(req.arguments(), "content"));
-                })
-                // bridge_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
-                .toolCall(askTool(), (exchange, req) -> {
-                    String self = callerTerminal(exchange);
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.ASK, self);
-                    if (denied != null) return denied;
-                    return ask(messages, self, str(req.arguments(), "question"), timeoutMs(req.arguments()));
-                })
-                .toolCall(statusTool(), (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
-                    if (denied != null) return denied;
-                    return status(messages, str(req.arguments(), "sessionId"));
-                })
-                .toolCall(pollTool(), (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
-                    if (denied != null) return denied;
-                    Map<String, Object> a = req.arguments();
-                    return poll(messages, str(a, "ticket"), str(a, "target"));
-                })
-                // CB-307 Increment 3: per-msgId ack (not needed in v1 but supported by the inbox).
-                // Acking removes a reply from the inbox, so it is a drain, not a read.
-                .toolCall(ackTool(), (exchange, req) -> {
-                    Map<String, Object> a = req.arguments();
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.DRAIN, str(a, "target"));
-                    if (denied != null) return denied;
-                    return ack(messages, str(a, "target"), str(a, "msgId"));
-                })
-                // Fleet management (CB-108): spawn/list/stop over ClaudeCodeLauncher.
-                .toolCall(spawnTool(), (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SPAWN, null);
-                    if (denied != null) return denied;
-                    String caller = callerTerminal(exchange);
-                    if (caller != null) primaryRegistry.record(caller);
-                    Map<String, Object> a = req.arguments();
-                    // CB-112: worker inherits the primary's cwd unless the call pins one.
-                    // CB-301: carry the caller's identity as the session owner (null for the primary).
-                    // CB-301-ext: optional isolated worktree for parallel implementers.
-                    String callerCwd = identity.cwdForPid(callerPid(exchange));
-                    return spawn(sessions, str(a, "profile"), str(a, "cwd"), callerCwd,
-                            callerTerminal(exchange), worktreeRequest(a));
-                })
-                .toolCall(listTool(), (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
-                    if (denied != null) return denied;
-                    return listFleet(workers, sessions,
-                            callers == null ? Map.of() : callers.leads(),
-                            callerTerminal(exchange));
-                })
-                .toolCall(stopTool(), (exchange, req) -> {
-                    String paneId = str(req.arguments(), "paneId");
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.STOP, paneId);
-                    if (denied != null) return denied;
-                    return stop(sessions, paneId);
-                })
-                .toolCall(profilesTool(), (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
-                    if (denied != null) return denied;
-                    return profiles(workers);
-                })
-                .toolCall(whoamiTool(), (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
-                    if (denied != null) return denied;
-                    return whoami(principal(exchange), sessions);
-                })
-                .build();
-        this.authz = callers;
-        this.metrics = metrics;
-    }
-
-    /**
-     * Pre-CB-501 identity: worker if the connection maps to a pane, otherwise the primary. Used
-     * only by the legacy constructor, where authorization is not enforced anyway.
-     */
-    private static Principal legacyPrincipal(ConnectionIdentity identity, String addr, int port) {
-        ConnectionIdentity.Caller c = identity.resolve(addr, port);
-        return c.terminal() != null
-                ? Principal.worker(c.terminal(), c.pid())
-                : Principal.primary(c.pid());
-    }
-
-    /** The caller reconstructed from the transport context. */
-    private static Principal principal(McpSyncServerExchange exchange) {
-        return principalFrom(exchange.transportContext().get(CALLER_ROLE),
-                callerTerminal(exchange), callerPid(exchange), callerName(exchange));
-    }
-
-    /**
-     * Rebuild a {@link Principal} from the three values the context extractor stashed.
-     *
-     * <p>Split out from {@link #principal(McpSyncServerExchange)} so the identity rules are
-     * reachable without an {@code McpSyncServerExchange} — that is an SDK type this project has no
-     * mocking library to fabricate, which is why this logic had no test at all until CB-513.
-     *
-     * @param role     the stashed {@link Role} name, or {@code null} on the legacy path
-     * @param terminal the worker terminal, or {@code null} for a non-worker
-     * @param pid      the calling pid, or {@code -1}
-     */
-    static Principal principalFrom(Object role, String terminal, long pid) {
-        return principalFrom(role, terminal, pid, null);
-    }
-
-    /** As {@link #principalFrom(Object, String, long)}, carrying a lead's name (CB-530). */
-    static Principal principalFrom(Object role, String terminal, long pid, String name) {
-        if (role == null) {
-            // No role stashed (legacy path): fall back to the historical interpretation.
-            return terminal != null ? Principal.worker(terminal, pid) : Principal.primary(pid);
-        }
-        return new Principal(Role.valueOf(role.toString()), terminal, pid, name);
-    }
-
-    /**
-     * Gate a tool call on the CB-505 table. Returns {@code null} when the call may proceed, or the
-     * error result to return when it may not.
-     */
-    private McpSchema.CallToolResult deny(McpSyncServerExchange exchange, Authz.Action action,
-                                          String target) {
-        return denyFor(principal(exchange), action, target);
-    }
-
-    /**
-     * The policy half of {@link #deny}: everything except pulling the caller out of the MCP
-     * exchange. Kept separate so the authorization decision — the actual control — is unit-testable
-     * without fabricating an SDK {@code McpSyncServerExchange}.
-     *
-     * <p>This surface exists because the enforcement was previously unreachable from a test: no
-     * test constructs a {@code BridgeMcp}, so the whole MCP-side gate ran zero times in the suite
-     * while the REST-side equivalent had ten tests. A security control nothing exercises is a
-     * claim, not a control.
-     *
-     * @return {@code null} when the call may proceed, or the error result to return when it may not
-     */
-    McpSchema.CallToolResult denyFor(Principal caller, Authz.Action action, String target) {
-        // The enforcement switch lives HERE rather than in the exchange-facing wrapper: any future
-        // tool that calls this directly must not be able to skip the gate by accident.
-        if (authz == null) {
-            return null; // legacy constructor: authorization not enforced
-        }
-        if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ) {
-                AuditLog.allowed(caller, action, target); // reads would drown the trail
-            }
-            return null;
-        }
-        String reason = Authz.isUnauthenticated(caller) ? "unauthenticated" : "forbidden";
-        AuditLog.denied(caller, action, target, reason);
-        if (metrics != null) {
-            metrics.inc(BridgedMetrics.AUTH_FAILURES, "reason", reason);
-        }
-        return error(reason + ": " + caller.describe() + " may not " + action);
-    }
-
-    /** The worker identity resolved from this call's connection, or {@code null} if the primary. */
-    private static String callerTerminal(McpSyncServerExchange exchange) {
-        Object v = exchange.transportContext().get(CALLER_TERMINAL);
-        String s = v == null ? null : v.toString();
-        return (s == null || s.isBlank()) ? null : s;
-    }
-
-    /** The lead name resolved from this call's connection, or {@code null} (CB-530). */
-    private static String callerName(McpSyncServerExchange exchange) {
-        Object v = exchange.transportContext().get(CALLER_NAME);
-        String s = v == null ? null : v.toString();
-        return (s == null || s.isBlank()) ? null : s;
-    }
-
-    /** The caller's PID resolved from this call's connection, or {@code -1} if unknown. */
-    private static long callerPid(McpSyncServerExchange exchange) {
-        Object v = exchange.transportContext().get(CALLER_PID);
-        try {
-            return v == null ? -1 : Long.parseLong(v.toString());
-        } catch (NumberFormatException e) {
-            return -1;
-        }
-    }
-
-    private static String orEmpty(String s) {
-        return s == null ? "" : s;
-    }
-
-    /** The Streamable-HTTP servlet to mount at {@code /mcp} on the daemon's Jetty. */
-    public HttpServlet servlet() {
-        return transport;
-    }
-
-    /** Graceful shutdown of the MCP server. */
-    public void close() {
-        server.closeGracefully();
-    }
-
-    // --- tool logic (thin adapters over the services; unit-testable) ---------------------------
-
-    /** {@code bridge_send}: delegate {@code content} to a worker session and block for its reply. */
-    static McpSchema.CallToolResult send(MessageService messages, String sessionId, String content, Long timeoutMs) {
-        if (isBlank(sessionId) || isBlank(content)) {
-            return error("sessionId and content are required");
-        }
-        long timeout = clamp(timeoutMs == null ? DEFAULT_TIMEOUT_MS : timeoutMs);
-        try {
-            return formatReply(messages.send(sessionId, content, timeout), timeout);
-        } catch (HerdrException e) {
-            return error("herdr error contacting session " + sessionId + ": " + e.getMessage());
-        }
-    }
-
-    /**
-     * {@code bridge_send} carrying a {@code turnId}: the primary's answer to a worker's
-     * {@code bridge_ask} (CB-205). Resolves the worker's blocked question and blocks for its reply as
-     * it resumes the same turn — surfaced to the primary identically to a normal send.
-     */
-    static McpSchema.CallToolResult answer(MessageService messages, String turnId, String content, Long timeoutMs) {
-        if (isBlank(turnId) || isBlank(content)) {
-            return error("turnId and content are required to answer a worker's question");
-        }
-        long timeout = clamp(timeoutMs == null ? DEFAULT_TIMEOUT_MS : timeoutMs);
-        return formatReply(messages.answer(turnId, content, timeout), timeout);
-    }
-
-    /**
-     * {@code bridge_ask} (CB-205): a worker pauses its delegated turn to ask the primary, blocking
-     * until the primary answers. The worker is identified by its connection ({@code callerTerminal}),
-     * never an argument — a {@code null} means the caller is not a known worker.
-     */
-    static McpSchema.CallToolResult ask(MessageService messages, String callerTerminal, String question, Long timeoutMs) {
-        if (callerTerminal == null) {
-            return error("bridge_ask is for workers only — could not identify the calling worker "
-                    + "from the connection");
-        }
-        if (isBlank(question)) {
-            return error("question is required");
-        }
-        long timeout = Math.clamp(timeoutMs == null ? ASK_DEFAULT_TIMEOUT_MS : timeoutMs, 1, ASK_MAX_TIMEOUT_MS);
-        MessageService.AskResult r = messages.ask(callerTerminal, question, timeout);
-        return switch (r.outcome()) {
-            case ANSWERED -> text(r.answer());
-            case NO_WAITER -> error("no primary is awaiting this turn — bridge_ask only works while a "
-                    + "bridge_send delegation is open to answer it");
-            case TIMED_OUT -> text("[no answer within " + timeout + "ms — the primary did not respond; "
-                    + "proceed on your best judgement, then call bridge_reply to end the turn]");
-        };
-    }
-
-    /** Render a {@link MessageService.Reply} as a tool result — shared by {@link #send} and {@link #answer}. */
-    private static McpSchema.CallToolResult formatReply(MessageService.Reply r, long timeout) {
-        return switch (r.outcome()) {
-            case REPLIED -> text(r.text());
-            // The worker's turn finished but it never called bridge_reply — hand back the scraped
-            // transcript tail, flagged so the primary knows it isn't a structured reply.
-            case COMPLETED_UNREPLIED -> text(
-                    "[worker finished without a structured bridge_reply — transcript tail follows]\n" + r.text());
-            // The worker ran the turn then wedged (CB-109) — surface the error context.
-            case WORKER_FAILED -> text("[worker failed — turn ended in an unrecoverable state]\n" + r.text());
-            // The worker paused mid-turn to ask (CB-205) — tell the primary how to answer in-turn.
-            case QUESTION -> text("[question] the worker paused to ask before it can finish:\n" + r.text()
-                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + r.turnId()
-                    + "\" and content set to your answer; the worker resumes the same turn.");
-            case STALE_TURN -> error("that question is no longer open — it timed out or was already "
-                    + "answered (turnId stale)");
-            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> text("[no reply within " + timeout + "ms — worker "
-                    + r.outcome().name().toLowerCase().replace("timed_out_", "") + "; retry or poll status]");
-        };
-    }
-
-    /**
-     * {@code bridge_send} with {@code wait:false}: delegate {@code content} and return a ticket
-     * immediately (fire-and-poll), so a long task isn't cut off by the caller's MCP call timeout.
-     */
-    static McpSchema.CallToolResult sendAsync(MessageService messages, String sessionId, String content) {
-        if (isBlank(sessionId) || isBlank(content)) {
-            return error("sessionId and content are required");
-        }
-        String ticket = messages.sendAsync(sessionId, content);
-        return text("accepted — task delegated. Poll bridge_poll with ticket=" + ticket);
-    }
-
-    /** {@code bridge_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
-    static McpSchema.CallToolResult poll(MessageService messages, String ticket, String target) {
-        if (!isBlank(target)) {
-            var replies = messages.drainReplies(target);
-            if (replies.isEmpty()) {
-                return text("[]");
-            }
-            return text(json(replies));
-        }
-        if (isBlank(ticket)) {
-            return error("ticket (or target) is required");
-        }
-        MessageService.TaskView v = messages.poll(ticket);
-        if (v == null) {
-            return error("unknown ticket: " + ticket + " (never issued, or expired)");
-        }
-        return switch (v.phase()) {
-            case DONE -> text(v.replySource() != null && v.replySource().equals("transcript")
-                    ? "[done — worker finished without a structured bridge_reply; transcript tail follows]\n" + v.reply()
-                    : v.reply());
-            case PENDING -> text("[pending — " + v.detail() + "]");
-            case FAILED -> text("[failed — " + v.detail() + "]");
-        };
-    }
-
-    /**
-     * {@code bridge_reply}: the worker returns its structured answer, resolving the awaiting send
-     * or — when no send is open — queueing the reply in the inbox for later drain (CB-307).
-     * {@code callerTerminal} is resolved from the connection (never an argument); a {@code null}
-     * means the caller is not a known worker (e.g. the primary called it by mistake).
-     */
-    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, String content) {
-        if (callerTerminal == null) {
-            return error("bridge_reply is for workers only — could not identify the calling worker "
-                    + "from the connection");
-        }
-        if (content == null) {
-            return error("content is required");
-        }
-        messages.reply(callerTerminal, content);
-        return text("delivered");
-    }
-
-    /** {@code bridge_ack}: acknowledge (remove) a specific reply from the inbox. */
-    static McpSchema.CallToolResult ack(MessageService messages, String target, String msgId) {
-        if (isBlank(target) || isBlank(msgId)) {
-            return error("target and msgId are required");
-        }
-        messages.ackReply(target, msgId);
-        return text("acknowledged " + msgId);
-    }
-
-    /** {@code bridge_status}: the live lifecycle status of a worker session. */
-    static McpSchema.CallToolResult status(MessageService messages, String sessionId) {
-        if (isBlank(sessionId)) {
-            return error("sessionId is required");
-        }
-        try {
-            return text(messages.status(sessionId).name().toLowerCase());
-        } catch (HerdrException e) {
-            return error("herdr error for session " + sessionId + ": " + e.getMessage());
-        }
-    }
-
-    /**
-     * {@code bridge_whoami}: the caller's own identity, as the daemon already resolved it.
-     *
-     * <p>Every other tool <em>consumes</em> this identity — the authorization gate, the reply
-     * rendezvous, the cwd inherit — but none reported it, so an agent had to infer its own role
-     * from side channels the daemon does not control: a charter string in its system prompt, the
-     * name its MCP mount happens to carry, or {@code ANTHROPIC_BASE_URL} (which Claude-model
-     * workers do not set). The failure mode of guessing is asymmetric and silent: a primary that
-     * mistakes itself for a worker is refused by {@link Authz} and learns immediately, while a
-     * worker that mistakes itself for the primary ends its turn without {@code bridge_reply} and
-     * the sender simply receives nothing. This tool removes the guess.
-     *
-     * <p>For a worker the session registry adds what it knows about that session. A worker the
-     * registry has no record of — one that outlived a daemon restart — still gets its role and
-     * {@code sessionId}, which is the load-bearing part.
-     */
-    static McpSchema.CallToolResult whoami(Principal caller, SessionManager sessions) {
-        Map<String, Object> m = new LinkedHashMap<>();
-        m.put("role", caller.role().name().toLowerCase());
-        if (caller.isArchitect()) {
-            // CB-548: the role reads "architect"; the name is the gateway-local slot the pane is
-            // bound to, and the pane itself so a peer knows where to reach it.
-            if (caller.name() != null) {
-                m.put("architect", caller.name());
-            }
-            if (caller.terminal() != null) {
-                m.put("sessionId", caller.terminal());
-            }
-            return text(json(m));
-        }
-        if (!caller.isWorker()) {
-            // CB-530: which lead, once more than one pane is configured as one. `role` deliberately
-            // still reads "primary" — the fallback ladder in CLAUDE.md keys on it, and a lead IS a
-            // primary for authorization; the name is additive so no existing reader breaks.
-            if (caller.name() != null) {
-                m.put("leader", caller.name());
-            }
-            // CB-532: a lead's own pane, so it can tell a peer where to reach it — and so an
-            // operator can read off which tab hosts which lead without going to herdr.
-            if (caller.terminal() != null) {
-                m.put("sessionId", caller.terminal());
-            }
-            return text(json(m));
-        }
-        m.put("sessionId", caller.terminal());
-        sessions.roster().stream()
-                .filter(s -> caller.terminal().equals(s.terminalId()))
-                .findFirst()
-                .ifPresent(s -> {
-                    m.put("paneId", s.paneId());
-                    m.put("profile", s.profile());
-                    m.put("state", s.state().name().toLowerCase());
-                    if (s.worktree() != null) {
-                        m.put("worktree", s.worktree());
-                    }
-                    if (s.branch() != null) {
-                        m.put("branch", s.branch());
-                    }
-                    if (s.ownerTerminal() != null) {
-                        m.put("owner", s.ownerTerminal());
-                    }
-                });
-        return text(json(m));
-    }
-
-    // --- fleet management logic (CB-108 / CB-301) --------------------------------------------
-
-    /** {@code bridge_spawn} without cwd/caller context (default resolution). */
-    static McpSchema.CallToolResult spawn(SessionManager sessions, String profile) {
-        return spawn(sessions, profile, null, null, null, null);
-    }
-
-    /**
-     * {@code bridge_spawn}: launch a guard-checked worker for {@code profile} (blank → the default
-     * profile) and return its session id + pane id. The worker's cwd is {@code requestedCwd} if given,
-     * else the profile's config, else {@code callerCwd} (the primary's directory), else the daemon's.
-     * CB-301: the session is registered with {@code ownerTerminal} as its owner.
-     * CB-301-ext: {@code worktreeRequest} non-null provisions an isolated git worktree.
-     */
-    static McpSchema.CallToolResult spawn(SessionManager sessions, String profile,
-                                          String requestedCwd, String callerCwd,
-                                          String ownerTerminal, WorktreeRequest worktreeRequest) {
-        try {
-            WorkerSession worker = sessions.acquire(isBlank(profile) ? null : profile,
-                    requestedCwd, callerCwd, ownerTerminal, worktreeRequest);
-            return text(json(workerView(worker)));
-        } catch (GuardException e) {
-            return error("subscription boundary: " + e.getMessage());
-        } catch (IllegalArgumentException e) {
-            return error(e.getMessage()); // unknown / no-default profile
-        } catch (PeerUnreachableException e) {
-            return error("spawn timed out — worker pane never reached injectable state: " + e.getMessage());
-        } catch (HerdrException e) {
-            return error("herdr error spawning worker: " + e.getMessage());
-        }
-    }
-
-    /** Build a {@link WorktreeRequest} from {@code bridge_spawn}'s optional {@code worktree}/{@code ticket} args. */
-    private static WorktreeRequest worktreeRequest(Map<String, Object> a) {
-        Object w = a.get("worktree");
-        if (w == null || Boolean.FALSE.equals(w)) {
-            return null;
-        }
-        String ticket = str(a, "ticket");
-        if (w instanceof String s) {
-            if (s.isBlank() || "false".equalsIgnoreCase(s)) {
-                return null;
-            }
-            if ("true".equalsIgnoreCase(s)) {
-                if (isBlank(ticket)) {
-                    throw new IllegalArgumentException("worktree=true requires a ticket slug");
-                }
-                return new WorktreeRequest(ticket, null);
-            }
-            return new WorktreeRequest(s, null);
-        }
-        if (w instanceof Boolean b && b) {
-            if (isBlank(ticket)) {
-                throw new IllegalArgumentException("worktree=true requires a ticket slug");
-            }
-            return new WorktreeRequest(ticket, null);
-        }
-        return null;
-    }
-
-    /** {@code bridge_profiles}: the configured worker profiles and the default. */
-    static McpSchema.CallToolResult profiles(PeerLauncher workers) {
-        return text(json(Map.of(
-                "profiles", workers.profiles(),
-                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile())));
-    }
-
-    /**
-     * {@code bridge_list}: the whole fleet — {@code leads} and {@code workers} — each merged with
-     * live herdr status. CB-519 decoupled the registry key (a host-unique id) from the herdr pane
-     * coordinate, so the join is on the terminal id, which both the session and the live agent carry.
-     *
-     * <p>CB-535 added the {@code leads} half. Until then this listed the worker roster alone, and a
-     * lead asking "who else is here?" got an empty array — which reads as <em>no peers</em> but
-     * actually means <em>no workers spawned</em>. There was no way at all for a lead to learn a
-     * peer's address; it had to be carried across by a human. Both halves are reported even when a
-     * half is empty, so an empty {@code workers} can no longer be mistaken for an empty fleet.
-     *
-     * <p>Leads are drawn from the resolver rather than from a second registry, so an address listed
-     * here is one that would actually resolve as a lead — see {@link CallerResolver#leads()}. The
-     * caller's own row is flagged {@code "self": true}: a peer needs to tell its own pane apart from
-     * a peer's, and the alternative is every lead calling {@code bridge_whoami} to subtract itself.
-     *
-     * @param leads    terminal_id → lead name, live from the resolver
-     * @param selfTerm the calling pane's terminal id, or blank for a caller with no pane
-     */
-    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions,
-                                              Map<String, String> leads, String selfTerm) {
-        try {
-            Map<String, Agent> live = workers.list().stream()
-                    .map(Agent.class::cast)
-                    .filter(a -> a.terminalId() != null)
-                    .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
-            List<Map<String, Object>> leadRows = leads.entrySet().stream()
-                    .sorted(Map.Entry.comparingByValue())
-                    .map(e -> leadView(e.getKey(), e.getValue(), live.get(e.getKey()), selfTerm))
-                    .toList();
-            List<Map<String, Object>> out = sessions.roster().stream()
-                    .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
-                    .toList();
-            return text(json(Map.of("leads", leadRows, "workers", out)));
-        } catch (HerdrException e) {
-            return error("herdr error listing the fleet: " + e.getMessage());
-        }
-    }
-
-    /**
-     * One lead's row: its address, its name, and whether it can be reached right now.
-     *
-     * <p>{@code status} is herdr's live view, and {@code unknown} when herdr is not tracking that
-     * pane as an agent — the honest answer, and the one that matters: a lead whose pane herdr cannot
-     * see is a lead a {@code bridge_send} cannot be typed into. It is reported rather than hidden,
-     * because a peer that has gone unreachable is exactly what the sender needs to know.
-     */
-    private static Map<String, Object> leadView(String terminal, String name, Agent live,
-                                                String selfTerm) {
-        Map<String, Object> m = new LinkedHashMap<>();
-        m.put("sessionId", terminal);
-        m.put("name", name);
-        m.put("status", live == null || live.status() == null
-                ? "unknown" : live.status().name().toLowerCase());
-        if (terminal.equals(selfTerm)) {
-            m.put("self", true);
-        }
-        return m;
-    }
-
-    /** {@code bridge_stop}: tear a worker down by its pane id. */
-    static McpSchema.CallToolResult stop(SessionManager sessions, String paneId) {
-        if (isBlank(paneId)) {
-            return error("paneId is required");
-        }
-        try {
-            sessions.release(paneId);
-            return text("stopped " + paneId);
-        } catch (HerdrException e) {
-            return error("herdr error stopping " + paneId + ": " + e.getMessage());
-        }
-    }
-
-    /** CB-301 projection from the authoritative session registry. */
-    private static Map<String, Object> workerView(WorkerSession s) {
-        Map<String, Object> m = new LinkedHashMap<>();
-        m.put("sessionId", s.terminalId());
-        m.put("paneId", s.paneId());
-        m.put("status", s.state().name().toLowerCase());
-        if (s.worktree() != null) {
-            m.put("worktree", s.worktree());
-        }
-        if (s.branch() != null) {
-            m.put("branch", s.branch());
-        }
-        return m;
-    }
-
-    private static String json(Object o) {
-        try {
-            return MAPPER.writeValueAsString(o);
-        } catch (Exception e) {
-            return String.valueOf(o);
-        }
-    }
-
-    // --- tool schemas --------------------------------------------------------------------------
-
-    private static McpSchema.Tool sendTool() {
-        return tool("bridge_send",
-                "Delegate a task to a worker session. By default blocks until the worker replies and "
-                        + "returns its reply (or a 'still working / queued' note on timeout). Pass wait:false "
-                        + "for a long task to return a ticket immediately, then poll it with bridge_poll. To "
-                        + "answer a worker's bridge_ask, pass its turnId (with content) instead of sessionId.",
-                objectSchema(Map.of(
-                        "sessionId", stringProp("The worker session id (herdr terminal_id) to delegate to"),
-                        "content", stringProp("The task/message to send to the worker (or your answer, with turnId)"),
-                        "timeoutMs", Map.of("type", "integer", "description", "Max ms to wait for a reply (blocking mode)"),
-                        "wait", Map.of("type", "boolean",
-                                "description", "Block for the reply (default true); false returns a ticket to poll"),
-                        "turnId", stringProp("When answering a worker's bridge_ask, its question turnId — "
-                                + "routes your answer back into the same turn (omit for a normal delegation)")),
-                        List.of("content")));
-    }
-
-    private static McpSchema.Tool askTool() {
-        // No target/session arg — the worker's identity is resolved from the connection.
-        return tool("bridge_ask",
-                "Pause your current delegated turn to ask the primary a question, blocking until it "
-                        + "answers — then resume the same turn with the answer. Use this when only the "
-                        + "primary has a decision or detail you need to continue. You do not address the "
-                        + "primary; identity is resolved from your connection.",
-                objectSchema(Map.of(
-                        "question", stringProp("The question to put to the primary"),
-                        "timeoutMs", Map.of("type", "integer",
-                                "description", "Max ms to wait for the primary's answer")),
-                        List.of("question")));
-    }
-
-    private static McpSchema.Tool pollTool() {
-        return tool("bridge_poll",
-                "Check an async delegation (a bridge_send with wait:false) by its ticket: "
-                        + "pending, done (with the worker's reply), or failed. When target (a worker "
-                        + "session id) is present instead of ticket, drain that worker's inbox of "
-                        + "replies delivered when no send was open.",
-                objectSchema(Map.of(
-                        "ticket", stringProp("The ticket returned by bridge_send wait:false"),
-                        "target", stringProp("Worker session id to drain pending replies from (optional)")),
-                        List.of()));
-    }
-
-    private static McpSchema.Tool ackTool() {
-        return tool("bridge_ack",
-                "Acknowledge (remove) a specific reply from a worker's inbox. Use when the primary "
-                        + "has processed a reply and wants to confirm it, leaving other pending replies "
-                        + "in the inbox for later drain.",
-                objectSchema(Map.of(
-                        "target", stringProp("Worker session id whose inbox to ack from"),
-                        "msgId", stringProp("The message id to acknowledge")),
-                        List.of("target", "msgId")));
-    }
-
-    private static McpSchema.Tool spawnTool() {
-        return tool("bridge_spawn",
-                "Spawn a new off-subscription worker session. Pass a profile (from bridge_profiles) to "
-                        + "pick the backend, or omit it for the default. The worker opens your current "
-                        + "directory by default; pass cwd to pin a different one. Pass worktree:true (with "
-                        + "ticket) or worktree:<ticket-slug> to provision an isolated git worktree. "
-                        + "Returns the worker's sessionId (use with bridge_send) and paneId (use with bridge_stop).",
-                objectSchema(Map.of(
-                        "profile", stringProp("Worker profile to spawn (omit for the default profile)"),
-                        "cwd", stringProp("Working directory for the worker (omit to inherit yours)"),
-                        "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
-                        "ticket", stringProp("Ticket slug when worktree:true")),
-                        List.of()));
-    }
-
-    private static McpSchema.Tool profilesTool() {
-        return tool("bridge_profiles",
-                "List the configured worker profiles (backends) and which one bridge_spawn uses by default.",
-                objectSchema(Map.of(), List.of()));
-    }
-
-    private static McpSchema.Tool listTool() {
-        return tool("bridge_list",
-                "List the whole fleet the bridge tracks, in two parts. 'leads' are your PEERS — other "
-                        + "orchestrators, each with its sessionId (the address to bridge_send to), "
-                        + "name, live status, and 'self': true on your own row; this is how you "
-                        + "discover a peer lead without being told its address. 'workers' are the "
-                        + "sessions delegated to — each with sessionId, paneId, profile, state, "
-                        + "optional worktree/branch/owner, and live herdr status. An empty 'workers' "
-                        + "means no workers are spawned; it says nothing about peers.",
-                objectSchema(Map.of(), List.of()));
-    }
-
-    private static McpSchema.Tool stopTool() {
-        return tool("bridge_stop",
-                "Tear down a worker session by its paneId (from bridge_spawn or bridge_list).",
-                objectSchema(Map.of(
-                        "paneId", stringProp("The worker's paneId to stop")),
-                        List.of("paneId")));
-    }
-
-    private static McpSchema.Tool replyTool() {
-        // No session/target arg — the caller's identity is resolved from the connection.
-        return tool("bridge_reply",
-                "Return your structured answer for a message you were sent, resolving the sender's "
-                        + "blocked bridge_send. A worker MUST end every delegated turn with exactly "
-                        + "one of these. A lead uses it only to answer another lead that messaged "
-                        + "it — never to answer a worker, whose turn it is not.",
-                objectSchema(Map.of(
-                        "content", stringProp("Your reply/answer")),
-                        List.of("content")));
-    }
-
-    private static McpSchema.Tool statusTool() {
-        return tool("bridge_status",
-                "Get the live lifecycle status (idle/working/blocked/unknown) of a worker session.",
-                objectSchema(Map.of(
-                        "sessionId", stringProp("The worker session id to query")),
-                        List.of("sessionId")));
-    }
-
-    private static McpSchema.Tool whoamiTool() {
-        return tool("bridge_whoami",
-                "Report who YOU are on the bridge — your role is resolved from your connection "
-                        + "(unforgeable), never from anything you claim. Returns role 'primary' (you "
-                        + "orchestrate: spawn/send/stop; reply ONLY to answer a peer lead that "
-                        + "messaged you, never to answer a worker), 'architect' (you delegate turns "
-                        + "and reply/ask as your own pane, but cannot spawn/stop/drain), or 'worker' "
-                        + "(you were delegated to: you must end every turn with exactly one "
-                        + "bridge_reply, and cannot spawn or send), plus 'leader'/'architect' naming "
-                        + "which one you are, your own sessionId, and profile/worktree/branch when "
-                        + "you are a worker. Call this first when following role-conditional "
-                        + "instructions rather than guessing.",
-                objectSchema(Map.of(), List.of()));
-    }
-
-    // --- small helpers -------------------------------------------------------------------------
-
-    // The SDK 2.0.0 deprecates its own Tool builders without a stable replacement — isolate it here.
-    @SuppressWarnings("deprecation")
-    private static McpSchema.Tool tool(String name, String description, Map<String, Object> inputSchema) {
-        return McpSchema.Tool.builder(name).description(description).inputSchema(inputSchema).build();
-    }
-
-    private static Map<String, Object> objectSchema(Map<String, Object> properties, List<String> required) {
-        return Map.of("type", "object", "properties", properties, "required", required);
-    }
-
-    private static Map<String, Object> stringProp(String description) {
-        return Map.of("type", "string", "description", description);
-    }
-
-    private static McpSchema.CallToolResult text(String s) {
-        return McpSchema.CallToolResult.builder().addTextContent(s == null ? "" : s).build();
-    }
-
-    private static McpSchema.CallToolResult error(String s) {
-        return McpSchema.CallToolResult.builder().addTextContent(s).isError(true).build();
-    }
-
-    private static String str(Map<String, Object> args, String key) {
-        Object v = args.get(key);
-        return v == null ? null : v.toString();
-    }
-
-    private static Long timeoutMs(Map<String, Object> args) {
-        Object v = args.get("timeoutMs");
-        return v instanceof Number n ? n.longValue() : null;
-    }
-
-    private static long clamp(long ms) {
-        return Math.clamp(ms, 1, MAX_TIMEOUT_MS);
-    }
-
-    private static boolean isBlank(String s) {
-        return s == null || s.isBlank();
-    }
-}

bridged/src/main/java/dev/ltms/bridged/mcp/ConnectionIdentity.java

@@ -1,66 +0,0 @@
-package dev.ltms.bridged.mcp;
-
-import dev.ltms.bridged.herdr.PaneLocator;
-
-/**
- * Resolves <em>who is calling</em> an MCP tool from the connection alone — the anti-spoofing
- * identity model of the MCP contract. It ties the connection's loopback peer PID (from the OS)
- * to a herdr agent pane (from herdr), yielding the caller's worker {@code terminal_id}. A caller
- * that maps to no worker pane — the primary, or an off-host client — resolves to {@code null}.
- *
- * <p>Both sources are authoritative and unforgeable: the OS reports the real connecting PID, and
- * herdr owns the PID→pane mapping. A worker cannot claim to be another worker, nor the primary.
- * Single-host only (the herd shares the {@code bridged} host); the token path is the split-host
- * fallback.
- */
-public final class ConnectionIdentity {
-
-    private final PaneLocator panes;
-    private final PeerPidLookup pids;
-    private final ProcessCwdLookup cwds;
-
-    /** Identity only (no cwd resolution — {@link #cwdForPid} returns {@code null}). */
-    public ConnectionIdentity(PaneLocator panes, PeerPidLookup pids) {
-        this(panes, pids, _ -> null);
-    }
-
-    /** Identity plus cwd resolution (CB-112 — inherit the primary's directory on spawn). */
-    public ConnectionIdentity(PaneLocator panes, PeerPidLookup pids, ProcessCwdLookup cwds) {
-        this.panes = panes;
-        this.pids = pids;
-        this.cwds = cwds;
-    }
-
-    /**
-     * The caller resolved from the connection: its worker {@code terminal} (or {@code null} for the
-     * primary / an off-host client) and its {@code pid} (or {@code -1} if not resolvable).
-     */
-    public record Caller(String terminal, long pid) {
-    }
-
-    /** Resolve the caller's terminal and PID from one peer-PID lookup. */
-    public Caller resolve(String remoteAddr, int remotePort) {
-        if (!isLoopback(remoteAddr)) {
-            return new Caller(null, -1); // only same-host callers can be workers
-        }
-        long pid = pids.pidForLocalPort(remotePort);
-        return new Caller(panes.terminalForPid(pid), pid);
-    }
-
-    /**
-     * The calling worker's {@code terminal_id}, or {@code null} if the caller is not a known
-     * on-host worker (treat as the primary).
-     */
-    public String callerTerminal(String remoteAddr, int remotePort) {
-        return resolve(remoteAddr, remotePort).terminal();
-    }
-
-    /** The working directory of {@code pid} (the primary's cwd on an MCP spawn), or {@code null}. */
-    public String cwdForPid(long pid) {
-        return pid > 0 ? cwds.cwdForPid(pid) : null;
-    }
-
-    private static boolean isLoopback(String addr) {
-        return "127.0.0.1".equals(addr) || "::1".equals(addr) || "0:0:0:0:0:0:0:1".equals(addr);
-    }
-}

bridged/src/main/java/dev/ltms/bridged/msg/AmqpReplyInbox.java

@@ -1,242 +0,0 @@
-package dev.ltms.bridged.msg;
-
-import com.rabbitmq.client.AMQP;
-import com.rabbitmq.client.Channel;
-import com.rabbitmq.client.Connection;
-import com.rabbitmq.client.ConnectionFactory;
-import com.rabbitmq.client.DeliverCallback;
-import com.rabbitmq.client.Recoverable;
-import com.rabbitmq.client.RecoveryListener;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.concurrent.ConcurrentHashMap;
-
-/**
- * AMQP-backed {@link ReplyInbox} (CB-307 Stage 2): genuine cross-restart durability behind the same
- * port {@link InMemoryReplyInbox} implements as soft state.
- *
- * <p><strong>Mapping — consume-and-hold with deferred manual ack.</strong> Each target has a durable
- * queue {@code agent.<target>.inbox}. The gateway that owns the target starts a manual-ack consumer
- * ({@link #own}) that pulls persistent messages off that queue into an in-memory <em>held</em> map
- * (keyed by {@code msgId}) but does <em>not</em> ack them. {@link #peek} returns that snapshot;
- * {@link #ack} acks the broker delivery-tag and drops the entry. Because messages stay unacked until
- * the owning gateway actually drains them, a crash (or a {@code java -jar} bounce) before caller-ack
- * leaves them on the broker — it redelivers on reconnect. That is the durability the in-memory
- * adapter cannot give, with the port contract preserved.
- *
- * <p><strong>Ownership is explicit.</strong> {@link #own} declares the queue and starts the consumer;
- * {@link #release} cancels it. {@link #publish} sends to the queue but does <em>not</em> imply ownership
- * and does not attach a consumer. This split is required by CB-308 federation, where one gateway may
- * publish to an agent owned by another gateway; in that case the publisher must not compete for
- * deliveries.
- *
- * <p><strong>Dedup.</strong> The consumer keys the held map by {@code msgId}; a redelivered duplicate
- * (at-least-once, or a producer double-publish) is acked-and-dropped on arrival, so it never
- * double-queues.
- *
- * <p><strong>Visibility.</strong> Unlike the in-memory adapter, publish → broker → consumer is
- * asynchronous, so a {@link #peek} immediately after {@link #publish} may not yet see the message
- * (broker delivery latency). Callers that need the reply drained poll (as the primary already does);
- * the contract test waits for visibility. This is inherent to broker-backed delivery, not a defect.
- *
- * <p>The default deploy targets LavinMQ; a stock RabbitMQ speaks the same AMQP 0-9-1 (URI-only swap),
- * so the {@code @Tag("contract")} integration test runs against a RabbitMQ container.
- */
-public final class AmqpReplyInbox implements ReplyInbox, AutoCloseable {
-
-    private static final Logger log = LoggerFactory.getLogger(AmqpReplyInbox.class);
-
-    private static final String QUEUE_PREFIX = "agent.";
-    private static final String QUEUE_SUFFIX = ".inbox";
-
-    private final Connection connection;
-    private final Channel channel;
-    /** All channel operations (publish/declare/ack/cancel) serialize on this — a Channel is not thread-safe. */
-    private final Object channelLock = new Object();
-    /** target → (msgId → held delivery). Per-target map is guarded by synchronizing on itself. */
-    private final ConcurrentHashMap<String, LinkedHashMap<String, Held>> held = new ConcurrentHashMap<>();
-    /** Targets whose queue is declared and consumer is running, mapped to their broker consumer tag. */
-    private final ConcurrentHashMap<String, String> consumerTags = new ConcurrentHashMap<>();
-
-    /** A message pulled off the broker but not yet acked: its delivery-tag plus the port payload. */
-    private record Held(long deliveryTag, InboxMessage message) {}
-
-    /** Connect to {@code uri} (e.g. {@code amqp://guest:guest@127.0.0.1:5672/}) and open the inbox. */
-    public static AmqpReplyInbox open(String uri) {
-        try {
-            ConnectionFactory factory = new ConnectionFactory();
-            factory.setUri(uri);
-            // Self-heal transient blips; topology recovery re-declares queues and re-attaches consumers.
-            factory.setAutomaticRecoveryEnabled(true);
-            factory.setTopologyRecoveryEnabled(true);
-            return new AmqpReplyInbox(factory.newConnection("bridged-reply-inbox"));
-        } catch (Exception e) {
-            throw new IllegalStateException("cannot connect to AMQP broker at " + uri, e);
-        }
-    }
-
-    /** Wrap an already-open connection (injection seam for the contract test). */
-    AmqpReplyInbox(Connection connection) {
-        this.connection = connection;
-        try {
-            this.channel = connection.createChannel();
-        } catch (IOException e) {
-            throw new IllegalStateException("cannot open AMQP channel", e);
-        }
-        // On automatic recovery the broker redelivers unacked messages with FRESH delivery-tags; the
-        // tags we were holding are now stale. Drop the held snapshot so the re-attached consumer
-        // repopulates it with valid tags (dedup by msgId still prevents any double-queue).
-        if (connection instanceof Recoverable recoverable) {
-            recoverable.addRecoveryListener(new RecoveryListener() {
-                @Override
-                public void handleRecovery(Recoverable recoverable) {
-                    held.clear();
-                    log.info("AMQP connection recovered; cleared held replies for fresh redelivery");
-                }
-
-                @Override
-                public void handleRecoveryStarted(Recoverable recoverable) {
-                    // no-op: we act once recovery completes
-                }
-            });
-        }
-    }
-
-    @Override
-    public void own(String target) {
-        synchronized (channelLock) {
-            if (consumerTags.containsKey(target)) {
-                return;                            // already owning this target
-            }
-            String queue = queueName(target);
-            try {
-                channel.queueDeclare(queue, true, false, false, null); // durable, non-exclusive, keep on idle
-                String tag = channel.basicConsume(queue, false, deliverCallback(target), _ -> { });
-                consumerTags.put(target, tag);
-                log.debug("AMQP inbox owns queue {} for target {}", queue, target);
-            } catch (IOException e) {
-                throw new IllegalStateException("cannot own queue " + queue, e);
-            }
-        }
-    }
-
-    @Override
-    public void release(String target) {
-        synchronized (channelLock) {
-            String tag = consumerTags.remove(target);
-            held.remove(target);                   // stale delivery tags must not survive release
-            if (tag == null) {
-                return;
-            }
-            try {
-                channel.basicCancel(tag);
-            } catch (IOException e) {
-                throw new IllegalStateException("cannot cancel consumer for " + target, e);
-            }
-        }
-    }
-
-    @Override
-    public void publish(String target, String msgId, String content) {
-        AMQP.BasicProperties props = new AMQP.BasicProperties.Builder()
-                .messageId(msgId)
-                .deliveryMode(2)                   // persistent — survives a broker restart
-                .contentType("text/plain")
-                .build();
-        try {
-            synchronized (channelLock) {
-                channel.basicPublish("", queueName(target), props, content.getBytes(StandardCharsets.UTF_8));
-            }
-        } catch (IOException e) {
-            throw new IllegalStateException("cannot publish reply to " + queueName(target), e);
-        }
-    }
-
-    @Override
-    public List<InboxMessage> peek(String target) {
-        var perTarget = held.get(target);
-        if (perTarget == null) {
-            return List.of();
-        }
-        synchronized (perTarget) {
-            return perTarget.values().stream().map(Held::message).toList();
-        }
-    }
-
-    @Override
-    public void ack(String target, String msgId) {
-        var perTarget = held.get(target);
-        if (perTarget == null) {
-            return;
-        }
-        Held h;
-        synchronized (perTarget) {
-            h = perTarget.remove(msgId);
-        }
-        if (h == null) {
-            return;                                // never held (or already acked) — no-op
-        }
-        try {
-            synchronized (channelLock) {
-                channel.basicAck(h.deliveryTag(), false);
-            }
-        } catch (IOException e) {
-            // Ack didn't reach the broker: restore the entry so a later ack (or a redelivery after
-            // reconnect) can retry. Keeps the at-least-once contract — a reply is never silently lost.
-            synchronized (perTarget) {
-                perTarget.putIfAbsent(msgId, h);
-            }
-            throw new IllegalStateException("cannot ack reply " + msgId + " on " + queueName(target), e);
-        }
-    }
-
-    private DeliverCallback deliverCallback(String target) {
-        return (_, delivery) -> {
-            String msgId = delivery.getProperties().getMessageId();
-            long tag = delivery.getEnvelope().getDeliveryTag();
-            if (msgId == null || msgId.isBlank()) {
-                msgId = Long.toHexString(tag);     // synthesize an id so dedup still has a key
-            }
-            String content = new String(delivery.getBody(), StandardCharsets.UTF_8);
-            var perTarget = held.computeIfAbsent(target, _ -> new LinkedHashMap<>());
-            boolean duplicate;
-            synchronized (perTarget) {
-                if (perTarget.containsKey(msgId)) {
-                    duplicate = true;
-                } else {
-                    perTarget.put(msgId, new Held(tag, new InboxMessage(msgId, target, content)));
-                    duplicate = false;
-                }
-            }
-            if (duplicate) {
-                // Redelivered duplicate: ack the new tag and drop it so the broker stops resending.
-                synchronized (channelLock) {
-                    channel.basicAck(tag, false);
-                }
-            }
-        };
-    }
-
-    private static String queueName(String target) {
-        return QUEUE_PREFIX + target + QUEUE_SUFFIX;
-    }
-
-    @Override
-    public void close() {
-        try {
-            channel.close();
-        } catch (Exception e) {
-            log.debug("AMQP channel close: {}", e.toString());
-        }
-        try {
-            connection.close();
-        } catch (Exception e) {
-            log.debug("AMQP connection close: {}", e.toString());
-        }
-    }
-}

bridged/src/main/java/dev/ltms/bridged/msg/MessageService.java

@@ -1,527 +0,0 @@
-package dev.ltms.bridged.msg;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.List;
-import java.util.UUID;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.CompletionException;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ExecutionException;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.TimeoutException;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.concurrent.locks.ReentrantLock;
-
-/**
- * The blocking delegation feature (CB-104): deliver {@code content} into a worker and block until
- * the worker returns a <em>structured reply</em> via {@code bridge_reply} (the {@link Rendezvous}),
- * then hand that reply back. Delivery is the {@link Injector}'s job (the background poller sends it
- * when the worker is injectable); this service never drives the injector or scrapes the terminal —
- * completion is the worker's explicit reply, not a guess about {@code agent_status}.
- *
- * <p>Sends are serialized per session so exactly one reply can be outstanding per worker, which is
- * what lets a reply map unambiguously to its send (no cross-talk between concurrent callers).
- *
- * <p>If the worker never replies within the timeout, the caller gets a typed "still working" /
- * "queued" outcome — the message may still be mid-flight. A finished-but-unreplied turn is caught
- * by the CB-106 completion fallback (see {@link Rendezvous#resolveCompletion}).
- *
- * <p><strong>Async fire-and-poll (CB-107).</strong> A caller's MCP client caps a blocking call at
- * ~60s, but a real delegated task runs for minutes. {@link #sendAsync} therefore runs the same
- * blocking {@link #send} on a background virtual thread and hands back a <em>ticket</em> the caller
- * polls with {@link #poll}. The blocking and async paths share one code path (and the same per-target
- * serialization), so async inherits the reply + completion resolution behaviour for free.
- */
-public final class MessageService {
-
-    private static final Logger log = LoggerFactory.getLogger(MessageService.class);
-
-    /**
-     * The window a fire-and-poll send waits for resolution — generous, since no caller is blocked on
-     * it; a real delegated task resolves (reply or completion) well within this, and only a genuinely
-     * hung worker rides it out.
-     */
-    private static final long ASYNC_TIMEOUT_MS = 30 * 60 * 1_000L;
-
-    /** How long a finished (terminal) ticket is retained for polling before it is pruned. */
-    private static final long TICKET_TTL_NANOS = 10 * 60 * 1_000_000_000L;
-
-    /** Outcome of a blocking send. */
-    public enum Outcome {
-        /** The worker called {@code bridge_reply}; {@code text} holds the structured answer. */
-        REPLIED,
-        /**
-         * The worker's delegated turn finished without a {@code bridge_reply} (CB-106 fallback);
-         * {@code text} is the scraped transcript tail rather than a structured answer.
-         */
-        COMPLETED_UNREPLIED,
-        /**
-         * The worker ran the turn then wedged in an unrecoverable state (CB-109); {@code text} is the
-         * failure context (e.g. the error screen). Terminal, but not a successful completion.
-         */
-        WORKER_FAILED,
-        /**
-         * The worker paused mid-turn to ask the primary a question (CB-205); {@code text} is the
-         * question and {@code turnId} correlates the answer. Not terminal — the primary answers with
-         * {@link #answer(String, String, long)} and the turn resumes.
-         */
-        QUESTION,
-        /** Timed out after the message was delivered — the worker is still working. */
-        TIMED_OUT_WORKING,
-        /** Timed out before delivery — the message is still queued for the worker. */
-        TIMED_OUT_QUEUED,
-        /** Another send to this session was in flight for the whole window. */
-        BUSY,
-        /**
-         * An answer ({@link #answer(String, String, long)}) referenced a {@code turnId} that is no
-         * longer open — the worker's {@code bridge_ask} already timed out or was answered.
-         */
-        STALE_TURN
-    }
-
-    /**
-     * @param outcome how the send ended (or paused)
-     * @param text    the worker's answer when {@link #completed()} (a structured {@code bridge_reply}
-     *                for {@link Outcome#REPLIED}, a scraped transcript tail for
-     *                {@link Outcome#COMPLETED_UNREPLIED}), or the question for {@link Outcome#QUESTION},
-     *                else {@code null}
-     * @param turnId  correlation id for a {@link Outcome#QUESTION} (answered via
-     *                {@link #answer(String, String, long)}), else {@code null}
-     */
-    public record Reply(Outcome outcome, String text, String turnId) {
-        /** A reply with no correlation id (the common terminal outcomes). */
-        public Reply(Outcome outcome, String text) {
-            this(outcome, text, null);
-        }
-
-        /** Whether the worker's turn actually finished with an answer (replied or scraped). */
-        public boolean completed() {
-            return outcome == Outcome.REPLIED || outcome == Outcome.COMPLETED_UNREPLIED;
-        }
-    }
-
-    /** How a worker's {@code bridge_ask} (CB-205) resolved. */
-    public enum AskOutcome {
-        /** The primary answered; {@link AskResult#answer} carries it. */
-        ANSWERED,
-        /** No delegation was open to surface the question to — the worker has no one to ask. */
-        NO_WAITER,
-        /** The primary did not answer within the window. */
-        TIMED_OUT
-    }
-
-    /** The outcome of a worker's {@code bridge_ask}: how it resolved and (if answered) the answer. */
-    public record AskResult(AskOutcome outcome, String answer) {
-    }
-
-    /** Lifecycle phase of an async delegation ticket. */
-    public enum Phase {
-        /** Delegated and in flight — queued for the worker or being worked. */
-        PENDING,
-        /** The worker's turn finished; {@link TaskView#reply} holds the answer. */
-        DONE,
-        /** The delegation could not complete (timed out, worker gone, or busy). */
-        FAILED
-    }
-
-    /**
-     * A poll snapshot of an async delegation.
-     *
-     * @param reply       the answer when {@link #phase} is {@link Phase#DONE}, else {@code null}
-     * @param replySource {@code "reply"} (structured {@code bridge_reply}) or {@code "transcript"}
-     *                    (completion scrape) when {@link Phase#DONE}, else {@code null}
-     * @param detail      a human note (live worker status while pending, or the failure reason)
-     */
-    public record TaskView(String ticket, Phase phase, String reply, String replySource, String detail) {
-    }
-
-    /** An in-flight or finished async delegation, keyed by its ticket. */
-    private record Task(String target, CompletableFuture<Reply> future, long createdNanos) {
-    }
-
-    private final AgentControl agents;
-    private final Injector injector;
-    private final Rendezvous rendezvous;
-    private final ReplyInbox inbox;
-    private final ReplyPushLoop pushLoop;
-    private final Metrics metrics; // CB-502: nullable — no registry in unit tests
-    private final ConcurrentHashMap<String, ReentrantLock> sessionLocks = new ConcurrentHashMap<>();
-    private final ConcurrentHashMap<String, Task> tasks = new ConcurrentHashMap<>();
-    private final AtomicLong ticketSeq = new AtomicLong();
-    private final ExecutorService asyncExecutor = Executors.newThreadPerTaskExecutor(
-            Thread.ofVirtual().name("bridge-async-", 0).factory());
-
-    /**
-     * Create with an explicit {@link ReplyInbox} and optional {@link ReplyPushLoop}.
-     *
-     * @param pushLoop nullable — when non-null, the push loop is notified on the no-waiter reply
-     *                 branch ({@link #reply}) so it can nudge the primary to drain the inbox
-     */
-    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
-                          ReplyInbox inbox, ReplyPushLoop pushLoop) {
-        this(agents, injector, rendezvous, inbox, pushLoop, null);
-    }
-
-    /**
-     * As above, with a metric registry (CB-502). Instrumenting here rather than at the REST and MCP
-     * edges means both surfaces are counted by one piece of code and cannot drift.
-     *
-     * @param metrics nullable — when null, nothing is recorded
-     */
-    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
-                          ReplyInbox inbox, ReplyPushLoop pushLoop, Metrics metrics) {
-        this.agents = agents;
-        this.injector = injector;
-        this.rendezvous = rendezvous;
-        this.inbox = inbox;
-        this.pushLoop = pushLoop;
-        this.metrics = metrics;
-    }
-
-    /** Create with an explicit {@link ReplyInbox} and no push loop. */
-    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous, ReplyInbox inbox) {
-        this(agents, injector, rendezvous, inbox, null);
-    }
-
-    /** Backward-compatible constructor that uses a default {@link InMemoryReplyInbox}. */
-    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous) {
-        this(agents, injector, rendezvous, new InMemoryReplyInbox());
-    }
-
-    /** Current lifecycle status of a worker (the {@code GET /sessions/{id}/status} surface). */
-    public AgentStatus status(String target) {
-        return agents.status(target);
-    }
-
-    /**
-     * Route a worker's explicit {@code bridge_reply}: resolve an open send, or queue it in the
-     * inbox if no send is currently open. Unlike the bare {@link Rendezvous#resolve}, a no-waiter
-     * result is <em>not</em> a failure — the reply is held for later drain.
-     *
-     * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code bridge_ask} /
-     * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
-     * are interactive and must never be queued.
-     *
-     * @return always {@code true} — the reply either resolved a live send or was queued
-     */
-    public boolean reply(String session, String content) {
-        if (rendezvous.resolve(session, content)) {
-            count(BridgedMetrics.REPLIES, "path", "rendezvous");
-            return true;                       // a live send took it — unchanged fast path
-        }
-        inbox.publish(session, UUID.randomUUID().toString(), content);
-        // A rising inbox share is the signal CB-307 exists to make visible: the worker finished but
-        // nobody was waiting, so delivery now depends on the push loop and a drain.
-        count(BridgedMetrics.REPLIES, "path", "inbox");
-        if (pushLoop != null) {
-            pushLoop.onReplyQueued(session);
-        }
-        return true;                           // held, not lost
-    }
-
-    /** Record a counter sample when a registry is wired; a no-op in unit tests. */
-    private void count(String name, String... labels) {
-        if (metrics != null) {
-            metrics.inc(name, labels);
-        }
-    }
-
-    /** Count a send's terminal outcome and pass the reply through unchanged. */
-    private Reply recorded(Reply r) {
-        String label = sendOutcomeLabel(r.outcome());
-        if (label != null) {
-            count(BridgedMetrics.SENDS, "outcome", label);
-        }
-        return r;
-    }
-
-    /** Map a terminal send outcome to its metric label, or {@code null} for non-terminal ones. */
-    private static String sendOutcomeLabel(Outcome o) {
-        return switch (o) {
-            case REPLIED -> "replied";
-            case COMPLETED_UNREPLIED -> "completion_fallback";
-            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> "timeout";
-            case WORKER_FAILED -> "failed";
-            case STALE_TURN, QUESTION -> null; // not a completed delegation
-        };
-    }
-
-    /**
-     * Abandon any send still waiting on {@code target} because its session has gone away (CB-516).
-     *
-     * <p>Without this, tearing a worker down left its rendezvous waiter open: a blocking
-     * {@code bridge_send} kept blocking, and an async one kept reporting {@code PENDING} until
-     * {@link #ASYNC_TIMEOUT_MS} — thirty minutes — even though the worker provably no longer
-     * existed and the delegation could never complete. Worse, {@code poll} already had the evidence
-     * (it calls {@code liveStatus} to build its detail string and gets back {@code "unknown"}) and
-     * reported {@code PENDING} anyway.
-     *
-     * <p>Resolving the waiter as a failure — rather than letting it time out — also means the
-     * outcome is counted, so a torn-down delegation stops being invisible to {@code /metrics}.
-     *
-     * @return true if a live waiter was failed
-     */
-    public boolean abandon(String target, String reason) {
-        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
-        if (waiter == null || waiter.isDone()) {
-            return false; // nobody is blocked on this worker — nothing to abandon
-        }
-        boolean failed = rendezvous.resolveFailure(waiter, reason);
-        if (failed) {
-            log.debug("abandoned send to {}: {}", target, reason);
-        }
-        return failed;
-    }
-
-    /**
-     * Acknowledge a specific reply by {@code msgId} for {@code target}. Removes it from the inbox
-     * so that a subsequent drain or peek no longer returns it.
-     */
-    public void ackReply(String target, String msgId) {
-        inbox.ack(target, msgId);
-    }
-
-    /**
-     * Drain (peek + ack) all pending inbox replies for {@code target}. At-least-once: returns the
-     * messages and acknowledges them; an in-flight failure between returning and the caller
-     * processing them re-surfaces them on a subsequent drain (the ack is local).
-     *
-     * @return the drained messages, newest last (FIFO); empty list if none
-     */
-    public List<ReplyInbox.InboxMessage> drainReplies(String target) {
-        var messages = inbox.peek(target);
-        for (var msg : messages) {
-            inbox.ack(target, msg.msgId());
-        }
-        return messages;
-    }
-
-    /**
-     * Deliver {@code content} to {@code target} (a herdr {@code terminal_id}) and block until the
-     * worker replies via {@link Rendezvous} or {@code timeoutMillis} elapses.
-     */
-    public Reply send(String target, String content, long timeoutMillis) {
-        long deadlineNanos = System.nanoTime() + timeoutMillis * 1_000_000L;
-        ReentrantLock lock = sessionLocks.computeIfAbsent(target, _ -> new ReentrantLock());
-
-        if (!tryLock(lock, remainingMillis(deadlineNanos))) {
-            return new Reply(Outcome.BUSY, null); // another send held the session the whole window
-        }
-        try {
-            CompletableFuture<Void> delivered = injector.enqueue(target, content);
-            CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(target);
-            try {
-                Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
-                return recorded(new Reply(outcomeOf(r.kind()), r.text(), r.turnId()));
-            } catch (TimeoutException e) {
-                boolean wasDelivered = delivered.isDone() && !delivered.isCompletedExceptionally();
-                log.debug("send to {} timed out (delivered={})", target, wasDelivered);
-                return recorded(new Reply(
-                        wasDelivered ? Outcome.TIMED_OUT_WORKING : Outcome.TIMED_OUT_QUEUED, null));
-            } catch (ExecutionException e) {
-                Throwable cause = e.getCause();
-                throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
-            } catch (InterruptedException e) {
-                Thread.currentThread().interrupt();
-                throw new IllegalStateException("interrupted awaiting reply from " + target, e);
-            } finally {
-                rendezvous.close(target, reply);
-            }
-        } finally {
-            lock.unlock();
-        }
-    }
-
-    /**
-     * A worker's mid-turn question (CB-205 reverse rendezvous): surface {@code question} to the
-     * primary by resolving its open blocking {@code bridge_send}, then block this (worker) call until
-     * the primary answers via {@link #answer} or {@code timeoutMillis} elapses. Identity is the
-     * worker's own session — it does not address the primary.
-     *
-     * <p>Returns {@link AskOutcome#NO_WAITER} when no delegation is open to surface the question to
-     * (nothing to answer it), {@link AskOutcome#ANSWERED} with the primary's answer, or
-     * {@link AskOutcome#TIMED_OUT} if the primary stayed silent. The worker resumes its turn either
-     * way — an answered ask hands back the answer; an unanswered one leaves it to proceed alone.
-     */
-    public AskResult ask(String workerSession, String question, long timeoutMillis) {
-        Rendezvous.AskTicket ticket = rendezvous.openAsk(workerSession);
-        // Only the freshly-opening caller surfaces the question; a coalesced duplicate simply blocks on
-        // the shared answer future that the fresh owner is already responsible for.
-        if (ticket.fresh()) {
-            // Register the reverse waiter first, then surface the question — so the answer, which can
-            // arrive the instant the primary reacts, always finds an open waiter to resolve.
-            if (!rendezvous.resolveQuestion(workerSession, question, ticket.turnId())) {
-                rendezvous.closeAsk(ticket.turnId());
-                return new AskResult(AskOutcome.NO_WAITER, null); // no primary is blocked on this worker
-            }
-        }
-        try {
-            String answer = ticket.answer().get(timeoutMillis, TimeUnit.MILLISECONDS);
-            return new AskResult(AskOutcome.ANSWERED, answer);
-        } catch (TimeoutException e) {
-            log.debug("bridge_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
-            return new AskResult(AskOutcome.TIMED_OUT, null);
-        } catch (ExecutionException e) {
-            Throwable cause = e.getCause();
-            throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            throw new IllegalStateException("interrupted awaiting the primary's answer for " + workerSession, e);
-        } finally {
-            // Only the fresh owner tears down the shared turn; a duplicate must leave it open.
-            if (ticket.fresh()) {
-                rendezvous.closeAsk(ticket.turnId());
-            }
-        }
-    }
-
-    /**
-     * The primary's answer to a worker's {@code bridge_ask} (CB-205): resolve the worker's blocked
-     * question identified by {@code turnId}, then — like a fresh {@link #send} — block for the worker's
-     * eventual {@code bridge_reply} as it finishes the resumed turn. The worker session is derived from
-     * {@code turnId}, never a caller argument.
-     *
-     * <p>Unlike {@link #send} this does not re-inject through the {@link Injector}: the worker is
-     * mid-turn (already picked up), so the answer flows back through its own open {@code bridge_ask}
-     * call, not a new status-gated delivery. The forward waiter is opened <em>before</em> the worker
-     * is unblocked so a reply that lands the instant it resumes is not lost.
-     */
-    public Reply answer(String turnId, String content, long timeoutMillis) {
-        String workerSession = rendezvous.askSession(turnId);
-        if (workerSession == null) {
-            return new Reply(Outcome.STALE_TURN, null); // the ask lapsed (timed out or already answered)
-        }
-        long deadlineNanos = System.nanoTime() + timeoutMillis * 1_000_000L;
-        ReentrantLock lock = sessionLocks.computeIfAbsent(workerSession, _ -> new ReentrantLock());
-        if (!tryLock(lock, remainingMillis(deadlineNanos))) {
-            return new Reply(Outcome.BUSY, null);
-        }
-        try {
-            CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(workerSession);
-            if (!rendezvous.answerAsk(turnId, content)) {
-                rendezvous.close(workerSession, reply);
-                return new Reply(Outcome.STALE_TURN, null); // lapsed between the lookup and the unblock
-            }
-            try {
-                Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
-                return new Reply(outcomeOf(r.kind()), r.text(), r.turnId());
-            } catch (TimeoutException e) {
-                // The worker resumed but hasn't replied yet — no completion fallback arms an answered
-                // turn (it never re-entered the injector), so a silent worker rides out the window.
-                return new Reply(Outcome.TIMED_OUT_WORKING, null);
-            } catch (ExecutionException e) {
-                Throwable cause = e.getCause();
-                throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
-            } catch (InterruptedException e) {
-                Thread.currentThread().interrupt();
-                throw new IllegalStateException("interrupted awaiting reply from " + workerSession, e);
-            } finally {
-                rendezvous.close(workerSession, reply);
-            }
-        } finally {
-            lock.unlock();
-        }
-    }
-
-    /**
-     * Fire-and-poll variant of {@link #send}: deliver {@code content} to {@code target} on a
-     * background virtual thread and return immediately with a ticket to {@link #poll}. This is how a
-     * long task is delegated without tripping the caller's MCP client call timeout.
-     *
-     * @return the ticket to poll for the eventual result
-     */
-    public String sendAsync(String target, String content) {
-        String ticket = "task-" + ticketSeq.incrementAndGet();
-        CompletableFuture<Reply> future =
-                CompletableFuture.supplyAsync(() -> send(target, content, ASYNC_TIMEOUT_MS), asyncExecutor);
-        tasks.put(ticket, new Task(target, future, System.nanoTime()));
-        pruneTerminalTickets();
-        log.debug("async send {} -> {}", ticket, target);
-        return ticket;
-    }
-
-    /**
-     * Snapshot the state of an async delegation. Returns {@code null} for an unknown/expired ticket;
-     * otherwise a {@link Phase#PENDING} view (with the live worker status as detail), a
-     * {@link Phase#DONE} view carrying the reply, or a {@link Phase#FAILED} view with the reason.
-     */
-    public TaskView poll(String ticket) {
-        Task task = tasks.get(ticket);
-        if (task == null) {
-            return null;
-        }
-        CompletableFuture<Reply> f = task.future();
-        if (!f.isDone()) {
-            return new TaskView(ticket, Phase.PENDING, null, null, "worker " + liveStatus(task.target()));
-        }
-        Reply r;
-        try {
-            r = f.getNow(null);
-        } catch (CompletionException | java.util.concurrent.CancellationException e) {
-            Throwable cause = (e instanceof CompletionException ce && ce.getCause() != null) ? ce.getCause() : e;
-            return new TaskView(ticket, Phase.FAILED, null, null, cause.getMessage());
-        }
-        if (r.completed()) {
-            String source = r.outcome() == Outcome.REPLIED ? "reply" : "transcript";
-            return new TaskView(ticket, Phase.DONE, r.text(), source, null);
-        }
-        // A wedged worker (CB-109) carries the error context as its reason; the timeout/busy
-        // outcomes carry none, so fall back to the outcome name.
-        String detail = r.outcome() == Outcome.WORKER_FAILED && r.text() != null
-                ? r.text()
-                : "no reply — " + r.outcome().name().toLowerCase();
-        return new TaskView(ticket, Phase.FAILED, null, null, detail);
-    }
-
-    /** Best-effort live worker status for a pending poll; never throws (a lookup error is just noise). */
-    private String liveStatus(String target) {
-        try {
-            return agents.status(target).name().toLowerCase();
-        } catch (RuntimeException e) {
-            return "unknown";
-        }
-    }
-
-    /** Drop finished tickets older than the TTL so the registry cannot grow without bound. */
-    private void pruneTerminalTickets() {
-        long cutoff = System.nanoTime() - TICKET_TTL_NANOS;
-        tasks.values().removeIf(t -> t.future().isDone() && t.createdNanos() < cutoff);
-    }
-
-    /** Release the async executor. */
-    public void close() {
-        asyncExecutor.shutdown();
-    }
-
-    /** Map a rendezvous {@link Rendezvous.Kind} onto its send {@link Outcome} (shared by send/answer). */
-    private static Outcome outcomeOf(Rendezvous.Kind kind) {
-        return switch (kind) {
-            case REPLY -> Outcome.REPLIED;
-            case COMPLETION -> Outcome.COMPLETED_UNREPLIED;
-            case FAILED -> Outcome.WORKER_FAILED;
-            case QUESTION -> Outcome.QUESTION;
-        };
-    }
-
-    private static boolean tryLock(ReentrantLock lock, long millis) {
-        try {
-            return lock.tryLock(Math.max(0, millis), TimeUnit.MILLISECONDS);
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            throw new IllegalStateException("interrupted awaiting the session send lock", e);
-        }
-    }
-
-    private static long remainingMillis(long deadlineNanos) {
-        return (deadlineNanos - System.nanoTime()) / 1_000_000L;
-    }
-}

bridged/src/main/java/dev/ltms/bridged/msg/ReplyPushLoop.java

@@ -1,188 +0,0 @@
-package dev.ltms.bridged.msg;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-
-/**
- * Mechanism (b) of CB-307: a dedicated, status-gated push loop that nudges the primary's own
- * herdr pane when a worker reply lands with no live {@code bridge_send} to resolve it.
- *
- * <p>The loop is triggered by {@link #onReplyQueued(String)} (called from
- * {@link MessageService#reply} after the durable inbox publish). It checks four conditions
- * at each tick via {@link #decide(String, int)}, then either injects a drain nudge,
- * waits for the primary to become injectable, or stops reminding.
- *
- * <p>Bounded: at most {@link #maxReminders} nudges per target, with a configurable backoff
- * between them. The reply is never lost — the durable inbox is the backstop.
- */
-public final class ReplyPushLoop {
-
-    private static final Logger log = LoggerFactory.getLogger(ReplyPushLoop.class);
-    static final String NUDGE_FORMAT = "Worker %s returned a reply — run bridge_poll(target=%s) to collect it";
-
-    private final PrimaryRegistry primaryRegistry;
-    private final AgentControl agents;
-    private final ReplyInbox inbox;
-    private final ScheduledExecutorService scheduler;
-    private final int maxReminders;
-    private final long backoffMs;
-    private final Metrics metrics; // CB-512: nullable — no registry in unit tests
-
-    /** Track targets that have an active schedule. */
-    private final ConcurrentHashMap<String, Boolean> activeTargets = new ConcurrentHashMap<>();
-
-    public ReplyPushLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
-                         ScheduledExecutorService scheduler,
-                         int maxReminders, long backoffMs) {
-        this(primaryRegistry, agents, inbox, scheduler, maxReminders, backoffMs, null);
-    }
-
-    /** As above, with a metric registry (CB-512) so push outcomes are counted. */
-    public ReplyPushLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
-                         ScheduledExecutorService scheduler,
-                         int maxReminders, long backoffMs, Metrics metrics) {
-        this.primaryRegistry = primaryRegistry;
-        this.agents = agents;
-        this.inbox = inbox;
-        this.scheduler = scheduler;
-        this.maxReminders = maxReminders;
-        this.backoffMs = backoffMs;
-        this.metrics = metrics;
-    }
-
-    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
-    private void countNudge(String outcome) {
-        if (metrics != null) {
-            metrics.inc(BridgedMetrics.PUSH_NUDGES, "outcome", outcome);
-        }
-    }
-
-    // --- decision logic (package-private for unit-testing) -------------------------------------
-
-    /** The action the loop should take for a target at the given reminder count. */
-    enum Action { INJECT, WAIT_BUSY, STOP }
-
-    /**
-     * Pure decision function: examine the current state and return what the loop should do.
-     *
-     * @param target        the worker session (target terminal id)
-     * @param reminderCount how many nudges have been sent so far for this target
-     * @return the action the caller should take
-     */
-    Action decide(String target, int reminderCount) {
-        // CB-532: the destination is per-delegation — the lead that sent this worker its work, not
-        // "the primary". With two leads orchestrating one fleet the singular question has no right
-        // answer, and answering it anyway interrupted whichever lead happened to call bridge_send
-        // first with results it never asked for.
-        var nudgeTarget = primaryRegistry.nudgeTargetFor(target);
-        if (nudgeTarget.isEmpty()) {
-            log.debug("push: no lead is known to be waiting on {}, stopping reminder", target);
-            return Action.STOP;
-        }
-        if (inbox.peek(target).isEmpty()) {
-            log.debug("push: inbox empty for {}, stopping reminder", target);
-            return Action.STOP;
-        }
-        if (reminderCount >= maxReminders) {
-            log.debug("push: reminder cap ({}) reached for {}, stopping", maxReminders, target);
-            countNudge("exhausted");
-            return Action.STOP;
-        }
-        String leadTerminal = nudgeTarget.get();
-        AgentStatus status;
-        try {
-            status = agents.status(leadTerminal);
-        } catch (RuntimeException e) {
-            log.debug("push: status check failed for lead {}, will retry", leadTerminal, e);
-            return Action.WAIT_BUSY;
-        }
-        if (status.injectable()) {
-            return Action.INJECT;
-        }
-        log.debug("push: lead {} is {} (not injectable), waiting", leadTerminal, status);
-        return Action.WAIT_BUSY;
-    }
-
-    // --- public entrypoint ---------------------------------------------------------------------
-
-    /**
-     * Called when a reply is queued for {@code target}. Idempotent per target: a second call while
-     * a schedule is active is a no-op. The schedule nudges the primary, then schedules a follow-up
-     * check (reminder on backoff, or re-check on WAIT_BUSY), until the inbox is empty or the cap
-     * is reached.
-     */
-    public void onReplyQueued(String target) {
-        if (activeTargets.putIfAbsent(target, Boolean.TRUE) != null) {
-            log.debug("push: already active for {}, ignoring duplicate trigger", target);
-            return; // already scheduled
-        }
-        log.debug("push: starting reminder loop for {}", target);
-        scheduleNext(target, 0);
-    }
-
-    /** Execute one loop tick — called on the scheduler thread. */
-    private void tick(String target, int reminderCount) {
-        var action = decide(target, reminderCount);
-        switch (action) {
-            case INJECT -> {
-                injectNudge(target, reminderCount);
-                scheduleNext(target, reminderCount + 1);
-            }
-            // Re-check after the configured backoff; the primary may become injectable soon.
-            case WAIT_BUSY -> scheduleNext(target, reminderCount);
-            case STOP -> {
-                activeTargets.remove(target);
-                log.debug("push: reminder loop ended for {}", target);
-            }
-        }
-    }
-
-    /** Send the nudge and log the event. */
-    private void injectNudge(String target, int reminderCount) {
-        // Re-read rather than threading it down from decide(): the delegating lead can change
-        // between the decision and the injection, and the nudge should follow the current one.
-        var lead = primaryRegistry.nudgeTargetFor(target);
-        if (lead.isEmpty()) {
-            log.debug("push: lead for {} disappeared before the nudge could be sent", target);
-            return;
-        }
-        String leadTerminal = lead.get();
-        String nudge = NUDGE_FORMAT.formatted(target, target);
-        try {
-            agents.send(leadTerminal, nudge);
-            log.debug("push: nudge {}/{} sent to lead {} for target {}",
-                    reminderCount + 1, maxReminders, leadTerminal, target);
-            countNudge("delivered");
-        } catch (RuntimeException e) {
-            log.warn("push: failed to nudge lead {} for target {} (reminder {}/{}): {}",
-                    leadTerminal, target, reminderCount + 1, maxReminders, e.toString());
-        }
-    }
-
-    /** Schedule the next tick on the scheduler thread pool. */
-    private void scheduleNext(String target, int nextReminderCount) {
-        scheduler.schedule(() -> tick(target, nextReminderCount), backoffMs, TimeUnit.MILLISECONDS);
-    }
-
-    // --- lifecycle -----------------------------------------------------------------------------
-
-    /** Shut down the scheduler. Outstanding reminders are cancelled. */
-    public void stop() {
-        scheduler.shutdownNow();
-        activeTargets.clear();
-    }
-
-    /** @see #stop() */
-    public void close() {
-        stop();
-    }
-}

bridged/src/main/java/dev/ltms/bridged/peer/PeerLauncher.java

@@ -1,94 +0,0 @@
-package dev.ltms.bridged.peer;
-
-import java.util.List;
-import java.util.Set;
-
-/**
- * SPI for materializing a connected peer — the only way the bridge core creates or tears down
- * a peer process. Every launcher is a first-party, in-tree adapter selected by (future) profile
- * config; today's single adapter is the {@code ClaudeCodeLauncher} / Claude Code over herdr.
- *
- * <p>The core delegates spawn and teardown to this interface without knowing how the peer is set
- * up. Environment variables, CLI flags, subscription guards, transport (herdr tab/pane) layout,
- * and naming conventions are all adapter-private — the core sees only the returned
- * {@link PeerHandle} whose {@code id()} is the registry/routing key.
- *
- * <p>The interface is a superset of what {@code SessionManager} and {@code Bridged.main} call
- * on the concrete launcher today.
- */
-public interface PeerLauncher {
-
-    /**
-     * The set of {@link Capability capabilities} this launcher declares. A peer whose profile
-     * opts into a git-forge token should include {@link Capability#SELF_PR}; the base set for
-     * the Claude Code herdr adapter is always {@code MID_TURN_ASK, WORKTREE, ORPHAN_REAP}.
-     */
-    Set<Capability> capabilities();
-
-    /**
-     * {@code profileName}/requestedCwd null/blank → default resolution. Returns after the peer
-     * process is live (env + argv + placement complete). Never returns {@code null}.
-     *
-     * @param req the spawn parameters (profile, requested cwd, caller cwd)
-     * @return a handle whose {@link PeerHandle#id()} is the registry/routing key
-     * @throws IllegalArgumentException if the profile is unknown and no default is configured
-     */
-    PeerHandle spawn(SpawnRequest req);
-
-    /**
-     * The configured worker profile names — the set of names {@code spawn(profileName)} accepts.
-     */
-    Set<String> profiles();
-
-    /**
-     * The profile a no-argument {@link #spawn(SpawnRequest)} uses, or {@code null} if none is configured.
-     */
-    String defaultProfile();
-
-    /**
-     * Resolve the effective working directory for a spawn {@code req} without actually spawning.
-     * Resolution order: requestedCwd → profile cwd → callerCwd → daemon cwd.
-     *
-     * @return the resolved absolute path, never null/blank
-     */
-    String effectiveCwd(SpawnRequest req);
-
-    /**
-     * The parity-overlay file list for {@code profileName} (default list when unset). Used by
-     * worktree provisioning to copy config files into the isolated checkout before spawning.
-     */
-    List<String> parityOverlay(String profileName);
-
-    /**
-     * The set of all agents this launcher currently tracks, transport-specific. Each element
-     * exposes at minimum a pane-like {@code id()} matching this launcher's {@link PeerHandle}
-     * scheme, plus transport-level status. Callers merge this set with the session registry to
-     * build a live roster view.
-     */
-    List<?> list();
-
-    /**
-     * Reap orphaned peers left behind by a prior daemon process. Only peers whose naming scheme
-     * matches this launcher's and whose nonce differs from the current process are eligible.
-     * Best-effort: a failure to list or to stop any one peer is logged and never aborts startup.
-     *
-     * @return the number of orphaned peers reaped
-     */
-    int reapOrphanWorkers();
-
-    /**
-     * Tear a peer down by its registry/routing key ({@link PeerHandle#id()}). Tolerates an
-     * already-gone peer. Also cleans up launcher-private resources (e.g. empty dedicated tabs)
-     * when safe to do so.
-     */
-    void stop(String id);
-
-    /**
-     * Discard the context of the peer identified by {@code id}. Implementations must bypass normal
-     * bridge delivery/turn accounting. Unsupported peer kinds return {@code false} without sending
-     * a guessed command.
-     *
-     * @return {@code true} when a reset was sent and its status transition must settle before reuse
-     */
-    boolean clearContext(String id);
-}

bridged/src/main/java/dev/ltms/bridged/peer/SpawnRequest.java

@@ -1,24 +0,0 @@
-package dev.ltms.bridged.peer;
-
-/**
- * Parameters for a {@link PeerLauncher#spawn(SpawnRequest)} call — the peer-neutral
- * aggregation of what the core knows at delegation time: which profile to use, the caller's
- * requested working directory, and the caller's own cwd (to inherit when no other cwd is set).
- *
- * <p>A null or blank {@code profileName} means "use the launcher's default profile."
- * A null or blank {@code requestedCwd} means "inherit from config or caller."
- * A null {@code callerCwd} means "the request came from the daemon itself (not a primary)."
- *
- * <p>{@code sessionName} and {@code resumeSessionId} carry the session's durable identity (CB-547a):
- * the bridge's LOGICAL name for the session (stable across restarts, meaningful to an operator)
- * and the peer's OWN prior session id to resume, respectively. Both are <em>opted in</em> — either
- * may be null/blank, in which case the launcher derives a display name and mints a fresh session.
- */
-public record SpawnRequest(String profileName, String requestedCwd, String callerCwd,
-                           String sessionName, String resumeSessionId) {
-
-    /** Back-compat: a spawn with no session identity (fresh session, launcher-derived name). */
-    public SpawnRequest(String profileName, String requestedCwd, String callerCwd) {
-        this(profileName, requestedCwd, callerCwd, null, null);
-    }
-}

bridged/src/main/java/dev/ltms/bridged/placement/FixedPlacementPolicy.java

@@ -1,22 +0,0 @@
-package dev.ltms.bridged.placement;
-
-/**
- * Backward-compatible placement: an unqualified spawn always resolves to the configured default
- * profile, exactly as {@code CompositePeerLauncher} did before CB-518. This ignores caps and
- * reachability so that a pre-existing config behaves identically after upgrade.
- */
-final class FixedPlacementPolicy implements PlacementPolicy {
-
-    @Override
-    public PlacementCandidate select(PlacementContext ctx) {
-        String d = ctx.defaultProfile();
-        if (d != null && !d.isBlank()) {
-            return new PlacementCandidate(d, null, 1.0f, null);
-        }
-        if (!ctx.candidates().isEmpty()) {
-            PlacementCandidate first = ctx.candidates().getFirst();
-            return new PlacementCandidate(first.profile(), null, first.weight(), first.maxLoad());
-        }
-        throw new PlacementException("no worker profiles configured");
-    }
-}

bridged/src/main/java/dev/ltms/bridged/placement/PlacementContext.java

@@ -1,19 +0,0 @@
-package dev.ltms.bridged.placement;
-
-import java.util.List;
-import java.util.Set;
-import java.util.function.Function;
-
-/**
- * Everything a {@link PlacementPolicy} needs to make one selection.
- *
- * @param defaultProfile profile a {@code fixed} policy should return (may be {@code null})
- * @param candidates     every configured candidate; the policy filters out those at cap or unreachable
- * @param liveCount      current live worker count per profile (from the session registry)
- * @param unreachable    profiles already known to have failed in this spawn attempt
- */
-public record PlacementContext(String defaultProfile,
-                               List<PlacementCandidate> candidates,
-                               Function<String, Integer> liveCount,
-                               Set<String> unreachable) {
-}

bridged/src/main/java/dev/ltms/bridged/placement/PlacementPolicyUtil.java

@@ -1,65 +0,0 @@
-package dev.ltms.bridged.placement;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Shared filtering and empty-set reporting used by the built-in placement policies.
- */
-final class PlacementPolicyUtil {
-
-    private PlacementPolicyUtil() {
-    }
-
-    /**
-     * Candidates that are not known-unreachable and have not reached their maxLoad.
-     * A {@code null} maxLoad means unlimited.
-     */
-    static List<PlacementCandidate> available(PlacementContext ctx) {
-        List<PlacementCandidate> out = new ArrayList<>();
-        for (PlacementCandidate c : ctx.candidates()) {
-            if (ctx.unreachable().contains(c.profile())) {
-                continue;
-            }
-            Integer cap = c.maxLoad();
-            if (cap != null) {
-                int live = ctx.liveCount().apply(c.profile());
-                if (live >= cap) {
-                    continue;
-                }
-            }
-            out.add(c);
-        }
-        return out;
-    }
-
-    /**
-     * Build a clear exception describing why every candidate was dropped: all at capacity,
-     * all unreachable, or a mix.
-     */
-    static PlacementException emptyException(PlacementContext ctx) {
-        int atCap = 0;
-        int unreachable = 0;
-        for (PlacementCandidate c : ctx.candidates()) {
-            Integer cap = c.maxLoad();
-            if (ctx.unreachable().contains(c.profile())) {
-                unreachable++;
-            } else if (cap != null && ctx.liveCount().apply(c.profile()) >= cap) {
-                atCap++;
-            }
-        }
-
-        int total = ctx.candidates().size();
-        if (total == 0) {
-            return new PlacementException("no worker profiles configured");
-        }
-        if (atCap == total) {
-            return new PlacementException("all worker profiles are at maxLoad");
-        }
-        if (unreachable == total) {
-            return new PlacementException("all worker profiles are unreachable");
-        }
-        return new PlacementException("no worker profile available: " + atCap + " at maxLoad, "
-                + unreachable + " unreachable, " + (total - atCap - unreachable) + " remaining");
-    }
-}

bridged/src/main/java/dev/ltms/bridged/rest/BridgedApp.java

@@ -1,563 +0,0 @@
-package dev.ltms.bridged.rest;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import dev.ltms.bridged.auth.AuditLog;
-import dev.ltms.bridged.auth.Authz;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.Principal;
-import dev.ltms.bridged.guard.GuardException;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.inject.WorkerPresence;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.WorkerSession;
-import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.peer.PeerLauncher;
-import io.javalin.Javalin;
-import io.javalin.http.Context;
-import jakarta.servlet.http.HttpServlet;
-import org.eclipse.jetty.servlet.ServletHolder;
-
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
-import java.util.stream.Collectors;
-
-/**
- * The REST surface — {@code bridged}'s contract and its testability seam. Every
- * feature is reachable here without Claude or MCP in the loop, so each is an
- * acceptance test against plain HTTP. MCP tools (later) are thin adapters over these
- * same endpoints and are validated by parity, not by re-implementing behaviour.
- *
- * <p>Built from injected collaborators so tests supply fakes and run on an ephemeral
- * port; {@code main} supplies the real Unix-socket client and worker service.
- */
-public final class BridgedApp {
-
-    /** Default blocking window for a message; kept under typical HTTP idle timeouts. */
-    private static final long DEFAULT_MESSAGE_TIMEOUT_MS = 25_000;
-    private static final long MAX_MESSAGE_TIMEOUT_MS = 120_000;
-    /** Blocking window for a worker's bridge_ask (CB-205); the worker's MCP client caps its own call. */
-    private static final long DEFAULT_ASK_TIMEOUT_MS = 55_000;
-    private static final long MAX_ASK_TIMEOUT_MS = 115_000;
-
-    /** Context attribute under which the resolved caller is stashed by the auth filter. */
-    private static final String CALLER = "bridged.caller";
-
-    private final HerdrClient herdr;
-    private final PeerLauncher workers;
-    private final SessionManager sessions; // CB-301: authoritative session registry
-    private final MessageService messages;
-    private final WorkerPresence presence; // CB-113: which workers are MCP-connected (available)
-    private final HttpServlet mcpServlet; // MCP Streamable-HTTP endpoint, mounted at /mcp (nullable)
-    private final CallerResolver auth;    // CB-501: null → authz not enforced (legacy behaviour)
-    private final Metrics metrics;        // CB-502: null → /metrics not exposed
-    private final ObjectMapper mapper = new ObjectMapper();
-
-    /**
-     * Legacy constructor — no identity resolution and no authorization, exactly as the REST surface
-     * behaved before CB-501. Retained so existing acceptance tests keep exercising handler
-     * behaviour without each needing an auth fixture.
-     */
-    public BridgedApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
-                      MessageService messages, WorkerPresence presence,
-                      HttpServlet mcpServlet) {
-        this(herdr, workers, sessions, messages, presence, mcpServlet, null, null);
-    }
-
-    /**
-     * @param auth    resolves each request's {@link Principal}; {@code null} disables authorization
-     *                entirely (legacy). {@code main} always supplies one.
-     * @param metrics registry to instrument and expose at {@code GET /metrics}; {@code null} omits
-     *                the endpoint
-     */
-    public BridgedApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
-                      MessageService messages, WorkerPresence presence,
-                      HttpServlet mcpServlet, CallerResolver auth, Metrics metrics) {
-        this.herdr = herdr;
-        this.workers = workers;
-        this.sessions = sessions;
-        this.messages = messages;
-        this.presence = presence;
-        this.mcpServlet = mcpServlet;
-        this.auth = auth;
-        this.metrics = metrics;
-    }
-
-    /** Wire routes onto a fresh, unstarted Javalin instance. Caller starts it. */
-    public Javalin build() {
-        Javalin app = Javalin.create(cfg -> {
-            cfg.showJavalinBanner = false;
-            if (mcpServlet != null) {
-                // The MCP server shares the daemon's port; Jetty routes /mcp to its servlet.
-                cfg.jetty.modifyServletContextHandler(h ->
-                        h.addServlet(new ServletHolder(mcpServlet), "/mcp"));
-            }
-        });
-        // CB-501: resolve identity once per request, before any handler. /mcp does NOT pass through
-        // here — it is a raw servlet on Jetty's context handler — so BridgeMcp enforces separately
-        // against the same CallerResolver. Any check that lives in only one place is not a control.
-        if (auth != null) {
-            app.before(ctx -> ctx.attribute(CALLER,
-                    auth.resolve(ctx.req().getRemoteAddr(), ctx.req().getRemotePort(),
-                            ctx.header("Authorization"))));
-        }
-        app.get("/healthz", this::healthz);
-        if (metrics != null) {
-            app.get("/metrics", this::metrics);
-        }
-        app.get("/sessions", this::sessions);
-        app.get("/agents", this::agents);
-        app.get("/workers", this::listWorkers);                 // CB-304: registry roster + live herdr status
-        app.get("/profiles", this::profiles);                    // configured worker profiles
-        app.post("/workers", this::spawnWorker);                 // optional ?profile= or {"profile":…}
-        app.delete("/workers/{paneId}", this::stopWorker);
-        app.post("/sessions/{id}/message", this::sendMessage);   // bridge_send (primary; blocking, wait:false, or answer via turnId)
-        app.post("/sessions/{id}/reply", this::replyMessage);    // bridge_reply (worker)
-        app.get("/sessions/{id}/replies", this::drainReplies);   // drain reply inbox (CB-307)
-        app.post("/sessions/{id}/ask", this::askMessage);        // bridge_ask (worker → primary, CB-205)
-        app.get("/sessions/{id}/status", this::sessionStatus);   // bridge_status
-        app.get("/tasks/{ticket}", this::taskStatus);            // poll an async (wait:false) send
-        return app;
-    }
-
-    /**
-     * Gate a handler on the CB-505 authorization table. Returns {@code true} when the request may
-     * proceed; otherwise writes the error response and returns {@code false}.
-     *
-     * <p>401 vs 403 is a real distinction here: 401 means "you presented no usable identity" (a
-     * credential problem the caller can fix), 403 means "you are authenticated, but this is not
-     * yours" (a worker reaching for another worker's session, or for orchestration).
-     */
-    private boolean allow(Context ctx, Authz.Action action, String target) {
-        if (auth == null) {
-            return true; // legacy: authorization not enforced
-        }
-        Principal caller = ctx.attribute(CALLER);
-        if (Authz.permits(caller, action, target)) {
-            if (action != Authz.Action.READ && action != Authz.Action.METRICS) {
-                AuditLog.allowed(caller, action, target); // reads would drown the trail
-            }
-            return true;
-        }
-        if (Authz.isUnauthenticated(caller)) {
-            AuditLog.denied(caller, action, target, "unauthenticated");
-            countAuthFailure("unauthenticated");
-            ctx.status(401).json(Map.of("error", "unauthenticated",
-                    "detail", "present Authorization: Bearer <token>"));
-        } else {
-            AuditLog.denied(caller, action, target, "forbidden");
-            countAuthFailure("forbidden");
-            ctx.status(403).json(Map.of("error", "forbidden",
-                    "detail", caller.describe() + " may not " + action + " on "
-                            + (target == null ? "this resource" : target)));
-        }
-        return false;
-    }
-
-    private void countAuthFailure(String reason) {
-        if (metrics != null) {
-            metrics.inc("bridged_auth_failures_total", "reason", reason);
-        }
-    }
-
-    /** Prometheus scrape endpoint (CB-502). */
-    private void metrics(Context ctx) {
-        if (!allow(ctx, Authz.Action.METRICS, null)) {
-            return;
-        }
-        ctx.status(200).contentType("text/plain; version=0.0.4; charset=utf-8").result(metrics.render());
-    }
-
-    /** Liveness + herdr reachability. 200 when herdr answers ping, 503 otherwise. */
-    private void healthz(Context ctx) {
-        try {
-            JsonNode pong = herdr.call("ping");
-            ctx.status(200).json(Map.of(
-                    "status", "ok",
-                    "herdr", Map.of(
-                            "version", pong.path("version").asText(""),
-                            "protocol", pong.path("protocol").asInt())));
-        } catch (HerdrException e) {
-            ctx.status(503).json(Map.of(
-                    "status", "degraded",
-                    "herdr", "unreachable",
-                    "detail", e.getMessage()));
-        }
-    }
-
-    /** Sessions view derived from herdr {@code workspace.list} (one workspace → one row). */
-    private void sessions(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
-            return;
-        }
-        JsonNode result = herdr.call("workspace.list");
-        List<Map<String, Object>> out = new ArrayList<>();
-        for (JsonNode w : result.path("workspaces")) {
-            out.add(Map.of(
-                    "id", w.path("workspace_id").asText(""),
-                    "label", w.path("label").asText(""),
-                    "focused", w.path("focused").asBoolean(false),
-                    "paneCount", w.path("pane_count").asInt(),
-                    "agentStatus", w.path("agent_status").asText("unknown")));
-        }
-        ctx.status(200).json(Map.of("sessions", out));
-    }
-
-    /** Discovery: every agent herdr tracks, keyed by its Claude session UUID. */
-    private void agents(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
-            return;
-        }
-        ctx.status(200).json(Map.of("agents",
-                workers.list().stream().map(Agent.class::cast).map(BridgedApp::view).toList()));
-    }
-
-    /** CB-304: bridge-owned roster merged with live herdr status by paneId. */
-    private void listWorkers(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
-            return;
-        }
-        // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
-        Map<String, Agent> live = workers.list().stream()
-                .map(Agent.class::cast)
-                .filter(a -> a.terminalId() != null)
-                .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
-        List<Map<String, Object>> out = sessions.roster().stream()
-                .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
-                .toList();
-        ctx.status(200).json(Map.of("workers", out));
-    }
-
-    /** The configured worker profiles and which one a no-argument spawn uses. */
-    private void profiles(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
-            return;
-        }
-        ctx.status(200).json(Map.of(
-                "profiles", workers.profiles(),
-                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile()));
-    }
-
-    /**
-     * Spawn a guard-checked worker. An optional {@code profile} (query param or {@code {"profile":…}}
-     * body) picks which configured profile; omitted → the default. 403 if the base_url would breach
-     * the subscription boundary, 400 for an unknown profile.
-     */
-    private void spawnWorker(Context ctx) {
-        if (!allow(ctx, Authz.Action.SPAWN, null)) {
-            return;
-        }
-        String profile = ctx.queryParam("profile");
-        String cwd = ctx.queryParam("cwd");
-        String worktree = ctx.queryParam("worktree");
-        String ticket = ctx.queryParam("ticket");
-        if (profile == null || profile.isBlank() || cwd == null || cwd.isBlank()
-                || worktree == null || worktree.isBlank()) {
-            try {
-                String body = ctx.body();
-                if (!body.isBlank()) {
-                    JsonNode b = mapper.readTree(body);
-                    if (profile == null || profile.isBlank()) profile = b.path("profile").asText(null);
-                    if (cwd == null || cwd.isBlank()) cwd = b.path("cwd").asText(null);
-                    if (worktree == null || worktree.isBlank()) worktree = b.path("worktree").asText(null);
-                    if (ticket == null || ticket.isBlank()) ticket = b.path("ticket").asText(null);
-                }
-            } catch (Exception ignored) {
-                // A malformed/empty body just means "no overrides" → fall through to defaults.
-            }
-        }
-        WorktreeRequest wt = worktreeRequest(worktree, ticket);
-        try {
-            // No MCP caller over REST, so callerCwd and ownerTerminal are null.
-            WorkerSession worker = sessions.acquire(blankToNull(profile), blankToNull(cwd), null, null, wt);
-            ctx.status(201).json(view(worker));
-        } catch (GuardException e) {
-            ctx.status(403).json(Map.of("error", "subscription_boundary", "detail", e.getMessage()));
-        } catch (IllegalArgumentException e) {
-            ctx.status(400).json(Map.of("error", "unknown_profile", "detail", e.getMessage()));
-        } catch (PeerUnreachableException e) {
-            ctx.status(502).json(Map.of("error", "spawn_timeout", "detail", e.getMessage()));
-        }
-    }
-
-    private static WorktreeRequest worktreeRequest(String worktree, String ticket) {
-        if (worktree == null || worktree.isBlank() || "false".equalsIgnoreCase(worktree)) {
-            return null;
-        }
-        if ("true".equalsIgnoreCase(worktree)) {
-            if (ticket == null || ticket.isBlank()) {
-                throw new IllegalArgumentException("worktree=true requires a ticket slug");
-            }
-            return new WorktreeRequest(ticket, null);
-        }
-        return new WorktreeRequest(worktree, null);
-    }
-
-    private static String blankToNull(String s) {
-        return (s == null || s.isBlank()) ? null : s;
-    }
-
-    /** Tear a worker down by pane id. */
-    private void stopWorker(Context ctx) {
-        String paneId = ctx.pathParam("paneId");
-        if (!allow(ctx, Authz.Action.STOP, paneId)) {
-            return;
-        }
-        sessions.release(paneId);
-        ctx.status(204);
-    }
-
-    /**
-     * The blocking delegation call (CB-104): inject {@code content} into the worker via the
-     * status-gated injector and block until the worker returns a structured {@code bridge_reply}.
-     * Times out with a typed 202 (working / queued / busy) rather than an error — the message may
-     * still land.
-     */
-    private void sendMessage(Context ctx) {
-        String id = ctx.pathParam("id");
-        if (!allow(ctx, Authz.Action.SEND, id)) {
-            return;
-        }
-        String content;
-        String turnId;
-        long timeout;
-        boolean wait;
-        try {
-            JsonNode body = mapper.readTree(ctx.body());
-            content = body.path("content").asText("");
-            turnId = body.path("turnId").asText(null);
-            timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
-            wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
-        } catch (Exception e) {
-            ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
-            return;
-        }
-        if (content.isBlank()) {
-            ctx.status(400).json(Map.of("error", "bad_request", "detail", "content is required"));
-            return;
-        }
-        timeout = Math.clamp(timeout, 1, MAX_MESSAGE_TIMEOUT_MS);
-
-        // Answering a worker's bridge_ask (CB-205): always blocks, and derives the worker from turnId.
-        if (turnId != null && !turnId.isBlank()) {
-            writeReply(ctx, id, messages.answer(turnId, content, timeout), timeout);
-            return;
-        }
-
-        if (!wait) {
-            // Fire-and-poll (CB-107): return a ticket immediately; the caller polls GET /tasks/{ticket}.
-            String ticket = messages.sendAsync(id, content);
-            ctx.status(202).json(Map.of("sessionId", id, "ticket", ticket, "status", "accepted"));
-            return;
-        }
-
-        try {
-            writeReply(ctx, id, messages.send(id, content, timeout), timeout);
-        } catch (HerdrException e) {
-            herdrError(ctx, e);
-        }
-    }
-
-    /**
-     * Render a {@link MessageService.Reply} onto the response — shared by a normal send and a
-     * bridge_ask answer. A structured/scraped completion is 200; a worker's mid-turn question a 202
-     * (with its {@code turnId}); a stale answer a 409; every other non-terminal outcome a typed 202.
-     */
-    private void writeReply(Context ctx, String id, MessageService.Reply reply, long timeout) {
-        switch (reply.outcome()) {
-            case QUESTION -> ctx.status(202).json(Map.of(
-                    "sessionId", id, "status", "question",
-                    "question", reply.text(), "turnId", reply.turnId()));
-            case STALE_TURN -> ctx.status(409).json(Map.of(
-                    "sessionId", id, "error", "stale_turn",
-                    "detail", "that question is no longer open (timed out or already answered)"));
-            case REPLIED, COMPLETED_UNREPLIED -> {
-                // replySource distinguishes a structured bridge_reply from the CB-106 completion
-                // fallback (a scrape of the worker's transcript when it finished without replying).
-                String source = reply.outcome() == MessageService.Outcome.REPLIED ? "reply" : "transcript";
-                ctx.status(200).json(Map.of("sessionId", id, "reply", reply.text(), "replySource", source));
-            }
-            default -> ctx.status(202).json(Map.of(
-                    "sessionId", id,
-                    "status", switch (reply.outcome()) {
-                        case TIMED_OUT_WORKING -> "working";
-                        case TIMED_OUT_QUEUED -> "queued";
-                        case BUSY -> "busy";
-                        case WORKER_FAILED -> "failed";
-                        default -> "done"; // unreachable (terminal outcomes handled above)
-                    },
-                    "detail", reply.outcome() == MessageService.Outcome.WORKER_FAILED && reply.text() != null
-                            ? reply.text()
-                            : "no reply within " + timeout + "ms; poll status or retry"));
-        }
-    }
-
-    /**
-     * A worker's mid-turn question ({@code bridge_ask}, CB-205) — surfaces to the primary's open
-     * blocking send and blocks until it answers. 200 with the answer, 409 if no delegation is open,
-     * 202 if the primary stayed silent.
-     */
-    private void askMessage(Context ctx) {
-        String id = ctx.pathParam("id");
-        if (!allow(ctx, Authz.Action.ASK, id)) {
-            return;
-        }
-        String question;
-        long timeout;
-        try {
-            JsonNode body = mapper.readTree(ctx.body());
-            question = body.path("question").asText("");
-            timeout = body.path("timeoutMs").asLong(DEFAULT_ASK_TIMEOUT_MS);
-        } catch (Exception e) {
-            ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
-            return;
-        }
-        if (question.isBlank()) {
-            ctx.status(400).json(Map.of("error", "bad_request", "detail", "question is required"));
-            return;
-        }
-        timeout = Math.clamp(timeout, 1, MAX_ASK_TIMEOUT_MS);
-        MessageService.AskResult r = messages.ask(id, question, timeout);
-        switch (r.outcome()) {
-            case ANSWERED -> ctx.status(200).json(Map.of("sessionId", id, "answered", true, "answer", r.answer()));
-            case NO_WAITER -> ctx.status(409).json(Map.of(
-                    "sessionId", id, "error", "no_pending_send",
-                    "detail", "no primary is awaiting this turn to answer a question"));
-            case TIMED_OUT -> ctx.status(202).json(Map.of(
-                    "sessionId", id, "status", "no_answer",
-                    "detail", "the primary did not answer within " + timeout + "ms"));
-        }
-    }
-
-    /**
-     * The worker's structured reply ({@code bridge_reply}) — resolves the blocking send awaiting
-     * on this session, or queues the reply in the inbox when no send is open (CB-307).
-     */
-    private void replyMessage(Context ctx) {
-        String id = ctx.pathParam("id");
-        // The rule that matters: a worker may reply only as itself. Over MCP this was already true
-        // structurally (identity comes from the connection, never an argument); over REST the path
-        // id was simply trusted, so this is where the invariant actually gets enforced.
-        if (!allow(ctx, Authz.Action.REPLY, id)) {
-            return;
-        }
-        String content;
-        try {
-            content = mapper.readTree(ctx.body()).path("content").asText("");
-        } catch (Exception e) {
-            ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
-            return;
-        }
-        messages.reply(id, content);
-        ctx.status(200).json(Map.of("sessionId", id, "delivered", true));
-    }
-
-    /**
-     * Drain the reply inbox for a worker session — peek + ack any replies that arrived when no send
-     * was open. At-least-once: draining removes them from the inbox so a subsequent read returns
-     * nothing; an in-flight failure between the drain and the caller's processing re-surfaces them.
-     */
-    private void drainReplies(Context ctx) {
-        String id = ctx.pathParam("id");
-        if (!allow(ctx, Authz.Action.DRAIN, id)) {
-            return;
-        }
-        var replies = messages.drainReplies(id);
-        ctx.status(200).json(Map.of("sessionId", id, "replies",
-                replies.stream().map(m -> Map.of(
-                        "msgId", m.msgId(),
-                        "content", m.content())).toList()));
-    }
-
-    /**
-     * Live lifecycle status of a worker (MCP `bridge_status` wraps this in CB-105), plus its
-     * <em>readiness</em> (CB-113): {@code ready} is true once the worker's Claude has connected the
-     * bridge MCP — the reliable "available to receive a task" signal, unlike bare {@code idle}, which
-     * is also true during boot.
-     */
-    private void sessionStatus(Context ctx) {
-        String id = ctx.pathParam("id");
-        if (!allow(ctx, Authz.Action.READ, id)) {
-            return;
-        }
-        try {
-            ctx.status(200).json(Map.of(
-                    "sessionId", id,
-                    "status", messages.status(id).name().toLowerCase(),
-                    "ready", presence.isPresent(id)));
-        } catch (HerdrException e) {
-            herdrError(ctx, e);
-        }
-    }
-
-    /** Poll an async (wait:false) delegation by ticket. 404 for an unknown/expired ticket. */
-    private void taskStatus(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
-            return;
-        }
-        MessageService.TaskView v = messages.poll(ctx.pathParam("ticket"));
-        if (v == null) {
-            ctx.status(404).json(Map.of("error", "unknown_ticket", "detail", "no such task (or it has expired)"));
-            return;
-        }
-        Map<String, Object> body = new LinkedHashMap<>();
-        body.put("ticket", v.ticket());
-        body.put("phase", v.phase().name().toLowerCase());
-        if (v.reply() != null) {
-            body.put("reply", v.reply());
-            body.put("replySource", v.replySource());
-        }
-        if (v.detail() != null) {
-            body.put("detail", v.detail());
-        }
-        ctx.status(200).json(body);
-    }
-
-    /** Map a herdr failure: unknown target → 404, anything else → 502 (herdr is upstream). */
-    private static void herdrError(Context ctx, HerdrException e) {
-        if (e.code() != null && e.code().endsWith("_not_found")) {
-            ctx.status(404).json(Map.of("error", "session_not_found", "detail", e.getMessage()));
-        } else {
-            ctx.status(502).json(Map.of("error", "herdr_error", "detail", e.getMessage()));
-        }
-    }
-
-    /** Stable JSON projection of an agent (null-safe for the start-time shape). */
-    private static Map<String, Object> view(Agent a) {
-        Map<String, Object> m = new LinkedHashMap<>();
-        m.put("terminalId", a.terminalId());
-        m.put("paneId", a.paneId());
-        m.put("workspaceId", a.workspaceId());
-        m.put("tabId", a.tabId());
-        m.put("sessionId", a.sessionId());
-        m.put("agentType", a.agentType());
-        m.put("status", a.status().name().toLowerCase());
-        return m;
-    }
-
-    /** CB-301 projection of an authoritative bridge-owned session. */
-    private static Map<String, Object> view(WorkerSession s) {
-        Map<String, Object> m = new LinkedHashMap<>();
-        m.put("terminalId", s.terminalId());
-        m.put("paneId", s.paneId());
-        m.put("profile", s.profile());
-        m.put("cwd", s.cwd());
-        m.put("ownerTerminal", s.ownerTerminal());
-        m.put("state", s.state().name().toLowerCase());
-        if (s.worktree() != null) {
-            m.put("worktree", s.worktree());
-        }
-        if (s.branch() != null) {
-            m.put("branch", s.branch());
-        }
-        return m;
-    }
-}

bridged/src/main/java/dev/ltms/bridged/session/GitWorktrees.java

@@ -1,217 +0,0 @@
-package dev.ltms.bridged.session;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.io.UncheckedIOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.security.SecureRandom;
-import java.util.List;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.stream.Collectors;
-
-/**
- * Production {@link Worktrees} implementation that shells {@code git} via {@link ProcessBuilder}.
- * Non-zero exits become {@link WorktreeException}. Worktree directories live under a configurable
- * root (default: a sibling {@code .bridged-worktrees} of the repo root) so they are never nested
- * inside the primary working tree.
- */
-public final class GitWorktrees implements Worktrees {
-
-    private static final Logger log = LoggerFactory.getLogger(GitWorktrees.class);
-
-    /** Project-level MCP config. Present in the repo, so every worktree checks the primary's out. */
-    private static final String MCP_CONFIG = ".mcp.json";
-
-    /** What {@link #isolateToolSurface} writes: a valid, explicitly empty server map. */
-    private static final String NEUTRAL_MCP_CONFIG = "{\n  \"mcpServers\": {}\n}\n";
-
-    private final String configuredRoot;
-    private final SecureRandom random = new SecureRandom();
-    private final AtomicLong seq = new AtomicLong();
-
-    /** Default constructor: worktree root is derived per-repo as {@code <repoRoot>/../.bridged-worktrees}. */
-    public GitWorktrees() {
-        this(null);
-    }
-
-    /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
-    public GitWorktrees(String configuredRoot) {
-        this.configuredRoot = configuredRoot;
-    }
-
-    @Override
-    public String add(String repoRoot, String branch, String baseRef) {
-        String base = (baseRef == null || baseRef.isBlank()) ? "HEAD" : baseRef;
-        String nonce = nonce();
-        Path root = resolveRoot(repoRoot);
-        Path path = root.resolve(nonce);
-        try {
-            Files.createDirectories(root);
-        } catch (IOException e) {
-            throw new WorktreeException("cannot create worktree root " + root + ": " + e.getMessage(), e);
-        }
-        String wt = path.toAbsolutePath().toString();
-        log.info("adding worktree branch={} path={} base={}", branch, wt, base);
-        exec("git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base);
-        isolateToolSurface(wt);
-        return wt;
-    }
-
-    /**
-     * Neutralize the worktree's project MCP config so a worker inherits only the tools its launcher
-     * mounts (the bridge, via {@code --mcp-config}) — never the primary's.
-     *
-     * <p>This is unconditional, and it is not the same job as the parity overlay. The repo's own
-     * committed {@code .mcp.json} declares the primary's IDE servers, so a fresh checkout mounts them
-     * whether or not the overlay copies anything; a worker that inherits them navigates and edits
-     * through tools bound to the <em>primary's</em> IntelliJ project, which silently hands it absolute
-     * paths outside its own worktree. That is not hypothetical: a CB-523 worker made all 59 of its
-     * edits in the primary checkout while compiling its worktree, so every build it ran was of code
-     * that did not contain its changes.
-     *
-     * <p>Writing an empty server map (rather than deleting the file) keeps a project-level
-     * {@code .mcp.json} present and explicit, and the {@code --skip-worktree} bit keeps the
-     * neutralized copy from ever showing up as a local modification the worker might commit.
-     */
-    private void isolateToolSurface(String worktreePath) {
-        Path root = Path.of(worktreePath).toAbsolutePath().normalize();
-        Path mcp = root.resolve(MCP_CONFIG);
-        try {
-            Files.writeString(mcp, NEUTRAL_MCP_CONFIG);
-        } catch (IOException e) {
-            throw new WorktreeException("cannot neutralize " + MCP_CONFIG + " in the worktree: "
-                    + e.getMessage(), e);
-        }
-        if (isTracked(root, MCP_CONFIG)) {
-            exec("git", "-C", worktreePath, "update-index", "--skip-worktree", MCP_CONFIG);
-        }
-        log.debug("neutralized {} — worker tool surface is launcher-mounted only", MCP_CONFIG);
-    }
-
-    @Override
-    public void remove(String repoRoot, String worktreePath) {
-        Path p = Path.of(worktreePath);
-        if (!Files.exists(p)) {
-            log.debug("worktree {} already gone — nothing to remove", worktreePath);
-            return;
-        }
-        log.info("removing worktree {}", worktreePath);
-        exec("git", "-C", repoRoot, "worktree", "remove", "--force", worktreePath);
-    }
-
-    @Override
-    public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
-        if (overlay == null || overlay.isEmpty()) {
-            return;
-        }
-        Path srcRoot = Path.of(repoRoot).toAbsolutePath().normalize();
-        Path dstRoot = Path.of(worktreePath).toAbsolutePath().normalize();
-        for (String rel : overlay) {
-            Path src = srcRoot.resolve(rel).normalize();
-            if (!Files.exists(src)) {
-                log.debug("parity overlay source missing — skipping {}", rel);
-                continue;
-            }
-            Path dst = dstRoot.resolve(rel).normalize();
-            try {
-                Files.createDirectories(dst.getParent());
-                Files.copy(src, dst, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.COPY_ATTRIBUTES);
-                log.debug("copied parity overlay {}", rel);
-            } catch (IOException e) {
-                throw new WorktreeException("cannot copy overlay " + rel + ": " + e.getMessage(), e);
-            }
-            if (isTracked(dstRoot, rel)) {
-                exec("git", "-C", worktreePath, "update-index", "--skip-worktree", rel);
-                log.debug("marked overlay --skip-worktree {}", rel);
-            }
-        }
-    }
-
-    @Override
-    public String repoRoot(String cwd) {
-        String out = exec("git", "-C", cwd, "rev-parse", "--show-toplevel");
-        return Path.of(out.trim()).toAbsolutePath().normalize().toString();
-    }
-
-    /** Resolve the directory that will hold per-session worktree checkouts. */
-    private Path resolveRoot(String repoRoot) {
-        if (configuredRoot != null && !configuredRoot.isBlank()) {
-            return Path.of(configuredRoot).toAbsolutePath().normalize();
-        }
-        Path repo = Path.of(repoRoot).toAbsolutePath().normalize();
-        return repo.resolveSibling(".bridged-worktrees");
-    }
-
-    private String nonce() {
-        return String.format("%06x", random.nextInt(1 << 24)) + "-" + seq.incrementAndGet();
-    }
-
-    private boolean isTracked(Path worktreeRoot, String rel) {
-        return exitCode("git", "-C", worktreeRoot.toString(), "ls-files", "--error-unmatch", rel) == 0;
-    }
-
-    /**
-     * Run a command and return its stdout. Non-zero exit → {@link WorktreeException} with both
-     * stdout and stderr (merged by redirectErrorStream).
-     */
-    private String exec(String... command) {
-        String out;
-        int code;
-        Process p;
-        try {
-            p = new ProcessBuilder(command).redirectErrorStream(true).start();
-        } catch (IOException e) {
-            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
-        }
-        try (BufferedReader r = new BufferedReader(new InputStreamReader(p.getInputStream(), StandardCharsets.UTF_8))) {
-            out = r.lines().collect(Collectors.joining("\n"));
-        } catch (IOException e) {
-            p.destroyForcibly();
-            throw new UncheckedIOException(e);
-        }
-        try {
-            if (!p.waitFor(30, TimeUnit.SECONDS)) {
-                p.destroyForcibly();
-                throw new WorktreeException("command timed out: " + String.join(" ", command) + "\n" + out);
-            }
-            code = p.exitValue();
-        } catch (InterruptedException e) {
-            p.destroyForcibly();
-            Thread.currentThread().interrupt();
-            throw new WorktreeException("interrupted waiting for command: " + String.join(" ", command), e);
-        }
-        if (code != 0) {
-            throw new WorktreeException("exit " + code + " for: " + String.join(" ", command)
-                    + (out.isBlank() ? "" : "\n" + out));
-        }
-        return out;
-    }
-
-    private int exitCode(String... command) {
-        Process p;
-        try {
-            p = new ProcessBuilder(command).redirectErrorStream(true).start();
-        } catch (IOException e) {
-            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
-        }
-        try {
-            if (!p.waitFor(30, TimeUnit.SECONDS)) {
-                p.destroyForcibly();
-                throw new WorktreeException("command timed out: " + String.join(" ", command));
-            }
-            return p.exitValue();
-        } catch (InterruptedException e) {
-            p.destroyForcibly();
-            Thread.currentThread().interrupt();
-            throw new WorktreeException("interrupted waiting for command: " + String.join(" ", command), e);
-        }
-    }
-}

bridged/src/main/java/dev/ltms/bridged/session/SessionManager.java

@@ -1,537 +0,0 @@
-package dev.ltms.bridged.session;
-
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.inject.TurnListener;
-import dev.ltms.bridged.inject.WorkerPresence;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.SpawnRequest;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.security.SecureRandom;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.function.Consumer;
-import java.util.function.LongSupplier;
-
-/**
- * Authoritative in-daemon registry of the worker sessions this {@code bridged} process spawned.
- * Delegates spawn/teardown to a {@link PeerLauncher} (which performs subscription-guarded env
- * setup and process/materialization) and adds lifecycle tracking, ownership, and deterministic
- * teardown on top.
- *
- * <p>The state machine is intentionally one-shot / no-reuse: every acquired worker is fresh,
- * and a finished or released worker is torn down, never pooled. {@link #recycle} is a convenience
- * for {@code release + acquire} with a new distinct pane id.
- *
- * <p>The manager implements {@link TurnListener} so the injector's turn boundaries drive
- * {@code READY → BUSY → DONE} (or {@code FAILED}). It exposes a {@link WorkerPresence} view via
- * {@link #asPresence()}: any MCP contact from a worker marks it present and simultaneously
- * transitions the session {@code SPAWNING → READY}.
- */
-public final class SessionManager implements TurnListener {
-
-    private static final Logger log = LoggerFactory.getLogger(SessionManager.class);
-
-    private final PeerLauncher launcher;
-    private final Worktrees worktrees;
-    private final ConcurrentHashMap<String /*paneId*/, WorkerSession> registry = new ConcurrentHashMap<>();
-    private final WorkerPresence presence;
-    private final SecureRandom nonceRandom = new SecureRandom();
-    private final AtomicLong nonceSeq = new AtomicLong();
-    private final LongSupplier nowNanos;
-    private final int contextCap;
-    private final boolean clearAfterTurn;
-
-    /** CB-520: notified with a terminalId on every acquire; no-op until wired. */
-    private final List<Consumer<String>> acquireListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
-    /** CB-516: notified with a terminalId on every release; no-op until wired. */
-    private final List<Consumer<String>> releaseListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
-
-    /** Backward-compatible constructor: shared-tree sessions, production git seam. */
-    public SessionManager(PeerLauncher launcher) {
-        this(launcher, new GitWorktrees(), System::nanoTime, 0, false);
-    }
-
-    /** Backward-compatible constructor with an injectable worktree seam. */
-    public SessionManager(PeerLauncher launcher, Worktrees worktrees) {
-        this(launcher, worktrees, System::nanoTime, 0, false);
-    }
-
-    /** Test constructor with an injectable clock. */
-    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos) {
-        this(launcher, worktrees, nowNanos, 0, false);
-    }
-
-    /** Production constructor with a configured context turn cap. */
-    public SessionManager(PeerLauncher launcher, Worktrees worktrees, int contextCap) {
-        this(launcher, worktrees, System::nanoTime, contextCap, false);
-    }
-
-    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos,
-                           int contextCap) {
-        this(launcher, worktrees, nowNanos, contextCap, false);
-    }
-
-    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos,
-                          int contextCap, boolean clearAfterTurn) {
-        this.launcher = launcher;
-        this.worktrees = worktrees;
-        this.presence = new PresenceBridge(this);
-        this.nowNanos = nowNanos;
-        this.contextCap = contextCap;
-        this.clearAfterTurn = clearAfterTurn;
-    }
-
-    /**
-     * The single {@link WorkerPresence} view of this manager: it records availability and forwards
-     * the signal to the {@code SPAWNING → READY} transition. Pass this to the {@code Injector} and
-     * {@code BridgeMcp} where they previously accepted a plain {@link WorkerPresence}. The same
-     * instance is returned every call — presence is shared state, so a fresh bridge per call would
-     * fragment the {@code present} set and lose signals across callers.
-     */
-    public WorkerPresence asPresence() {
-        return presence;
-    }
-
-    /**
-     * Spawn a worker and register it as {@link WorkerSession.State#SPAWNING}. The caller's
-     * identity is recorded as {@code ownerTerminal} ({@code null} for daemon/anon callers).
-     */
-    public WorkerSession acquire(String profile, String requestedCwd, String callerCwd,
-                                 String ownerTerminal) {
-        return acquire(profile, requestedCwd, callerCwd, ownerTerminal, null);
-    }
-
-    /**
-     * Spawn a worker, optionally inside a fresh git worktree. When {@code wt} is non-null the
-     * worktree is provisioned, parity-overlaid, and its path becomes the worker's cwd. On any
-     * failure before registration the worktree is removed so no dangling checkout is left.
-     */
-    public WorkerSession acquire(String profile, String requestedCwd, String callerCwd,
-                                 String ownerTerminal, WorktreeRequest wt) {
-        if (wt == null) {
-            SpawnRequest req = new SpawnRequest(profile, requestedCwd, callerCwd);
-            PeerHandle handle = launcher.spawn(req);
-            String resolvedProfile = resolveProfile(handle, profile);
-            String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
-            long now = nowNanos.getAsLong();
-            WorkerSession session = new WorkerSession(
-                    handle.id(),
-                    handle.terminalId(),
-                    resolvedProfile,
-                    cwd,
-                    ownerTerminal,
-                    now,
-                    now,
-                    0,
-                    WorkerSession.State.SPAWNING,
-                    null,
-                    null);
-            registry.put(handle.id(), session);
-            log.debug("acquired session id={} terminal={} profile={} owner={}",
-                    handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
-            notifyAcquired(session.terminalId());
-            return session;
-        }
-        return acquireWithWorktree(profile, requestedCwd, callerCwd, ownerTerminal, wt);
-    }
-
-    /** Tear a worker down by pane id and remove it from the registry. Idempotent. */
-    public void release(String paneId) {
-        WorkerSession removed = registry.remove(paneId);
-        if (removed != null) {
-            log.debug("releasing session pane={} terminal={} state={}",
-                    removed.paneId(), removed.terminalId(), removed.state());
-            // CB-516: a send still waiting on this worker can never be answered now. Tell the
-            // listener BEFORE the pane is torn down, so a blocked caller fails fast with a real
-            // reason instead of sitting on a rendezvous nothing will ever resolve.
-            notifyReleased(removed.terminalId());
-        }
-        launcher.stop(paneId);
-        if (removed != null && removed.worktree() != null) {
-            worktrees.remove(worktrees.repoRoot(removed.cwd()), removed.worktree());
-        }
-    }
-
-    /**
-     * Register a callback invoked with a session's {@code terminalId} whenever it is acquired
-     * (CB-520). This is the hook that lets the reply inbox {@code own} a target's queue.
-     */
-    public void onAcquire(Consumer<String> listener) {
-        if (listener != null) {
-            acquireListeners.add(listener);
-        }
-    }
-
-    /**
-     * Register a callback invoked with a session's {@code terminalId} whenever it is released
-     * (CB-516). Every teardown path funnels through {@link #release}, so one hook covers the REST
-     * and MCP stop tools, the idle-TTL reaper, {@code recycle}, and shutdown drain alike.
-     *
-     * <p>Added rather than injected because {@code MessageService} — one intended listener — is
-     * constructed after this manager (it needs the injector and rendezvous, which need the session
-     * presence view this manager exposes). Wiring it at construction would require breaking that
-     * cycle for one callback.
-     */
-    public void onRelease(Consumer<String> listener) {
-        if (listener != null) {
-            releaseListeners.add(listener);
-        }
-    }
-
-    /** A listener failure must never prevent the acquisition it is reacting to. */
-    private void notifyAcquired(String terminalId) {
-        if (terminalId == null) {
-            return;
-        }
-        for (Consumer<String> listener : acquireListeners) {
-            try {
-                listener.accept(terminalId);
-            } catch (RuntimeException e) {
-                log.warn("acquire listener failed for terminal {}: {}", terminalId, e.toString());
-            }
-        }
-    }
-
-    /** A listener failure must never prevent the teardown it is reacting to. */
-    private void notifyReleased(String terminalId) {
-        if (terminalId == null) {
-            return;
-        }
-        for (Consumer<String> listener : releaseListeners) {
-            try {
-                listener.accept(terminalId);
-            } catch (RuntimeException e) {
-                log.warn("release listener failed for terminal {}: {}", terminalId, e.toString());
-            }
-        }
-    }
-
-    private WorkerSession acquireWithWorktree(String profile, String requestedCwd, String callerCwd,
-                                              String ownerTerminal, WorktreeRequest wt) {
-        String preResolvedProfile = (profile == null || profile.isBlank())
-                ? launcher.defaultProfile() : profile;
-        // CB-507: resolve through the launcher's CB-112 chain (requested → profile cwd → caller →
-        // daemon cwd → "."), never the raw args. A plain REST spawn supplies neither a requested
-        // nor a caller cwd, so taking the first non-blank of those two yielded null and put
-        // `git -C null` on the command line — an NPE out of ProcessBuilder, surfacing as HTTP 500.
-        // The non-worktree path always used this chain; only this branch was missed.
-        String repoRoot = worktrees.repoRoot(
-                launcher.effectiveCwd(new SpawnRequest(preResolvedProfile, requestedCwd, callerCwd)));
-        String branch = "worker/" + slug(wt.ticketSlug()) + "-" + nonce();
-        String path = null;
-        PeerHandle handle;
-        try {
-            path = worktrees.add(repoRoot, branch, wt.baseRef());
-            worktrees.overlayParity(repoRoot, path, launcher.parityOverlay(preResolvedProfile));
-            handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd));
-        } catch (RuntimeException e) {
-            if (path != null) {
-                try {
-                    worktrees.remove(repoRoot, path);
-                } catch (RuntimeException cleanup) {
-                    log.warn("failed to clean up worktree {} after spawn error: {}", path, cleanup.getMessage());
-                }
-            }
-            throw e;
-        }
-        String resolvedProfile = resolveProfile(handle, profile);
-        String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, path, callerCwd));
-        long now = nowNanos.getAsLong();
-        WorkerSession session = new WorkerSession(
-                handle.id(),
-                handle.terminalId(),
-                resolvedProfile,
-                cwd,
-                ownerTerminal,
-                now,
-                now,
-                0,
-                WorkerSession.State.SPAWNING,
-                path,
-                branch);
-        registry.put(handle.id(), session);
-        log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
-                handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
-        notifyAcquired(session.terminalId());
-        return session;
-    }
-
-    private String slug(String raw) {
-        return raw == null ? "ticket" : raw.toLowerCase().replaceAll("[^a-z0-9]+", "-").replaceAll("^-+|-+$", "");
-    }
-
-    private String nonce() {
-        return String.format("%06x", nonceRandom.nextInt(1 << 24)) + "-" + nonceSeq.incrementAndGet();
-    }
-
-    /**
-     * The profile to record for a session. A launcher that performed dynamic selection tells us
-     * the actual profile via {@link PeerHandle#profile()}; otherwise fall back to what the caller
-     * requested (or the launcher's default for a no-profile spawn).
-     */
-    private String resolveProfile(PeerHandle handle, String requestedProfile) {
-        String fromHandle = handle.profile();
-        if (fromHandle != null && !fromHandle.isBlank()) {
-            return fromHandle;
-        }
-        if (requestedProfile != null && !requestedProfile.isBlank()) {
-            return requestedProfile;
-        }
-        return launcher.defaultProfile();
-    }
-
-    /**
-     * Release the old session and acquire a fresh one with the same profile and working directory.
-     * The new session is guaranteed to have a pane id distinct from the old one (no-reuse invariant).
-     */
-    public WorkerSession recycle(String paneId) {
-        WorkerSession old = registry.get(paneId);
-        if (old == null) {
-            throw new IllegalArgumentException("no session for paneId " + paneId);
-        }
-        release(paneId);
-        return acquire(old.profile(), old.cwd(), old.cwd(), old.ownerTerminal());
-    }
-
-    /** The session for {@code paneId}, if it is still registered and not released. */
-    public Optional<WorkerSession> get(String paneId) {
-        return Optional.ofNullable(registry.get(paneId));
-    }
-
-    /** Bridge-owned roster: all registered sessions (acquired minus released). */
-    public List<WorkerSession> roster() {
-        return List.copyOf(registry.values());
-    }
-
-    /**
-     * CB-304 merged roster+live view. The registry is authoritative for worktree, branch,
-     * profile, owner, and state; the optional live agent supplies the herdr-reported status.
-     */
-    public static Map<String, Object> rosterView(WorkerSession session, Agent live) {
-        Map<String, Object> m = new LinkedHashMap<>();
-        m.put("sessionId", session.terminalId());
-        m.put("paneId", session.paneId());
-        m.put("profile", session.profile());
-        m.put("state", session.state().name().toLowerCase());
-        if (session.worktree() != null) {
-            m.put("worktree", session.worktree());
-        }
-        if (session.branch() != null) {
-            m.put("branch", session.branch());
-        }
-        if (session.ownerTerminal() != null) {
-            m.put("owner", session.ownerTerminal());
-        }
-        m.put("liveStatus", live == null ? "unknown" : live.status().name().toLowerCase());
-        return m;
-    }
-
-    /** Lifecycle hook: worker became available on the bridge MCP. */
-    void onReady(String terminalId) {
-        transitionByTerminal(terminalId, WorkerSession.State.SPAWNING, WorkerSession.State.READY);
-    }
-
-    /**
-     * Lifecycle hook: a message was delivered into the worker — it is now busy on a turn.
-     * The turn count is bumped and the activity timestamp is refreshed. A {@code DONE} session
-     * can be re-delivered for multi-turn reuse until it is released.
-     */
-    @Override
-    public void onDelivered(String target) {
-        WorkerSession current = findByTerminal(target);
-        if (current == null) return;
-        if (current.state() != WorkerSession.State.READY && current.state() != WorkerSession.State.DONE) {
-            return;
-        }
-        long now = nowNanos.getAsLong();
-        WorkerSession updated = current.withState(WorkerSession.State.BUSY).bumpTurn(now);
-        if (replace(current, updated)) {
-            log.debug("session transitioned terminal={} pane={} {} -> BUSY turn={}",
-                    target, current.paneId(), current.state(), updated.turnCount());
-        }
-    }
-
-    /** Lifecycle hook: the worker's delegated turn completed successfully. */
-    @Override
-    public void onTurnComplete(String target) {
-        completeTurn(target, false);
-    }
-
-    @Override
-    public boolean hasPostTurnAction(String target) {
-        if (!clearAfterTurn) return false;
-        WorkerSession current = findByTerminal(target);
-        return current != null && current.state() == WorkerSession.State.BUSY
-                && (contextCap <= 0 || current.turnCount() < contextCap);
-    }
-
-    @Override
-    public boolean onTurnCompleteWithPostAction(String target) {
-        return completeTurn(target, true);
-    }
-
-    private boolean completeTurn(String target, boolean startContextReset) {
-        WorkerSession current = findByTerminal(target);
-        if (current == null || current.state() != WorkerSession.State.BUSY) return false;
-        long now = nowNanos.getAsLong();
-        WorkerSession updated = current.withState(WorkerSession.State.DONE).withActivity(now);
-        if (replace(current, updated)) {
-            log.debug("session transitioned terminal={} pane={} BUSY -> DONE turn={}",
-                    target, current.paneId(), updated.turnCount());
-        }
-        if (contextCap > 0 && updated.turnCount() >= contextCap) {
-            release(current.paneId());
-            return false;
-        }
-        if (!startContextReset || !clearAfterTurn) return false;
-        try {
-            return launcher.clearContext(current.paneId());
-        } catch (RuntimeException e) {
-            log.warn("context reset failed for terminal={} pane={}; continuing without reset: {}",
-                    target, current.paneId(), e.getMessage());
-            return false;
-        }
-    }
-
-    /** Lifecycle hook: the worker's delegated turn failed. */
-    @Override
-    public void onTurnFailed(String target) {
-        onFailed(target);
-    }
-
-    /** Lifecycle hook: the worker vanished or was dropped mid-life. */
-    void onFailed(String target) {
-        WorkerSession current = findByTerminal(target);
-        if (current == null) return;
-        if (current.state() == WorkerSession.State.RELEASED) return;
-        if (replace(current, current.withState(WorkerSession.State.FAILED))) {
-            log.debug("session marked failed terminal={} pane={}", target, current.paneId());
-        }
-    }
-
-    /**
-     * Best-effort reap of sessions that have been idle longer than {@code idleTtlNanos}. Only
-     * {@code READY} and {@code DONE} sessions are eligible — never a {@code SPAWNING} or
-     * {@code BUSY} worker. Returns the number of sessions released.
-     */
-    int reapIdle(long idleTtlNanos) {
-        long now = nowNanos.getAsLong();
-        int reaped = 0;
-        for (WorkerSession s : roster()) {
-            if (s.state() != WorkerSession.State.READY && s.state() != WorkerSession.State.DONE) {
-                continue;
-            }
-            if (now - s.lastActivityAtNanos() > idleTtlNanos) {
-                release(s.paneId());
-                reaped++;
-            }
-        }
-        return reaped;
-    }
-
-    /**
-     * Gracefully drain all registered sessions. For each session that is {@code BUSY}, poll up to
-     * {@code timeoutNanos} for it to leave {@code BUSY}, then release it regardless. Non-busy
-     * sessions are released immediately. A failure releasing one session is logged and does not
-     * abort the rest.
-     */
-    void drainAll(long timeoutNanos) {
-        long deadline = System.nanoTime() + timeoutNanos;
-        for (WorkerSession s : roster()) {
-            try {
-                if (s.state() == WorkerSession.State.BUSY) {
-                    while (System.nanoTime() < deadline) {
-                        WorkerSession current = registry.get(s.paneId());
-                        if (current == null || current.state() != WorkerSession.State.BUSY) {
-                            break;
-                        }
-                        try {
-                            long remaining = deadline - System.nanoTime();
-                            Thread.sleep(Math.min(TimeUnit.NANOSECONDS.toMillis(remaining), 50));
-                        } catch (InterruptedException e) {
-                            Thread.currentThread().interrupt();
-                            break;
-                        }
-                    }
-                }
-                release(s.paneId());
-            } catch (RuntimeException e) {
-                log.warn("drain failed for pane={}; continuing with remaining sessions", s.paneId(), e);
-            }
-        }
-    }
-
-    /**
-     * Close this manager by draining all sessions. The timeout comes from configuration when set,
-     * otherwise a sensible default.
-     */
-    public void close(Integer drainTimeoutSeconds) {
-        int seconds = (drainTimeoutSeconds != null && drainTimeoutSeconds > 0) ? drainTimeoutSeconds : 5;
-        drainAll(TimeUnit.SECONDS.toNanos(seconds));
-    }
-
-    /** Number of sessions currently registered. */
-    public int size() {
-        return registry.size();
-    }
-
-    /**
-     * The registered session owning {@code terminalId}, or {@code null} if none does.
-     *
-     * <p>A null {@code terminalId} is a normal input, not a caller bug: every lifecycle hook here is
-     * fed from the MCP transport, where the <em>primary</em> resolves to a {@link
-     * dev.ltms.bridged.auth.Principal} with no terminal. {@code BridgeMcp} documents that contact as
-     * a no-op, and {@link dev.ltms.bridged.inject.WorkerPresence#markPresent} honours it — but
-     * {@code PresenceBridge} then forwards the same null here. Matching on a null id can never
-     * succeed anyway (a registered session always has a terminal), so answer "no match" rather than
-     * throwing: an NPE on this path takes down an unrelated tool call for the primary.
-     */
-    private WorkerSession findByTerminal(String terminalId) {
-        if (terminalId == null) return null;
-        for (WorkerSession s : registry.values()) {
-            if (terminalId.equals(s.terminalId())) return s;
-        }
-        return null;
-    }
-
-    private void transitionByTerminal(String terminalId, WorkerSession.State from,
-                                      WorkerSession.State to) {
-        WorkerSession current = findByTerminal(terminalId);
-        if (current == null || current.state() != from) return;
-        long now = nowNanos.getAsLong();
-        if (replace(current, current.withState(to).withActivity(now))) {
-            log.debug("session transitioned terminal={} pane={} {} -> {}",
-                    terminalId, current.paneId(), from, to);
-        }
-    }
-
-    private boolean replace(WorkerSession expected, WorkerSession updated) {
-        return registry.replace(expected.paneId(), expected, updated);
-    }
-
-    /** WorkerPresence bridge that also drives the manager's READY transition. */
-    private static final class PresenceBridge extends WorkerPresence {
-        private final SessionManager sessions;
-
-        PresenceBridge(SessionManager sessions) {
-            this.sessions = sessions;
-        }
-
-        @Override
-        public void markPresent(String terminal) {
-            if (terminal == null || terminal.isBlank()) {
-                return; // the primary's contact carries no worker terminal — not a readiness signal
-            }
-            super.markPresent(terminal);
-            sessions.onReady(terminal);
-        }
-    }
-}

bridged/src/main/java/dev/ltms/bridged/session/SessionReaper.java

@@ -1,70 +0,0 @@
-package dev.ltms.bridged.session;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.concurrent.TimeUnit;
-
-/**
- * Periodic virtual-thread reaper that tears down {@code READY}/{@code DONE} sessions which have
- * exceeded their idle TTL. Modeled on {@link dev.ltms.bridged.inject.StatusPoller}: a single
- * virtual-thread loop, idempotent start/stop, and no {@code ScheduledExecutorService}.
- */
-public final class SessionReaper {
-
-    private static final Logger log = LoggerFactory.getLogger(SessionReaper.class);
-    private static final long DEFAULT_INTERVAL_MILLIS = 5000;
-
-    private final SessionManager sessions;
-    private final long idleTtlNanos;
-    private final long intervalMillis;
-    private volatile boolean running;
-    private Thread thread;
-
-    /** Construct a reaper with the default 5-second polling interval. */
-    public SessionReaper(SessionManager sessions, long idleTtlSeconds) {
-        this(sessions, idleTtlSeconds, DEFAULT_INTERVAL_MILLIS);
-    }
-
-    /** Construct a reaper with an explicit polling interval (useful for tests). */
-    public SessionReaper(SessionManager sessions, long idleTtlSeconds, long intervalMillis) {
-        this.sessions = sessions;
-        this.idleTtlNanos = TimeUnit.SECONDS.toNanos(idleTtlSeconds);
-        this.intervalMillis = intervalMillis;
-    }
-
-    /** Start the reaper loop on a virtual thread. Idempotent. */
-    public synchronized void start() {
-        if (running) return;
-        running = true;
-        thread = Thread.ofVirtual().name("session-reaper").start(this::loop);
-        log.info("session reaper started (idle ttl {}s, interval {}ms)",
-                TimeUnit.NANOSECONDS.toSeconds(idleTtlNanos), intervalMillis);
-    }
-
-    private void loop() {
-        while (running) {
-            try {
-                sessions.reapIdle(idleTtlNanos);
-            } catch (RuntimeException e) {
-                log.warn("session reaper iteration failed; continuing", e);
-            }
-            sleep();
-        }
-    }
-
-    private void sleep() {
-        try {
-            Thread.sleep(intervalMillis);
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            running = false;
-        }
-    }
-
-    /** Stop the reaper loop. Idempotent. */
-    public synchronized void stop() {
-        running = false;
-        if (thread != null) thread.interrupt();
-    }
-}

bridged/src/main/java/dev/ltms/bridged/session/WorkerSession.java

@@ -1,61 +0,0 @@
-package dev.ltms.bridged.session;
-
-/**
- * A bridge-owned worker session — the authoritative in-daemon record of a worker this
- * process spawned. Immutable; state transitions are performed by replacing the record in
- * {@link SessionManager}'s registry.
- *
- * @param paneId         the host-unique opaque id (CB-519) — the registry key and the argument to
- *                       teardown. Despite the historical name this is the {@link
- *                       dev.ltms.bridged.peer.PeerHandle#id()}, a UUID, and is distinct from the
- *                       launcher-private herdr pane coordinate.
- * @param terminalId     herdr terminal handle — the {@code target} for send/read/status
- * @param profile        the worker profile name that spawned this session
- * @param cwd            the resolved working directory the worker started in
- * @param ownerTerminal  the caller that requested this worker ({@code null} = daemon/anon)
- * @param spawnedAtNanos     {@link System#nanoTime()} when the session was registered
- * @param lastActivityAtNanos {@link System#nanoTime()} of the most recent lifecycle event
- * @param turnCount          number of delegated turns that have been delivered to this session
- * @param state              current lifecycle state in the one-shot FSM
- */
-public record WorkerSession(
-        String paneId,
-        String terminalId,
-        String profile,
-        String cwd,
-        String ownerTerminal,
-        long spawnedAtNanos,
-        long lastActivityAtNanos,
-        int turnCount,
-        State state,
-        String worktree,
-        String branch) {
-
-    /** One-shot worker lifecycle states. */
-    public enum State {
-        SPAWNING,
-        READY,
-        BUSY,
-        DONE,
-        FAILED,
-        RELEASED
-    }
-
-    /** Return a copy of this session in {@code state}. */
-    public WorkerSession withState(State state) {
-        return new WorkerSession(paneId, terminalId, profile, cwd, ownerTerminal, spawnedAtNanos,
-                lastActivityAtNanos, turnCount, state, worktree, branch);
-    }
-
-    /** Return a copy with {@code lastActivityAtNanos} updated to {@code nowNanos}. */
-    public WorkerSession withActivity(long nowNanos) {
-        return new WorkerSession(paneId, terminalId, profile, cwd, ownerTerminal, spawnedAtNanos,
-                nowNanos, turnCount, state, worktree, branch);
-    }
-
-    /** Return a copy with the turn count incremented and activity timestamped at {@code nowNanos}. */
-    public WorkerSession bumpTurn(long nowNanos) {
-        return new WorkerSession(paneId, terminalId, profile, cwd, ownerTerminal, spawnedAtNanos,
-                nowNanos, turnCount + 1, state, worktree, branch);
-    }
-}

bridged/src/main/java/dev/ltms/bridged/session/Worktrees.java

@@ -1,18 +0,0 @@
-package dev.ltms.bridged.session;
-
-import java.util.List;
-
-/** Seam between {@link SessionManager} and git worktree operations. Tests use a recording fake. */
-public interface Worktrees {
-    /** git -C <repoRoot> worktree add <path> -b <branch> <baseRef|HEAD>. Returns the worktree path. */
-    String add(String repoRoot, String branch, String baseRef);
-
-    /** git -C <repoRoot> worktree remove --force <path>. Idempotent (already-gone tolerated). */
-    void remove(String repoRoot, String worktreePath);
-
-    /** Copy each existing overlay path repoRoot→worktree; mark tracked ones --skip-worktree. */
-    void overlayParity(String repoRoot, String worktreePath, List<String> overlay);
-
-    /** git -C <cwd> rev-parse --show-toplevel — the repo root that owns cwd. */
-    String repoRoot(String cwd);
-}

bridged/src/main/java/dev/ltms/bridged/worker/ClaudeCodeLauncher.java

@@ -1,318 +0,0 @@
-package dev.ltms.bridged.worker;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.EnumSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-import java.util.function.Function;
-import java.util.function.LongSupplier;
-
-/**
- * The {@link HerdrPeerLauncher} adapter for <strong>Claude Code</strong> — the safe path from a
- * delegation request to a running off-subscription Claude.
- *
- * <p>Everything transport-related (tab/pane placement, the CB-306 spawn-readiness gate, unique
- * naming, CB-117 orphan reap, teardown, listing, cwd resolution) lives in the base. This class
- * supplies only the two Claude-specific seams:
- * <ul>
- *   <li>the {@code claude} name prefix (so reap matches {@code claude-*} panes, never another
- *       adapter's), and</li>
- *   <li>{@link #buildLaunch}, which encodes the subscription boundary: build the worker env with
- *       {@code ANTHROPIC_BASE_URL}, assert that host is on the allowlist <em>before</em> touching
- *       herdr, and mount the bridge MCP + reply charter as inline launch flags. A worker's base_url
- *       lives in the env map handed to herdr and nowhere else; {@code bridged}'s own environment is
- *       never mutated, and nothing is written to the worker's profile.</li>
- * </ul>
- */
-public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
-
-    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
-    private static final String NAME_PREFIX = "claude";
-
-    private static final Logger log = LoggerFactory.getLogger(ClaudeCodeLauncher.class);
-
-    private final SubscriptionGuard guard;
-
-    /**
-     * Standing instruction appended to the worker's system prompt so it returns its result via
-     * {@code bridge_reply}. Injected as a launch flag, so nothing is written to the worker's
-     * profile — it is guidance, and a worker that never replies is caught by the send's timeout.
-     */
-    static final String REPLY_CHARTER =
-            "You are an off-subscription worker in the claude-bridge fleet. Every message you "
-            + "receive arrives through the bridge, and the ONLY channel back to the sender is the "
-            + "bridge_reply MCP tool. Text you write in your terminal is NOT sent anywhere — the "
-            + "sender cannot see your screen, so an in-terminal answer is silently discarded. "
-            + "Therefore you MUST end EVERY turn by calling bridge_reply with `content` set to your "
-            + "complete response. This holds for every message without exception — tasks, questions, "
-            + "clarifications, acknowledgements, and ordinary back-and-forth conversation. Call "
-            + "bridge_reply exactly once, as the final action of your turn, with your full answer in "
-            + "`content`; never wait for confirmation first. If you end a turn without calling "
-            + "bridge_reply, the sender receives nothing and the exchange stalls.";
-
-    /**
-     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so
-     * existing deployments and tests keep the legacy non-blocking spawn semantics.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
-                              Function<String, String> env) {
-        this(agents, spaces, guard, profiles, defaultProfile, env, 0,
-                System::currentTimeMillis, () -> sleepUninterruptibly(300));
-    }
-
-    /**
-     * Production constructor with spawn-ready gate enabled. The gate polls {@code agents.status()}
-     * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs, long spawnReadyPollMs) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs,
-                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs));
-    }
-
-    /**
-     * Full testability constructor. Every injectable collaborator is explicit so unit tests supply
-     * fakes for the clock ({@code nowMillis}) and poll-loop wait ({@code sleeper}). The
-     * {@code sleeper} is never called when the gate is disabled ({@code spawnReadyTimeoutMs == 0}).
-     *
-     * @param agents               herdr agent control (start, status, close)
-     * @param spaces               workspace / tab control (ensure, create, close)
-     * @param guard                subscription-boundary guard (checked before spawning)
-     * @param profiles             configured worker profiles
-     * @param defaultProfile       profile a no-argument spawn uses (nullable)
-     * @param env                  host env lookup (injectable for tests)
-     * @param spawnReadyTimeoutMs  max ms to wait for injectable state (0 disables the gate)
-     * @param nowMillis            monotonic clock source (e.g. {@code System::currentTimeMillis})
-     * @param sleeper              sleep/wait hook (e.g. {@code () -> Thread.sleep(pollMs)}); it
-     *                             already encodes the poll interval, so the 8th positional argument
-     *                             (poll ms) is accepted for API symmetry but otherwise unused here
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs,
-                              LongSupplier nowMillis, Runnable sleeper) {
-        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper);
-        this.guard = guard;
-    }
-
-    /**
-     * {@inheritDoc}
-     *
-     * <p>A legacy spawn with no session identity is a fresh, launcher-derived session — delegate to
-     * the session-aware form with no name and no resume id.
-     */
-    @Override
-    protected Launch buildLaunch(BridgedConfig.Worker cfg) {
-        return buildLaunch(cfg, null, null);
-    }
-
-    /**
-     * {@inheritDoc}
-     *
-     * <p>The spawn sequence encodes the subscription boundary: assert the profile's base_url is on
-     * the allowlist <em>before</em> any herdr call, then build the worker env with
-     * {@code ANTHROPIC_*}, the parity-neutral git-forge grant, and the bridge MCP + reply charter
-     * mounted as inline launch flags. When the request carries session identity (CB-547a) it is
-     * applied here — see {@link #applySessionIdentity}.
-     */
-    @Override
-    protected Launch buildLaunch(BridgedConfig.Worker cfg, String sessionName, String resumeSessionId) {
-        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
-        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
-        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
-        // requirement is skipped FOR IT ONLY. Every other profile keeps the hard boundary below.
-        boolean onSubscription = cfg.isSubscription();
-        String baseUrl = cfg.baseUrl();
-
-        if (onSubscription) {
-            // NO SILENT CONTRADICTION: subscription:true + a baseUrl state opposite intents; refuse
-            // loudly rather than pick a winner.
-            if (baseUrl != null && !baseUrl.isBlank()) {
-                throw new IllegalStateException("profile '" + cfg.profile()
-                        + "' sets both subscription: true and a baseUrl ('" + baseUrl + "') — the two "
-                        + "are contradictory: a subscription profile must not point at an endpoint. "
-                        + "Drop baseUrl, or drop subscription: true.");
-            }
-            // Visible without anyone going looking for it: this worker bills the subscription.
-            log.warn("spawning profile '{}' on the Claude subscription (subscription: true) — this "
-                    + "worker WILL bill the operator's subscription", cfg.profile());
-        } else {
-            guard.assertWorker(baseUrl); // hard stop before we spawn anything
-        }
-
-        Map<String, String> workerEnv = baseEnv(cfg);
-        if (onSubscription) {
-            // CB-542 belt-and-braces: on the subscription path no guard vets these two keys, and the
-            // profile's env: is layered in by baseEnv — so strip any that rode in there. Config load
-            // already rejects this (loudly, naming the profile); this makes the boundary hold even
-            // for a profile built in code that never passed through that validation.
-            workerEnv.remove("ANTHROPIC_BASE_URL");
-            workerEnv.remove("ANTHROPIC_AUTH_TOKEN");
-        } else {
-            workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
-            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
-        }
-        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
-        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
-        applyGitToken(workerEnv, cfg);
-
-        // CB-547a: Claude Code can MINT its own session id, so bridged chooses it — a fresh spawn
-        // gets a UUID we pass as --session-id and return from agentSessionId(), so the resume
-        // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
-        // id via -r and passes no --session-id (the two conflict). Both are injected before the
-        // model flag so --model keeps outranking the operator's own argv.
-        // mutableArgv: argvWithBridge may hand back the profile's own (immutable) List.of when it
-        // has no MCP — session flags must be added into a list we own.
-        List<String> argv = mutableArgv(argvWithBridge(cfg));
-        String agentSessionId = applySessionIdentity(argv, sessionName, resumeSessionId);
-        return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
-    }
-
-    /**
-     * Add the Claude-specific session-identity flags to {@code argv} and return the peer's OWN
-     * session id — the resume handle. A resume request passes the prior id via {@code -r} and
-     * returns that id; a fresh named session mints a new UUID, passes it via {@code --session-id},
-     * and returns the mint. The bridge's logical name rides along as {@code -n} when present. When
-     * <em>no</em> identity is requested (sessionName and resumeSessionId both blank) this adds
-     * nothing and returns {@code null}, keeping the legacy no-identity launch byte-identical.
-     */
-    private static String applySessionIdentity(List<String> argv, String sessionName, String resumeSessionId) {
-        boolean resuming = resumeSessionId != null && !resumeSessionId.isBlank();
-        boolean named = sessionName != null && !sessionName.isBlank();
-        if (!resuming && !named) {
-            return null; // no identity requested — keep the legacy launch byte-identical
-        }
-        if (named) {
-            argv.add("-n");
-            argv.add(sessionName);
-        }
-        if (resuming) {
-            argv.add("-r");
-            argv.add(resumeSessionId);
-            return resumeSessionId;
-        }
-        String minted = UUID.randomUUID().toString();
-        argv.add("--session-id");
-        argv.add(minted);
-        return minted;
-    }
-
-    /**
-     * The launch argv, plus — when {@code worker.mcpUrl} is set — inline {@code --mcp-config} for
-     * the bridge server and {@code --append-system-prompt} for the {@link #REPLY_CHARTER}. Neither
-     * touches the profile's config; both are pure command-line flags. This inline-flag mount is
-     * Claude Code specific — other adapters mount MCP and instructions their own way.
-     */
-    private List<String> argvWithBridge(BridgedConfig.Worker cfg) {
-        if (!cfg.hasMcp()) {
-            return cfg.argv();
-        }
-        String mcpJson = "{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
-                + cfg.mcpUrl() + "\"}}}";
-        List<String> argv = mutableArgv(cfg.argv());
-        argv.add("--mcp-config");
-        argv.add(mcpJson);
-        argv.add("--append-system-prompt");
-        argv.add(REPLY_CHARTER);
-        return argv;
-    }
-
-    /**
-     * Pin the model on the command line as well as in {@code ANTHROPIC_MODEL} (CB-533).
-     *
-     * <p>The env var alone is not a reliable pin for this adapter, because the argv is usually a
-     * launcher rather than {@code claude} itself — {@code ["ccs", "<profile>"]} — and {@code ccs}
-     * exports its profile's own model family ({@code ANTHROPIC_MODEL}, {@code DEFAULT_OPUS/SONNET/
-     * HAIKU}, {@code CLAUDE_CODE_SUBAGENT_MODEL}) over whatever it inherited. A worker profile that
-     * set {@code model:} therefore got silently overruled by its own launcher. Claude Code's
-     * {@code --model} flag outranks the environment, and {@code ccs <profile> [claude-args...]}
-     * passes trailing arguments through, so the flag survives the wrapper.
-     *
-     * <p>Appended last so it also outranks anything in the operator's own {@code argv}. Profiles
-     * that deliberately leave {@code model:} unset (letting {@code ccs} own model selection, as
-     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
-     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
-     */
-    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Worker cfg) {
-        if (cfg.model() == null || cfg.model().isBlank()) {
-            return argv;
-        }
-        List<String> withModel = mutableArgv(argv);
-        withModel.add("--model");
-        withModel.add(cfg.model());
-        return withModel;
-    }
-
-    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
-
-    /** Spawn a worker for the default profile in the resolved default cwd. */
-    public Agent spawn() {
-        return spawnInternal(null, null, null);
-    }
-
-    /** Spawn a worker for a named profile (null → default) in the resolved default cwd. */
-    public Agent spawn(String profileName) {
-        return spawnInternal(profileName, null, null);
-    }
-
-    /** Spawn a worker for a named profile with an explicit requested/caller cwd (CB-112). */
-    public Agent spawn(String profileName, String requestedCwd, String callerCwd) {
-        return spawnInternal(profileName, requestedCwd, callerCwd);
-    }
-
-    // --- capabilities --------------------------------------------------------------------------
-
-    @Override
-    public Set<Capability> capabilities() {
-        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
-                Capability.CONTEXT_RESET, Capability.ORPHAN_REAP,
-                Capability.SESSION_NAME, Capability.SESSION_RESUME);
-        if (hasGitTokenProfile()) {
-            caps.add(Capability.SELF_PR);
-        }
-        return Set.copyOf(caps);
-    }
-
-    @Override
-    public boolean clearContext(String id) {
-        String target = agentTarget(id);
-        if (target == null) {
-            return false;
-        }
-        // This deliberately bypasses Injector: /clear is housekeeping, not a delegated turn.
-        agents().send(target, "/clear");
-        return true;
-    }
-
-    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
-    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Worker::hasGitToken);
-    }
-
-    // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------
-
-    /**
-     * Whether {@code name} is a Claude Code bridge worker started by a <em>different</em> process
-     * than {@code currentNonce}. A thin {@code claude}-prefix binding of
-     * {@link HerdrPeerLauncher#isForeignWorker(String, String, String)}.
-     */
-    static boolean isForeignWorker(String name, String currentNonce) {
-        return HerdrPeerLauncher.isForeignWorker(NAME_PREFIX, name, currentNonce);
-    }
-}

bridged/src/main/java/dev/ltms/bridged/worker/CompositePeerLauncher.java

@@ -1,275 +0,0 @@
-package dev.ltms.bridged.worker;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
-import dev.ltms.bridged.placement.PlacementCandidate;
-import dev.ltms.bridged.placement.PlacementContext;
-import dev.ltms.bridged.placement.PlacementPolicies;
-import dev.ltms.bridged.placement.PlacementPolicy;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.EnumSet;
-import java.util.HashSet;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.function.Function;
-
-/**
- * The {@link PeerLauncher} the core actually holds when more than one adapter is configured — a thin
- * router in front of one {@link HerdrPeerLauncher} per peer {@code kind} (Claude Code, opencode, …).
- * It owns no transport of its own; it dispatches each SPI call to the delegate that owns the profile
- * involved, and fans the fleet-wide queries (list/reap/caps/profiles) across all delegates.
- *
- * <p>Routing rules:
- * <ul>
- *   <li><strong>By profile</strong> — {@link #spawn}, {@link #effectiveCwd}, {@link #parityOverlay}
- *       resolve the profile (a null/blank name → the global {@link #defaultProfile}) and delegate to
- *       the single adapter that declares it. Profiles partition cleanly across adapters: the
- *       constructor rejects a name claimed by two.</li>
- *   <li><strong>By pane id</strong> — {@link #stop} routes to the adapter that spawned that pane
- *       (recorded at spawn time). A pane the composite never spawned (only real for a caller that
- *       hand-rolls an id) falls back to the first delegate; teardown is pane-id addressed and
- *       tab cleanup is single-occupant guarded, so it is safe either way.</li>
- *   <li><strong>Fleet-wide</strong> — {@link #reapOrphanWorkers} and {@link #capabilities} fan out
- *       and combine. {@link #list} is deduplicated by pane id because every herdr-backed delegate
- *       shares one herdr connection and so reports the same global agent set.</li>
- * </ul>
- *
- * <p>CB-518: an unqualified spawn is routed through a {@link PlacementPolicy}. The default
- * {@code fixed} policy reproduces the historical default-profile behaviour; {@code weighted} uses
- * smooth weighted round-robin with {@code maxLoad} gating. If a chosen profile fails with
- * {@link PeerUnreachableException}, the composite advances to the next available candidate and
- * retries, bounded by the number of candidates.
- */
-public final class CompositePeerLauncher implements PeerLauncher {
-
-    private static final Logger log = LoggerFactory.getLogger(CompositePeerLauncher.class);
-
-    private final List<HerdrPeerLauncher> delegates;
-    private final Map<String, HerdrPeerLauncher> byProfile;
-    private final String defaultProfile;
-
-    /** paneId → the delegate that spawned it, so {@link #stop} tears down through the right adapter. */
-    private final Map<String, HerdrPeerLauncher> spawnedBy = new ConcurrentHashMap<>();
-
-    private final Map<String, BridgedConfig.Worker> profileConfigs;
-    private final PlacementPolicy placementPolicy;
-    private final Function<String, Integer> liveCount;
-
-    /**
-     * Backward-compatible constructor: fixed placement, no live-counting. Use this for tests and
-     * simple wiring; it preserves the pre-CB-518 behaviour exactly.
-     *
-     * @param delegates      one adapter per configured peer kind; must be non-empty and declare
-     *                       disjoint profile-name sets
-     * @param defaultProfile the profile a no-argument spawn resolves to (may be null)
-     * @throws IllegalArgumentException if {@code delegates} is empty or two adapters claim one profile
-     */
-    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates, String defaultProfile) {
-        this(delegates, defaultProfile, Map.of(), PlacementPolicies.fixed(), name -> 0);
-    }
-
-    /**
-     * Production constructor with a placement policy and live-worker counter.
-     *
-     * @param delegates      one adapter per configured peer kind; must be non-empty and declare
-     *                       disjoint profile-name sets
-     * @param defaultProfile the profile a no-argument spawn resolves to under {@code fixed} policy
-     * @param profileConfigs all configured worker profiles (used for candidate weights/caps)
-     * @param placementPolicy which policy governs unqualified spawns
-     * @param liveCount      live worker count per profile (must never return {@code null})
-     */
-    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
-                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Worker> profileConfigs,
-                                 PlacementPolicy placementPolicy,
-                                 Function<String, Integer> liveCount) {
-        if (delegates.isEmpty()) {
-            throw new IllegalArgumentException("at least one peer adapter must be configured");
-        }
-        this.delegates = List.copyOf(delegates);
-        this.defaultProfile = defaultProfile;
-        // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
-        // policy breaks exact-weight ties on it, so a salted iteration order would make placement
-        // differ from one JVM run to the next.
-        this.profileConfigs = Collections.unmodifiableMap(new LinkedHashMap<>(profileConfigs));
-        this.placementPolicy = placementPolicy;
-        this.liveCount = liveCount;
-        Map<String, HerdrPeerLauncher> index = new LinkedHashMap<>();
-        for (HerdrPeerLauncher d : this.delegates) {
-            for (String profile : d.profiles()) {
-                HerdrPeerLauncher prev = index.putIfAbsent(profile, d);
-                if (prev != null) {
-                    throw new IllegalArgumentException(
-                            "worker profile '" + profile + "' is claimed by two peer adapters");
-                }
-            }
-        }
-        // Order-preserving for the same reason, and because profiles() is user-visible (bridge_profiles).
-        this.byProfile = Collections.unmodifiableMap(index);
-    }
-
-    /** The adapter owning {@code profileName} (null/blank → the default). Throws on an unknown profile. */
-    private HerdrPeerLauncher route(String profileName) {
-        String resolved = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
-        if (resolved == null) {
-            // No profile and no default configured — hand to the first delegate so it raises the
-            // same "no default" error it would on its own; keeps the SPI contract single-sourced.
-            return delegates.getFirst();
-        }
-        HerdrPeerLauncher d = byProfile.get(resolved);
-        if (d == null) {
-            throw new IllegalArgumentException("unknown worker profile: " + resolved);
-        }
-        return d;
-    }
-
-    @Override
-    public PeerHandle spawn(SpawnRequest req) {
-        String requestedProfile = req.profileName();
-        if (requestedProfile != null && !requestedProfile.isBlank()) {
-            // An explicit profile bypasses the policy entirely.
-            HerdrPeerLauncher d = route(requestedProfile);
-            PeerHandle handle = d.spawn(req);
-            spawnedBy.put(handle.id(), d);
-            return handle;
-        }
-
-        List<PlacementCandidate> candidates = candidates();
-        Set<String> unreachable = new HashSet<>();
-        PlacementContext ctx = new PlacementContext(defaultProfile, candidates, liveCount, unreachable);
-
-        int maxAttempts = candidates.isEmpty() ? 1 : candidates.size();
-        for (int attempt = 0; attempt < maxAttempts; attempt++) {
-            PlacementCandidate chosen;
-            try {
-                chosen = placementPolicy.select(ctx);
-            } catch (RuntimeException e) {
-                // No candidate left (all at cap or all unreachable). The policy already threw a clear
-                // message; do not wrap it in a generic PeerUnreachableException.
-                throw e;
-            }
-
-            HerdrPeerLauncher d = byProfile.get(chosen.profile());
-            if (d == null) {
-                // A configured profile with no adapter is a wiring bug; fail fast.
-                unreachable.add(chosen.profile());
-                continue;
-            }
-
-            // CB-547a: route the chosen profile but keep the caller's session identity — dropping it
-            // here would silently sever the resume handle on every policy-routed spawn.
-            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd(),
-                    req.sessionName(), req.resumeSessionId());
-            try {
-                PeerHandle handle = d.spawn(routedReq);
-                spawnedBy.put(handle.id(), d);
-                return handle;
-            } catch (PeerUnreachableException e) {
-                log.warn("spawn on profile {} unreachable, will retry next candidate if any: {}",
-                        chosen.profile(), e.getMessage());
-                unreachable.add(chosen.profile());
-                // Update the context for the next selection so the policy excludes this profile.
-                ctx = new PlacementContext(defaultProfile, candidates, liveCount, unreachable);
-            }
-        }
-
-        throw new PeerUnreachableException(
-                "no reachable worker profile available after trying " + unreachable.size()
-                        + " candidate(s): " + String.join(", ", unreachable));
-    }
-
-    /** Build the candidate list from the configured profiles, in definition order. */
-    private List<PlacementCandidate> candidates() {
-        List<PlacementCandidate> out = new ArrayList<>();
-        for (Map.Entry<String, BridgedConfig.Worker> e : profileConfigs.entrySet()) {
-            BridgedConfig.Worker w = e.getValue();
-            out.add(new PlacementCandidate(e.getKey(), null, w.weight(), w.maxLoad()));
-        }
-        return out;
-    }
-
-    @Override
-    public String effectiveCwd(SpawnRequest req) {
-        return route(req.profileName()).effectiveCwd(req);
-    }
-
-    @Override
-    public List<String> parityOverlay(String profileName) {
-        return route(profileName).parityOverlay(profileName);
-    }
-
-    @Override
-    public void stop(String id) {
-        HerdrPeerLauncher d = spawnedBy.remove(id);
-        if (d == null) {
-            log.debug("stop({}) — no recorded owner, routing to the first adapter (pane-addressed)", id);
-            d = delegates.getFirst();
-        }
-        d.stop(id);
-    }
-
-    @Override
-    public boolean clearContext(String id) {
-        HerdrPeerLauncher delegate = spawnedBy.get(id);
-        if (delegate == null) {
-            log.debug("clearContext({}) ignored — no recorded owning adapter", id);
-            return false;
-        }
-        return delegate.clearContext(id);
-    }
-
-    @Override
-    public Set<String> profiles() {
-        return byProfile.keySet();
-    }
-
-    @Override
-    public String defaultProfile() {
-        return defaultProfile;
-    }
-
-    /** Every herdr agent, deduplicated by pane id (all delegates share one herdr and list globally). */
-    @Override
-    public List<Agent> list() {
-        Map<String, Agent> byPane = new LinkedHashMap<>();
-        for (HerdrPeerLauncher d : delegates) {
-            for (Agent a : d.list()) {
-                if (a.paneId() != null) {
-                    byPane.putIfAbsent(a.paneId(), a);
-                }
-            }
-        }
-        return List.copyOf(byPane.values());
-    }
-
-    @Override
-    public int reapOrphanWorkers() {
-        int reaped = 0;
-        for (HerdrPeerLauncher d : delegates) {
-            reaped += d.reapOrphanWorkers();
-        }
-        return reaped;
-    }
-
-    /** The union of every adapter's capabilities — a capability any adapter offers, the fleet offers. */
-    @Override
-    public Set<Capability> capabilities() {
-        EnumSet<Capability> caps = EnumSet.noneOf(Capability.class);
-        for (HerdrPeerLauncher d : delegates) {
-            caps.addAll(d.capabilities());
-        }
-        return Set.copyOf(caps);
-    }
-}

bridged/src/main/java/dev/ltms/bridged/worker/HerdrPeerLauncher.java

@@ -1,670 +0,0 @@
-package dev.ltms.bridged.worker;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.security.SecureRandom;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.function.Function;
-import java.util.function.LongSupplier;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-/**
- * Abstract base for {@link PeerLauncher} adapters that materialize a peer as a <em>herdr</em>
- * agent (a CLI coding agent running in a herdr tab/pane). It owns everything that is the same
- * regardless of <em>which</em> coding agent runs: tab/pane placement, the CB-306 spawn-readiness
- * gate, unique naming, CB-117 orphan reap, teardown, {@link #list() listing}, and cwd resolution.
- *
- * <p>Two seams are peer-specific and supplied by the concrete adapter:
- * <ul>
- *   <li>{@code namePrefix} (constructor arg) — the label prefix ({@code claude}, {@code opencode})
- *       that drives both unique naming and the orphan-reap pattern, so each adapter reaps only its
- *       own kind of pane and never another's.</li>
- *   <li>{@link #buildLaunch(BridgedConfig.Worker)} — the peer-specific env map + argv, including any
- *       subscription/guard check, MCP mount, and instruction injection. The base never sees how the
- *       peer is configured; it only places and starts the returned {@link Launch}.</li>
- * </ul>
- *
- * <p>Placement: in the default {@code tab} policy a peer lands in its own tab inside a dedicated
- * worker space (found-or-created once, then shared), so peers never split or clutter the user's
- * real work spaces. Teardown removes the peer's pane <em>and</em> its now-empty tab, tolerating an
- * already-gone peer so a repeated DELETE is harmless.
- */
-public abstract class HerdrPeerLauncher implements PeerLauncher {
-
-    private static final Logger log = LoggerFactory.getLogger(HerdrPeerLauncher.class);
-
-    /** herdr rejects a duplicate agent {@code name}; we retry a bumped name this many times. */
-    private static final int NAME_RETRIES = 8;
-
-    /**
-     * Retries for {@code agent.start} against a seed pane whose shell has not reached its prompt
-     * yet — {@code tab.create}/{@code pane.split} return as soon as the pane exists, and herdr
-     * refuses to start an agent in a pane that is not "an available shell" ({@code agent_pane_busy}).
-     */
-    private static final int SHELL_READY_RETRIES = 20;
-
-    private final String namePrefix;                       // label prefix: naming + reap scheme
-    private final AgentControl agents;
-    private final WorkspaceControl spaces;
-    private final Map<String, BridgedConfig.Worker> profiles; // profile name → spawn settings
-    private final String defaultProfile;                      // profile a no-arg spawn uses (nullable)
-
-    /** Host env lookup (injectable for tests); adapters read it in {@link #buildLaunch}. */
-    protected final Function<String, String> env;
-
-    private final AtomicLong nameSeq = new AtomicLong(); // per-peer counter (also the tab #)
-
-    private final long spawnReadyTimeoutMs; // 0 = disable gate (legacy non-blocking spawn)
-    private final LongSupplier nowMillis; // monotonic clock (injectable for tests)
-    private final Runnable sleeper; // sleep/wait hook (injectable for tests; never real-sleep in unit tests)
-
-    // Per-process token mixed into each peer name so a fresh process (nameSeq back at 0) cannot
-    // collide with same-profile peers that outlived a restart. See startUniquelyNamed.
-    private final String nameNonce = String.format("%06x", new SecureRandom().nextInt(1 << 24));
-
-    // CB-519: PeerHandle.id() is a host-unique opaque UUID, decoupled from the herdr pane id. The
-    // routing/registry key is the UUID; the herdr pane id is a launcher-private placement/teardown
-    // coordinate. This map bridges the two so stop(id) can resolve a host-unique key back to the
-    // exact pane it must tear down. The pane id is launcher-private (never the routing key) — see
-    // PeerHandle.id().
-    private final ConcurrentMap<String, String> paneByAgentId = new ConcurrentHashMap<>();
-    private final AtomicBoolean resetUnsupportedLogged = new AtomicBoolean();
-
-    /**
-     * @param namePrefix          label prefix for this peer kind (drives naming and reap)
-     * @param agents              herdr agent control (start, status, close)
-     * @param spaces              workspace / tab control (ensure, create, close)
-     * @param profiles            configured peer profiles
-     * @param defaultProfile      profile a no-argument spawn uses (nullable)
-     * @param env                 host env lookup (injectable for tests)
-     * @param spawnReadyTimeoutMs max ms to wait for injectable state (0 disables the gate)
-     * @param nowMillis           monotonic clock source (e.g. {@code System::currentTimeMillis})
-     * @param sleeper             sleep/wait hook (never called when the gate is disabled); the poll
-     *                            interval is baked into this hook, so the base needs no poll field
-     */
-    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
-                                Function<String, String> env,
-                                long spawnReadyTimeoutMs,
-                                LongSupplier nowMillis, Runnable sleeper) {
-        this.namePrefix = namePrefix;
-        this.agents = agents;
-        this.spaces = spaces;
-        this.profiles = Map.copyOf(profiles);
-        this.defaultProfile = defaultProfile;
-        this.env = env;
-        this.spawnReadyTimeoutMs = spawnReadyTimeoutMs;
-        this.nowMillis = nowMillis;
-        this.sleeper = sleeper;
-    }
-
-    // --- adapter seams -------------------------------------------------------------------------
-
-    /**
-     * Build the peer-specific launch for {@code cfg}: the environment map and argv handed to herdr.
-     * Any subscription/guard check, MCP mount, and instruction injection happen here. The env map
-     * and argv are adapter-private; the base only places and starts what is returned.
-     */
-    protected abstract Launch buildLaunch(BridgedConfig.Worker cfg);
-
-    /**
-     * Session-aware variant of {@link #buildLaunch(BridgedConfig.Worker)} (CB-547a). Default
-     * discards the session identity and delegates to the profile-only form, so an adapter that
-     * carries no durable peer session (opencode, say) inherits byte-identical behaviour and needs
-     * no change. An adapter that does (Claude Code) overrides this to mint/resume the id and to
-     * surface it on the returned {@link Launch#agentSessionId()}.
-     *
-     * @param cfg               the resolved profile to spawn
-     * @param sessionName       the bridge's logical session name, or null/blank for launcher-derived
-     * @param resumeSessionId   the peer's own prior session id to resume, or null/blank for fresh
-     */
-    protected Launch buildLaunch(BridgedConfig.Worker cfg, String sessionName, String resumeSessionId) {
-        return buildLaunch(cfg);
-    }
-
-    /** Direct transport access for peer-specific, non-turn control operations. */
-    protected final AgentControl agents() {
-        return agents;
-    }
-
-    /** Resolve the public peer id to the launcher's private herdr target. */
-    protected final String agentTarget(String id) {
-        return paneByAgentId.get(id);
-    }
-
-    @Override
-    public boolean clearContext(String id) {
-        if (resetUnsupportedLogged.compareAndSet(false, true)) {
-            log.warn("context reset is unsupported for peer kind {}; clearAfterTurn is a no-op",
-                    namePrefix);
-        }
-        return false;
-    }
-
-    /**
-     * A peer-specific launch: the herdr {@code env} map and {@code argv}, plus — for an adapter
-     * that carries durable session identity (CB-547a) — the peer's OWN session id
-     * ({@link PeerHandle#agentSessionId()}), known before the peer has written anything. Null for
-     * a launch that carries no identity.
-     */
-    protected record Launch(Map<String, String> env, List<String> argv, String agentSessionId) {
-
-        /** A launch without a discoverable agent session id (an adapter that carries none). */
-        Launch(Map<String, String> env, List<String> argv) {
-            this(env, argv, null);
-        }
-    }
-
-    // --- profile surface -----------------------------------------------------------------------
-
-    /** The configured peer profile names (what {@code spawn(profile)} accepts). */
-    @Override
-    public Set<String> profiles() {
-        return profiles.keySet();
-    }
-
-    /** The parity-overlay file list for {@code profileName} (default list when unset). */
-    @Override
-    public List<String> parityOverlay(String profileName) {
-        String name = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
-        if (name == null || name.isBlank()) {
-            return List.of();
-        }
-        BridgedConfig.Worker cfg = profiles.get(name);
-        return cfg == null ? List.of() : cfg.parityOverlay();
-    }
-
-    /** The profile a no-argument spawn uses, or {@code null} if none is configured. */
-    @Override
-    public String defaultProfile() {
-        return defaultProfile;
-    }
-
-    /** The configured profiles, for adapter capability decisions (e.g. any git-token grant). */
-    protected Collection<BridgedConfig.Worker> profileConfigs() {
-        return profiles.values();
-    }
-
-    /** Resolve {@code profileName} (null/blank → default) to its config, or throw with the options. */
-    protected BridgedConfig.Worker requireProfile(String profileName) {
-        String name = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
-        if (name == null || name.isBlank()) {
-            throw new IllegalArgumentException("no default worker profile is configured — "
-                    + "pass a profile; configured: " + profiles.keySet());
-        }
-        BridgedConfig.Worker cfg = profiles.get(name);
-        if (cfg == null) {
-            throw new IllegalArgumentException("unknown worker profile '" + name
-                    + "' — configured: " + profiles.keySet());
-        }
-        return cfg;
-    }
-
-    // --- spawn ---------------------------------------------------------------------------------
-
-    /** A started peer plus the launch's agent-session id (the resume handle, or null). */
-    private record Spawned(Agent agent, String agentSessionId) {
-    }
-
-    /**
-     * Spawn a peer. {@code profileName} null/blank → the default profile. The working directory
-     * (CB-112) is resolved by {@link #resolveCwd}: an explicit {@code requestedCwd}, else the
-     * profile's configured {@code cwd}, else {@code callerCwd} (the primary's cwd, when the spawn
-     * came from the primary over MCP), else the daemon's cwd — never assumed to be {@code $HOME}.
-     * The adapter's {@link #buildLaunch} runs before any herdr call.
-     */
-    protected Agent spawnInternal(String profileName, String requestedCwd, String callerCwd) {
-        return spawnInternal(profileName, requestedCwd, callerCwd, null, null).agent();
-    }
-
-    /**
-     * Spawn a peer with session identity (CB-547a). {@code sessionName} and {@code resumeSessionId}
-     * are threaded from the {@link SpawnRequest} into {@link #buildLaunch(BridgedConfig.Worker,
-     * String, String)}, and the launch's resolved agent-session id is returned alongside the agent
-     * so the caller can put it on the {@link PeerHandle}.
-     */
-    protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
-                                    String sessionName, String resumeSessionId) {
-        BridgedConfig.Worker cfg = requireProfile(profileName);
-        Launch launch = buildLaunch(cfg, sessionName, resumeSessionId);
-        String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
-        Agent agent = cfg.tabPlacement()
-                ? spawnInTab(cfg, launch.env(), launch.argv(), cwd)
-                : spawnAsPane(cfg, launch.env(), launch.argv(), cwd);
-        return new Spawned(agent, launch.agentSessionId());
-    }
-
-    /**
-     * {@inheritDoc}
-     *
-     * <p>Delegates to {@link #spawnInternal} and wraps the resulting herdr {@link Agent} in a
-     * {@link WorkerHandle} whose {@link PeerHandle#id()} is a fresh <em>host-unique</em> opaque
-     * UUID (CB-519), deliberately decoupled from the herdr pane id: the id is the registry/routing
-     * key and must never collide across daemon processes on the same host, while the herdr pane id
-     * stays a launcher-private placement/teardown coordinate, remembered here so {@link #stop}
-     * can resolve the host-unique key back to its pane. When {@code spawnReadyTimeoutMs > 0},
-     * blocks until the peer's herdr status is injectable or the timeout elapses; on timeout the
-     * pane is closed (no orphan) and a {@link PeerUnreachableException} is thrown.
-     */
-    @Override
-    public PeerHandle spawn(SpawnRequest req) {
-        Spawned spawned = spawnInternal(req.profileName(), req.requestedCwd(), req.callerCwd(),
-                req.sessionName(), req.resumeSessionId());
-        Agent agent = spawned.agent();
-        String paneId = agent.paneId();
-        if (spawnReadyTimeoutMs > 0) {
-            waitUntilInjectableOrThrow(paneId);
-        }
-        // CB-519: the handle id is a host-unique UUID; the herdr pane it maps to stays internal.
-        String id = UUID.randomUUID().toString();
-        paneByAgentId.put(id, paneId);
-        return new WorkerHandle(id, agent.terminalId(), requireProfile(req.profileName()).profile(),
-                req.sessionName(), spawned.agentSessionId());
-    }
-
-    @Override
-    public String effectiveCwd(SpawnRequest req) {
-        return effectiveCwd(req.profileName(), req.requestedCwd(), req.callerCwd());
-    }
-
-    /**
-     * CB-301: the effective working directory a spawn for {@code profileName} would use, without
-     * actually spawning.
-     */
-    private String effectiveCwd(String profileName, String requestedCwd, String callerCwd) {
-        return resolveCwd(requestedCwd, requireProfile(profileName), callerCwd);
-    }
-
-    /**
-     * CB-112 cwd resolution: spawn arg → profile config → the primary's cwd → the daemon's cwd.
-     * Never returns {@code null}/blank: {@code "."} (the daemon's own working directory) is the
-     * guaranteed last resort so a pathological environment with an unset {@code user.dir} still
-     * honours the "never assume {@code $HOME}" contract rather than letting herdr default the pane.
-     */
-    private static String resolveCwd(String requestedCwd, BridgedConfig.Worker cfg, String callerCwd) {
-        return firstNonBlank(requestedCwd, cfg.cwd(), callerCwd, System.getProperty("user.dir"), ".");
-    }
-
-    private static String firstNonBlank(String... values) {
-        for (String v : values) {
-            if (v != null && !v.isBlank()) return v;
-        }
-        return null;
-    }
-
-    /** Dedicated worker space → own tab (carrying cwd+env) → start the peer into the seed pane. */
-    private Agent spawnInTab(BridgedConfig.Worker cfg, Map<String, String> workerEnv,
-                             List<String> argv, String cwd) {
-        Workspace space = spaces.ensureWorkspace(cfg.workspace());
-        Tab.Created tab = spaces.createTab(space.workspaceId(), cwd, workerEnv);
-        log.info("spawning {} profile={} space={} tab={} cwd={}",
-                namePrefix, cfg.profile(), space.workspaceId(), tab.tab().tabId(), cwd);
-
-        Started started;
-        try {
-            if (tab.rootPaneId() == null) {
-                // Protocol 19 starts the agent INTO the seed pane — without one there is nowhere
-                // to start, and a partial tab would be left behind.
-                throw new IllegalStateException("tab " + tab.tab().tabId()
-                        + " had no seed pane in the create response — cannot start a peer in it");
-            }
-            started = startUniquelyNamed(cfg, argv, tab.rootPaneId());
-        } catch (RuntimeException e) {
-            // The peer never started — don't leave the tab we just created orphaned.
-            // Best-effort cleanup; never let it mask the real spawn failure.
-            try {
-                spaces.closeTab(tab.tab().tabId());
-            } catch (RuntimeException cleanup) {
-                log.warn("failed to close orphaned tab {} after spawn error: {}",
-                        tab.tab().tabId(), cleanup.getMessage());
-            }
-            throw e;
-        }
-
-        // The peer is LIVE now, in the seed pane itself (no shell pane to drop — protocol 19).
-        // Labelling is cosmetic: it must not fail the spawn or orphan the running peer — on error
-        // we log and still return it so the caller gets its paneId and can tear it down.
-        tidy("label tab " + tab.tab().tabId(),
-                () -> spaces.renameTab(tab.tab().tabId(), cfg.renderTabLabel(started.seq())));
-        log.info("{} started pane={} tab={} terminal={}",
-                namePrefix, started.agent().paneId(), started.agent().tabId(), started.agent().terminalId());
-        return started.agent();
-    }
-
-    /** Run a best-effort post-start cleanup step, logging (not throwing) on failure. */
-    private void tidy(String what, Runnable step) {
-        try {
-            step.run();
-        } catch (RuntimeException e) {
-            log.warn("post-start step failed ({}) — peer is running regardless: {}", what, e.getMessage());
-        }
-    }
-
-    /** Legacy placement: split the currently-focused tab; the peer still starts in {@code cwd}. */
-    private Agent spawnAsPane(BridgedConfig.Worker cfg, Map<String, String> workerEnv,
-                              List<String> argv, String cwd) {
-        log.info("spawning {} (pane placement) profile={} cwd={} argv={}",
-                namePrefix, cfg.profile(), cwd, argv);
-        String paneId = spaces.splitPane(cwd, workerEnv);
-        if (paneId == null) {
-            throw new IllegalStateException("pane.split returned no pane — cannot start a peer");
-        }
-        Agent peer = startUniquelyNamed(cfg, argv, paneId).agent();
-        log.info("{} started pane={} terminal={}", namePrefix, peer.paneId(), peer.terminalId());
-        return peer;
-    }
-
-    /** A started peer together with the sequence its unique name/label used. */
-    private record Started(Agent agent, long seq) {
-    }
-
-    /**
-     * Start the peer under a unique herdr agent name. herdr requires each running agent's
-     * {@code name} to be distinct (a 2nd identical {@code name} fails {@code agent_name_taken}) —
-     * the exact case that makes multiple peers useful. The name is
-     * {@code <prefix>-<profile>-<nonce>-<seq>}: {@code seq} distinguishes peers within this process,
-     * and the per-process {@code nonce} keeps a fresh process (whose {@code seq} restarts at 0) from
-     * colliding with same-profile peers that outlived a restart. The retry is a belt-and-braces
-     * backstop for the astronomically unlikely nonce+seq clash; the name is a label only — herdr
-     * detects kind and status from terminal output, not from it.
-     */
-    private Started startUniquelyNamed(BridgedConfig.Worker cfg, List<String> argv, String paneId) {
-        // Protocol 19 resolves the executable from the agent kind (== namePrefix here), so
-        // argv[0] — the configured executable — is dropped and only the extra args are passed.
-        List<String> args = argv.isEmpty() ? argv : argv.subList(1, argv.size());
-        HerdrException last = null;
-        for (int attempt = 0; attempt < NAME_RETRIES; attempt++) {
-            long seq = nameSeq.incrementAndGet();
-            String name = namePrefix + "-" + cfg.profile() + "-" + nameNonce + "-" + seq;
-            try {
-                return new Started(startAwaitingShellPrompt(name, args, paneId), seq);
-            } catch (HerdrException e) {
-                if (!"agent_name_taken".equals(e.code())) throw e;
-                log.debug("peer name '{}' taken, retrying", name);
-                last = e;
-            }
-        }
-        throw last;
-    }
-
-    /** Start the agent into {@code paneId}, waiting out the seed shell's boot with the sleeper. */
-    private Agent startAwaitingShellPrompt(String name, List<String> args, String paneId) {
-        HerdrException busy = null;
-        for (int attempt = 0; attempt < SHELL_READY_RETRIES; attempt++) {
-            try {
-                return agents.start(name, namePrefix, args, paneId);
-            } catch (HerdrException e) {
-                if (!"agent_pane_busy".equals(e.code())) throw e;
-                log.debug("pane {} not at its shell prompt yet, retrying agent.start", paneId);
-                busy = e;
-                sleeper.run();
-            }
-        }
-        throw busy;
-    }
-
-    // --- discovery + reap ----------------------------------------------------------------------
-
-    /** All herdr-tracked agents — discovery for "what peers exist". */
-    @Override
-    public List<Agent> list() {
-        return agents.list();
-    }
-
-    /**
-     * Reap peer panes left behind by an earlier daemon process (CB-117). herdr keeps a peer's pane
-     * alive across a daemon restart <em>by design</em>, and that pane's id is held only by its
-     * spawner — so a peer whose owning process exited before issuing the matching teardown leaks
-     * with nothing tracking it. On boot we scan herdr for agents whose name matches our
-     * {@code <prefix>-<profile>-<nonce>-<seq>} scheme with a nonce <em>other</em> than this
-     * process's {@link #nameNonce}, and tear each one down (its pane and, via {@link #stop}, its
-     * now-empty dedicated tab). A current-nonce peer is ours and live, so it is left running; a
-     * user's own session carries no such name and is never touched. A peer from a <em>different</em>
-     * adapter (different prefix) is likewise never touched. Best-effort: a failed listing, or a
-     * failure to stop any one peer, is logged and never aborts startup.
-     *
-     * @return the number of orphaned peers reaped
-     */
-    @Override
-    public int reapOrphanWorkers() {
-        List<Agent> all;
-        try {
-            all = agents.list();
-        } catch (RuntimeException e) {
-            log.warn("orphan-peer reap skipped — agent.list failed: {}", e.getMessage());
-            return 0;
-        }
-        int reaped = 0;
-        for (Agent a : all) {
-            if (!isForeignWorker(namePrefix, a.name(), nameNonce)) continue;
-            try {
-                stop(a.paneId());
-                reaped++;
-                log.info("reaped orphan {} {} (pane={} tab={}) left by a prior daemon",
-                        namePrefix, a.name(), a.paneId(), a.tabId());
-            } catch (RuntimeException e) {
-                log.warn("could not reap orphan {} {} (pane={}): {}",
-                        namePrefix, a.name(), a.paneId(), e.getMessage());
-            }
-        }
-        if (reaped > 0) {
-            log.info("orphan-peer reap complete — {} stale {} peer(s) removed at startup", reaped, namePrefix);
-        }
-        return reaped;
-    }
-
-    /** The {@code <prefix>-<profile>-<nonce>-<seq>} name pattern; group 1 captures the 6-hex nonce. */
-    static Pattern workerNamePattern(String prefix) {
-        return Pattern.compile(prefix + "-.*-([0-9a-f]{6})-\\d+");
-    }
-
-    /**
-     * Whether {@code name} is a peer of kind {@code prefix} started by a <em>different</em> process
-     * than {@code currentNonce} — the reap predicate (CB-117). True only for the prefix's naming
-     * scheme with a foreign nonce: a non-peer name, a different adapter's name, or our own live
-     * nonce is excluded. Pure and package-private so the decision is unit-testable without herdr.
-     */
-    static boolean isForeignWorker(String prefix, String name, String currentNonce) {
-        String nonce = workerNonce(prefix, name);
-        return nonce != null && !nonce.equals(currentNonce);
-    }
-
-    /** The 6-hex nonce embedded in a {@code prefix} peer name, or {@code null} if not one. */
-    static String workerNonce(String prefix, String name) {
-        if (name == null) return null;
-        Matcher m = workerNamePattern(prefix).matcher(name);
-        return m.matches() ? m.group(1) : null;
-    }
-
-    /** This process's peer-name nonce (a label component only; exposed for reaper tests). */
-    String nameNonce() {
-        return nameNonce;
-    }
-
-    // --- teardown ------------------------------------------------------------------------------
-
-    /**
-     * Tear a peer down: close the pane, and close its tab <em>only</em> when the peer is that tab's
-     * sole occupant. The single-pane check is what makes this safe regardless of how the peer was
-     * placed (or a placement-config change across a restart): a pane-placement peer sitting in one
-     * of the user's shared tabs has siblings, so its tab is never closed — we only ever remove a
-     * tab we created to hold one peer.
-     *
-     * <p>{@code idOrPane} is the {@link PeerHandle#id()} of a peer this launcher spawned (CB-519's
-     * host-unique opaque UUID), resolved through {@link #paneByAgentId} to the pane it must tear
-     * down. An argument that is not one of our ids is treated as a raw herdr pane id — the
-     * {@link #reapOrphanWorkers() orphan-reap} and spawn-gate-timeout paths, plus any caller that
-     * passes a pane directly, keep working without an owning id.
-     *
-     * <p>Resolves the tab from the pane <em>before</em> closing it. An already-gone pane/tab
-     * (repeated DELETE, crashed peer) is treated as success; any other failure propagates so a
-     * genuinely failed teardown is not reported as done.
-     */
-    @Override
-    public void stop(String idOrPane) {
-        // Teardown knows only the pane, not which profile spawned it. Attempt tab cleanup when any
-        // profile uses tab placement (so the bridge may have created a dedicated peer tab); the
-        // single-occupant check below is what actually protects the user's shared tabs.
-        String paneId = paneByAgentId.remove(idOrPane);
-        if (paneId == null) {
-            paneId = idOrPane; // raw-pane fallback (reap, gate timeout, pane-addressed callers)
-        }
-        WorkspaceControl.PaneLocation loc = usesTabPlacement() ? spaces.locatePane(paneId) : null;
-        try {
-            agents.close(paneId);
-        } catch (HerdrException e) {
-            if (!isAlreadyGone(e)) throw e;
-            log.debug("pane.close({}) ignored — already gone: {}", paneId, e.getMessage());
-        }
-        if (loc != null && loc.tabPaneCount() == 1) {
-            spaces.closeTab(loc.tabId());
-        } else if (loc != null) {
-            log.debug("not closing tab {} — it holds {} panes (not a dedicated peer tab)",
-                    loc.tabId(), loc.tabPaneCount());
-        }
-    }
-
-    /** Whether any configured profile places peers in their own tab (so tabs may need cleanup). */
-    private boolean usesTabPlacement() {
-        return profiles.values().stream().anyMatch(BridgedConfig.Worker::tabPlacement);
-    }
-
-    /** True when a herdr error means the target is already gone (safe to treat as done). */
-    private static boolean isAlreadyGone(HerdrException e) {
-        return e.code() != null && e.code().endsWith("_not_found");
-    }
-
-    // --- spawn-readiness gate (CB-306) ---------------------------------------------------------
-
-    /**
-     * Poll {@link AgentControl#status} until the pane reports an injectable state or the configured
-     * timeout elapses. On timeout, close the pane (self-reap) and throw.
-     */
-    private void waitUntilInjectableOrThrow(String paneId) {
-        long deadline = nowMillis.getAsLong() + spawnReadyTimeoutMs;
-        while (nowMillis.getAsLong() < deadline) {
-            if (agents.status(paneId).injectable()) {
-                log.debug("peer pane={} reached injectable state", paneId);
-                return;
-            }
-            sleeper.run();
-        }
-        log.warn("peer pane={} did not become injectable within {}ms — closing", paneId, spawnReadyTimeoutMs);
-        stop(paneId);
-        throw new PeerUnreachableException(
-                "worker pane " + paneId + " did not reach injectable state within "
-                        + spawnReadyTimeoutMs + "ms");
-    }
-
-    /**
-     * A concrete {@link PeerHandle} wrapping herdr agent coordinates, the profile that spawned it,
-     * and the session identity the launch resolved (CB-547a): the bridge's logical name and the
-     * peer's own session id, both null when the spawn carried no identity.
-     */
-    private record WorkerHandle(String id, String terminalId, String profile,
-                                String sessionName, String agentSessionId) implements PeerHandle {
-    }
-
-    // --- shared helpers ------------------------------------------------------------------------
-
-    /** Put {@code k → v} only when {@code v} is present (non-null, non-blank). */
-    protected static void putIfPresent(Map<String, String> m, String k, String v) {
-        if (v != null && !v.isBlank()) {
-            m.put(k, v);
-        }
-    }
-
-    /** Host env lookup that tolerates an unconfigured (null/blank) var name — returns null then. */
-    protected String resolveEnv(String name) {
-        return (name == null || name.isBlank()) ? null : env.apply(name);
-    }
-
-    /**
-     * The parity-neutral git-forge token grant (CB-302): when {@code cfg} opts in via
-     * {@code gitTokenEnv} and the token resolves, inject {@code GITEA_TOKEN} plus its paired
-     * {@code GITEA_HOST}. Push over SSH is unaffected; the only incremental grant is PR-create.
-     * Peer-neutral, so every herdr adapter reuses it unchanged.
-     */
-    protected void applyGitToken(Map<String, String> workerEnv, BridgedConfig.Worker cfg) {
-        if (!cfg.hasGitToken()) {
-            return;
-        }
-        String gitToken = resolveEnv(cfg.gitTokenEnv());
-        if (gitToken != null) {
-            workerEnv.put("GITEA_TOKEN", gitToken);
-            putIfPresent(workerEnv, "GITEA_HOST", resolveEnv(cfg.gitHostEnv()));
-        }
-    }
-
-    /** A fresh mutable env map — the conventional starting point for {@link #buildLaunch}. */
-    /**
-     * Seed a worker's environment (CB-511): the daemon's own {@code PATH}, then the profile's
-     * {@code env:} entries.
-     *
-     * <p>Why this exists: bridged passes herdr an explicit env map, and herdr merges it into
-     * <em>its own</em> process environment. So before this, a worker inherited whatever PATH the
-     * herdr server happened to be started with — on this host, one from weeks earlier with no JDK
-     * and no Maven, which left workers unable to run the build they were being asked to run. The
-     * worker's toolchain must follow from configuration, not from how a long-lived daemon was
-     * launched.
-     *
-     * <p>Adapter-specific variables are layered on top of this by {@code buildLaunch} and therefore
-     * win. That ordering is deliberate and load-bearing: it stops a profile's {@code env:} from
-     * overriding {@code ANTHROPIC_BASE_URL} and slipping past {@link
-     * dev.ltms.bridged.guard.SubscriptionGuard}, which is checked against the profile's
-     * {@code baseUrl} and nothing else.
-     */
-    protected Map<String, String> baseEnv(BridgedConfig.Worker cfg) {
-        Map<String, String> workerEnv = new LinkedHashMap<>();
-        String path = env.apply("PATH");
-        if (path != null && !path.isBlank()) {
-            workerEnv.put("PATH", path);
-        }
-        if (cfg != null && cfg.env() != null) {
-            workerEnv.putAll(cfg.env());
-        }
-        return workerEnv;
-    }
-
-    /** Defensive copy of {@code argv} plus room to append launch flags. */
-    protected static List<String> mutableArgv(List<String> argv) {
-        return new ArrayList<>(argv);
-    }
-
-    /**
-     * Uninterruptible sleep — the production {@link #sleeper}. Tests supply their own no-op /
-     * fast-faking sleeper so they never real-sleep.
-     */
-    protected static void sleepUninterruptibly(long ms) {
-        try {
-            Thread.sleep(ms);
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            // preserve the interrupt flag but continue — poll loops should not be aborted by an
-            // interrupt that was not meant for them.
-        }
-    }
-}

bridged/src/main/java/dev/ltms/bridged/worker/OpenCodeLauncher.java

@@ -1,331 +0,0 @@
-package dev.ltms.bridged.worker;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-
-import java.io.IOException;
-import java.io.UncheckedIOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.EnumSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Function;
-import java.util.function.LongSupplier;
-
-/**
- * The {@link HerdrPeerLauncher} adapter for <strong>opencode</strong> — an open-source,
- * provider-agnostic terminal coding agent. Its whole reason for existing is to prove the
- * {@code PeerLauncher} SPI is genuinely provider-neutral: opencode shares none of Claude Code's
- * private launch seams, yet reuses every line of shared transport in the base (tab/pane placement,
- * the CB-306 readiness gate, unique naming + CB-117 reap, teardown, listing, cwd).
- *
- * <p>The divergences from {@link ClaudeCodeLauncher}, all confined to {@link #buildLaunch}:
- * <ul>
- *   <li><strong>No subscription boundary.</strong> opencode carries no {@code ANTHROPIC_BASE_URL}
- *       and there is no {@link dev.ltms.bridged.guard.SubscriptionGuard} — the guard is a
- *       Claude-private concern, not part of the SPI. opencode reads the operator's own provider
- *       credentials from its global {@code auth.json}; the bridge injects none.</li>
- *   <li><strong>File-based MCP mount + instructions.</strong> opencode has no inline
- *       {@code --mcp-config}/{@code --append-system-prompt}. Instead the bridge writes an ephemeral
- *       {@code opencode.json} that declares the bridge as a {@code remote} MCP server and lists a
- *       reply-charter file under {@code instructions}, then points the worker at it with
- *       {@code OPENCODE_CONFIG}. This is the one place the launcher touches disk — Claude never did.</li>
- *   <li><strong>Model as a flag.</strong> the {@code provider/model} selector is passed as
- *       {@code -m}, not an env var.</li>
- *   <li><strong>{@code opencode} name prefix</strong> so reap matches {@code opencode-*} panes and
- *       never another adapter's.</li>
- * </ul>
- */
-public final class OpenCodeLauncher extends HerdrPeerLauncher {
-
-    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
-    private static final String NAME_PREFIX = "opencode";
-
-    /** Writer for the generated {@code opencode.json}. */
-    private static final ObjectMapper JSON = new ObjectMapper();
-
-    /**
-     * Standing instruction written to the charter file and mounted via the config's
-     * {@code instructions} so the worker returns its result through {@code bridge_reply}. Kept on
-     * disk (not a launch flag) because opencode's {@code instructions} takes file paths, not inline
-     * text — the file is regenerated per spawn and never touches the worker's own profile.
-     */
-    static final String REPLY_CHARTER =
-            "You are an off-subscription worker in the claude-bridge fleet, running under opencode. "
-            + "Every message you receive arrives through the bridge, and the ONLY channel back to the "
-            + "sender is the bridge_reply MCP tool. Text you write in your terminal is NOT sent "
-            + "anywhere — the sender cannot see your screen, so an in-terminal answer is silently "
-            + "discarded. Therefore you MUST end EVERY turn by calling bridge_reply with `content` set "
-            + "to your complete response. This holds for every message without exception — tasks, "
-            + "questions, clarifications, acknowledgements, and ordinary back-and-forth conversation. "
-            + "Call bridge_reply exactly once, as the final action of your turn, with your full answer "
-            + "in `content`; never wait for confirmation first. If you end a turn without calling "
-            + "bridge_reply, the sender receives nothing and the exchange stalls.";
-
-    /** Root under which per-spawn opencode config dirs are created (injectable for tests). */
-    private final Path configRoot;
-
-    /**
-     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so it
-     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
-     */
-    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
-                            Function<String, String> env) {
-        this(agents, spaces, profiles, defaultProfile, env, 0,
-                System::currentTimeMillis, () -> sleepUninterruptibly(300),
-                defaultConfigRoot());
-    }
-
-    /**
-     * Production constructor with the spawn-ready gate enabled. Polls {@code agents.status()} until
-     * the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
-     */
-    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
-                            Function<String, String> env,
-                            long spawnReadyTimeoutMs, long spawnReadyPollMs) {
-        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
-                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                defaultConfigRoot());
-    }
-
-    /**
-     * Full testability constructor. Every injectable collaborator is explicit so unit tests supply a
-     * fake clock ({@code nowMillis}), poll-loop wait ({@code sleeper}), and a temp {@code configRoot}
-     * they can inspect the generated {@code opencode.json}/charter under.
-     *
-     * @param agents              herdr agent control (start, status, close)
-     * @param spaces              workspace / tab control (ensure, create, close)
-     * @param profiles            configured worker profiles
-     * @param defaultProfile      profile a no-argument spawn uses (nullable)
-     * @param env                 host env lookup (injectable for tests)
-     * @param spawnReadyTimeoutMs max ms to wait for injectable state (0 disables the gate)
-     * @param nowMillis           monotonic clock source (e.g. {@code System::currentTimeMillis})
-     * @param sleeper             sleep/wait hook (encodes the poll interval; never called when the
-     *                            gate is disabled)
-     * @param configRoot          existing directory under which per-spawn config dirs are created
-     */
-    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
-                            Function<String, String> env,
-                            long spawnReadyTimeoutMs,
-                            LongSupplier nowMillis, Runnable sleeper, Path configRoot) {
-        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper);
-        this.configRoot = configRoot;
-    }
-
-    private static Path defaultConfigRoot() {
-        return Path.of(System.getProperty("java.io.tmpdir"));
-    }
-
-    /**
-     * {@inheritDoc}
-     *
-     * <p>Builds the opencode launch: no {@code ANTHROPIC_*} and no guard (opencode reads its own
-     * provider credentials); when the profile mounts the bridge MCP, generate an ephemeral
-     * {@code opencode.json} (remote MCP server + reply-charter instructions) and point the worker at
-     * it via {@code OPENCODE_CONFIG}; carry the parity-neutral git-forge grant; and select the model
-     * with {@code -m}.
-     */
-    @Override
-    protected Launch buildLaunch(BridgedConfig.Worker cfg) {
-        Map<String, String> workerEnv = baseEnv(cfg);
-        // A config file is needed for the bridge MCP mount, for a pinned endpoint (CB-508), or both.
-        if (cfg.hasMcp() || hasCustomProvider(cfg)) {
-            workerEnv.put("OPENCODE_CONFIG", writeConfig(cfg).toString());
-        }
-        applyGitToken(workerEnv, cfg);
-        return new Launch(workerEnv, argvWithModel(argvWithAuto(cfg), cfg));
-    }
-
-    /**
-     * True when this profile pins its own OpenAI-compatible endpoint (CB-508) rather than using
-     * whatever provider opencode resolves by default.
-     *
-     * <p>Note this reuses {@code baseUrl}, the same field the Claude adapter injects as
-     * {@code ANTHROPIC_BASE_URL} — but it does <em>not</em> go through {@code SubscriptionGuard}.
-     * That asymmetry is deliberate and safe: the guard exists to stop a worker borrowing the
-     * primary's Anthropic subscription, and an opencode process has no Anthropic credential path
-     * at all. Pointing it at a local vLLM cannot leak the subscription.
-     */
-    private static boolean hasCustomProvider(BridgedConfig.Worker cfg) {
-        return cfg.baseUrl() != null && !cfg.baseUrl().isBlank();
-    }
-
-    /**
-     * The launch argv plus the unconditional {@code --auto} flag, which auto-approves the
-     * permissions opencode does not explicitly deny. It is unconditional, not a preference: a
-     * spawned peer has no human at its pane — the bridge spawned it — so one that stops at an
-     * approval prompt is a wedged agent, indistinguishable from a legitimate mid-turn wait and
-     * unable to end its turn with {@code bridge_reply}. opencode's own help calls this
-     * "dangerous!", but the blast radius here is already bounded by design: a worker runs in its
-     * own git worktree on its own branch, is off-subscription, and cannot merge — the lead is the
-     * gate.
-     */
-    private List<String> argvWithAuto(BridgedConfig.Worker cfg) {
-        List<String> argv = mutableArgv(cfg.argv());
-        argv.add("--auto");
-        return argv;
-    }
-
-    /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
-    private List<String> argvWithModel(List<String> argv, BridgedConfig.Worker cfg) {
-        if (cfg.model() != null && !cfg.model().isBlank()) {
-            argv.add("-m");
-            argv.add(cfg.model());
-        }
-        return argv;
-    }
-
-    /**
-     * Write an ephemeral {@code opencode.json} (and the reply-charter file it references) into a
-     * fresh per-spawn directory under {@link #configRoot}, and return the config file's path for
-     * {@code OPENCODE_CONFIG}. The dir is unique per spawn so concurrent workers never race on it;
-     * it is best-effort cleaned on JVM exit (worker config is disposable — regenerated every spawn).
-     */
-    private Path writeConfig(BridgedConfig.Worker cfg) {
-        try {
-            Path dir = Files.createTempDirectory(configRoot, "bridged-opencode-");
-            dir.toFile().deleteOnExit();
-
-            ObjectNode root = JSON.createObjectNode();
-            root.put("$schema", "https://opencode.ai/config.json");
-
-            if (cfg.hasMcp()) {
-                Path charter = dir.resolve("reply-charter.md");
-                Files.writeString(charter, REPLY_CHARTER);
-                charter.toFile().deleteOnExit();
-
-                ObjectNode bridge = root.putObject("mcp").putObject("bridge");
-                bridge.put("type", "remote");
-                bridge.put("url", cfg.mcpUrl());
-                bridge.put("enabled", true);
-                root.putArray("instructions").add(charter.toAbsolutePath().toString());
-            }
-            if (hasCustomProvider(cfg)) {
-                addCustomProvider(root, cfg);
-            }
-
-            Path cfgFile = dir.resolve("opencode.json");
-            // Built with Jackson rather than string concatenation: the provider block is nested and
-            // carries operator-supplied values (URL, model id, api key), so escaping must be real.
-            Files.writeString(cfgFile, JSON.writerWithDefaultPrettyPrinter().writeValueAsString(root));
-            cfgFile.toFile().deleteOnExit();
-            return cfgFile;
-        } catch (IOException e) {
-            throw new UncheckedIOException(
-                    "cannot write opencode config for profile " + cfg.profile(), e);
-        }
-    }
-
-    /**
-     * Declare a custom OpenAI-compatible provider so the worker talks to a pinned endpoint (a local
-     * vLLM, say) instead of opencode's default gateway (CB-508).
-     *
-     * <p>The provider id comes from the {@code provider/model} selector in {@code model:}, so one
-     * field drives both the declaration and the {@code -m} flag and they cannot drift apart.
-     */
-    private void addCustomProvider(ObjectNode root, BridgedConfig.Worker cfg) {
-        String[] parts = splitModelSelector(cfg);
-        String providerId = parts[0];
-        String modelId = parts[1];
-
-        ObjectNode provider = root.putObject("provider").putObject(providerId);
-        provider.put("npm", "@ai-sdk/openai-compatible");
-        provider.put("name", providerId + " (bridged)");
-
-        ObjectNode options = provider.putObject("options");
-        options.put("baseURL", openAiBaseUrl(cfg.baseUrl()));
-        // vLLM and friends usually ignore the key, but the AI SDK still requires a non-empty one.
-        String token = resolveEnv(cfg.tokenEnv());
-        options.put("apiKey", (token == null || token.isBlank()) ? "bridged-local-noauth" : token);
-
-        provider.putObject("models").putObject(modelId).put("name", modelId);
-    }
-
-    /**
-     * Split {@code model:} into its {@code provider} and {@code model} halves. A pinned endpoint
-     * needs both, so a bare model name is rejected loudly rather than silently falling back to the
-     * default gateway — a worker quietly talking to the wrong endpoint is the failure this avoids.
-     */
-    private static String[] splitModelSelector(BridgedConfig.Worker cfg) {
-        String model = cfg.model();
-        int slash = model == null ? -1 : model.indexOf('/');
-        if (model == null || model.isBlank() || slash <= 0 || slash == model.length() - 1) {
-            throw new IllegalArgumentException(
-                    "profile " + cfg.profile() + " sets baseUrl (a pinned opencode endpoint) so"
-                            + " model: must be \"<provider>/<model>\", e.g."
-                            + " \"local-vllm/deepseek-v4-flash\"; got "
-                            + (model == null ? "null" : '"' + model + '"'));
-        }
-        return new String[]{model.substring(0, slash), model.substring(slash + 1)};
-    }
-
-    /**
-     * The OpenAI-compatible base URL for {@code baseUrl}. A bare {@code host:port} gets {@code /v1}
-     * appended (where these servers put the API); a URL that already carries a path is taken as-is,
-     * so an endpoint mounted somewhere unusual is still reachable.
-     */
-    private static String openAiBaseUrl(String baseUrl) {
-        String trimmed = baseUrl.trim();
-        while (trimmed.endsWith("/")) {
-            trimmed = trimmed.substring(0, trimmed.length() - 1);
-        }
-        int schemeEnd = trimmed.indexOf("://");
-        String afterScheme = schemeEnd < 0 ? trimmed : trimmed.substring(schemeEnd + 3);
-        return afterScheme.contains("/") ? trimmed : trimmed + "/v1";
-    }
-
-    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
-
-    /** Spawn a worker for the default profile in the resolved default cwd. */
-    public Agent spawn() {
-        return spawnInternal(null, null, null);
-    }
-
-    /** Spawn a worker for a named profile (null → default) in the resolved default cwd. */
-    public Agent spawn(String profileName) {
-        return spawnInternal(profileName, null, null);
-    }
-
-    /** Spawn a worker for a named profile with an explicit requested/caller cwd (CB-112). */
-    public Agent spawn(String profileName, String requestedCwd, String callerCwd) {
-        return spawnInternal(profileName, requestedCwd, callerCwd);
-    }
-
-    // --- capabilities --------------------------------------------------------------------------
-
-    @Override
-    public Set<Capability> capabilities() {
-        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE, Capability.ORPHAN_REAP);
-        if (hasGitTokenProfile()) {
-            caps.add(Capability.SELF_PR);
-        }
-        return Set.copyOf(caps);
-    }
-
-    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
-    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Worker::hasGitToken);
-    }
-
-    // --- CB-117 reap predicate (opencode prefix), kept for direct unit testing -----------------
-
-    /**
-     * Whether {@code name} is an opencode bridge worker started by a <em>different</em> process than
-     * {@code currentNonce}. A thin {@code opencode}-prefix binding of
-     * {@link HerdrPeerLauncher#isForeignWorker(String, String, String)}.
-     */
-    static boolean isForeignWorker(String name, String currentNonce) {
-        return HerdrPeerLauncher.isForeignWorker(NAME_PREFIX, name, currentNonce);
-    }
-}

bridged/src/test/java/dev/ltms/bridged/auth/ArchitectRegistryTest.java

@@ -1,67 +0,0 @@
-package dev.ltms.bridged.auth;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import org.junit.jupiter.api.Test;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-548 — the architect-slot registry: the config snapshot of slot → profile, and the live
- * terminal → slot binding the resolver reads. The role the binding produces is asserted in
- * {@link CallerResolverTest}; this pins the registry object itself.
- */
-class ArchitectRegistryTest {
-
-    private static final Map<String, BridgedConfig.Architect> SLOTS = Map.of(
-            "lead-designer", new BridgedConfig.Architect("term_design", "sonnet"),
-            "reviewer", new BridgedConfig.Architect(null, "gx10"));
-
-    private final ArchitectRegistry registry =
-            new ArchitectRegistry(SLOTS, () -> Map.of("term_design", "lead-designer"));
-
-    @Test
-    void exposesTheConfiguredSlots() {
-        assertEquals(SLOTS.keySet(), registry.slots().keySet());
-        assertTrue(registry.isSlot("reviewer"));
-        assertFalse(registry.isSlot("nope"));
-    }
-
-    @Test
-    void theSpawnLifecycleReadsTheProfileBackFromASlot() {
-        assertEquals("sonnet", registry.profileForSlot("lead-designer"));
-        assertEquals("gx10", registry.profileForSlot("reviewer"));
-        assertNull(registry.profileForSlot("unknown"), "an unknown slot has no profile");
-    }
-
-    @Test
-    void resolvesTheSlotOfALiveTerminal() {
-        assertEquals("lead-designer", registry.slotForTerminal("term_design"));
-        assertNull(registry.slotForTerminal("term_unbound"));
-        assertNull(registry.slotForTerminal(null), "no terminal ⇒ no slot");
-    }
-
-    @Test
-    void theBindingIsLiveReReadPerCall() {
-        Map<String, String> live = new HashMap<>();
-        ArchitectRegistry r = new ArchitectRegistry(SLOTS, () -> live);
-
-        assertNull(r.slotForTerminal("term_design"));
-
-        live.put("term_design", "lead-designer"); // injected after construction
-
-        assertEquals("lead-designer", r.slotForTerminal("term_design"));
-    }
-
-    @Test
-    void theSlotSnapshotIsFixedByConstruction() {
-        Map<String, BridgedConfig.Architect> mutable = new HashMap<>(SLOTS);
-        ArchitectRegistry r = new ArchitectRegistry(mutable, Map::of);
-
-        mutable.put("hijack", new BridgedConfig.Architect("t", "gx10"));
-
-        assertFalse(r.isSlot("hijack"), "a handed-over map is not offered as live state");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/config/BridgedConfigTest.java

@@ -1,899 +0,0 @@
-package dev.ltms.bridged.config;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-class BridgedConfigTest {
-
-    @Test
-    void loadsFullConfig(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, """
-                bind:
-                  host: 127.0.0.1
-                  port: 8080
-                herdrSocket: ~/.config/herdr/herdr.sock
-                worker:
-                  profile: ltms-local
-                  baseUrl: http://gx00.gw:8000
-                  model: coder
-                guard:
-                  offSubscriptionHosts:
-                    - gx00.gw
-                    - ollama.ltms.dev
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(8080, cfg.bind().port());
-        assertEquals("ltms-local", cfg.worker().profile());
-        assertTrue(cfg.guard().hostSet().contains("gx00.gw"));
-        assertTrue(cfg.guard().hostSet().contains("ollama.ltms.dev"));
-    }
-
-    @Test
-    void appliesDefaultsForMissingSections(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("minimal.yaml");
-        Files.writeString(f, "bind:\n  host: 0.0.0.0\n  port: 9000\n");
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(9000, cfg.bind().port());
-        assertNotNull(cfg.guard(), "guard must default to empty, never null");
-        assertTrue(cfg.guard().offSubscriptionHosts().isEmpty());
-        assertFalse(cfg.lifecycle().clearAfterTurn(), "context clearing is opt-in");
-    }
-
-    @Test
-    void singleWorkerBecomesAOneEntryProfileMapWithItselfAsDefault(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("single.yaml");
-        Files.writeString(f, """
-                worker:
-                  profile: ltms-local
-                  baseUrl: http://gx00.gw:8000
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(Set.of("ltms-local"), cfg.workerProfiles().keySet(), "legacy worker → one profile");
-        assertEquals("ltms-local", cfg.defaultProfile());
-    }
-
-    @Test
-    void loadsMultipleWorkerProfilesWithADefault(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("multi.yaml");
-        Files.writeString(f, """
-                workers:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                    argv: ["ccs", "gx10"]
-                  ollama:
-                    baseUrl: http://ollama.ltms.dev
-                    argv: ["ccs", "ollama"]
-                defaultWorker: gx10
-                guard:
-                  offSubscriptionHosts: [gx10.gw, ollama.ltms.dev]
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(Set.of("gx10", "ollama"), cfg.workerProfiles().keySet());
-        // Order, not just membership: placement breaks an exact-weight tie on definition order, so a
-        // hash-ordered map here would make equal-weight placement differ from one restart to the next.
-        assertEquals(java.util.List.of("gx10", "ollama"),
-                java.util.List.copyOf(cfg.workerProfiles().keySet()),
-                "workerProfiles must preserve YAML definition order");
-        assertEquals("gx10", cfg.defaultProfile());
-        assertEquals("ollama", cfg.workerProfiles().get("ollama").profile(), "profile defaults to its map key");
-        assertEquals("http://gx10.gw:8000", cfg.workerProfiles().get("gx10").baseUrl());
-    }
-
-    @Test
-    void ignoresUnknownKeys(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("future.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\nfutureFeature:\n  enabled: true\n");
-        assertDoesNotThrow(() -> BridgedConfig.load(f));
-    }
-
-    /**
-     * CB-530. Unknown keys stay ignored — config must be allowed to run ahead of the code — but they
-     * must be NAMED at load. A whole block that parses, is dropped, and is never mentioned again is
-     * indistinguishable from one that works: that is exactly how a hand-written `leaders:` registry
-     * came to look configured while being inert.
-     */
-    @Test
-    void unknownTopLevelKeysAreNamedSoADroppedBlockCannotLookLikeAWorkingOne() {
-        assertEquals(List.of("futureFeature", "leedars"),
-                BridgedConfig.unknownTopLevelKeys(
-                        "bind:\n  port: 8080\nleedars:\n  a: b\nfutureFeature: true\n"),
-                "a typo'd key is the common case and must be reported by name");
-    }
-
-    @Test
-    void everyKeyThisBuildUnderstandsIsAbsentFromTheUnknownList() {
-        assertTrue(BridgedConfig.unknownTopLevelKeys("""
-                bind:
-                  port: 8080
-                herdrSocket: /tmp/s
-                workers: {}
-                defaultWorker: a
-                guard: {}
-                worktreeRoot: /tmp
-                lifecycle: {}
-                spawnReadyTimeoutMs: 1
-                spawnReadyPollMs: 1
-                broker: {}
-                primary: {}
-                leaders: {}
-                architects: {}
-                leadScan: {}
-                placement: fixed
-                auth: {}
-                """).isEmpty(), "the known-key set must not drift from the record components");
-    }
-
-    @Test
-    void aMalformedOrEmptyDocumentIsNotReportedAsUnknownKeys() {
-        assertTrue(BridgedConfig.unknownTopLevelKeys("").isEmpty());
-        assertTrue(BridgedConfig.unknownTopLevelKeys("just a scalar").isEmpty());
-    }
-
-    // ── CB-531: lead discovery by tab label ─────────────────────────────────────────────────────
-
-    @Test
-    void leadScanIsOffUnlessTheBlockIsPresent(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-scan.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\n");
-
-        assertNull(BridgedConfig.load(f).leadScan(),
-                "turning this on widens who resolves as PRIMARY — upgrading the daemon must not do that");
-    }
-
-    @Test
-    void leadScanDefaultsItsFieldsWhenTheBlockIsPresentButBare(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bare-scan.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\nleadScan: {}\n");
-
-        BridgedConfig.LeadScan scan = BridgedConfig.load(f).leadScan();
-        assertEquals("lead:", scan.tabPrefix());
-        assertEquals(10, scan.intervalSeconds());
-    }
-
-    @Test
-    void leadScanReadsAnExplicitPrefixAndInterval(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("scan.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                leadScan:
-                  tabPrefix: "drive:"
-                  intervalSeconds: 30
-                """);
-
-        BridgedConfig.LeadScan scan = BridgedConfig.load(f).leadScan();
-        assertEquals("drive:", scan.tabPrefix());
-        assertEquals(30, scan.intervalSeconds());
-    }
-
-    /**
-     * The hazard the guard exists for: bridged writes worker tab labels and reads lead tab labels.
-     * Overlap the two and every worker it spawns is read back as a lead.
-     */
-    @Test
-    void aLeadPrefixThatAWorkerTabLabelAlsoMatchesRefusesToStart(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("collide.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  gx10:
-                    tabLabel: "lead: {profile} #{n}"
-                leadScan:
-                  tabPrefix: "lead:"
-                """);
-        BridgedConfig cfg = BridgedConfig.load(f);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateLeadScan);
-        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
-    }
-
-    @Test
-    void theDefaultWorkerTabLabelDoesNotCollideWithTheDefaultLeadPrefix(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("ok.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  gx10:
-                    baseUrl: http://gx00.gw:8000
-                leadScan: {}
-                """);
-
-        assertDoesNotThrow(() -> BridgedConfig.load(f).validateLeadScan());
-    }
-
-    @Test
-    void theCollisionGuardIsANoOpWhenScanningIsOff(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("off.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  gx10:
-                    tabLabel: "lead: {profile}"
-                """);
-
-        assertDoesNotThrow(() -> BridgedConfig.load(f).validateLeadScan(),
-                "a label that collides with a convention nobody reads is not a problem");
-    }
-
-    // ── CB-530: the leaders registry ────────────────────────────────────────────────────────────
-
-    @Test
-    void leadersBlockRegistersEveryPaneByName(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("leaders.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                leaders:
-                  opus-5.0:
-                    terminal: term_opus
-                    kind: claude
-                  gpt-sol-5.6:
-                    terminal: term_sol
-                    kind: opencode
-                    model: openai/gpt-5.6-terra
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-
-        assertEquals(Set.of("opus-5.0", "gpt-sol-5.6"), cfg.leaders().keySet());
-        assertEquals("opencode", cfg.leaders().get("gpt-sol-5.6").kind());
-        assertEquals("openai/gpt-5.6-terra", cfg.leaders().get("gpt-sol-5.6").model());
-        // The whole point: BOTH panes resolve as leads, so neither is demoted to worker.
-        assertEquals(Map.of("term_opus", "opus-5.0", "term_sol", "gpt-sol-5.6"),
-                cfg.leaderTerminals());
-    }
-
-    @Test
-    void aLegacyPrimaryPinAloneStillRegistersAsALeadNamedPrimary(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("legacy-pin.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\nprimary:\n  terminal: term_fixed\n");
-
-        assertEquals(Map.of("term_fixed", "primary"), BridgedConfig.load(f).leaderTerminals(),
-                "configs that never migrate must behave exactly as they did before CB-530");
-    }
-
-    @Test
-    void anExplicitLeadersEntryWinsOverThePinForTheSameTerminal(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("both.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                primary:
-                  terminal: term_shared
-                leaders:
-                  opus-5.0:
-                    terminal: term_shared
-                """);
-
-        assertEquals(Map.of("term_shared", "opus-5.0"), BridgedConfig.load(f).leaderTerminals(),
-                "the pin is the older spelling of the same fact; the named entry is what was meant");
-    }
-
-    @Test
-    void bothBlocksTogetherRegisterTheUnionOfTheirTerminals(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("union.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                primary:
-                  terminal: term_pinned
-                leaders:
-                  gpt-sol-5.6:
-                    terminal: term_sol
-                """);
-
-        assertEquals(Map.of("term_pinned", "primary", "term_sol", "gpt-sol-5.6"),
-                BridgedConfig.load(f).leaderTerminals());
-    }
-
-    @Test
-    void neitherBlockLeavesNothingRegistered(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("none.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\n");
-
-        assertTrue(BridgedConfig.load(f).leaderTerminals().isEmpty());
-    }
-
-    /** A lead entry with no terminal identifies nothing — it must not register a null key. */
-    @Test
-    void aLeadWithoutATerminalIsNotRegistered(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-terminal.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                leaders:
-                  sketch:
-                    kind: opencode
-                  real:
-                    terminal: term_real
-                """);
-
-        assertEquals(Map.of("term_real", "real"), BridgedConfig.load(f).leaderTerminals());
-    }
-
-    // ── CB-548: the architects registry ────────────────────────────────────────────────────────
-
-    @Test
-    void architectsBlockBindsSlotsByGatewayLocalName(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("architects.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                architects:
-                  lead-designer:
-                    terminal: term_design
-                    profile: sonnet
-                  reviewer:
-                    profile: sonnet
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(Set.of("lead-designer", "reviewer"), cfg.architects().keySet(),
-                "slot names are the keys — gateway-local unique by construction");
-        assertEquals("sonnet", cfg.architects().get("lead-designer").profile(),
-                "each slot carries its strong-model profile reference");
-        assertEquals("term_design", cfg.architects().get("lead-designer").terminal());
-        // A slot with no terminal binds nothing yet — the live binding may supply it later.
-        assertTrue(cfg.architects().get("reviewer").terminal() == null
-                || cfg.architects().get("reviewer").terminal().isBlank());
-    }
-
-    @Test
-    void architectTerminalsMapsEachBoundSlotByItsPane(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("arch-terminals.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                architects:
-                  lead-designer:
-                    terminal: term_design
-                    profile: sonnet
-                  reviewer:
-                    terminal: term_review
-                    profile: sonnet
-                  unbound:
-                    profile: sonnet
-                """);
-
-        assertEquals(Map.of("term_design", "lead-designer", "term_review", "reviewer"),
-                BridgedConfig.load(f).architectTerminals(),
-                "a slot with no terminal registers no binding; the value is the slot name");
-    }
-
-    @Test
-    void noArchitectsBlockLeavesNothingBound(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-arch.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\n");
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertNull(cfg.architects());
-        assertTrue(cfg.architectTerminals().isEmpty(),
-                "no architects: block ⇒ no architect identity, exactly as before CB-548");
-    }
-
-    @Test
-    void anArchitectSlotMayResolveToTheSoleProfileWithoutPrivileging(@TempDir Path dir) throws Exception {
-        // Even a single unqualified worker profile can back an architect slot — the reference is
-        // by name, not by position, so an explicit name is required.
-        Path f = dir.resolve("arch-single.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                worker:
-                  profile: ltms-local
-                  baseUrl: http://gx10.gw:8000
-                architects:
-                  lead-designer:
-                    terminal: term_design
-                    profile: ltms-local
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertDoesNotThrow(cfg::validateArchitects);
-        assertEquals("ltms-local", cfg.architects().get("lead-designer").profile());
-    }
-
-    @Test
-    void anArchitectProfileThatIsNotConfiguredRefusesToStart(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("arch-bad-profile.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                architects:
-                  lead-designer:
-                    terminal: term_design
-                    profile: sonnet
-                """);
-        BridgedConfig cfg = BridgedConfig.load(f);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateArchitects);
-        assertTrue(e.getMessage().contains("lead-designer"), "the refusal names the slot");
-        assertTrue(e.getMessage().contains("sonnet"), "the refusal names the offending profile");
-    }
-
-    @Test
-    void anArchitectSlotMissingAProfileRefusesToStart(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("arch-no-profile.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                architects:
-                  lead-designer:
-                    terminal: term_design
-                    profile: ""
-                """);
-        BridgedConfig cfg = BridgedConfig.load(f);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateArchitects);
-        assertTrue(e.getMessage().contains("lead-designer"), "the refusal names the slot");
-    }
-
-    @Test
-    void aValidArchitectRegistryPassesValidation(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("arch-ok.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                architects:
-                  lead-designer:
-                    terminal: term_design
-                    profile: sonnet
-                  reviewer:
-                    profile: gx10
-                """);
-
-        assertDoesNotThrow(() -> BridgedConfig.load(f).validateArchitects());
-    }
-
-    @Test
-    void absentArchitectsBlockPassesValidation(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-arch.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\n");
-
-        assertDoesNotThrow(() -> BridgedConfig.load(f).validateArchitects());
-    }
-
-    @Test
-    void absentBrokerBlockLeavesInboxSoftState(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-broker.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\n");
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertNull(cfg.broker(), "no broker: block → null → in-memory inbox is selected");
-    }
-
-    @Test
-    void brokerBlockWithUriEnablesAmqpAdapter(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("broker.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                broker:
-                  uri: amqp://guest:guest@127.0.0.1:5672/
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertNotNull(cfg.broker());
-        assertTrue(cfg.broker().isConfigured(), "a non-blank uri enables the AMQP adapter");
-        assertEquals("amqp://guest:guest@127.0.0.1:5672/", cfg.broker().uri());
-    }
-
-    @Test
-    void brokerBlockWithBlankUriStaysSoftState(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("broker-blank.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\nbroker:\n  uri: \"\"\n");
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertNotNull(cfg.broker());
-        assertFalse(cfg.broker().isConfigured(), "an empty uri must not enable AMQP");
-    }
-
-    @Test
-    void absentPrimaryBlockLeavesPrimaryNull(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-primary.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\n");
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertNull(cfg.primary(), "no primary: block → null → connection-derived identity");
-    }
-
-    @Test
-    void primaryBlockWithTerminalPinsIdentity(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("primary-pinned.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                primary:
-                  terminal: term_fixed
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertNotNull(cfg.primary());
-        assertEquals("term_fixed", cfg.primary().terminal());
-    }
-
-    @Test
-    void primaryBlockWithBlankTerminalDefaultsToDerived(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("primary-blank.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\nprimary:\n  terminal: \"\"\n");
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertNotNull(cfg.primary());
-        assertTrue(cfg.primary().terminal() == null || cfg.primary().terminal().isBlank(),
-                "a blank terminal in yaml should be treated as absent — null or empty are equivalent");
-    }
-
-    // --- CB-402: peer kind discriminator -------------------------------------------------------
-
-    @Test
-    void workerKindDefaultsToClaudeCodeWhenOmitted(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("kind-absent.yaml");
-        Files.writeString(f, """
-                workers:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                    argv: ["ccs", "gx10"]
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(BridgedConfig.Worker.KIND_CLAUDE_CODE, cfg.workerProfiles().get("gx10").kind(),
-                "a worker with no kind: is a claude-code worker (backward compatible)");
-    }
-
-    @Test
-    void opencodeKindIsNormalizedToLowerCase(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("kind-opencode.yaml");
-        Files.writeString(f, """
-                workers:
-                  gemini:
-                    kind: OpenCode
-                    model: google/gemini-2.5-pro
-                    argv: ["opencode"]
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(BridgedConfig.Worker.KIND_OPENCODE, cfg.workerProfiles().get("gemini").kind(),
-                "kind is normalised to lower-case so YAML casing does not matter");
-    }
-
-    @Test
-    void kindPredicatesReflectTheResolvedKind(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("kind-predicates.yaml");
-        Files.writeString(f, """
-                workers:
-                  claude:
-                    baseUrl: http://gx10.gw:8000
-                  gemini:
-                    kind: opencode
-                    model: google/gemini-2.5-pro
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        BridgedConfig.Worker claude = cfg.workerProfiles().get("claude");
-        BridgedConfig.Worker gemini = cfg.workerProfiles().get("gemini");
-        assertTrue(claude.isClaudeCode(), "the default-kind worker is claude-code");
-        assertFalse(claude.isOpenCode(), "a claude-code worker is not opencode");
-        assertTrue(gemini.isOpenCode(), "the kind: opencode worker is opencode");
-        assertFalse(gemini.isClaudeCode(), "an opencode worker is not claude-code");
-    }
-
-    @Test
-    void argvDefaultsToTheKindBinaryWhenUnset(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("kind-argv.yaml");
-        Files.writeString(f, """
-                workers:
-                  claude:
-                    baseUrl: http://gx10.gw:8000
-                  gemini:
-                    kind: opencode
-                    model: google/gemini-2.5-pro
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(java.util.List.of("claude"), cfg.workerProfiles().get("claude").argv(),
-                "a claude-code worker with no argv defaults to the claude binary");
-        assertEquals(java.util.List.of("opencode"), cfg.workerProfiles().get("gemini").argv(),
-                "an opencode worker with no argv defaults to the opencode binary, never claude");
-    }
-
-    @Test
-    void authDefaultsToLoopbackTrustSoExistingConfigsBehaveAsBefore(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-auth-block.yaml");
-        Files.writeString(f, "bind:\n  host: 127.0.0.1\n  port: 8765\n");
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertNotNull(cfg.auth(), "auth must default rather than be null");
-        assertFalse(cfg.auth().tokenMode());
-        assertEquals("BRIDGED_API_TOKEN", cfg.auth().tokenEnv(), "documented default env var");
-        assertDoesNotThrow(cfg::validateAuthExposure, "loopback + loopback-trust is the safe pairing");
-    }
-
-    /**
-     * CB-501's highest-value check. Under loopback-trust, "not a known worker" means "the primary" —
-     * sound only while the OS refuses remote connections. Widening the bind without token mode
-     * would silently promote every reachable client to the most privileged role on the bus.
-     */
-    @Test
-    void aNonLoopbackBindWithoutTokenModeIsRefusedAtStartup(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("exposed.yaml");
-        Files.writeString(f, "bind:\n  host: 0.0.0.0\n  port: 8765\n");
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateAuthExposure);
-        assertTrue(e.getMessage().contains("auth.mode: token"),
-                "the error must say how to fix it, not just that it refused");
-    }
-
-    @Test
-    void aNonLoopbackBindIsAllowedOnceTokenModeIsOn(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("exposed-with-token.yaml");
-        Files.writeString(f, """
-                bind:
-                  host: 0.0.0.0
-                  port: 8765
-                auth:
-                  mode: token
-                  tokenEnv: MY_TOKEN
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertTrue(cfg.auth().tokenMode());
-        assertEquals("MY_TOKEN", cfg.auth().tokenEnv());
-        assertDoesNotThrow(cfg::validateAuthExposure);
-    }
-
-    @Test
-    void loopbackFormsAreAllRecognised(@TempDir Path dir) throws Exception {
-        for (String host : new String[]{"127.0.0.1", "localhost", "::1", "127.0.0.53"}) {
-            Path f = dir.resolve("lb-" + host.replace(':', '_') + ".yaml");
-            Files.writeString(f, "bind:\n  host: \"" + host + "\"\n  port: 8765\n");
-            assertDoesNotThrow(() -> BridgedConfig.load(f).validateAuthExposure(),
-                    host + " is loopback and must not trip the exposure guard");
-        }
-    }
-
-    /**
-     * The shipped {@code bridged.example.yaml} must actually parse. Config binds through a plain
-     * Jackson mapper with {@code ignoreUnknown = true}, so a misspelled key in the example is
-     * silently dropped and the operator gets a default they did not ask for — exactly how a
-     * {@code spawn_ready_timeout_ms} typo survived in the example until the CB-5xx wrap-up.
-     */
-    @Test
-    void shippedExampleConfigParses() {
-        Path example = Path.of("bridged.example.yaml");
-        assertTrue(Files.exists(example), "bridged.example.yaml must ship next to the pom");
-
-        BridgedConfig cfg = BridgedConfig.load(example);
-        assertEquals(8765, cfg.bind().port(), "example binds the documented default port");
-        assertTrue(cfg.workerProfiles().containsKey("gx10"), "example documents the gx10 profile");
-        assertEquals("gx10", cfg.defaultProfile(), "example's defaultWorker resolves");
-        assertTrue(cfg.guard().hostSet().contains("gx01.gw"),
-                "every example profile's base_url host must be in the example allowlist");
-    }
-
-    /**
-     * Every optional knob the example documents must bind under the exact spelling used there.
-     * Keep this list in step with {@code bridged.example.yaml}: a rename that updates the record
-     * but not the example (or vice versa) fails here instead of silently no-op'ing in production.
-     */
-    @Test
-    void everyOptionalKnobDocumentedInTheExampleBinds(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("all-knobs.yaml");
-        Files.writeString(f, """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                spawnReadyTimeoutMs: 25000
-                spawnReadyPollMs: 400
-                worktreeRoot: /tmp/bridged-worktrees
-                workers:
-                  gx10:
-                    kind: claude-code
-                    baseUrl: http://gx01.gw:8000
-                    configDir: /tmp/ccs/gx10
-                    cwd: /tmp/repo
-                    parityOverlay: [".mcp.json", ".env"]
-                    gitTokenEnv: GITEA_TOKEN
-                    gitHostEnv: GITEA_HOST
-                    weight: 0.5
-                    maxLoad: 2
-                placement: weighted
-                lifecycle:
-                  idleTtlSeconds: 300
-                  contextCap: 10
-                  drainTimeoutSeconds: 5
-                  clearAfterTurn: true
-                broker:
-                  uri: amqp://guest:guest@127.0.0.1:5672
-                primary:
-                  terminal: term_abc123
-                  pushReminders: 5
-                  pushBackoffMs: 15000
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals(25000, cfg.spawnReadyTimeoutMs(), "spawnReadyTimeoutMs is camelCase, not snake_case");
-        assertEquals(400, cfg.spawnReadyPollMs(), "spawnReadyPollMs is camelCase, not snake_case");
-        assertEquals("/tmp/bridged-worktrees", cfg.worktreeRoot());
-
-        BridgedConfig.Worker w = cfg.workerProfiles().get("gx10");
-        assertEquals("/tmp/ccs/gx10", w.configDir());
-        assertEquals("/tmp/repo", w.cwd());
-        assertEquals(java.util.List.of(".mcp.json", ".env"), w.parityOverlay());
-        assertTrue(w.hasGitToken(), "gitTokenEnv binds and enables the CB-302 PR grant");
-        assertEquals("GITEA_HOST", w.gitHostEnv());
-        assertEquals(0.5f, w.weight(), 0.0001f, "weight binds as a float");
-        assertEquals(2, w.maxLoad(), "maxLoad binds as an integer");
-
-        assertEquals("weighted", cfg.placement(), "placement binds at the top level");
-        assertEquals(300, cfg.lifecycle().idleTtlSeconds());
-        assertEquals(10, cfg.lifecycle().contextCap());
-        assertEquals(5, cfg.lifecycle().drainTimeoutSeconds());
-        assertTrue(cfg.lifecycle().clearAfterTurn());
-        assertEquals("amqp://guest:guest@127.0.0.1:5672", cfg.broker().uri());
-        assertEquals("term_abc123", cfg.primary().terminal());
-        assertEquals(5, cfg.primary().remindersOrDefault());
-        assertEquals(15000L, cfg.primary().backoffMsOrDefault());
-    }
-
-    @Test
-    void placementDefaultsToFixedForExistingConfigs(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-placement.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertEquals("fixed", cfg.placement(), "omitted placement must default to fixed");
-    }
-
-    @Test
-    void workerWeightAndMaxLoadDefaultSanely(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-weight.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                workers:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        BridgedConfig.Worker w = cfg.workerProfiles().get("gx10");
-        assertEquals(1.0f, w.weight(), 0.0001f, "absent weight defaults to 1.0");
-        assertNull(w.maxLoad(), "absent maxLoad defaults to unlimited (null)");
-    }
-
-    @Test
-    void subscriptionFlagBindsAndDefaultsFalse(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("subscription.yaml");
-        Files.writeString(f, """
-                workers:
-                  sonnet:
-                    subscription: true
-                    argv: ["ccs", "sonnet"]
-                  opted:
-                    baseUrl: http://gx10.gw:8000
-                """);
-
-        BridgedConfig cfg = BridgedConfig.load(f);
-        assertTrue(cfg.workerProfiles().get("sonnet").isSubscription(),
-                "subscription: true binds as an explicit opt-in");
-        assertFalse(cfg.workerProfiles().get("opted").isSubscription(),
-                "a profile without the key stays off-subscription (the default)");
-    }
-
-    // ── CB-542: subscription:true must not smuggle an unguarded endpoint via env: ───────────────
-
-    @Test
-    void aSubscriptionProfileWithAnthropicBaseUrlInEnvIsRejected(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("baseUrl.yaml");
-        Files.writeString(f, """
-                workers:
-                  sonnet:
-                    subscription: true
-                    argv: ["ccs", "sonnet"]
-                    env:
-                      ANTHROPIC_BASE_URL: http://anything-not-on-the-allowlist
-                """);
-        BridgedConfig cfg = BridgedConfig.load(f);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class,
-                cfg::validateSubscriptionProfiles);
-        assertTrue(e.getMessage().contains("sonnet"), "the refusal names the offending profile");
-        assertTrue(e.getMessage().contains("ANTHROPIC_BASE_URL"),
-                "the refusal names the offending key: " + e.getMessage());
-    }
-
-    @Test
-    void aSubscriptionProfileWithAnthropicAuthTokenInEnvIsRejected(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("authToken.yaml");
-        Files.writeString(f, """
-                workers:
-                  sonnet:
-                    subscription: true
-                    argv: ["ccs", "sonnet"]
-                    env:
-                      ANTHROPIC_AUTH_TOKEN: sk-ant-not-on-any-allowlist
-                """);
-        BridgedConfig cfg = BridgedConfig.load(f);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class,
-                cfg::validateSubscriptionProfiles);
-        assertTrue(e.getMessage().contains("sonnet"), "the refusal names the offending profile");
-        assertTrue(e.getMessage().contains("ANTHROPIC_AUTH_TOKEN"),
-                "the refusal names the offending key: " + e.getMessage());
-    }
-
-    @Test
-    void aSubscriptionProfileWithACleanEnvPassesValidation(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("clean.yaml");
-        Files.writeString(f, """
-                workers:
-                  sonnet:
-                    subscription: true
-                    argv: ["ccs", "sonnet"]
-                    env:
-                      JAVA_HOME: /opt/jdk
-                """);
-        BridgedConfig cfg = BridgedConfig.load(f);
-
-        assertDoesNotThrow(cfg::validateSubscriptionProfiles,
-                "a subscription profile may carry env: — just not the Anthropic binding keys");
-    }
-
-    @Test
-    void aNonSubscriptionProfileMayCarryAnthropicEnvKeys(@TempDir Path dir) throws Exception {
-        // The override is only dangerous on the subscription path, where no guard could vet it. A
-        // plain profile's env: is still overwritten by the launcher's guard-checked value (CB-511).
-        Path f = dir.resolve("nonsub.yaml");
-        Files.writeString(f, """
-                workers:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                    env:
-                      ANTHROPIC_BASE_URL: http://something
-                """);
-        BridgedConfig cfg = BridgedConfig.load(f);
-
-        assertDoesNotThrow(cfg::validateSubscriptionProfiles,
-                "only subscription:true profiles are checked — off-subscription ones keep the baseUrl guard");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/herdr/AgentControlContractTest.java

@@ -1,56 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-import org.junit.jupiter.api.Tag;
-import org.junit.jupiter.api.Test;
-
-import java.nio.file.Files;
-import java.util.List;
-import java.util.Map;
-
-import static org.junit.jupiter.api.Assertions.*;
-import static org.junit.jupiter.api.Assumptions.assumeTrue;
-
-/**
- * Contract test for the worker env seam against a REAL herdr. Under protocol 19 (CB-521) the
- * env map is injected at PANE CREATION ({@code tab.create}), not {@code agent.start} — and
- * {@code agent.start} now only launches supported agent kinds, so this probes the seed pane's
- * SHELL directly (never {@code claude}, so no subscription/token involvement) and always tears
- * the throwaway space down.
- *
- * <p>Tagged {@code contract}; run with {@code mvn test -Pcontract}.
- */
-@Tag("contract")
-class AgentControlContractTest {
-
-    private boolean noSocket() {
-        return !Files.exists(UnixSocketHerdrClient.defaultSocketPath());
-    }
-
-    @Test
-    void tabCreateInjectsEnvIntoTheSeedShell() throws Exception {
-        assumeTrue(!noSocket(), "no herdr socket — skipping");
-        try (UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect()) {
-            WorkspaceControl spaces = new WorkspaceControl(herdr);
-            Workspace space = spaces.ensureWorkspace("__bridged_env_contract__");
-            Tab.Created tab = spaces.createTab(space.workspaceId(), null,
-                    Map.of("ANTHROPIC_BASE_URL", "http://gx00.gw:8000"));
-            try {
-                assertNotNull(tab.rootPaneId(), "tab.create must return the seed pane");
-                Thread.sleep(1000); // let the seed shell reach its prompt
-                herdr.call("pane.send_input", Map.of(
-                        "pane_id", tab.rootPaneId(),
-                        "text", "printf 'PROBE_BASE=[%s]\\n' \"$ANTHROPIC_BASE_URL\"",
-                        "keys", List.of("enter")));
-                Thread.sleep(800);
-                String visible = herdr.call("pane.read",
-                                Map.of("pane_id", tab.rootPaneId(), "source", "visible"))
-                        .path("read").path("text").asText("");
-                assertTrue(visible.contains("PROBE_BASE=[http://gx00.gw:8000]"),
-                        "env map must reach the seed shell; saw: " + visible);
-            } finally {
-                spaces.closeTab(tab.tab().tabId());
-                herdr.call("workspace.close", Map.of("workspace_id", space.workspaceId()));
-            }
-        }
-    }
-}

bridged/src/test/java/dev/ltms/bridged/herdr/LeadTabScannerTest.java

@@ -1,262 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import org.junit.jupiter.api.Test;
-
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicLong;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-531. A lead is never spawned, so the daemon has to <em>find</em> it: these assert that an
- * operator-labelled tab is what makes a pane a lead, and — just as importantly — what does not.
- */
-class LeadTabScannerTest {
-
-    private static final ObjectMapper MAPPER = new ObjectMapper();
-    private static final long TTL = TimeUnit.SECONDS.toNanos(10);
-
-    /**
-     * A herdr whose workspace/tab/pane topology is declared per test. Counts calls so the caching
-     * contract can be asserted, and can be made to fail on demand.
-     */
-    private static final class TopologyHerdr implements HerdrClient {
-        /** workspace_id → label. */
-        final Map<String, String> workspaces = new LinkedHashMap<>();
-        /** tab_id → [workspace_id, label]. */
-        final Map<String, String[]> tabs = new LinkedHashMap<>();
-        /** pane_id → [tab_id, terminal_id]. */
-        final Map<String, String[]> panes = new LinkedHashMap<>();
-        int calls;
-        boolean failing;
-
-        TopologyHerdr workspace(String id, String label) {
-            workspaces.put(id, label);
-            return this;
-        }
-
-        TopologyHerdr tab(String tabId, String workspaceId, String label) {
-            tabs.put(tabId, new String[]{workspaceId, label});
-            return this;
-        }
-
-        TopologyHerdr pane(String paneId, String tabId, String terminalId) {
-            panes.put(paneId, new String[]{tabId, terminalId});
-            return this;
-        }
-
-        @Override
-        public JsonNode call(String method, Object params) {
-            calls++;
-            if (failing) {
-                throw new HerdrException("socket closed");
-            }
-            List<String> items = new ArrayList<>();
-            switch (method) {
-                case "workspace.list" -> {
-                    workspaces.forEach((id, label) -> items.add(
-                            "{\"workspace_id\":\"%s\",\"label\":\"%s\"}".formatted(id, label)));
-                    return read("{\"workspaces\":[%s]}".formatted(String.join(",", items)));
-                }
-                case "tab.list" -> {
-                    String ws = String.valueOf(((Map<?, ?>) params).get("workspace_id"));
-                    tabs.forEach((id, t) -> {
-                        if (ws.equals(t[0])) {
-                            items.add(("{\"tab_id\":\"%s\",\"workspace_id\":\"%s\",\"label\":%s,"
-                                    + "\"pane_count\":1}").formatted(id, t[0],
-                                    t[1] == null ? "null" : "\"" + t[1] + "\""));
-                        }
-                    });
-                    return read("{\"tabs\":[%s]}".formatted(String.join(",", items)));
-                }
-                case "pane.list" -> {
-                    panes.forEach((id, p) -> items.add(
-                            "{\"pane_id\":\"%s\",\"tab_id\":\"%s\",\"terminal_id\":\"%s\"}"
-                                    .formatted(id, p[0], p[1])));
-                    return read("{\"panes\":[%s]}".formatted(String.join(",", items)));
-                }
-                default -> throw new AssertionError("unexpected herdr call: " + method);
-            }
-        }
-
-        private static JsonNode read(String json) {
-            try {
-                return MAPPER.readTree(json);
-            } catch (Exception e) {
-                throw new AssertionError(e);
-            }
-        }
-
-        @Override
-        public void close() {
-        }
-    }
-
-    /**
-     * The usual shape: one user space with lead tabs, one worker space bridged owns.
-     *
-     * <p>Not closed: {@code close()} is a no-op on this fake, and every test needs the handle after
-     * the scanner is built (to mutate the topology or read {@code calls}).
-     */
-    @SuppressWarnings("resource")
-    private TopologyHerdr twoLeads() {
-        return new TopologyHerdr()
-                .workspace("w1", "main")
-                .workspace("w9", "bridged-workers")
-                .tab("w1:t1", "w1", "lead: opus-5.0")
-                .tab("w1:t2", "w1", "lead: gpt-sol-5.6")
-                .tab("w1:t3", "w1", "notes")
-                .tab("w9:t1", "w9", "worker: gx10 #1")
-                .pane("w1:p1", "w1:t1", "term_opus")
-                .pane("w1:p2", "w1:t2", "term_gpt")
-                .pane("w1:p3", "w1:t3", "term_notes")
-                .pane("w9:p1", "w9:t1", "term_worker");
-    }
-
-    private LeadTabScanner scanner(TopologyHerdr herdr, Map<String, String> configured,
-                                   AtomicLong clock) {
-        return new LeadTabScanner(herdr, "lead:", Set.of("bridged-workers"), configured, TTL,
-                clock::get);
-    }
-
-    @Test
-    void everyLabelledTabBecomesALeadNamedByItsLabel() {
-        Map<String, String> leads = scanner(twoLeads(), Map.of(), new AtomicLong()).get();
-
-        assertEquals(Map.of("term_opus", "opus-5.0", "term_gpt", "gpt-sol-5.6"), leads,
-                "two leads discovered from labels alone — no terminal_id was ever configured");
-    }
-
-    @Test
-    void anUnlabelledTabContributesNothing() {
-        assertFalse(scanner(twoLeads(), Map.of(), new AtomicLong()).get().containsKey("term_notes"));
-    }
-
-    /**
-     * The guard that matters: bridged labels its own worker tabs, so if a worker space were scanned
-     * a naming accident would promote the fleet. The exclusion is by workspace, not by hoping the
-     * worker template never collides.
-     */
-    @Test
-    void aTabInAWorkerSpaceIsNeverALeadEvenWhenItsLabelMatches() {
-        TopologyHerdr herdr = twoLeads().tab("w9:t2", "w9", "lead: impostor")
-                .pane("w9:p2", "w9:t2", "term_impostor");
-
-        assertFalse(scanner(herdr, Map.of(), new AtomicLong()).get().containsKey("term_impostor"));
-    }
-
-    @Test
-    void aBarePrefixNamesNobodyAndIsRejected() {
-        TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
-                .tab("w1:t1", "w1", "lead:").pane("w1:p1", "w1:t1", "term_a");
-
-        assertEquals(Map.of(), scanner(herdr, Map.of(), new AtomicLong()).get(),
-                "a lead with no name would resolve as PRIMARY with nothing to attribute it to");
-    }
-
-    @Test
-    void thePrefixMatchesCaseInsensitivelyAndTheNameIsTrimmed() {
-        TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
-                .tab("w1:t1", "w1", "  LEAD:   opus-5.0  ").pane("w1:p1", "w1:t1", "term_a");
-
-        assertEquals(Map.of("term_a", "opus-5.0"), scanner(herdr, Map.of(), new AtomicLong()).get());
-    }
-
-    @Test
-    void everyPaneInALeadTabResolvesAsThatLead() {
-        // A human may split their own lead tab. Both panes are theirs, so both are that lead —
-        // nothing bridged placed can land here (see the worker-space test above).
-        TopologyHerdr herdr = twoLeads().pane("w1:p1b", "w1:t1", "term_opus_split");
-
-        assertEquals("opus-5.0", scanner(herdr, Map.of(), new AtomicLong()).get().get("term_opus_split"));
-    }
-
-    @Test
-    void anExplicitlyConfiguredLeadIsMergedInAndOutranksALabel() {
-        Map<String, String> configured = Map.of("term_opus", "pinned-name", "term_extra", "from-config");
-
-        Map<String, String> leads = scanner(twoLeads(), configured, new AtomicLong()).get();
-
-        assertEquals("pinned-name", leads.get("term_opus"), "an explicit pin is the operator's last word");
-        assertEquals("from-config", leads.get("term_extra"), "a configured lead needs no tab at all");
-        assertEquals("gpt-sol-5.6", leads.get("term_gpt"));
-    }
-
-    // ── caching ─────────────────────────────────────────────────────────────────────────────────
-
-    @Test
-    void aSecondLookupWithinTheTtlDoesNotTouchHerdr() {
-        TopologyHerdr herdr = twoLeads();
-        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, Map.of(), clock);
-
-        s.get();
-        int afterFirst = herdr.calls;
-        clock.addAndGet(TTL - 1);
-        s.get();
-
-        assertEquals(afterFirst, herdr.calls,
-                "resolve() runs on every request — an un-cached scan would put herdr on that path");
-    }
-
-    @Test
-    void aTabLabelledAfterStartupIsPickedUpOnceTheTtlExpires() {
-        TopologyHerdr herdr = twoLeads();
-        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, Map.of(), clock);
-        assertFalse(s.get().containsKey("term_notes"));
-
-        herdr.tab("w1:t3", "w1", "lead: late-arrival"); // the operator renames their tab
-        clock.addAndGet(TTL);
-
-        assertEquals("late-arrival", s.get().get("term_notes"),
-                "the whole point over `leaders:`: no config edit, no restart");
-    }
-
-    @Test
-    void aFailedScanKeepsTheLeadsAlreadyKnownRatherThanDemotingThem() {
-        TopologyHerdr herdr = twoLeads();
-        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, Map.of(), clock);
-        Map<String, String> before = s.get();
-
-        herdr.failing = true;
-        clock.addAndGet(TTL);
-
-        assertEquals(before, s.get(),
-                "a herdr hiccup must not silently demote a live lead to a worker mid-session");
-    }
-
-    @Test
-    void aFailedFirstScanStillHonoursTheConfiguredLeads() {
-        TopologyHerdr herdr = twoLeads();
-        herdr.failing = true;
-
-        Map<String, String> leads = scanner(herdr, Map.of("term_x", "opus-5.0"), new AtomicLong()).get();
-
-        assertEquals(Map.of("term_x", "opus-5.0"), leads,
-                "config-named leads must not depend on herdr answering at all");
-    }
-
-    @Test
-    void aDownHerdrIsRetriedOncePerTtlNotOncePerRequest() {
-        TopologyHerdr herdr = twoLeads();
-        herdr.failing = true;
-        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, Map.of(), clock);
-
-        s.get();
-        int afterFirst = herdr.calls;
-        s.get();
-        s.get();
-
-        assertEquals(afterFirst, herdr.calls, "the failure path must be rate-limited too");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/herdr/PaneLocatorTest.java

@@ -1,27 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/** Unit tests for PID → pane resolution (the herdr half of connection-based MCP identity). */
-class PaneLocatorTest {
-
-    private final PaneLocator loc = new PaneLocator(new FakeHerdr());
-
-    @Test
-    void resolvesTerminalForAForegroundPid() {
-        assertEquals("term_a", loc.terminalForPid(FakeHerdr.WORKER_PID));
-    }
-
-    @Test
-    void nullForAPidInNoPane() {
-        assertNull(loc.terminalForPid(999_999));
-    }
-
-    @Test
-    void nullForNonPositivePid() {
-        assertNull(loc.terminalForPid(0));
-        assertNull(loc.terminalForPid(-1));
-    }
-}

bridged/src/test/java/dev/ltms/bridged/inject/CompletionResolverTest.java

@@ -1,302 +0,0 @@
-package dev.ltms.bridged.inject;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.msg.Rendezvous;
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/** Unit behaviour of the CB-106 completion resolver in isolation from the injector. */
-class CompletionResolverTest {
-
-    @Test
-    void skipsTheScrapeWhenNoSendIsWaiting() {
-        FakeHerdr herdr = new FakeHerdr();
-        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        resolver.resolve("term_a", null); // no in-flight turn captured for this target
-
-        assertFalse(herdr.called("agent.read"),
-                "a turn nobody is blocked on must not cost a transcript scrape");
-    }
-
-    @Test
-    void failSkipsTheScrapeWhenNoSendIsWaiting() {
-        FakeHerdr herdr = new FakeHerdr();
-        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        resolver.fail("term_a", null); // no in-flight turn, and no registered waiter to fall back to
-
-        assertFalse(herdr.called("agent.read"),
-                "a wedge nobody is blocked on must not cost a transcript scrape");
-    }
-
-    @Test
-    void captureBaselineSkipsTheReadWhenNoSendIsWaiting() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ X\n❯ ");
-        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        resolver.captureBaseline("term_a"); // no send to attribute a later completion to
-
-        assertFalse(herdr.called("agent.read"),
-                "with no waiting send there is no turn to baseline — skip the scrape");
-    }
-
-    // --- CB-115 clean scrape: extract the last assistant block ----------------
-
-    @Test
-    void extractsTheLastAssistantBlockStrippingChrome() {
-        String raw = """
-                ⏺ Reading the file…
-
-                ⏺ Done. The bug was an off-by-one in the loop bound.
-
-                ╭──────────────────────────────────────╮
-                │ >                                    │
-                ╰──────────────────────────────────────╯
-                  ⏵⏵ auto mode on · ? for shortcuts
-                """;
-        assertEquals("Done. The bug was an off-by-one in the loop bound.",
-                CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    @Test
-    void keepsMultiLineAssistantContent() {
-        String raw = "⏺ Line one.\nLine two.\n❯ ";
-        assertEquals("Line one.\nLine two.", CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    @Test
-    void fallsBackToRawTextWhenThereIsNoMarker() {
-        String raw = "plain worker output with no glyph";
-        assertEquals("plain worker output with no glyph", CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    @Test
-    void blankScrapeYieldsEmpty() {
-        assertTrue(CompletionResolver.lastAssistantBlock("").isEmpty());
-        assertTrue(CompletionResolver.lastAssistantBlock(null).isEmpty());
-    }
-
-    @Test
-    void stripsSpinnerAndRuleChrome() {
-        String raw = """
-                ⏺ Channel check confirmed — your message got through.
-
-                ✻ Brewed for 11s
-
-                ─────────────────────────────────────
-                """;
-        assertEquals("Channel check confirmed — your message got through.",
-                CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    @Test
-    void cutsANextTurnPromptEchoAndTrailingTipsFromTheBlock() {
-        // The exact turn-2 leak: the scrape captured the settled answer, then a "✻ Cooked" spinner,
-        // then the NEXT turn's echoed prompt, then a "✶ Forming…" spinner and trailing tips/warnings
-        // whose lines (⎿, ⚠) are not themselves chrome-terminated. Stopping at the first boundary
-        // (the ✻ spinner) is what keeps every one of those interface lines out of the reply.
-        String raw = """
-                ⏺ Channel confirmed — the bridge reply delivered successfully.
-
-                ✻ Cooked for 9s
-
-                ❯ Thanks. Now a small task: what is 17 * 23? Show just the number.
-
-
-
-                ✶ Forming…
-                  ⎿  Tip: Name your conversations with /rename
-                  ⚠ claude.ai connectors are disabled because ANTHROPIC_API_KEY is set
-                """;
-        assertEquals("Channel confirmed — the bridge reply delivered successfully.",
-                CompletionResolver.lastAssistantBlock(raw));
-    }
-
-    // --- CB-115 misattribution guard: suppress a stale (unchanged) completion -------
-
-    @Test
-    void suppressesACompletionWhoseScrapeIsUnchangedFromDelivery() {
-        // Rapid back-to-back turn: the pane still shows the PREVIOUS turn's answer when this turn's
-        // (misattributed) completion boundary fires. The scrape == the delivery baseline, so the
-        // send must NOT be resolved with the stale answer.
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ 391\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        var waiter = rendezvous.open("term_a");   // a send is blocked on this turn
-        // The turn as captured at delivery: its waiter, and the previous turn's answer still on screen.
-        var turn = new CompletionResolver.InFlight(waiter, "391");
-        resolver.resolve("term_a", turn);          // scrape still "391" == baseline → suppress
-
-        assertFalse(waiter.isDone(), "a completion with no output change must not resolve the send");
-        assertTrue(rendezvous.isWaiting("term_a"), "the send stays waiting for a real reply");
-    }
-
-    @Test
-    void resolvesACompletionWhoseScrapeChangedSinceDelivery() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ No, 391 = 17 × 23.\n❯ "); // the worker's real answer
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        var waiter = rendezvous.open("term_a");
-        // Delivery baseline was the previous turn's "391"; the scrape now differs → resolve.
-        var turn = new CompletionResolver.InFlight(waiter, "391");
-        resolver.resolve("term_a", turn);
-
-        assertTrue(waiter.isDone(), "a completion with new output must resolve the send");
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind());
-        assertEquals("No, 391 = 17 × 23.", waiter.getNow(null).text());
-    }
-
-    @Test
-    void resolvesSynchronouslyBeforePostTurnContextClearing() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ previous answer\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-        var waiter = rendezvous.open("term_a");
-        resolver.captureBaseline("term_a");
-        herdr.readText("⏺ answer that /clear would erase\n❯ ");
-
-        resolver.resolveBeforePostAction("term_a");
-
-        assertTrue(waiter.isDone(), "the answer is captured before the adapter sends /clear");
-        assertEquals("answer that /clear would erase", waiter.getNow(null).text());
-    }
-
-    @Test
-    void suppressesAnUnchangedCompletionEvenWhenTheBlockExceedsTheScrapeCap() {
-        // The fan-out issue-hunt finding: captureBaseline once stored the RAW (unclipped) assistant
-        // block while resolve compares against a clip()'d tail. For a block longer than MAX_SCRAPE_CHARS
-        // the two capped representations differ even when the pane never changed, so the CB-115
-        // byte-identical guard failed to fire and a stale completion could resolve the send. Both sides
-        // must clip identically; here an unchanged >cap block on rapid back-to-back turns stays suppressed.
-        String longBlock = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 500) + "\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(longBlock);
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        var waiter = rendezvous.open("term_a");        // a send is blocked on this turn
-        resolver.captureBaseline("term_a");            // baseline is the clipped >cap block
-        var turn = resolver.inFlight("term_a");
-        assertEquals(CompletionResolver.MAX_SCRAPE_CHARS, turn.baseline().length(),
-                "the delivery baseline is clipped to the same cap resolve() applies to the tail");
-
-        resolver.resolve("term_a", turn);              // scrape unchanged → clipped tail == baseline → suppress
-
-        assertFalse(waiter.isDone(),
-                "an unchanged >cap block must still be recognised as stale and suppressed");
-        assertTrue(rendezvous.isWaiting("term_a"), "the send stays waiting for a real reply");
-    }
-
-    @Test
-    void resolvesWhenThereIsNoBaseline() {
-        // No delivery baseline (e.g. the pre-turn read failed) ⇒ never suppress; the completion resolves.
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ hello\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertTrue(waiter.isDone(), "with no baseline a completion resolves as before");
-        assertEquals("hello", waiter.getNow(null).text());
-    }
-
-    @Test
-    void resolvesWhenTheScrapeItselfFailsEvenWithABaselinePresent() {
-        // The most important branch of the CB-115 guard: a failed read means the resolver could not
-        // SEE the screen — "couldn't see", not "no change". It must still resolve the send (an empty
-        // tail beats hanging until the caller's timeout), even though a baseline was captured. The
-        // baseline here is "" (an empty pane at delivery), so without the !scrapeFailed clause the
-        // byte-identical guard would wrongly match the empty tail and suppress.
-        FakeHerdr herdr = new FakeHerdr().healthy(false); // agent.read throws HerdrException
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        var waiter = rendezvous.open("term_a");
-        var turn = new CompletionResolver.InFlight(waiter, ""); // empty pane baselined at delivery
-        resolver.resolve("term_a", turn);
-
-        assertTrue(waiter.isDone(),
-                "a failed scrape must still resolve the send, not hang until the caller's timeout");
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind());
-        assertEquals("", waiter.getNow(null).text(), "the tail is empty because the screen was unreadable");
-    }
-
-    // --- CB-115/CB-116 fail guard: an already-done or absent waiter is left alone ---------
-
-    @Test
-    void failLeavesAnAlreadyResolvedWaiterUntouchedAndSkipsTheScrape() {
-        // The send was already resolved (e.g. by the worker's explicit reply) before fail fired.
-        // fail must not overwrite that value, and must not even scrape the worker — nobody needs it.
-        FakeHerdr herdr = new FakeHerdr().readText("an error screen");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        var waiter = rendezvous.open("term_a");
-        var turn = new CompletionResolver.InFlight(waiter, null);
-        assertTrue(rendezvous.resolveCompletion(waiter, "already replied"));
-
-        resolver.fail("term_a", turn);
-
-        assertFalse(herdr.called("agent.read"),
-                "fail must not scrape a waiter that is already done");
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
-                "fail must not overwrite the existing resolution");
-        assertEquals("already replied", waiter.getNow(null).text());
-    }
-
-    @Test
-    void failFallsBackToTheRegisteredWaiterWhenThereIsNoInFlightTurn() {
-        // A never-delivered readiness failure has no in-flight record but still has a blocked send;
-        // fail falls back to the waiter currently registered on the Rendezvous and fails it.
-        FakeHerdr herdr = new FakeHerdr().readText("stuck on an error screen");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        var waiter = rendezvous.open("term_a"); // send registered, but no captureBaseline ever ran
-        resolver.fail("term_a", null);          // no in-flight turn → fall back to the registered waiter
-
-        assertTrue(waiter.isDone(), "fail falls back to the registered waiter when no turn is in flight");
-        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind());
-        assertEquals("stuck on an error screen", waiter.getNow(null).text());
-    }
-
-    // --- CB-116 waiter identity: a late completion never crosses into the next turn ---------
-
-    @Test
-    void aLateCompletionForOneTurnNeverResolvesTheNextTurnsWaiter() {
-        // The cross-turn stale reply the conversation test surfaced: turn N's completion fallback
-        // fires AFTER turn N was resolved by an explicit bridge_reply and turn N+1 has opened its own
-        // waiter on the same session. Resolving "whatever is waiting now" would hand turn N's stale
-        // scrape to turn N+1; targeting turn N's captured waiter makes the late completion a no-op.
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ turn N answer\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
-
-        var waiterN = rendezvous.open("term_a"); // turn N's send
-        // The turn as the injector captured it at delivery (waiter + pre-turn baseline).
-        var turnN = new CompletionResolver.InFlight(waiterN, "an earlier answer");
-
-        // Turn N is resolved by the worker's explicit reply.
-        assertTrue(rendezvous.resolve("term_a", "N replied"));
-
-        // Turn N+1's send opens its own waiter on the same session (replacing the registered one).
-        var waiterN1 = rendezvous.open("term_a");
-
-        resolver.resolve("term_a", turnN); // turn N's completion fallback finally fires
-
-        assertFalse(waiterN1.isDone(), "turn N's late completion must not resolve turn N+1's waiter");
-        assertEquals(Rendezvous.Kind.REPLY, waiterN.getNow(null).kind(),
-                "turn N stays resolved by its own reply");
-        assertTrue(rendezvous.isWaiting("term_a"), "turn N+1 is still awaiting its own resolution");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/inject/InjectorTest.java

@@ -1,432 +0,0 @@
-package dev.ltms.bridged.inject;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.HerdrException;
-import org.junit.jupiter.api.Test;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ExecutionException;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * Golden-transcript tests for the status-gated injector (CB-103). Delivery rules are driven
- * deterministically by feeding {@code onStatus}, so no timing or real polling is involved.
- */
-class InjectorTest {
-
-    private static final String T = "term_a";
-
-    private final FakeHerdr herdr = new FakeHerdr();
-    private final Injector injector = new Injector(new AgentControl(herdr));
-
-    /**
-     * The logical messages delivered, in order. Under protocol 19 each delivery is one
-     * {@code agent.prompt} carrying the payload (it submits itself); the Enter nudge is a
-     * separate {@code agent.send_keys} and never appears here.
-     */
-    @SuppressWarnings("unchecked")
-    private List<String> sent() {
-        return herdr.calls.stream()
-                .filter(c -> c.method().equals("agent.prompt"))
-                .map(c -> ((Map<String, Object>) c.params()).get("text").toString())
-                .toList();
-    }
-
-    @Test
-    void deliversWhenIdle() {
-        CompletableFuture<Void> f = injector.enqueue(T, "hello");
-        assertFalse(f.isDone(), "not delivered until an injectable status arrives");
-        injector.onStatus(T, AgentStatus.IDLE);
-        assertTrue(f.isDone());
-        assertEquals(List.of("hello"), sent());
-    }
-
-    @Test
-    void holdsDeliveryUntilTheWorkerIsAvailable() {
-        // CB-113: idle alone is not enough — hold until the worker's MCP is connected (ready).
-        java.util.Set<String> ready = new java.util.HashSet<>();
-        Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, ready::contains);
-        inj.enqueue(T, "task");
-
-        inj.onStatus(T, AgentStatus.IDLE); // idle but not yet available → held out of the boot window
-        assertEquals(List.of(), sent(), "must not deliver into a not-yet-available worker");
-
-        ready.add(T);                      // the worker's Claude connects the bridge MCP
-        inj.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("task"), sent(), "delivers once the worker is available");
-    }
-
-    private long enterKeystrokes() {
-        return herdr.calls.stream()
-                .filter(c -> c.method().equals("agent.send_keys"))
-                .count();
-    }
-
-    @Test
-    void resubmitsEnterWhenADeliveredMessageIsNotPickedUp() {
-        // CB-113: the Enter at delivery can race the paste; while the worker stays idle (not picked
-        // up), the injector re-nudges Enter so the pending paste submits.
-        injector.enqueue(T, "task");
-        injector.onStatus(T, AgentStatus.IDLE); // deliver: paste + one Enter
-        long afterDeliver = enterKeystrokes();
-
-        injector.onStatus(T, AgentStatus.IDLE); // still idle → re-nudge Enter
-        injector.onStatus(T, AgentStatus.IDLE); // and again
-        assertTrue(enterKeystrokes() > afterDeliver, "an unpicked-up delivery re-nudges Enter");
-
-        injector.onStatus(T, AgentStatus.WORKING); // worker finally starts
-        long atPickup = enterKeystrokes();
-        injector.onStatus(T, AgentStatus.WORKING);
-        assertEquals(atPickup, enterKeystrokes(), "no more nudges once the worker has picked up");
-    }
-
-    @Test
-    void holdsWhileWorkingThenDeliversOnIdle() {
-        injector.enqueue(T, "later");
-        injector.onStatus(T, AgentStatus.WORKING);
-        assertEquals(List.of(), sent(), "must not inject mid-turn");
-        injector.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("later"), sent());
-    }
-
-    @Test
-    void blockedIsInjectableButUnknownIsNot() {
-        injector.enqueue(T, "answer");
-        injector.onStatus(T, AgentStatus.UNKNOWN);
-        assertEquals(List.of(), sent(), "unknown status is not safe to inject");
-        injector.onStatus(T, AgentStatus.BLOCKED);
-        assertEquals(List.of("answer"), sent(), "blocked worker can be answered");
-    }
-
-    @Test
-    void twoRapidDeliveriesNeverInterleave() {
-        injector.enqueue(T, "m1");
-        injector.enqueue(T, "m2");
-
-        // First idle window delivers only m1, even if idle is observed twice before pickup.
-        injector.onStatus(T, AgentStatus.IDLE);
-        injector.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("m1"), sent(), "second message must wait for the turn to complete");
-
-        // Worker picks up m1 (works), then returns idle → m2 delivers.
-        injector.onStatus(T, AgentStatus.WORKING);
-        injector.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("m1", "m2"), sent());
-    }
-
-    @Test
-    void transientUnknownDoesNotReleaseThePickupLatch() {
-        injector.enqueue(T, "m1");
-        injector.enqueue(T, "m2");
-        injector.onStatus(T, AgentStatus.IDLE); // m1 sent, awaiting pickup
-        assertEquals(List.of("m1"), sent());
-
-        injector.onStatus(T, AgentStatus.UNKNOWN); // a detection glitch is NOT a pickup
-        injector.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("m1"), sent(), "unknown must not let the next message interleave the turn");
-
-        injector.onStatus(T, AgentStatus.WORKING); // real pickup
-        injector.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("m1", "m2"), sent());
-    }
-
-    @Test
-    void missedPickupEdgeIsReleasedByGraceSoTheQueueNeverWedges() {
-        injector.enqueue(T, "m1");
-        injector.enqueue(T, "m2");
-        injector.onStatus(T, AgentStatus.IDLE); // m1 sent
-        assertEquals(List.of("m1"), sent());
-
-        // WORKING is never sampled (turn faster than the poll). The latch must release after
-        // the grace window so m2 is delivered rather than wedged forever.
-        for (int i = 0; i < 20; i++) injector.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("m1", "m2"), sent(), "safety valve must eventually deliver m2");
-    }
-
-    @Test
-    void fifoOrderAcrossManyTurns() {
-        injector.enqueue(T, "a");
-        injector.enqueue(T, "b");
-        injector.enqueue(T, "c");
-        for (int i = 0; i < 3; i++) {
-            injector.onStatus(T, AgentStatus.IDLE);   // deliver one
-            injector.onStatus(T, AgentStatus.WORKING); // pickup
-        }
-        injector.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("a", "b", "c"), sent());
-    }
-
-    @Test
-    void activeWhileQueuedOrInFlightThenQuietAfterTurnCompletes() {
-        assertTrue(injector.activeTargets().isEmpty());
-        injector.enqueue(T, "x");
-        assertEquals(Set.of(T), injector.activeTargets(), "active while a message is queued");
-
-        injector.onStatus(T, AgentStatus.IDLE); // delivers; awaiting pickup
-        assertEquals(Set.of(T), injector.activeTargets(),
-                "stays active so the poller can observe the worker pick the message up");
-
-        injector.onStatus(T, AgentStatus.WORKING); // pickup observed; now awaiting turn completion
-        assertEquals(Set.of(T), injector.activeTargets(),
-                "stays active after pickup so the working→idle completion boundary is observed");
-
-        injector.onStatus(T, AgentStatus.IDLE); // working → idle: turn complete
-        assertTrue(injector.activeTargets().isEmpty(), "quiet once the delegated turn has completed");
-    }
-
-    @Test
-    void firesTurnCompleteOnAConfirmedWorkingThenIdle() {
-        List<String> completed = new ArrayList<>();
-        Injector inj = new Injector(new AgentControl(herdr), completed::add);
-        inj.enqueue(T, "task");
-
-        inj.onStatus(T, AgentStatus.IDLE);    // deliver
-        inj.onStatus(T, AgentStatus.WORKING); // pickup + turn running
-        assertEquals(List.of(), completed, "no completion until the turn returns to idle");
-
-        inj.onStatus(T, AgentStatus.IDLE);    // working → idle: turn complete
-        assertEquals(List.of(T), completed, "a confirmed working→idle fires exactly one completion");
-    }
-
-    @Test
-    void postTurnResetSettlesBeforeNextDelegationWithoutBecomingATurn() {
-        AgentControl agents = new AgentControl(herdr);
-        class ResetListener implements TurnListener {
-            int completed;
-
-            @Override
-            public void onTurnComplete(String target) {
-                completed++;
-            }
-
-            @Override
-            public boolean hasPostTurnAction(String target) {
-                return true;
-            }
-
-            @Override
-            public boolean onTurnCompleteWithPostAction(String target) {
-                completed++;
-                agents.send(target, "/clear"); // direct housekeeping, never Injector.enqueue
-                return true;
-            }
-        }
-        ResetListener listener = new ResetListener();
-        Injector inj = new Injector(agents, listener);
-        inj.enqueue(T, "first");
-        inj.enqueue(T, "second");
-
-        inj.onStatus(T, AgentStatus.IDLE);    // first delegation
-        inj.onStatus(T, AgentStatus.WORKING);
-        inj.onStatus(T, AgentStatus.IDLE);    // first complete; reset dispatched
-        assertEquals(List.of("first", "/clear"), sent(),
-                "same-tick completion must not let the queued delegation overtake reset");
-
-        inj.onStatus(T, AgentStatus.WORKING); // reset picked up, but this is not a bridge turn
-        inj.onStatus(T, AgentStatus.IDLE);    // reset settled; second may now deliver
-        assertEquals(List.of("first", "/clear", "second"), sent());
-        assertEquals(1, listener.completed,
-                "reset settlement must not recursively emit another turn completion");
-    }
-
-    @Test
-    void doesNotSynthesizeCompletionFromAnUnconfirmedTurn() {
-        List<String> completed = new ArrayList<>();
-        Injector inj = new Injector(new AgentControl(herdr), completed::add);
-        inj.enqueue(T, "task");
-
-        // Deliver, then only ever idle — a `working` sample is never seen. The pickup grace unwedges
-        // the queue but must NOT invent a completion: without a sampled turn there is no trustworthy
-        // "the worker finished the task" signal, so the send should fall through to its timeout.
-        for (int i = 0; i < 15; i++) inj.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of(), completed, "no completion is synthesized from an unconfirmed turn");
-    }
-
-    /** Captures both turn-lifecycle callbacks so the CB-109 stall path can be asserted. */
-    private static final class Captor implements TurnListener {
-        final List<String> completed = new ArrayList<>();
-        final List<String> failed = new ArrayList<>();
-
-        @Override
-        public void onTurnComplete(String target) {
-            completed.add(target);
-        }
-
-        @Override
-        public void onTurnFailed(String target) {
-            failed.add(target);
-        }
-    }
-
-    // ~30s of unknown at the 250ms prod poll interval; enough onStatus samples to trip the stall.
-    private static final int STALL_SAMPLES = 130;
-
-    @Test
-    void failsAnOutstandingDelegationWhoseWorkerWedgesInUnknown() {
-        Captor cap = new Captor();
-        Injector inj = new Injector(new AgentControl(herdr), cap);
-        inj.enqueue(T, "task");
-
-        inj.onStatus(T, AgentStatus.IDLE);    // deliver
-        inj.onStatus(T, AgentStatus.WORKING); // worker starts the turn
-        for (int i = 0; i < STALL_SAMPLES; i++) inj.onStatus(T, AgentStatus.UNKNOWN); // then wedges
-
-        assertEquals(List.of(T), cap.failed, "a sustained unknown streak fails the outstanding send");
-        assertEquals(List.of(), cap.completed, "a wedge is a failure, not a completion");
-        assertTrue(inj.activeTargets().isEmpty(), "the wedged target is reclaimed, not polled forever");
-    }
-
-    @Test
-    void aTransientUnknownGlitchNeitherFailsNorBlocksCompletion() {
-        Captor cap = new Captor();
-        Injector inj = new Injector(new AgentControl(herdr), cap);
-        inj.enqueue(T, "task");
-
-        inj.onStatus(T, AgentStatus.IDLE);    // deliver
-        inj.onStatus(T, AgentStatus.WORKING); // confirmed turn
-        for (int i = 0; i < 10; i++) inj.onStatus(T, AgentStatus.UNKNOWN); // brief glitch, well under grace
-        inj.onStatus(T, AgentStatus.IDLE);    // working → idle: the real completion
-
-        assertEquals(List.of(), cap.failed, "a short unknown blip must not fail the turn");
-        assertEquals(List.of(T), cap.completed, "the streak reset, so the turn still completes");
-    }
-
-    @Test
-    void sendFailureDropsMessageAndFailsItsFuture() {
-        FakeHerdr failing = new FakeHerdr().agentSendFailsWith("send_failed");
-        Injector inj = new Injector(new AgentControl(failing));
-        CompletableFuture<Void> f = inj.enqueue(T, "boom");
-
-        inj.onStatus(T, AgentStatus.IDLE);
-        assertTrue(f.isCompletedExceptionally());
-        assertTrue(inj.activeTargets().isEmpty(), "poisoned message is dropped, not left blocking the queue");
-    }
-
-    @Test
-    void dropFailsPendingWaiters() {
-        CompletableFuture<Void> f = injector.enqueue(T, "orphan");
-        injector.drop(T, new HerdrException("worker gone", "pane_not_found", null));
-        assertTrue(f.isCompletedExceptionally(), "queued waiters unblock when the worker vanishes");
-    }
-
-    @Test
-    void dropFailsTheTurnOfADeliveredMessageWhenTheWorkerVanishes() {
-        // CB-110: the message was delivered (no longer queued), so failing queued waiters alone would
-        // leave its send hanging. A vanished worker must fail that in-flight turn too.
-        Captor cap = new Captor();
-        Injector inj = new Injector(new AgentControl(herdr), cap);
-        inj.enqueue(T, "task");
-        inj.onStatus(T, AgentStatus.IDLE);    // deliver
-        inj.onStatus(T, AgentStatus.WORKING); // turn running
-
-        inj.drop(T, new HerdrException("worker gone", "pane_not_found", null));
-        assertEquals(List.of(T), cap.failed, "a worker that vanishes mid-turn fails its in-flight send");
-    }
-
-    @Test
-    void dropFailsADeliveredTurnThatVanishesBeforePickupIsConfirmed() {
-        // Delivered but no WORKING sampled yet (awaitingCompletion=true, awaitingPickup still true,
-        // turnObserved=false) — a distinct state the other two drop tests don't cover. (Gap surfaced
-        // by an off-sub worker's review of CB-110, delegated through the bridge.)
-        Captor cap = new Captor();
-        Injector inj = new Injector(new AgentControl(herdr), cap);
-        inj.enqueue(T, "task");
-        inj.onStatus(T, AgentStatus.IDLE); // deliver; pickup never confirmed
-
-        inj.drop(T, new HerdrException("worker gone", "pane_not_found", null));
-        assertEquals(List.of(T), cap.failed, "a delivery that vanishes before pickup still fails its send");
-    }
-
-    // ~60s of idle-but-not-ready at the 250ms prod poll interval; enough to trip the readiness grace.
-    private static final int READINESS_SAMPLES = 245;
-
-    @Test
-    void failsAQueuedMessageWhoseWorkerNeverBecomesReady() {
-        // CB-114: herdr keeps reporting the worker idle, but its Claude never connects the bridge MCP,
-        // so the readiness gate never opens. The message must not be held (and the target polled)
-        // forever — after the grace it fails, the caller unblocks via the worker-failure path, the
-        // target is reclaimed, and the never-set presence is cleared.
-        Captor cap = new Captor();
-        List<String> forgotten = new ArrayList<>();
-        Injector inj = new Injector(new AgentControl(herdr), cap, _ -> false, forgotten::add);
-        CompletableFuture<Void> f = inj.enqueue(T, "task");
-
-        for (int i = 0; i < READINESS_SAMPLES; i++) inj.onStatus(T, AgentStatus.IDLE);
-
-        assertEquals(List.of(), sent(), "a never-ready worker is never delivered to");
-        assertTrue(f.isCompletedExceptionally(), "the caller's future fails instead of hanging forever");
-        assertEquals(List.of(T), cap.failed, "the awaiting send resolves through the worker-failure path");
-        assertEquals(List.of(), cap.completed, "a never-ready worker is a failure, not a completion");
-        assertEquals(List.of(T), forgotten, "the never-ready worker's presence is cleared");
-        assertTrue(inj.activeTargets().isEmpty(), "the target is reclaimed, not polled forever");
-    }
-
-    @Test
-    void aWorkerThatBecomesReadyWithinTheGraceIsDeliveredNormally() {
-        // The readiness grace must not fail a worker that is merely slow to boot: once it becomes
-        // available before the grace elapses, delivery proceeds as usual (the counter resets).
-        Set<String> ready = new java.util.HashSet<>();
-        Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, ready::contains, _ -> {
-        });
-        inj.enqueue(T, "task");
-
-        for (int i = 0; i < 100; i++) inj.onStatus(T, AgentStatus.IDLE); // still booting, well under grace
-        assertEquals(List.of(), sent());
-
-        ready.add(T); // MCP connects before the grace elapses
-        inj.onStatus(T, AgentStatus.IDLE);
-        assertEquals(List.of("task"), sent(), "a worker that connects within the grace is delivered to");
-    }
-
-    @Test
-    void dropClearsWorkerPresence() {
-        // CB-114 (finding #1): a vanished worker's readiness must be forgotten so a stale entry cannot
-        // linger past the worker's life (WorkerPresence.forget had no caller before this).
-        List<String> forgotten = new ArrayList<>();
-        Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, _ -> true, forgotten::add);
-        inj.enqueue(T, "orphan");
-        inj.drop(T, new HerdrException("worker gone", "pane_not_found", null));
-        assertEquals(List.of(T), forgotten, "drop clears the gone worker's presence");
-    }
-
-    @Test
-    void pollerDeliversToAnIdleWorker() throws Exception {
-        // End-to-end through the poller: idle worker → message delivered without manual onStatus.
-        FakeHerdr idle = new FakeHerdr().agentStatus("idle");
-        Injector inj = new Injector(new AgentControl(idle));
-        StatusPoller poller = new StatusPoller(new AgentControl(idle), inj, 10);
-        poller.start();
-        try {
-            CompletableFuture<Void> delivered = inj.enqueue(T, "via-poller");
-            delivered.get(2, TimeUnit.SECONDS); // completes when the poller drives the send
-        } finally {
-            poller.stop();
-        }
-        assertEquals(List.of("via-poller"), idle.calls.stream()
-                .filter(c -> c.method().equals("agent.prompt"))
-                .map(c -> {
-                    @SuppressWarnings("unchecked")
-                    Map<String, Object> p = (Map<String, Object>) c.params();
-                    return p.get("text").toString();
-                })
-                .toList());
-    }
-
-    @Test
-    void deliveredFutureCarriesSendFailure() {
-        FakeHerdr failing = new FakeHerdr().agentSendFailsWith("send_failed");
-        Injector inj = new Injector(new AgentControl(failing));
-        CompletableFuture<Void> f = inj.enqueue(T, "boom");
-        inj.onStatus(T, AgentStatus.IDLE);
-        ExecutionException ex = assertThrows(ExecutionException.class, f::get);
-        assertInstanceOf(HerdrException.class, ex.getCause());
-    }
-}

bridged/src/test/java/dev/ltms/bridged/mcp/BridgeMcpAuthzTest.java

@@ -1,201 +0,0 @@
-package dev.ltms.bridged.mcp;
-
-import dev.ltms.bridged.auth.Authz;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.Principal;
-import dev.ltms.bridged.auth.Role;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.PaneLocator;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.session.FakeWorktrees;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.worker.ClaudeCodeLauncher;
-import io.modelcontextprotocol.spec.McpSchema;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-
-import java.util.Map;
-import java.util.Set;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-513 — the CB-505 authorization gate on the <strong>MCP</strong> entry path.
- *
- * <p>Why this file exists: CB-505 claimed authorization is "enforced on both entry paths", and it
- * is — but only REST was ever tested ({@code BridgedAppAuthTest}). Coverage showed
- * {@code BridgeMcp.deny()}, {@code principal()} and every tool-registration lambda at <em>zero</em>
- * executed lines, because no test had ever constructed a {@code BridgeMcp} — the existing
- * {@code BridgeMcpTest} calls only the static handler methods. An unexercised security control is
- * a claim, not a control.
- *
- * <p>These tests construct a real {@code BridgeMcp} (which also exercises the constructor and the
- * tool wiring) and drive the policy half of the gate directly.
- */
-class BridgeMcpAuthzTest {
-
-    private final FakeHerdr herdr = new FakeHerdr();
-    private final AgentControl agents = new AgentControl(herdr);
-    private Metrics metrics;
-    private BridgeMcp mcp;
-
-    @AfterEach
-    void close() {
-        if (mcp != null) mcp.close();
-    }
-
-    /** A fully wired BridgeMcp on fakes — constructing it is itself part of what is under test. */
-    private BridgeMcp mcp(boolean enforce) {
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN", null,
-                "tab", "bridged-workers", "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(agents, new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> "tok");
-        SessionManager sessions = new SessionManager(workers, new FakeWorktrees());
-        MessageService messages = new MessageService(agents, new Injector(agents), new Rendezvous(),
-                new InMemoryReplyInbox());
-        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> 999_999);
-        metrics = BridgedMetrics.create(sessions, new InMemoryReplyInbox());
-
-        mcp = new BridgeMcp(messages, workers, sessions, identity, sessions.asPresence(),
-                new PrimaryRegistry(null),
-                enforce ? new CallerResolver(identity) : null,
-                metrics);
-        return mcp;
-    }
-
-    private static final Principal PRIMARY = Principal.primary(100);
-    private static final Principal WORKER_A = Principal.worker("term_a", 200);
-    private static final Principal ANON = Principal.anonymous();
-    private static final Principal ARCH_DESIGN = Principal.architect("lead-designer", "term_design", 400);
-
-    // --- the table, enforced on THIS path too ---------------------------------------------------
-
-    @Test
-    void primaryMayOrchestrate() {
-        BridgeMcp m = mcp(true);
-        for (Authz.Action a : new Authz.Action[]{Authz.Action.SPAWN, Authz.Action.STOP,
-                Authz.Action.SEND, Authz.Action.DRAIN, Authz.Action.READ}) {
-            assertNull(m.denyFor(PRIMARY, a, "term_a"), a + " is the primary's to perform");
-        }
-    }
-
-    @Test
-    void aWorkerMayNotOrchestrateOverMcp() {
-        BridgeMcp m = mcp(true);
-        for (Authz.Action a : new Authz.Action[]{Authz.Action.SPAWN, Authz.Action.STOP,
-                Authz.Action.SEND, Authz.Action.DRAIN}) {
-            McpSchema.CallToolResult denied = m.denyFor(WORKER_A, a, "term_a");
-            assertNotNull(denied, a + " must be refused to a worker");
-            assertTrue(denied.isError(), "a refusal is returned as an MCP tool error");
-        }
-    }
-
-    @Test
-    void aWorkerMayReplyAndAskOnlyAsItself() {
-        BridgeMcp m = mcp(true);
-        assertNull(m.denyFor(WORKER_A, Authz.Action.REPLY, "term_a"), "its own session is allowed");
-        assertNull(m.denyFor(WORKER_A, Authz.Action.ASK, "term_a"));
-
-        assertNotNull(m.denyFor(WORKER_A, Authz.Action.REPLY, "term_b"),
-                "worker A must not reply on worker B's session");
-        assertNotNull(m.denyFor(WORKER_A, Authz.Action.ASK, "term_b"));
-    }
-
-    @Test
-    void thePrimaryMayNotForgeAWorkerReplyOverMcp() {
-        BridgeMcp m = mcp(true);
-        // A forged reply would resolve the very rendezvous the primary is blocked on.
-        assertNotNull(m.denyFor(PRIMARY, Authz.Action.REPLY, "term_a"));
-        assertNotNull(m.denyFor(PRIMARY, Authz.Action.ASK, "term_a"));
-    }
-
-    // --- CB-548: the architect on this path ------------------------------------------------
-
-    @Test
-    void anArchitectMaySendAndReadButNotOrchestrateOverMcp() {
-        BridgeMcp m = mcp(true);
-        assertNull(m.denyFor(ARCH_DESIGN, Authz.Action.SEND, "term_a"),
-                "delegating a turn is the architect's job");
-        assertNull(m.denyFor(ARCH_DESIGN, Authz.Action.READ, null));
-
-        for (Authz.Action a : new Authz.Action[]{Authz.Action.SPAWN, Authz.Action.STOP,
-                Authz.Action.DRAIN}) {
-            McpSchema.CallToolResult denied = m.denyFor(ARCH_DESIGN, a, null);
-            assertNotNull(denied, a + " must be refused to an architect");
-            assertTrue(denied.isError(), "a refusal is returned as an MCP tool error");
-        }
-    }
-
-    @Test
-    void anArchitectMayReplyAndAskOnlyAsItsOwnPaneOverMcp() {
-        BridgeMcp m = mcp(true);
-        assertNull(m.denyFor(ARCH_DESIGN, Authz.Action.REPLY, "term_design"));
-        assertNull(m.denyFor(ARCH_DESIGN, Authz.Action.ASK, "term_design"));
-
-        assertNotNull(m.denyFor(ARCH_DESIGN, Authz.Action.REPLY, "term_a"),
-                "architect 'lead-designer' must not reply on worker term_a's session");
-    }
-
-    @Test
-    void anonymousIsRefusedEverythingAndCountedAsUnauthenticated() {
-        BridgeMcp m = mcp(true);
-        McpSchema.CallToolResult denied = m.denyFor(ANON, Authz.Action.READ, null);
-
-        assertNotNull(denied, "authenticated as nothing ⇒ authorized for nothing");
-        assertEquals(1, metrics.count(BridgedMetrics.AUTH_FAILURES, "reason", "unauthenticated"));
-        assertEquals(0, metrics.count(BridgedMetrics.AUTH_FAILURES, "reason", "forbidden"),
-                "a missing credential is 401-shaped, not 403-shaped");
-    }
-
-    @Test
-    void aWrongRoleIsCountedAsForbiddenNotUnauthenticated() {
-        BridgeMcp m = mcp(true);
-        assertNotNull(m.denyFor(WORKER_A, Authz.Action.SPAWN, null));
-
-        assertEquals(1, metrics.count(BridgedMetrics.AUTH_FAILURES, "reason", "forbidden"));
-        assertEquals(0, metrics.count(BridgedMetrics.AUTH_FAILURES, "reason", "unauthenticated"),
-                "the caller IS authenticated — it is just not the right role");
-    }
-
-    @Test
-    void theLegacyConstructorLeavesTheGateOpen() {
-        // The 22 pre-existing BridgeMcpTest cases rely on no authorization being enforced.
-        BridgeMcp m = mcp(false);
-        assertNull(m.denyFor(ANON, Authz.Action.SPAWN, null),
-                "no CallerResolver supplied ⇒ authorization not enforced (legacy behaviour)");
-    }
-
-    // --- identity reconstruction from the transport context ------------------------------------
-
-    @Test
-    void principalIsRebuiltFromTheStashedRole() {
-        assertEquals(Role.WORKER, BridgeMcp.principalFrom("WORKER", "term_a", 7).role());
-        assertEquals("term_a", BridgeMcp.principalFrom("WORKER", "term_a", 7).terminal());
-        assertEquals(Role.PRIMARY, BridgeMcp.principalFrom("PRIMARY", null, 7).role());
-        assertEquals(Role.ANONYMOUS, BridgeMcp.principalFrom("ANONYMOUS", null, -1).role());
-        // CB-548: an architect round-trips through the same stash, carrying its slot name.
-        Principal arch = BridgeMcp.principalFrom("ARCHITECT", "term_design", 7, "lead-designer");
-        assertEquals(Role.ARCHITECT, arch.role());
-        assertEquals("lead-designer", arch.name());
-        assertEquals("term_design", arch.terminal());
-    }
-
-    @Test
-    void aMissingRoleFallsBackToTheHistoricalInterpretation() {
-        // Legacy path: no role stashed. A terminal means worker; its absence meant "the primary",
-        // which is exactly the pre-CB-501 default CB-501 inverted — preserved only here.
-        assertEquals(Role.WORKER, BridgeMcp.principalFrom(null, "term_a", 7).role());
-        assertEquals(Role.PRIMARY, BridgeMcp.principalFrom(null, null, 7).role());
-    }
-}

bridged/src/test/java/dev/ltms/bridged/mcp/BridgeMcpTest.java

@@ -1,487 +0,0 @@
-package dev.ltms.bridged.mcp;
-
-import dev.ltms.bridged.auth.Principal;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.session.FakeWorktrees;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.WorkerSession;
-import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.worker.ClaudeCodeLauncher;
-import io.modelcontextprotocol.spec.McpSchema;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * Parity tests for the MCP tool adapters — they must produce the same outcomes as the REST routes,
- * since both drive the same {@link MessageService}/{@link Rendezvous}. The MCP wire protocol itself
- * is the SDK's concern; here we test the thin adapter logic directly.
- */
-class BridgeMcpTest {
-
-    private static final String T = "term_a";
-
-    private final FakeHerdr herdr = new FakeHerdr();
-    private final AgentControl agents = new AgentControl(herdr);
-    private final Rendezvous rendezvous = new Rendezvous();
-    private final InMemoryReplyInbox inbox = new InMemoryReplyInbox();
-    private final MessageService messages = new MessageService(agents, new Injector(agents), rendezvous, inbox);
-
-    @BeforeEach
-    void setUp() {
-        // CB-520: the inbox only peeks/acks targets it owns.
-        inbox.own(T);
-    }
-
-    private static String textOf(McpSchema.CallToolResult r) {
-        return ((McpSchema.TextContent) r.content().getFirst()).text();
-    }
-
-    private static ClaudeCodeLauncher workerService(FakeHerdr h, String baseUrl, Set<String> allow) {
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", baseUrl, "coder", null, "BRIDGED_WORKER_TOKEN", null,
-                "tab", "bridged-workers", "worker: {profile} #{n}", null, null, null);
-        return new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
-                new SubscriptionGuard(allow), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> "tok");
-    }
-
-    private static SessionManager sessionManager(FakeHerdr h, String baseUrl, Set<String> allow) {
-        return new SessionManager(workerService(h, baseUrl, allow));
-    }
-
-    @Test
-    void sendThenReplyRoundTrips() throws Exception {
-        // bridge_send blocks; bridge_reply resolves it with the worker's structured answer.
-        CompletableFuture<McpSchema.CallToolResult> send = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.send(messages, "term_a", "review this", 4000L));
-
-        // Wait until the send has opened its waiter so the reply resolves it (CB-307: reply now
-        // queues in the inbox if no waiter is open, which would break the round-trip).
-        long deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            //noinspection BusyWait
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"), "send should have opened its waiter");
-
-        McpSchema.CallToolResult reply = BridgeMcp.reply(messages, "term_a", "LGTM");
-        assertEquals("delivered", textOf(reply));
-
-        McpSchema.CallToolResult res = send.get(6, TimeUnit.SECONDS);
-        assertNotEquals(Boolean.TRUE, res.isError());
-        assertEquals("LGTM", textOf(res));
-    }
-
-    @Test
-    void asyncSendReturnsATicketThenPollReportsTheReply() throws Exception {
-        // wait:false parity — a ticket is issued, resolved by a reply, and surfaced by bridge_poll.
-        McpSchema.CallToolResult accepted = BridgeMcp.sendAsync(messages, "term_a", "do it");
-        assertNotEquals(Boolean.TRUE, accepted.isError());
-        String out = textOf(accepted);
-        assertTrue(out.contains("ticket="), out);
-        String ticket = out.substring(out.indexOf("ticket=") + "ticket=".length()).trim();
-
-        // Wait until the send has opened its waiter before replying (CB-307: reply never errors,
-        // so the old retry-on-error pattern no longer works — it would queue instead of resolve).
-        long deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            //noinspection BusyWait
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"), "send should have opened its waiter");
-
-        McpSchema.CallToolResult reply = BridgeMcp.reply(messages, "term_a", "async LGTM");
-        assertEquals("delivered", textOf(reply));
-
-        // Poll until the async send completes and reports the reply.
-        McpSchema.CallToolResult polled = BridgeMcp.poll(messages, ticket, null);
-        deadline = System.currentTimeMillis() + 3000;
-        while (!textOf(polled).contains("async LGTM") && System.currentTimeMillis() < deadline) {
-            //noinspection BusyWait
-            Thread.sleep(10);
-            polled = BridgeMcp.poll(messages, ticket, null);
-        }
-        assertEquals("async LGTM", textOf(polled));
-    }
-
-    @Test
-    void pollUnknownTicketIsAnError() {
-        McpSchema.CallToolResult res = BridgeMcp.poll(messages, "task-999", null);
-        assertTrue(res.isError());
-        assertTrue(textOf(res).contains("unknown ticket"));
-    }
-
-    @Test
-    void sendTimesOutWithAWorkingNote() {
-        McpSchema.CallToolResult res = BridgeMcp.send(messages, "term_a", "hi", 120L);
-        assertNotEquals(Boolean.TRUE, res.isError(), "a timeout is informational, not a tool error");
-        assertTrue(textOf(res).contains("no reply"), "got: " + textOf(res));
-    }
-
-    @Test
-    void sendRejectsMissingArgs() {
-        assertTrue(BridgeMcp.send(messages, null, "hi", null).isError());
-        assertTrue(BridgeMcp.send(messages, "term_a", "  ", null).isError());
-    }
-
-    @Test
-    void replyWithNoPendingSendIsQueuedNotError() {
-        // CB-307: a reply with no open send is now queued in the inbox, not an error.
-        McpSchema.CallToolResult res = BridgeMcp.reply(messages, "term_a", "orphan");
-        assertNotEquals(Boolean.TRUE, res.isError(), "a queued reply is not an error");
-        assertEquals("delivered", textOf(res));
-
-        // The reply is drainable by target.
-        var drained = messages.drainReplies("term_a");
-        assertEquals(1, drained.size());
-        assertEquals("orphan", drained.getFirst().content());
-    }
-
-    @Test
-    void bridgePollWithTargetDrainsReplies() {
-        // A reply with no open send queues it in the inbox.
-        BridgeMcp.reply(messages, "term_a", "queued-msg");
-
-        // bridge_poll with target drains the inbox.
-        McpSchema.CallToolResult res = BridgeMcp.poll(messages, null, "term_a");
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String text = textOf(res);
-        assertTrue(text.contains("queued-msg"), "the drained reply should appear in the result");
-
-        // Second drain returns empty.
-        McpSchema.CallToolResult empty = BridgeMcp.poll(messages, null, "term_a");
-        assertEquals("[]", textOf(empty));
-    }
-
-    @Test
-    void askThenAnswerRoundTrips() throws Exception {
-        // The primary delegates and blocks; wait until its waiter is open before the worker asks.
-        CompletableFuture<McpSchema.CallToolResult> send = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.send(messages, "term_a", "do X", 5000L));
-        long deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            //noinspection BusyWait
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"), "the send must be waiting for the ask to surface to");
-
-        // The worker asks mid-turn; the call blocks for the primary's answer.
-        CompletableFuture<McpSchema.CallToolResult> ask = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.ask(messages, "term_a", "which config?", 5000L));
-
-        // The primary's send unblocks with the question and a turnId to answer on.
-        McpSchema.CallToolResult q = send.get(6, TimeUnit.SECONDS);
-        assertNotEquals(Boolean.TRUE, q.isError());
-        String qt = textOf(q);
-        assertTrue(qt.contains("[question]"), qt);
-        String afterMarker = qt.substring(qt.indexOf("turnId=\"") + "turnId=\"".length());
-        String turnId = afterMarker.substring(0, afterMarker.indexOf('"'));
-
-        // The primary answers via bridge_send(turnId); this blocks again for the worker's reply.
-        CompletableFuture<McpSchema.CallToolResult> answer = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.answer(messages, turnId, "config.yaml", 5000L));
-
-        // The worker's ask returns the answer — it resumes the same turn.
-        assertEquals("config.yaml", textOf(ask.get(6, TimeUnit.SECONDS)));
-
-        // The resumed worker replies, resolving the answering send (wait for the reopened waiter).
-        deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            //noinspection BusyWait
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"), "the answer should have reopened a waiter");
-        McpSchema.CallToolResult reply = BridgeMcp.reply(messages, "term_a", "done");
-        assertEquals("delivered", textOf(reply));
-        assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
-    }
-
-    @Test
-    void askFromANonWorkerConnectionIsAnError() {
-        McpSchema.CallToolResult res = BridgeMcp.ask(messages, null, "which config?", 500L);
-        assertTrue(res.isError());
-        assertTrue(textOf(res).contains("workers only"), textOf(res));
-    }
-
-    @Test
-    void answerToAStaleTurnIsAnError() {
-        McpSchema.CallToolResult res = BridgeMcp.answer(messages, "term_a#999", "too late", 500L);
-        assertTrue(res.isError());
-        assertTrue(textOf(res).contains("no longer open"), textOf(res));
-    }
-
-    @Test
-    void spawnReturnsTheNewWorkersSessionAndPane() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sm = sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        McpSchema.CallToolResult res = BridgeMcp.spawn(sm, null);
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"sessionId\":\"term_new_1\""), out);
-        // CB-519: the "paneId" wire field now carries the host-unique opaque id, not the herdr pane.
-        WorkerSession s = sm.roster().getFirst();
-        assertTrue(out.contains("\"paneId\":\"" + s.paneId() + "\""), out);
-        assertNotEquals("w9:pRoot_1", s.paneId(), "the id is decoupled from the herdr pane coordinate");
-        assertTrue(out.contains("\"status\":\"spawning\""), out);
-    }
-
-    @Test
-    void spawnRejectsAnOffAllowlistProfileWithoutTouchingHerdr() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res =
-                BridgeMcp.spawn(sessionManager(h, "https://api.anthropic.com", Set.of("gx00.gw")), null);
-        assertTrue(res.isError());
-        assertTrue(textOf(res).contains("subscription boundary"));
-        assertFalse(h.called("agent.start"), "the guard must block before any spawn");
-    }
-
-    @Test
-    void spawnRejectsAnUnknownProfileAsAnError() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res =
-                BridgeMcp.spawn(sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), "nope");
-        assertTrue(res.isError());
-        assertTrue(textOf(res).contains("unknown worker profile"), textOf(res));
-    }
-
-    @Test
-    void spawnPassesTheRequestedCwdToTheWorker() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.spawn(
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), null, "/req/dir", null, null, null);
-        assertNotEquals(Boolean.TRUE, res.isError());
-        // Protocol 19: the requested cwd roots the worker's pane at creation (tab.create).
-        @SuppressWarnings("unchecked")
-        Map<String, Object> create = (Map<String, Object>) h.lastCall("tab.create").params();
-        assertEquals("/req/dir", create.get("cwd"));
-    }
-
-    @Test
-    void profilesListsConfiguredProfilesAndDefault() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.profiles(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("ltms-local"), out);
-        assertTrue(out.contains("\"default\":\"ltms-local\""), out);
-    }
-
-    @Test
-    void listReportsTrackedWorkers() {
-        FakeHerdr h = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), worktrees);
-        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
-                new WorktreeRequest("cb-304", null));
-
-        McpSchema.CallToolResult res = BridgeMcp.listFleet(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, Map.of(), "");
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"sessionId\":\"" + s.terminalId() + "\""), out);
-        assertTrue(out.contains("\"paneId\":\"" + s.paneId() + "\""), out);
-        assertTrue(out.contains("\"profile\":\"ltms-local\""), out);
-        assertTrue(out.contains("\"state\":\"spawning\""), out);
-        assertTrue(out.contains("\"worktree\":\"" + s.worktree() + "\""), out);
-        assertTrue(out.contains("\"branch\":\"" + s.branch() + "\""), out);
-        assertTrue(out.contains("\"owner\":\"term_primary\""), out);
-        assertTrue(out.contains("\"liveStatus\":\"unknown\""), out);
-    }
-
-    @Test
-    void listReportsLeadsAndFlagsTheCallersOwnRow() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-
-        McpSchema.CallToolResult res = BridgeMcp.listFleet(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions,
-                Map.of("term_me", "opus-5.0", "term_peer", "gpt-sol-5.6"), "term_me");
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"name\":\"opus-5.0\""), out);
-        assertTrue(out.contains("\"name\":\"gpt-sol-5.6\""), out);
-        assertTrue(out.contains("\"sessionId\":\"term_peer\""), out);
-        // The caller's own row is flagged, and only the caller's — a peer must be distinguishable
-        // from self without a second bridge_whoami call.
-        assertEquals(1, out.split("\"self\":true", -1).length - 1, out);
-        assertTrue(out.indexOf("term_me") < out.indexOf("\"self\":true"), out);
-    }
-
-    @Test
-    void listReportsBothHalvesEvenWhenEmpty() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-
-        McpSchema.CallToolResult res = BridgeMcp.listFleet(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, Map.of(), "");
-
-        // An absent "leads" key is what made an empty worker roster read as "no peers" (CB-535).
-        String out = textOf(res);
-        assertTrue(out.contains("\"leads\":[]"), out);
-        assertTrue(out.contains("\"workers\":[]"), out);
-    }
-
-    @Test
-    void listReportsALeadHerdrCannotSeeAsUnknown() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-
-        McpSchema.CallToolResult res = BridgeMcp.listFleet(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions,
-                Map.of("term_ghost", "gone-away"), "term_me");
-
-        // Reported, not hidden: an unreachable peer is exactly what a would-be sender needs to see.
-        String out = textOf(res);
-        assertTrue(out.contains("\"name\":\"gone-away\""), out);
-        assertTrue(out.contains("\"status\":\"unknown\""), out);
-    }
-
-    @Test
-    void stopTearsDownAWorkerByPane() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.stop(
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), "w9:pW");
-        assertNotEquals(Boolean.TRUE, res.isError());
-        assertEquals("stopped w9:pW", textOf(res));
-        assertTrue(h.called("pane.close"));
-    }
-
-    @Test
-    void stopRequiresAPaneId() {
-        FakeHerdr h = new FakeHerdr();
-        assertTrue(BridgeMcp.stop(
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), "  ").isError());
-    }
-
-    @Test
-    void bridgeAckReturnsConfirmationForValidArgs() {
-        McpSchema.CallToolResult res = BridgeMcp.ack(messages, "term_a", "msg-1");
-        assertNotEquals(Boolean.TRUE, res.isError());
-        assertTrue(textOf(res).contains("msg-1"), "response should mention the msgId");
-    }
-
-    @Test
-    void bridgeAckRejectsMissingArgs() {
-        assertTrue(BridgeMcp.ack(messages, null, "msg-1").isError());
-        assertTrue(BridgeMcp.ack(messages, "term_a", null).isError());
-        assertTrue(BridgeMcp.ack(messages, "  ", "msg-1").isError());
-    }
-
-    @Test
-    void bridgeAckRemovesSpecificReply() {
-        // Queue a reply and capture its msgId.
-        BridgeMcp.reply(messages, "term_a", "orphan");
-        var before = messages.drainReplies("term_a");
-        assertEquals(1, before.size(), "one reply in the inbox");
-        String msgId = before.getFirst().msgId();
-
-        // Publish the same reply again and ack it via bridge_ack surface.
-        BridgeMcp.reply(messages, "term_a", "orphan-again");
-        var peeked = messages.drainReplies("term_a");
-        assertEquals(1, peeked.size(), "one fresh reply in the inbox");
-
-        // ackReply works (no-op since published with a different UUID, but callable).
-        assertDoesNotThrow(() -> messages.ackReply("term_a", msgId));
-    }
-
-    @Test
-    void statusReportsLiveAgentStatus() {
-        FakeHerdr blocked = new FakeHerdr().agentStatus("blocked");
-        AgentControl blockedAgents = new AgentControl(blocked);
-        McpSchema.CallToolResult res = BridgeMcp.status(
-                new MessageService(blockedAgents, new Injector(blockedAgents), rendezvous), "term_a");
-        assertNotEquals(Boolean.TRUE, res.isError());
-        assertEquals("blocked", textOf(res));
-    }
-
-    // --- bridge_whoami: the caller's own identity, so an agent never has to guess its role -------
-
-    @Test
-    void whoamiReportsThePrimaryAsPrimaryAndNothingElse() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.whoami(
-                Principal.primary(100), sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"role\":\"primary\""), out);
-        // The primary owns no session — leaking a sessionId here would invite it to reply as one.
-        assertFalse(out.contains("sessionId"), out);
-    }
-
-    @Test
-    void whoamiReportsAWorkerWithItsRegisteredSession() {
-        FakeHerdr h = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        SessionManager sessions = new SessionManager(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), worktrees);
-        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
-                new WorktreeRequest("cb-517", null));
-
-        McpSchema.CallToolResult res = BridgeMcp.whoami(Principal.worker(s.terminalId(), 200), sessions);
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"role\":\"worker\""), out);
-        assertTrue(out.contains("\"sessionId\":\"" + s.terminalId() + "\""), out);
-        assertTrue(out.contains("\"profile\":\"ltms-local\""), out);
-        assertTrue(out.contains("\"worktree\":\"" + s.worktree() + "\""), out);
-        assertTrue(out.contains("\"branch\":\"" + s.branch() + "\""), out);
-        assertTrue(out.contains("\"owner\":\"term_primary\""), out);
-    }
-
-    /**
-     * A worker the registry has no record of — it outlived a daemon restart — must still learn the
-     * load-bearing fact. Degrading to "I don't know who you are" would put it back to guessing,
-     * which is the failure this tool exists to remove.
-     */
-    @Test
-    void whoamiStillReportsWorkerRoleWhenTheSessionIsUnregistered() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.whoami(Principal.worker("term_orphan", 200),
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"role\":\"worker\""), out);
-        assertTrue(out.contains("\"sessionId\":\"term_orphan\""), out);
-        assertFalse(out.contains("profile"), out); // nothing invented for a session we don't track
-    }
-
-    /**
-     * CB-548: an architect reports its role and which gateway-local slot its pane is bound to —
-     * the same shape as a lead, under the architect key, so it can tell a peer where to reach it.
-     */
-    @Test
-    void whoamiReportsAnArchitectWithItsSlotAndPane() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.whoami(
-                Principal.architect("lead-designer", "term_design", 400),
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"role\":\"architect\""), out);
-        assertTrue(out.contains("\"architect\":\"lead-designer\""), out);
-        assertTrue(out.contains("\"sessionId\":\"term_design\""), out);
-    }
-}

bridged/src/test/java/dev/ltms/bridged/mcp/ConnectionIdentityTest.java

@@ -1,46 +0,0 @@
-package dev.ltms.bridged.mcp;
-
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.PaneLocator;
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/** Connection → caller-identity resolution, with the OS peer-PID lookup faked. */
-class ConnectionIdentityTest {
-
-    private final FakeHerdr herdr = new FakeHerdr();
-
-    private ConnectionIdentity with(PeerPidLookup pids) {
-        return new ConnectionIdentity(new PaneLocator(herdr), pids);
-    }
-
-    @Test
-    void resolvesWorkerFromLoopbackPeerPid() {
-        assertEquals("term_a", with(_ -> FakeHerdr.WORKER_PID).callerTerminal("127.0.0.1", 55555));
-    }
-
-    @Test
-    void nullForOffHostCaller() {
-        // A non-loopback peer can't be an on-host worker → treat as primary/unknown.
-        assertNull(with(_ -> FakeHerdr.WORKER_PID).callerTerminal("10.0.0.9", 55555));
-    }
-
-    @Test
-    void nullWhenPidOwnsNoPane() {
-        // e.g. the primary — its PID maps to no worker pane.
-        assertNull(with(_ -> 999_999).callerTerminal("127.0.0.1", 55555));
-    }
-
-    @Test
-    void resolvesTheCallersPidAndCwd() {
-        // CB-112: the primary maps to no pane, but its PID and cwd are still readable.
-        ConnectionIdentity id = new ConnectionIdentity(
-                new PaneLocator(herdr), _ -> 999_999, pid -> pid == 999_999 ? "/main/project" : null);
-        ConnectionIdentity.Caller c = id.resolve("127.0.0.1", 55555);
-        assertNull(c.terminal(), "the primary owns no worker pane");
-        assertEquals(999_999, c.pid());
-        assertEquals("/main/project", id.cwdForPid(c.pid()), "the primary's cwd is resolvable from its PID");
-        assertNull(id.cwdForPid(-1), "no cwd for an unresolved PID");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/msg/MessageServiceTest.java

@@ -1,475 +0,0 @@
-package dev.ltms.bridged.msg;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.Injector;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * The message layer's resolution paths (CB-104 reply + CB-106 completion fallback). The turn is
- * driven deterministically by feeding {@code onStatus} rather than running a real poller.
- */
-class MessageServiceTest {
-
-    private static final String T = "term_a";
-
-    private final FakeHerdr herdr = new FakeHerdr().readText("BUILD GREEN: 391 files");
-    private final AgentControl agents = new AgentControl(herdr);
-    private final Rendezvous rendezvous = new Rendezvous();
-    private final CompletionResolver completion = new CompletionResolver(agents, rendezvous);
-    private final Injector injector = new Injector(agents, completion);
-    private final InMemoryReplyInbox inbox = new InMemoryReplyInbox();
-    private final MessageService messages = new MessageService(agents, injector, rendezvous, inbox);
-
-    @BeforeEach
-    void setUp() {
-        // CB-520: the inbox only peeks/acks targets it owns.
-        inbox.own(T);
-    }
-
-    /** Run {@code send} on a background thread; the current thread drives the worker's turn. */
-    private CompletableFuture<MessageService.Reply> sendAsync() {
-        return CompletableFuture.supplyAsync(() -> messages.send(T, "do the task", 5000));
-    }
-
-    private void awaitWaiting() throws InterruptedException {
-        long deadline = System.currentTimeMillis() + 2000;
-        while (!rendezvous.isWaiting(T) && System.currentTimeMillis() < deadline) {
-            //noinspection BusyWait
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting(T), "send should have opened its rendezvous waiter");
-    }
-
-    @Test
-    void completionFallbackResolvesATurnThatNeverCalledBridgeReply() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitWaiting();
-
-        herdr.readText("$ prompt");                // pre-turn pane: no answer yet (baseline reference)
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver the task (baselines the pre-turn content)
-        injector.onStatus(T, AgentStatus.WORKING); // worker picks it up and works
-        herdr.readText("BUILD GREEN: 391 files");  // the worker's turn produced new output
-        injector.onStatus(T, AgentStatus.IDLE);    // working → idle: turn complete, no bridge_reply
-
-        MessageService.Reply reply = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.COMPLETED_UNREPLIED, reply.outcome(),
-                "an unreplied but finished turn resolves via the completion fallback");
-        assertEquals("BUILD GREEN: 391 files", reply.text(), "the scraped transcript tail is returned");
-        assertTrue(reply.completed(), "a scraped completion still counts as completed");
-    }
-
-    @Test
-    void explicitBridgeReplyResolvesAsReplied() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitWaiting();
-
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver
-        injector.onStatus(T, AgentStatus.WORKING); // worker working
-        assertTrue(rendezvous.resolve(T, "LGTM ship it"), "an explicit reply resolves the send");
-
-        MessageService.Reply reply = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.REPLIED, reply.outcome());
-        assertEquals("LGTM ship it", reply.text());
-    }
-
-    @Test
-    void aWedgedWorkerResolvesTheSendAsFailedWithTheErrorContext() throws Exception {
-        herdr.readText("API Error: Unable to connect to API (ENOTFOUND)");
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitWaiting();
-
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver
-        injector.onStatus(T, AgentStatus.WORKING); // worker starts the turn
-        for (int i = 0; i < 130; i++) injector.onStatus(T, AgentStatus.UNKNOWN); // then wedges (CB-109)
-
-        MessageService.Reply reply = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.WORKER_FAILED, reply.outcome());
-        assertFalse(reply.completed(), "a wedge is terminal but not a successful completion");
-        assertTrue(reply.text().contains("ENOTFOUND"), "the error screen is carried as the failure reason");
-    }
-
-    @Test
-    void aWorkerThatVanishesMidTurnResolvesTheSendAsFailed() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitWaiting();
-
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver
-        injector.onStatus(T, AgentStatus.WORKING); // worker starts the turn
-        // The worker's pane crashes — the poller sees a *_not_found and drops it (CB-110).
-        injector.drop(T, new HerdrException("worker gone", "pane_not_found", null));
-
-        MessageService.Reply reply = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.WORKER_FAILED, reply.outcome(),
-                "a delivered send whose worker vanishes fails instead of hanging to the timeout");
-        assertFalse(reply.completed());
-    }
-
-    // --- bridge_ask reverse rendezvous (CB-205) ------------------------------------------------
-
-    @Test
-    void askSurfacesAsAQuestionAndTheAnswerResumesTheSameTurn() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitWaiting();
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver
-        injector.onStatus(T, AgentStatus.WORKING); // worker picks it up, then pauses to ask
-
-        // The worker asks mid-turn on its own thread; the call blocks for the primary's answer.
-        CompletableFuture<MessageService.AskResult> ask =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config file?", 5000));
-
-        // The primary's blocking send unblocks with the question and a turnId to answer on.
-        MessageService.Reply q = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.QUESTION, q.outcome());
-        assertEquals("which config file?", q.text());
-        assertNotNull(q.turnId(), "a question carries a turnId to answer on");
-
-        // The primary answers via bridge_send(turnId); this blocks again for the worker's reply.
-        CompletableFuture<MessageService.Reply> answer =
-                CompletableFuture.supplyAsync(() -> messages.answer(q.turnId(), "config.yaml", 5000));
-
-        // The worker's ask returns the answer — it resumes the same turn.
-        MessageService.AskResult a = ask.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.AskOutcome.ANSWERED, a.outcome());
-        assertEquals("config.yaml", a.answer());
-
-        // The resumed worker finishes with a structured reply, resolving the answering send.
-        awaitWaiting(); // the answering send has (re)opened its forward waiter
-        assertTrue(rendezvous.resolve(T, "done"), "the worker's final reply resolves the answering send");
-        MessageService.Reply done = answer.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.REPLIED, done.outcome());
-        assertEquals("done", done.text());
-    }
-
-    @Test
-    void duplicateAsksFromTheSameSessionCoalesceToOneTurn() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitWaiting();
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver
-        injector.onStatus(T, AgentStatus.WORKING); // worker picks it up, then pauses to ask
-
-        // A transport retry: two concurrent bridge_ask calls from the same worker session.
-        CompletableFuture<MessageService.AskResult> ask1 =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config file?", 5000));
-        CompletableFuture<MessageService.AskResult> ask2 =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config file?", 5000));
-
-        // The primary's single blocked send surfaces exactly ONE question (one turnId).
-        MessageService.Reply q = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.QUESTION, q.outcome());
-        assertEquals("which config file?", q.text());
-        assertNotNull(q.turnId(), "only one turnId should be minted");
-
-        // The primary answers that one turnId; both asks unblock with the same answer.
-        CompletableFuture<MessageService.Reply> answer =
-                CompletableFuture.supplyAsync(() -> messages.answer(q.turnId(), "config.yaml", 5000));
-
-        MessageService.AskResult a1 = ask1.get(5, TimeUnit.SECONDS);
-        MessageService.AskResult a2 = ask2.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.AskOutcome.ANSWERED, a1.outcome());
-        assertEquals("config.yaml", a1.answer());
-        assertEquals(MessageService.AskOutcome.ANSWERED, a2.outcome());
-        assertEquals("config.yaml", a2.answer());
-
-        // The resumed worker finishes with a structured reply, resolving the answering send.
-        awaitWaiting();
-        assertTrue(rendezvous.resolve(T, "done"), "the worker's final reply resolves the answering send");
-        MessageService.Reply done = answer.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.REPLIED, done.outcome());
-        assertEquals("done", done.text());
-    }
-
-    @Test
-    void askWithNoOpenDelegationReturnsNoWaiter() {
-        MessageService.AskResult r = messages.ask(T, "anyone listening?", 500);
-        assertEquals(MessageService.AskOutcome.NO_WAITER, r.outcome(),
-                "a question with no blocked send has no primary to answer it");
-    }
-
-    @Test
-    void askTimesOutWhenThePrimaryNeverAnswers() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitWaiting();
-        injector.onStatus(T, AgentStatus.IDLE);
-        injector.onStatus(T, AgentStatus.WORKING);
-
-        MessageService.AskResult r = messages.ask(T, "still there?", 200); // primary never answers
-        assertEquals(MessageService.AskOutcome.TIMED_OUT, r.outcome());
-
-        // The send itself already unblocked with the question the instant the ask surfaced.
-        MessageService.Reply q = send.get(2, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.QUESTION, q.outcome());
-    }
-
-    @Test
-    void answeringAnUnknownTurnIsStale() {
-        MessageService.Reply r = messages.answer(T + "#999", "too late", 500);
-        assertEquals(MessageService.Outcome.STALE_TURN, r.outcome(),
-                "an answer to a turn that never existed (or already lapsed) is stale, not a hang");
-    }
-
-    // --- timeout, answer, poll, and lock-contention edges ----------------------------------
-
-    @Test
-    void sendTimesOutBeforeDeliveryIsQueuedNotWorking() {
-        // Nothing ever delivers the message and nothing resolves the send, so the reply future
-        // times out with delivery still incomplete — the message is still queued for the worker.
-        MessageService.Reply r = messages.send(T, "never delivered", 50);
-        assertEquals(MessageService.Outcome.TIMED_OUT_QUEUED, r.outcome(),
-                "an undelivered send that times out is still queued, not working");
-        assertNull(r.text());
-    }
-
-    @Test
-    void sendTimesOutAfterDeliveryIsStillWorking() throws Exception {
-        CompletableFuture<MessageService.Reply> send =
-                CompletableFuture.supplyAsync(() -> messages.send(T, "do the task", 300));
-        awaitWaiting();
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver — the delivered future now completes
-        injector.onStatus(T, AgentStatus.WORKING); // worker starts but never replies
-        // No rendezvous.resolve(T, ...) — the reply future rides out its short timeout.
-
-        MessageService.Reply r = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.TIMED_OUT_WORKING, r.outcome(),
-                "a delivered send whose worker never replies times out as still working");
-    }
-
-    @Test
-    void answerTimesOutWhenTheResumedWorkerNeverReplies() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitWaiting();
-        injector.onStatus(T, AgentStatus.IDLE);
-        injector.onStatus(T, AgentStatus.WORKING);
-
-        CompletableFuture<MessageService.AskResult> ask =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config file?", 5000));
-
-        MessageService.Reply q = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.QUESTION, q.outcome());
-        assertNotNull(q.turnId());
-
-        // The primary answers, unblocking the worker; but the worker never sends the follow-up
-        // bridge_reply, so the answering send rides out its short window as still-working.
-        MessageService.Reply answer = messages.answer(q.turnId(), "config.yaml", 200);
-        assertEquals(MessageService.Outcome.TIMED_OUT_WORKING, answer.outcome(),
-                "an answered worker that never replies times out as still working");
-
-        MessageService.AskResult a = ask.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.AskOutcome.ANSWERED, a.outcome());
-        assertEquals("config.yaml", a.answer());
-    }
-
-    @Test
-    void pollReturnsNullForAnUnknownTicket() {
-        assertNull(messages.poll("task-999999"), "a ticket that was never minted is unknown");
-    }
-
-    @Test
-    void pollReportsACompletedTicket() throws Exception {
-        String ticket = messages.sendAsync(T, "long task");
-        awaitWaiting();
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver
-        injector.onStatus(T, AgentStatus.WORKING); // worker works
-        assertTrue(rendezvous.resolve(T, "async result"), "a reply resolves the async send");
-
-        // Wait for the background send to finish and publish a DONE view.
-        MessageService.TaskView view = null;
-        long deadline = System.currentTimeMillis() + 2000;
-        while (view == null || view.phase() != MessageService.Phase.DONE) {
-            if (System.currentTimeMillis() >= deadline) break;
-            view = messages.poll(ticket);
-            //noinspection BusyWait
-            Thread.sleep(5);
-        }
-        assertNotNull(view, "a resolved async send must become DONE");
-        assertEquals(MessageService.Phase.DONE, view.phase());
-        assertEquals("async result", view.reply(), "the completed ticket reports the reply");
-        assertEquals("reply", view.replySource(), "a structured bridge_reply is sourced from 'reply'");
-    }
-
-    @Test
-    void concurrentSendToSameSessionWhileFirstHoldsItIsBusy() throws Exception {
-        CompletableFuture<MessageService.Reply> first =
-                CompletableFuture.supplyAsync(() -> messages.send(T, "first", 5000));
-        awaitWaiting(); // the first send now holds the session lock, blocked on its reply
-
-        // A second send to the SAME session cannot take the lock within its short window.
-        MessageService.Reply busy = messages.send(T, "second", 100);
-        assertEquals(MessageService.Outcome.BUSY, busy.outcome(),
-                "a second send while another holds the session is busy, not a hang");
-        assertNull(busy.text());
-
-        // Release the first send so it resolves cleanly and the test thread is not left pinned.
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver the first message
-        injector.onStatus(T, AgentStatus.WORKING); // worker picks it up
-        assertTrue(rendezvous.resolve(T, "first done"), "the first send resolves with a reply");
-        MessageService.Reply firstReply = first.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.REPLIED, firstReply.outcome());
-        assertEquals("first done", firstReply.text());
-    }
-
-    // --- CB-307 reply inbox ----------------------------------------------------------------
-
-    @Test
-    void replyQueuesInInboxWhenNoSendIsOpen() {
-        // No send is open for this session — reply should queue in the inbox.
-        assertTrue(messages.reply(T, "queued-text"), "reply should succeed (queued)");
-
-        var drained = messages.drainReplies(T);
-        assertEquals(1, drained.size());
-        assertEquals("queued-text", drained.getFirst().content());
-    }
-
-    @Test
-    void replyResolvesOpenSendDoesNotQueue() throws Exception {
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitUninterruptibly(T);
-
-        // An explicit reply resolves the open send.
-        assertTrue(messages.reply(T, "send-resolved"), "reply should succeed (resolved live send)");
-
-        // The inbox should be empty — the reply went to the send, not the inbox.
-        assertTrue(messages.drainReplies(T).isEmpty(), "no reply in the inbox");
-
-        MessageService.Reply r = send.get(3, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.REPLIED, r.outcome());
-        assertEquals("send-resolved", r.text());
-    }
-
-    @Test
-    void drainRepliesReturnsAllPendingThenEmptyOnNextCall() {
-        messages.reply(T, "msg-1");
-        messages.reply(T, "msg-2");
-
-        var first = messages.drainReplies(T);
-        assertEquals(2, first.size());
-
-        var second = messages.drainReplies(T);
-        assertTrue(second.isEmpty(), "second drain should be empty (acked)");
-    }
-
-    @Test
-    void aQuestionIsNeverQueuedInTheInbox() {
-        // No send is open — bridge_ask with no delegation returns NO_WAITER,
-        // and the question text MUST NOT appear in the reply inbox.
-        // The inbox is only fed by MessageService.reply(), not by bridge_ask.
-        MessageService.AskResult r = messages.ask(T, "anyone there?", 500);
-        assertEquals(MessageService.AskOutcome.NO_WAITER, r.outcome(),
-                "bridge_ask with no open delegation must return NO_WAITER, never queued");
-
-        assertTrue(messages.drainReplies(T).isEmpty(), "questions must never be queued");
-    }
-
-    @Test
-    void completionFallbackIsNeverQueued() throws Exception {
-        // The fallback resolves a captured waiter, never the inbox.
-        CompletableFuture<MessageService.Reply> send = sendAsync();
-        awaitUninterruptibly(T);
-        injectDelivery();
-
-        // The worker never sends bridge_reply, but the turn completes.
-        herdr.readText("done-scraped");
-        completion.onTurnComplete(T); // The fallback arms and resolves the captured waiter.
-
-        MessageService.Reply r = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.COMPLETED_UNREPLIED, r.outcome());
-
-        // The inbox should be empty — the reply went to the captured waiter.
-        assertTrue(messages.drainReplies(T).isEmpty(), "completion fallback must not queue");
-    }
-
-    // --- helpers ---------------------------------------------------------------------------
-
-    /** Like {@link #awaitWaiting()} but rethrows as unchecked. */
-    private void awaitUninterruptibly(String session) {
-        try {
-            awaitWaiting();
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            throw new IllegalStateException(e);
-        }
-    }
-
-    /** Set up a delivered turn so the worker is working, ready for an ask or completion. */
-    private void injectDelivery() {
-        herdr.readText("$ prompt");                // pre-turn content baseline
-        injector.onStatus(T, AgentStatus.IDLE);    // deliver the task
-        injector.onStatus(T, AgentStatus.WORKING); // worker picks it up
-    }
-
-    // --- CB-516: a released session must not leave a send hanging ------------------------------
-
-    /**
-     * The bug this fixes: tearing a worker down left its rendezvous waiter open, so a blocking send
-     * kept blocking and an async one kept reporting PENDING until the 30-minute async timeout —
-     * even though the worker provably no longer existed.
-     */
-    @Test
-    void abandonFailsASendThatIsStillWaitingOnAReleasedSession() throws Exception {
-        CompletableFuture<MessageService.Reply> send =
-                CompletableFuture.supplyAsync(() -> messages.send(T, "work", 30_000));
-        awaitWaiting();
-
-        assertTrue(messages.abandon(T, "session released"), "a live waiter is abandoned");
-
-        MessageService.Reply r = send.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.WORKER_FAILED, r.outcome(),
-                "an abandoned send fails rather than riding out its timeout");
-        assertEquals("session released", r.text(), "the caller is told why");
-    }
-
-    @Test
-    void abandonIsANoOpWhenNobodyIsWaiting() {
-        assertFalse(messages.abandon(T, "session released"),
-                "no open send ⇒ nothing to abandon");
-    }
-
-    @Test
-    void abandonDoesNotOverwriteAnAlreadyResolvedSend() throws Exception {
-        CompletableFuture<MessageService.Reply> send =
-                CompletableFuture.supplyAsync(() -> messages.send(T, "work", 30_000));
-        awaitWaiting();
-        assertTrue(rendezvous.resolve(T, "the real answer"));
-
-        assertFalse(messages.abandon(T, "session released"),
-                "a send already answered by the worker must not be clobbered");
-        MessageService.Reply r = send.get(5, TimeUnit.SECONDS);
-        assertEquals("the real answer", r.text());
-    }
-
-    /** The async path is the one that hung: poll must report FAILED, not PENDING forever. */
-    @Test
-    void anAbandonedAsyncTaskPollsAsFailedNotPending() throws Exception {
-        String ticket = messages.sendAsync(T, "long task");
-        awaitWaiting();
-        assertEquals(MessageService.Phase.PENDING, messages.poll(ticket).phase());
-
-        messages.abandon(T, "session released");
-
-        MessageService.TaskView view = null;
-        long deadline = System.currentTimeMillis() + 3000;
-        while (System.currentTimeMillis() < deadline) {
-            view = messages.poll(ticket);
-            if (view.phase() != MessageService.Phase.PENDING) break;
-            Thread.sleep(10);
-        }
-        assertNotNull(view);
-        assertEquals(MessageService.Phase.FAILED, view.phase(),
-                "a delegation whose worker is gone must not keep reporting PENDING");
-        assertTrue(view.detail() != null && view.detail().contains("released"),
-                "and the detail says why, rather than 'worker unknown'");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/msg/ReplyPushLoopTest.java

@@ -1,304 +0,0 @@
-package dev.ltms.bridged.msg;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * Unit tests for {@link ReplyPushLoop}: decision logic, nudge injection, idempotency,
- * bounded reminders, and stop conditions.
- *
- * <p>Uses a {@link RecordingHerdrClient} that synchronizes access to its call list so the
- * scheduler thread and test thread never have memory ordering issues. The {@code decide()}
- * tests use a simple client with no concurrency concern.
- */
-class ReplyPushLoopTest {
-
-    private static final String PRIMARY = "term_primary";
-    private static final String WORKER = "term_worker";
-    private static final ObjectMapper MAPPER = new ObjectMapper();
-
-    private PrimaryRegistry registry;
-    private AgentControl agents;
-    private InMemoryReplyInbox inbox;
-    private ScheduledExecutorService scheduler;
-
-    @BeforeEach
-    void setUp() {
-        registry = new PrimaryRegistry(PRIMARY);
-        inbox = new InMemoryReplyInbox();
-        inbox.own(WORKER); // CB-520: the inbox only peeks/acks targets it owns
-        scheduler = Executors.newSingleThreadScheduledExecutor();
-    }
-
-    @AfterEach
-    void tearDown() {
-        scheduler.shutdownNow();
-    }
-
-    // --- decide() logic ------------------------------------------------------------------------
-
-    @Test
-    void decideWithoutPrimaryIsStop() {
-        agents = agentWithStatus("idle");
-        var loop = new ReplyPushLoop(
-                new PrimaryRegistry(null), agents, inbox, scheduler, 5, 100);
-        assertEquals(ReplyPushLoop.Action.STOP, loop.decide(WORKER, 0));
-    }
-
-    @Test
-    void decideWithEmptyInboxIsStop() {
-        agents = agentWithStatus("idle");
-        assertEquals(ReplyPushLoop.Action.STOP, loop().decide(WORKER, 0));
-    }
-
-    @Test
-    void decideAtCapIsStop() {
-        agents = agentWithStatus("idle");
-        inbox.publish(WORKER, "m1", "hello");
-        assertEquals(ReplyPushLoop.Action.STOP, loop(2, 100).decide(WORKER, 2));
-    }
-
-    @Test
-    void decideUnderCapWithInjectablePrimaryIsInject() {
-        agents = agentWithStatus("idle");
-        inbox.publish(WORKER, "m1", "hello");
-        assertEquals(ReplyPushLoop.Action.INJECT, loop().decide(WORKER, 0));
-    }
-
-    @Test
-    void decideUnderCapWithBlockedPrimaryIsInject() {
-        agents = agentWithStatus("blocked");
-        inbox.publish(WORKER, "m1", "hello");
-        assertEquals(ReplyPushLoop.Action.INJECT, loop().decide(WORKER, 0),
-                "BLOCKED is injectable");
-    }
-
-    @Test
-    void decideUnderCapWithDonePrimaryIsInject() {
-        agents = agentWithStatus("done");
-        inbox.publish(WORKER, "m1", "hello");
-        assertEquals(ReplyPushLoop.Action.INJECT, loop().decide(WORKER, 0),
-                "DONE is injectable");
-    }
-
-    @Test
-    void decideUnderCapWithBusyPrimaryIsWaitBusy() {
-        agents = agentWithStatus("working");
-        inbox.publish(WORKER, "m1", "hello");
-        assertEquals(ReplyPushLoop.Action.WAIT_BUSY, loop().decide(WORKER, 0));
-    }
-
-    @Test
-    void decideUnderCapWithUnknownPrimaryIsWaitBusy() {
-        agents = agentWithStatus("unknown");
-        inbox.publish(WORKER, "m1", "hello");
-        assertEquals(ReplyPushLoop.Action.WAIT_BUSY, loop().decide(WORKER, 0));
-    }
-
-    @Test
-    void decideStopsAfterInboxIsEmptied() {
-        agents = agentWithStatus("idle");
-        inbox.publish(WORKER, "m1", "hello");
-        assertEquals(ReplyPushLoop.Action.INJECT, loop().decide(WORKER, 0));
-        inbox.ack(WORKER, "m1");
-        assertEquals(ReplyPushLoop.Action.STOP, loop().decide(WORKER, 0));
-    }
-
-    // --- onReplyQueued integration -------------------------------------------------------------
-
-    @Test
-    void injectablePrimaryCausesExactlyOneNudge() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        inbox.publish(WORKER, "m1", "hello");
-
-        loop(1, 50).onReplyQueued(WORKER);
-
-        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS),
-                "one nudge (1 agent.prompt call) should have been sent");
-
-        // Exactly one nudge = exactly 1 agent.prompt call (it submits itself)
-        assertEquals(1, rec.sendCount());
-        assertTrue(rec.sentParams().stream()
-                        .anyMatch(e -> e.getValue().toString().contains("bridge_poll")),
-                "nudge text should contain bridge_poll");
-    }
-
-    @Test
-    void onReplyQueuedIsIdempotentPerTarget() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        inbox.publish(WORKER, "m1", "hello");
-
-        var loop = loop(1, 100);
-        loop.onReplyQueued(WORKER);
-        loop.onReplyQueued(WORKER); // second call — should be a no-op
-
-        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS),
-                "expected exactly one nudge (1 prompt)");
-        Thread.sleep(200);
-        assertEquals(1, rec.sendCount(),
-                "second onReplyQueued must not trigger another nudge");
-    }
-
-    @Test
-    void sendsUpToCapThenStops() throws Exception {
-        int cap = 2;
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        inbox.publish(WORKER, "m1", "hello");
-        rec.sendLatch = new CountDownLatch(cap);
-
-        loop(cap, 50).onReplyQueued(WORKER);
-
-        assertTrue(rec.sendLatch.await(5, TimeUnit.SECONDS),
-                cap + " nudges (" + cap + " prompts) should have fired");
-        Thread.sleep(300);
-        assertEquals(cap, rec.sendCount(),
-                "exactly " + cap + " agent.prompt calls (cap=" + cap + ")");
-    }
-
-    // --- nudge format --------------------------------------------------------------------------
-
-    @Test
-    void nudgeFormatIsCorrect() {
-        String nudge = ReplyPushLoop.NUDGE_FORMAT.formatted(WORKER, WORKER);
-        assertTrue(nudge.contains("Worker term_worker"));
-        assertTrue(nudge.contains("bridge_poll(target=term_worker)"));
-    }
-
-    // --- metrics (CB-512) ----------------------------------------------------------------------
-
-    @Test
-    void successfulNudgeIncrementsDelivered() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        inbox.publish(WORKER, "m1", "hello");
-        Metrics metrics = new Metrics();
-
-        loop(1, 50, metrics).onReplyQueued(WORKER);
-
-        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS),
-                "one nudge (1 agent.prompt call) should have been sent");
-        // The delivered count is bumped on the scheduler thread right after the send that releases
-        // the latch — settle briefly so the counter is published before we read it.
-        Thread.sleep(200);
-        assertEquals(1, metrics.count(BridgedMetrics.PUSH_NUDGES, "outcome", "delivered"),
-                "a successfully sent nudge must count as delivered");
-    }
-
-    @Test
-    void reminderCapIncrementsExhausted() {
-        agents = agentWithStatus("idle");
-        inbox.publish(WORKER, "m1", "hello");
-        Metrics metrics = new Metrics();
-
-        assertEquals(ReplyPushLoop.Action.STOP, loop(2, 100, metrics).decide(WORKER, 2));
-
-        assertEquals(1, metrics.count(BridgedMetrics.PUSH_NUDGES, "outcome", "exhausted"),
-                "hitting the reminder cap must count as exhausted");
-        assertEquals(0, metrics.count(BridgedMetrics.PUSH_NUDGES, "outcome", "delivered"));
-    }
-
-    // --- helpers -------------------------------------------------------------------------------
-
-    private ReplyPushLoop loop() {
-        return loop(5, 100);
-    }
-
-    private ReplyPushLoop loop(int maxReminders, long backoffMs) {
-        return new ReplyPushLoop(registry, agents, inbox, scheduler, maxReminders, backoffMs);
-    }
-
-    private ReplyPushLoop loop(int maxReminders, long backoffMs, Metrics metrics) {
-        return new ReplyPushLoop(registry, agents, inbox, scheduler, maxReminders, backoffMs, metrics);
-    }
-
-    private static AgentControl agentWithStatus(String status) {
-        return new AgentControl(new FakeHerdrClient(status));
-    }
-
-    /** Non-recording (single-threaded) fake — safe for decide() tests. */
-    private static final class FakeHerdrClient implements HerdrClient {
-        private final String agentStatus;
-
-        FakeHerdrClient(String agentStatus) {
-            this.agentStatus = agentStatus;
-        }
-
-        @Override
-        public JsonNode call(String method, Object params) {
-            if ("agent.get".equals(method)) {
-                return MAPPER.createObjectNode()
-                        .set("agent", MAPPER.createObjectNode()
-                                .put("terminal_id", PRIMARY)
-                                .put("agent_status", agentStatus));
-            }
-            return MAPPER.createObjectNode();
-        }
-
-        @Override
-        public void close() {
-        }
-    }
-
-    /**
-     * Thread-safe recording fake that counts agent.prompt calls (protocol 19: one nudge = one
-     * prompt). Uses synchronized access so the scheduler thread and test thread never race.
-     */
-    private static final class RecordingHerdrClient implements HerdrClient {
-        private final List<Map.Entry<String, Object>> calls =
-                Collections.synchronizedList(new ArrayList<>());
-        volatile CountDownLatch sendLatch = new CountDownLatch(1);
-
-        @Override
-        public JsonNode call(String method, Object params) {
-            if ("agent.get".equals(method)) {
-                return MAPPER.createObjectNode()
-                        .set("agent", MAPPER.createObjectNode()
-                                .put("terminal_id", PRIMARY)
-                                .put("agent_status", "idle"));   // recording double is always injectable
-            }
-            if ("agent.prompt".equals(method)) {
-                calls.add(Map.entry(method, params));
-                sendLatch.countDown();
-            }
-            return MAPPER.createObjectNode();
-        }
-
-        long sendCount() {
-            return calls.size();
-        }
-
-        List<Map.Entry<String, Object>> sentParams() {
-            return List.copyOf(calls);
-        }
-
-        @Override
-        public void close() {
-        }
-    }
-
-    private static RecordingHerdrClient recordingClient() {
-        return new RecordingHerdrClient();
-    }
-}

bridged/src/test/java/dev/ltms/bridged/placement/PlacementPolicyTest.java

@@ -1,183 +0,0 @@
-package dev.ltms.bridged.placement;
-
-import org.junit.jupiter.api.Test;
-
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Function;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * Unit tests for the placement policies. They run with no herdr and no launcher — pure selection
- * logic exercised through the descriptor type so CB-308 host expansion will not need to rewrite
- * these assertions.
- */
-class PlacementPolicyTest {
-
-    private static Function<String, Integer> noSessions() {
-        return name -> 0;
-    }
-
-    private static PlacementContext ctx(List<PlacementCandidate> candidates,
-                                        Function<String, Integer> liveCount,
-                                        Set<String> unreachable) {
-        return new PlacementContext("b", candidates, liveCount, unreachable);
-    }
-
-    private static PlacementContext ctx(List<PlacementCandidate> candidates,
-                                        Function<String, Integer> liveCount) {
-        return ctx(candidates, liveCount, Set.of());
-    }
-
-    @Test
-    void fixedReturnsDefaultEvenIfOtherProfilesExist() {
-        PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = ctx(List.of(
-                PlacementCandidate.profile("a"),
-                PlacementCandidate.profile("b")), noSessions());
-        assertEquals("b", policy.select(ctx).profile());
-    }
-
-    @Test
-    void fixedFallsBackToFirstCandidateWhenNoDefault() {
-        PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = new PlacementContext(null,
-                List.of(PlacementCandidate.profile("a"), PlacementCandidate.profile("b")),
-                noSessions(), Set.of());
-        assertEquals("a", policy.select(ctx).profile());
-    }
-
-    @Test
-    void fixedThrowsWhenNoProfilesAndNoDefault() {
-        PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = new PlacementContext(null, List.of(), noSessions(), Set.of());
-        assertThrows(PlacementException.class, () -> policy.select(ctx));
-    }
-
-    @Test
-    void roundRobinCyclesThroughAvailableProfiles() {
-        PlacementPolicy policy = PlacementPolicies.roundRobin();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a"),
-                PlacementCandidate.profile("b"),
-                PlacementCandidate.profile("c"));
-        assertEquals("a", policy.select(ctx(candidates, noSessions())).profile());
-        assertEquals("b", policy.select(ctx(candidates, noSessions())).profile());
-        assertEquals("c", policy.select(ctx(candidates, noSessions())).profile());
-        assertEquals("a", policy.select(ctx(candidates, noSessions())).profile());
-    }
-
-    @Test
-    void roundRobinSkipsProfilesAtMaxLoad() {
-        PlacementPolicy policy = PlacementPolicies.roundRobin();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 1.0f, 2),
-                PlacementCandidate.profile("b", 1.0f, null));
-        Function<String, Integer> liveCount = Map.of("a", 2)::get;
-        for (int i = 0; i < 5; i++) {
-            assertEquals("b", policy.select(ctx(candidates, liveCount)).profile());
-        }
-    }
-
-    @Test
-    void roundRobinThrowsWhenAllAtMaxLoad() {
-        PlacementPolicy policy = PlacementPolicies.roundRobin();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 1.0f, 1),
-                PlacementCandidate.profile("b", 1.0f, 1));
-        Function<String, Integer> liveCount = Map.of("a", 1, "b", 1)::get;
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> policy.select(ctx(candidates, liveCount)));
-        assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
-    }
-
-    @Test
-    void weightedAlternatesEvenlyWithEqualWeights() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 0.5f, null),
-                PlacementCandidate.profile("b", 0.5f, null));
-        int a = 0, b = 0;
-        for (int i = 0; i < 100; i++) {
-            String p = policy.select(ctx(candidates, noSessions())).profile();
-            if ("a".equals(p)) a++;
-            else if ("b".equals(p)) b++;
-        }
-        assertEquals(50, a, "equal weights should split 50/50");
-        assertEquals(50, b);
-    }
-
-    @Test
-    void weightedHoldsThreeToOneRatio() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 0.75f, null),
-                PlacementCandidate.profile("b", 0.25f, null));
-        int a = 0, b = 0;
-        for (int i = 0; i < 40; i++) {
-            String p = policy.select(ctx(candidates, noSessions())).profile();
-            if ("a".equals(p)) a++;
-            else if ("b".equals(p)) b++;
-        }
-        assertEquals(30, a, "0.75/0.25 should yield a 3:1 ratio over a multiple of 4");
-        assertEquals(10, b);
-    }
-
-    @Test
-    void weightedSkipsProfileAtMaxLoad() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 1.0f, 1),
-                PlacementCandidate.profile("b", 1.0f, null));
-        Function<String, Integer> liveCount = name -> "a".equals(name) ? 1 : 0;
-        for (int i = 0; i < 5; i++) {
-            assertEquals("b", policy.select(ctx(candidates, liveCount)).profile());
-        }
-    }
-
-    @Test
-    void weightedThrowsWhenAllAtMaxLoad() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 1.0f, 1),
-                PlacementCandidate.profile("b", 1.0f, 1));
-        Function<String, Integer> liveCount = name -> 1;
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> policy.select(ctx(candidates, liveCount)));
-        assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
-    }
-
-    @Test
-    void weightedThrowsWhenAllUnreachable() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a"),
-                PlacementCandidate.profile("b"));
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> policy.select(ctx(candidates, noSessions(), Set.of("a", "b"))));
-        assertTrue(e.getMessage().contains("unreachable"), e.getMessage());
-    }
-
-    @Test
-    void mixedExclusionMessageNamesBothReasons() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 1.0f, 1),
-                PlacementCandidate.profile("b", 1.0f, null));
-        Function<String, Integer> liveCount = name -> "a".equals(name) ? 1 : 0;
-        Set<String> unreachable = new HashSet<>();
-        unreachable.add("b");
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> policy.select(ctx(candidates, liveCount, unreachable)));
-        assertTrue(e.getMessage().contains("1 at maxLoad"), e.getMessage());
-        assertTrue(e.getMessage().contains("1 unreachable"), e.getMessage());
-    }
-
-    @Test
-    void unknownPolicyNameThrows() {
-        assertThrows(IllegalArgumentException.class, () -> PlacementPolicies.fromName("random"));
-    }
-}

bridged/src/test/java/dev/ltms/bridged/rest/BridgedAppTest.java

@@ -1,489 +0,0 @@
-package dev.ltms.bridged.rest;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.inject.StatusPoller;
-import dev.ltms.bridged.inject.WorkerPresence;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.session.FakeWorktrees;
-import dev.ltms.bridged.session.GitWorktrees;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.Worktrees;
-import dev.ltms.bridged.worker.ClaudeCodeLauncher;
-import io.javalin.Javalin;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-
-import java.net.URI;
-import java.net.http.HttpClient;
-import java.net.http.HttpRequest;
-import java.net.http.HttpResponse;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * REST acceptance tests — the feature contract over plain HTTP with a fake herdr, no
- * live daemon and no Claude in the loop. This is the surface later MCP tools match by
- * parity, and where the subscription boundary and worker placement are proven at the
- * API edge.
- */
-class BridgedAppTest {
-
-    private final ObjectMapper mapper = new ObjectMapper();
-    private final HttpClient http = HttpClient.newHttpClient();
-    private WorkerPresence presence;
-    private Javalin app;
-    private StatusPoller poller;
-
-    @AfterEach
-    void stop() {
-        if (poller != null) poller.stop();
-        if (app != null) app.stop();
-    }
-
-    private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow) {
-        return start(herdr, workerBaseUrl, allow, "tab");
-    }
-
-    private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement) {
-        return start(herdr, workerBaseUrl, allow, placement, new GitWorktrees());
-    }
-
-    private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement, Worktrees worktrees) {
-        BridgedConfig.Worker wcfg = new BridgedConfig.Worker(
-                "ltms-local", workerBaseUrl, "coder", null, "BRIDGED_WORKER_TOKEN", null,
-                placement, "bridged-workers", "worker: {profile} #{n}", null, null, null);
-        AgentControl agents = new AgentControl(herdr);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(
-                agents, new WorkspaceControl(herdr), new SubscriptionGuard(allow),
-                Map.of(wcfg.profile(), wcfg), wcfg.profile(),
-                k -> "BRIDGED_WORKER_TOKEN".equals(k) ? "tok-abc" : null);
-        SessionManager sessions = new SessionManager(workers, worktrees);
-        this.presence = sessions.asPresence();
-        Injector injector = new Injector(agents);
-        poller = new StatusPoller(agents, injector, 5); // delivers when the fake reports idle
-        poller.start();
-        Rendezvous rendezvous = new Rendezvous();
-        InMemoryReplyInbox inbox = new InMemoryReplyInbox();
-        sessions.onAcquire(inbox::own);
-        // The static REST tests address "term_a" without acquiring it through SessionManager, so own
-        // it directly so the inbox contract holds for those endpoints.
-        inbox.own("term_a");
-        MessageService messages = new MessageService(agents, injector, rendezvous, inbox);
-        app = new BridgedApp(herdr, workers, sessions, messages, this.presence, null)
-                .build().start("127.0.0.1", 0);
-        return app.port();
-    }
-
-    private int startHealthy() {
-        return start(new FakeHerdr(), "http://gx00.gw:8000", Set.of("gx00.gw"));
-    }
-
-    private HttpResponse<String> postMessage(int port, String json) throws Exception {
-        return postJson(port, "/sessions/term_a/message", json);
-    }
-
-    private HttpResponse<String> postJson(int port, String path, String json) throws Exception {
-        HttpRequest r = HttpRequest.newBuilder(URI.create("http://127.0.0.1:" + port + path))
-                .header("Content-Type", "application/json")
-                .POST(HttpRequest.BodyPublishers.ofString(json)).build();
-        return http.send(r, HttpResponse.BodyHandlers.ofString());
-    }
-
-
-    private HttpResponse<String> req(int port, String method, String path) throws Exception {
-        HttpRequest.Builder b = HttpRequest.newBuilder(URI.create("http://127.0.0.1:" + port + path));
-        b = switch (method) {
-            case "POST" -> b.POST(HttpRequest.BodyPublishers.noBody());
-            case "DELETE" -> b.DELETE();
-            default -> b.GET();
-        };
-        return http.send(b.build(), HttpResponse.BodyHandlers.ofString());
-    }
-
-    @SuppressWarnings("unchecked")
-    private Map<String, Object> params(FakeHerdr herdr, String method) {
-        return (Map<String, Object>) herdr.lastCall(method).params();
-    }
-
-    @Test
-    void healthzOkWhenHerdrAnswers() throws Exception {
-        int port = startHealthy();
-        HttpResponse<String> res = req(port, "GET", "/healthz");
-        assertEquals(200, res.statusCode());
-        JsonNode body = mapper.readTree(res.body());
-        assertEquals("ok", body.get("status").asText());
-        assertEquals(19, body.get("herdr").get("protocol").asInt());
-    }
-
-    @Test
-    void healthzDegradedWhenHerdrDown() throws Exception {
-        FakeHerdr down = new FakeHerdr().healthy(false);
-        int port = start(down, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        HttpResponse<String> res = req(port, "GET", "/healthz");
-        assertEquals(503, res.statusCode());
-        assertEquals("degraded", mapper.readTree(res.body()).get("status").asText());
-    }
-
-    @Test
-    void sessionsMapsWorkspaceList() throws Exception {
-        int port = startHealthy();
-        JsonNode sessions = mapper.readTree(req(port, "GET", "/sessions").body()).get("sessions");
-        assertEquals(2, sessions.size());
-        assertEquals("w1", sessions.get(0).get("id").asText());
-        assertEquals("done", sessions.get(1).get("agentStatus").asText());
-    }
-
-    @Test
-    void agentsExposesSessionUuid() throws Exception {
-        int port = startHealthy();
-        JsonNode agents = mapper.readTree(req(port, "GET", "/agents").body()).get("agents");
-        assertEquals(1, agents.size());
-        assertEquals("sess-1111", agents.get(0).get("sessionId").asText());
-        assertEquals("idle", agents.get(0).get("status").asText());
-    }
-
-    @Test
-    void spawnWorkerLandsInOwnTabInWorkerSpaceAndInjectsBaseUrl() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        HttpResponse<String> res = req(port, "POST", "/workers");
-        assertEquals(201, res.statusCode());
-        JsonNode body = mapper.readTree(res.body());
-        // CB-519: the responded paneId is a host-unique opaque UUID, not the herdr pane coordinate.
-        String id = body.get("paneId").asText();
-        assertNotEquals("w9:pRoot_1", id, "paneId is the host-unique id, not the herdr pane");
-        assertDoesNotThrow(() -> UUID.fromString(id), "paneId must be a UUID: " + id);
-        assertEquals("spawning", body.get("state").asText());
-
-        // Subscription boundary (protocol 19): tab.create carried base_url + token in its env
-        // map — the seed shell the agent starts into is what inherits them.
-        Map<String, Object> create = params(herdr, "tab.create");
-        @SuppressWarnings("unchecked")
-        Map<String, String> env = (Map<String, String>) create.get("env");
-        assertEquals("http://gx00.gw:8000", env.get("ANTHROPIC_BASE_URL"));
-        assertEquals("tok-abc", env.get("ANTHROPIC_AUTH_TOKEN"));
-
-        // Placement: worker space ensured, worker started INTO its tab's seed pane (which
-        // becomes the worker pane — nothing is dropped), and the tab given a friendly label.
-        Map<String, Object> start = params(herdr, "agent.start");
-        assertTrue(herdr.called("workspace.create"), "worker space must be found-or-created");
-        assertEquals("claude", start.get("kind"), "herdr resolves the executable from kind");
-        assertEquals("w9:pRoot_1", start.get("pane_id"), "worker must start into its tab's seed pane");
-        assertFalse(herdr.called("pane.close"), "the seed pane IS the worker pane — never dropped");
-        assertEquals("worker: ltms-local #1", params(herdr, "tab.rename").get("label"),
-                "tab label carries the worker number so siblings stay distinct");
-    }
-
-    @Test
-    void profilesEndpointListsConfiguredProfilesAndDefault() throws Exception {
-        int port = startHealthy();
-        JsonNode body = mapper.readTree(req(port, "GET", "/profiles").body());
-        assertEquals("ltms-local", body.get("default").asText());
-        assertEquals("ltms-local", body.get("profiles").get(0).asText());
-    }
-
-    @Test
-    void workersEndpointReturnsRegistryRosterWithLiveStatus() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "tab",
-                new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt"));
-
-        HttpResponse<String> spawn = req(port, "POST", "/workers?worktree=true&ticket=cb-304");
-        assertEquals(201, spawn.statusCode());
-        JsonNode spawned = mapper.readTree(spawn.body());
-        String paneId = spawned.get("paneId").asText();
-
-        HttpResponse<String> res = req(port, "GET", "/workers");
-        assertEquals(200, res.statusCode());
-        JsonNode workers = mapper.readTree(res.body()).get("workers");
-        assertEquals(1, workers.size());
-        JsonNode w = workers.get(0);
-        assertEquals(spawned.get("terminalId").asText(), w.get("sessionId").asText());
-        assertEquals(paneId, w.get("paneId").asText());
-        assertEquals("ltms-local", w.get("profile").asText());
-        assertEquals("spawning", w.get("state").asText());
-        assertTrue(w.has("worktree"), "worktree-backed session exposes worktree");
-        assertTrue(w.has("branch"), "worktree-backed session exposes branch");
-        assertEquals("unknown", w.get("liveStatus").asText(),
-                "liveStatus is unknown when herdr has no matching pane");
-    }
-
-    @Test
-    void spawnWithACwdParamRootsTheWorkerThere() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        assertEquals(201, req(port, "POST", "/workers?cwd=/tmp/proj").statusCode());
-        assertEquals("/tmp/proj", params(herdr, "tab.create").get("cwd"), "the worker starts in cwd");
-    }
-
-    @Test
-    void spawnWithAnUnknownProfileIs400() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        HttpResponse<String> res = req(port, "POST", "/workers?profile=nope");
-        assertEquals(400, res.statusCode());
-        assertEquals("unknown_profile", mapper.readTree(res.body()).get("error").asText());
-        assertFalse(herdr.called("agent.start"), "an unknown profile must not spawn anything");
-    }
-
-    @Test
-    void spawnWorkerReusesExistingWorkerSpace() throws Exception {
-        // A space labelled "bridged-workers" already exists → no second workspace.create.
-        FakeHerdr herdr = new FakeHerdr().withWorkspace("w9", "bridged-workers");
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        assertEquals(201, req(port, "POST", "/workers").statusCode());
-        assertFalse(herdr.called("workspace.create"), "existing worker space must be reused, not recreated");
-        assertTrue(herdr.called("tab.create"), "a fresh tab is still created for the worker");
-    }
-
-    @Test
-    @SuppressWarnings("unchecked")
-    void spawnRetriesUnderAFreshNameWhenAgentNameTaken() throws Exception {
-        // herdr rejects a duplicate agent name; the service must bump and retry.
-        FakeHerdr herdr = new FakeHerdr().agentNameTakenTimes(2);
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        assertEquals(201, req(port, "POST", "/workers").statusCode());
-        List<String> names = herdr.calls.stream()
-                .filter(c -> c.method().equals("agent.start"))
-                .map(c -> ((Map<String, Object>) c.params()).get("name").toString())
-                .toList();
-        assertEquals(3, names.size(), "2 rejected + 1 success");
-        assertEquals(3, Set.copyOf(names).size(), "each attempt must use a distinct name");
-    }
-
-    @Test
-    void spawnClosesTheCreatedTabWhenTheWorkerNeverStarts() throws Exception {
-        // Every agent.start attempt is rejected → spawn fails; the tab we created must not leak.
-        FakeHerdr herdr = new FakeHerdr().agentNameTakenTimes(99);
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        assertEquals(500, req(port, "POST", "/workers").statusCode());
-        assertTrue(herdr.called("tab.create"), "a tab was created before the failed start");
-        assertEquals("w9:t2", params(herdr, "tab.close").get("tab_id"), "orphaned tab must be closed");
-    }
-
-    @Test
-    void spawnWorkerRejectsOffAllowlistBaseUrlAndNeverTouchesHerdr() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        // base_url points at the subscription — guard must block before any herdr call.
-        int port = start(herdr, "https://api.anthropic.com", Set.of("gx00.gw"));
-
-        HttpResponse<String> res = req(port, "POST", "/workers");
-        assertEquals(403, res.statusCode());
-        assertEquals("subscription_boundary", mapper.readTree(res.body()).get("error").asText());
-        assertFalse(herdr.called("agent.start"), "guard must stop the spawn before herdr");
-        assertFalse(herdr.called("workspace.create"), "guard must stop before provisioning a space");
-    }
-
-    @Test
-    void panePlacementSplitsFocusedTabWithoutADedicatedSpace() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "pane");
-
-        assertEquals(201, req(port, "POST", "/workers").statusCode());
-        Map<String, Object> start = params(herdr, "agent.start");
-        assertFalse(start.containsKey("tab_id"), "pane placement must not target a tab");
-        assertFalse(herdr.called("workspace.create"), "pane placement uses no dedicated space");
-        assertFalse(herdr.called("tab.create"));
-    }
-
-    @Test
-    void stopWorkerClosesPaneAndItsTab() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        assertEquals(204, req(port, "DELETE", "/workers/w9:pW").statusCode());
-        assertTrue(herdr.called("pane.close"));
-        // Tab resolved from the pane (pane.get), then closed.
-        assertEquals("w9:t2", params(herdr, "tab.close").get("tab_id"));
-    }
-
-    @Test
-    void messageReturnsTheWorkersStructuredReply() throws Exception {
-        // CB-104 (option C): the blocking send resolves on the worker's bridge_reply, not a scrape.
-        FakeHerdr herdr = new FakeHerdr().agentStatus("idle"); // poller delivers the injection
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        var send = java.util.concurrent.CompletableFuture.supplyAsync(() -> {
-            try { return postMessage(port, "{\"content\":\"review this\",\"timeoutMs\":4000}"); }
-            catch (Exception e) { throw new RuntimeException(e); }
-        });
-
-        // Give the background send thread time to open its rendezvous waiter (CB-307: reply now
-        // queues in the inbox if no waiter is open, which would break the round-trip).
-        Thread.sleep(200);
-        HttpResponse<String> reply = postJson(port, "/sessions/term_a/reply", "{\"content\":\"LGTM ship it\"}");
-        assertEquals(200, reply.statusCode());
-
-        HttpResponse<String> res = send.get(6, java.util.concurrent.TimeUnit.SECONDS);
-        assertEquals(200, res.statusCode());
-        assertEquals("LGTM ship it", mapper.readTree(res.body()).get("reply").asText());
-        // (injection via agent.prompt is covered deterministically by the timeout-working test)
-    }
-
-    @Test
-    void asyncSendReturnsATicketThenPollReportsTheReply() throws Exception {
-        // CB-107 fire-and-poll: wait:false returns a ticket immediately; the result is polled.
-        FakeHerdr herdr = new FakeHerdr().agentStatus("idle"); // poller delivers the injection
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        HttpResponse<String> accepted = postMessage(port, "{\"content\":\"do it\",\"wait\":false}");
-        assertEquals(202, accepted.statusCode());
-        String ticket = mapper.readTree(accepted.body()).get("ticket").asText();
-        assertFalse(ticket.isBlank(), "an async send must return a ticket");
-
-        // Give the background async send thread time to open its rendezvous waiter.
-        Thread.sleep(200);
-        HttpResponse<String> reply = postJson(port, "/sessions/term_a/reply", "{\"content\":\"async LGTM\"}");
-        assertEquals(200, reply.statusCode());
-
-        // Polling the ticket now reports the finished delegation and its reply.
-        JsonNode task;
-        long deadline = System.currentTimeMillis() + 3000;
-        do {
-            task = mapper.readTree(req(port, "GET", "/tasks/" + ticket).body());
-            if ("done".equals(task.path("phase").asText())) break;
-            //noinspection BusyWait
-            Thread.sleep(10);
-        } while (System.currentTimeMillis() < deadline);
-        assertEquals("done", task.get("phase").asText());
-        assertEquals("async LGTM", task.get("reply").asText());
-        assertEquals("reply", task.get("replySource").asText());
-    }
-
-    @Test
-    void pollUnknownTicketIs404() throws Exception {
-        int port = startHealthy();
-        HttpResponse<String> res = req(port, "GET", "/tasks/task-999");
-        assertEquals(404, res.statusCode());
-        assertEquals("unknown_ticket", mapper.readTree(res.body()).get("error").asText());
-    }
-
-    @Test
-    void replyWithNoPendingSendQueuesInsteadOfConflict() throws Exception {
-        // CB-307: a reply with no open send now queues in the inbox, not a 409 conflict.
-        int port = startHealthy();
-        HttpResponse<String> res = postJson(port, "/sessions/term_a/reply", "{\"content\":\"orphan\"}");
-        assertEquals(200, res.statusCode());
-
-        // The queued reply is drainable.
-        HttpResponse<String> drain = req(port, "GET", "/sessions/term_a/replies");
-        assertEquals(200, drain.statusCode());
-        JsonNode body = mapper.readTree(drain.body());
-        assertEquals(1, body.get("replies").size());
-        assertEquals("orphan", body.get("replies").get(0).get("content").asText());
-    }
-
-    @Test
-    void drainRepliesReturnsEmptyForNoReplies() throws Exception {
-        int port = startHealthy();
-        HttpResponse<String> res = req(port, "GET", "/sessions/term_a/replies");
-        assertEquals(200, res.statusCode());
-        assertEquals(0, mapper.readTree(res.body()).get("replies").size());
-    }
-
-    @Test
-    void messageTimesOutQueuedWhenWorkerNeverInjectable() throws Exception {
-        FakeHerdr herdr = new FakeHerdr().agentStatus("working"); // never injectable → never delivered
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        HttpResponse<String> res = postMessage(port, "{\"content\":\"hi\",\"timeoutMs\":150}");
-        assertEquals(202, res.statusCode());
-        assertEquals("queued", mapper.readTree(res.body()).get("status").asText());
-        assertFalse(herdr.called("agent.prompt"), "no injection while the worker is mid-turn");
-    }
-
-    @Test
-    void messageTimesOutWorkingWhenDeliveredButNoReply() throws Exception {
-        FakeHerdr herdr = new FakeHerdr().agentStatus("idle"); // delivered, but nobody replies
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        HttpResponse<String> res = postMessage(port, "{\"content\":\"hi\",\"timeoutMs\":250}");
-        assertEquals(202, res.statusCode());
-        assertEquals("working", mapper.readTree(res.body()).get("status").asText());
-        assertTrue(herdr.called("agent.prompt"), "message was injected");
-    }
-
-    @Test
-    void messageRejectsBlankContent() throws Exception {
-        int port = startHealthy();
-        assertEquals(400, postMessage(port, "{}").statusCode());
-    }
-
-    @Test
-    void sessionStatusReportsLiveAgentStatus() throws Exception {
-        FakeHerdr herdr = new FakeHerdr().agentStatus("blocked");
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        HttpResponse<String> res = req(port, "GET", "/sessions/term_a/status");
-        assertEquals(200, res.statusCode());
-        assertEquals("blocked", mapper.readTree(res.body()).get("status").asText());
-    }
-
-    @Test
-    void sessionStatusReportsReadinessFromMcpPresence() throws Exception {
-        int port = start(new FakeHerdr(), "http://gx00.gw:8000", Set.of("gx00.gw"));
-        // Not yet seen on the bridge MCP → not ready.
-        assertFalse(mapper.readTree(req(port, "GET", "/sessions/term_a/status").body()).get("ready").asBoolean());
-        // Worker connects its MCP client → available.
-        presence.markPresent("term_a");
-        assertTrue(mapper.readTree(req(port, "GET", "/sessions/term_a/status").body()).get("ready").asBoolean());
-    }
-
-    @Test
-    void stopWorkerInPanePlacementClosesOnlyThePane() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "pane");
-
-        assertEquals(204, req(port, "DELETE", "/workers/w9:pW").statusCode());
-        assertTrue(herdr.called("pane.close"));
-        assertFalse(herdr.called("tab.close"), "pane placement owns no tab to close");
-        assertFalse(herdr.called("pane.get"), "no tab resolution in pane placement");
-    }
-
-    @Test
-    void stopNeverClosesATabThatHoldsOtherPanes() throws Exception {
-        // The worker's tab has 2 panes (e.g. a pane-placement worker sharing a user tab).
-        FakeHerdr herdr = new FakeHerdr().withWorkerTabPaneCount(2);
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        assertEquals(204, req(port, "DELETE", "/workers/w9:pW").statusCode());
-        assertTrue(herdr.called("pane.close"), "the worker's own pane is still closed");
-        assertFalse(herdr.called("tab.close"), "must not close a tab that holds the user's other panes");
-    }
-
-    @Test
-    void stopReportsFailureWhenPaneCloseFailsForARealReason() throws Exception {
-        FakeHerdr herdr = new FakeHerdr().paneCloseFailsWith("herdr_busy");
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        // A genuine teardown failure must surface, not be reported as a successful 204.
-        assertEquals(500, req(port, "DELETE", "/workers/w9:pW").statusCode());
-        assertFalse(herdr.called("tab.close"), "tab is not removed when the pane close failed");
-    }
-
-    @Test
-    void stopToleratesAnAlreadyGonePane() throws Exception {
-        FakeHerdr herdr = new FakeHerdr().paneCloseFailsWith("pane_not_found");
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        // Already-gone is success; the (now-empty) tab is still cleaned up.
-        assertEquals(204, req(port, "DELETE", "/workers/w9:pW").statusCode());
-        assertTrue(herdr.called("tab.close"));
-    }
-}

bridged/src/test/java/dev/ltms/bridged/session/FakeWorktrees.java

@@ -1,130 +0,0 @@
-package dev.ltms.bridged.session;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.CopyOnWriteArrayList;
-
-/** Recording fake {@link Worktrees} for CB-301-ext acceptance tests (no live git). */
-public final class FakeWorktrees implements Worktrees {
-
-    public record AddCall(String repoRoot, String branch, String baseRef) {
-    }
-
-    public record RemoveCall(String repoRoot, String worktreePath) {
-    }
-
-    public record OverlayCall(String repoRoot, String worktreePath,
-                               List<String> requested, List<String> copied, List<String> skipWorktree) {
-    }
-
-    public record RepoRootCall(String cwd) {
-    }
-
-    private final List<AddCall> addCalls = new CopyOnWriteArrayList<>();
-    private final List<RemoveCall> removeCalls = new CopyOnWriteArrayList<>();
-    private final List<OverlayCall> overlayCalls = new CopyOnWriteArrayList<>();
-    private final List<RepoRootCall> repoRootCalls = new CopyOnWriteArrayList<>();
-    private final Set<String> existingPaths = ConcurrentHashMap.newKeySet();
-    private final Set<String> trackedPaths = ConcurrentHashMap.newKeySet();
-    private volatile RuntimeException addFailure;
-    private volatile String repoRoot = "/repo";
-    private volatile String prefix = "/worktrees";
-
-    public FakeWorktrees withRepoRoot(String root) {
-        this.repoRoot = root;
-        return this;
-    }
-
-    public FakeWorktrees withPrefix(String prefix) {
-        this.prefix = prefix;
-        return this;
-    }
-
-    /** Paths that exist in the primary repo and will be copied to the worktree. */
-    public FakeWorktrees exists(String... paths) {
-        Collections.addAll(existingPaths, paths);
-        return this;
-    }
-
-    /** Paths that exist AND are tracked, so overlayParity should --skip-worktree them. */
-    public FakeWorktrees track(String... paths) {
-        exists(paths);
-        Collections.addAll(trackedPaths, paths);
-        return this;
-    }
-
-    /** Make subsequent {@link #add} calls throw (simulates git worktree add failure). */
-    public FakeWorktrees failAdd(String message) {
-        this.addFailure = new WorktreeException(message);
-        return this;
-    }
-
-    @Override
-    public String add(String repoRoot, String branch, String baseRef) {
-        addCalls.add(new AddCall(repoRoot, branch, baseRef));
-        if (addFailure != null) {
-            throw addFailure;
-        }
-        // The branch already carries a unique nonce, so the derived path is distinct per acquire
-        // without an extra counter — keep it a pure function of the branch the test can predict.
-        return prefix + "/" + branch.replace('/', '_');
-    }
-
-    @Override
-    public void remove(String repoRoot, String worktreePath) {
-        removeCalls.add(new RemoveCall(repoRoot, worktreePath));
-    }
-
-    @Override
-    public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
-        List<String> copied = new java.util.ArrayList<>();
-        List<String> skipped = new java.util.ArrayList<>();
-        for (String rel : overlay) {
-            if (!existingPaths.contains(rel)) {
-                continue; // missing source is silently skipped
-            }
-            copied.add(rel);
-            if (trackedPaths.contains(rel)) {
-                skipped.add(rel);
-            }
-        }
-        overlayCalls.add(new OverlayCall(repoRoot, worktreePath, List.copyOf(overlay),
-                List.copyOf(copied), List.copyOf(skipped)));
-    }
-
-    @Override
-    public String repoRoot(String cwd) {
-        repoRootCalls.add(new RepoRootCall(cwd));
-        return repoRoot;
-    }
-
-    public List<AddCall> addCalls() {
-        return List.copyOf(addCalls);
-    }
-
-    public List<RemoveCall> removeCalls() {
-        return List.copyOf(removeCalls);
-    }
-
-    public List<OverlayCall> overlayCalls() {
-        return List.copyOf(overlayCalls);
-    }
-
-    public List<RepoRootCall> repoRootCalls() {
-        return List.copyOf(repoRootCalls);
-    }
-
-    public AddCall lastAdd() {
-        return addCalls.isEmpty() ? null : addCalls.getLast();
-    }
-
-    public RemoveCall lastRemove() {
-        return removeCalls.isEmpty() ? null : removeCalls.getLast();
-    }
-
-    public OverlayCall lastOverlay() {
-        return overlayCalls.isEmpty() ? null : overlayCalls.getLast();
-    }
-}

bridged/src/test/java/dev/ltms/bridged/session/GitWorktreesTest.java

@@ -1,119 +0,0 @@
-package dev.ltms.bridged.session;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-525 acceptance test for tool-surface isolation. This is one of the few tests that drives real
- * {@code git} — the behaviour under test is precisely what {@link GitWorktrees} does to a checkout,
- * so a fake would assert nothing. Everything happens inside a {@link TempDir} throwaway repo.
- */
-class GitWorktreesTest {
-
-    /** A project MCP config with servers in it — what this repo actually commits. */
-    private static final String WITH_SERVERS = """
-            {
-              "mcpServers": {
-                "jetbrains": { "type": "sse", "url": "http://localhost:64342/sse" }
-              }
-            }
-            """;
-
-    private static Path initRepo(Path dir) throws Exception {
-        Files.createDirectories(dir);
-        git(dir, "init", "-q", "-b", "main");
-        git(dir, "config", "user.email", "test@example.invalid");
-        git(dir, "config", "user.name", "Test");
-        Files.writeString(dir.resolve(".mcp.json"), WITH_SERVERS);
-        Files.writeString(dir.resolve("README.md"), "seed\n");
-        git(dir, "add", ".mcp.json", "README.md");
-        git(dir, "commit", "-q", "-m", "seed");
-        return dir;
-    }
-
-    private static void git(Path cwd, String... args) throws Exception {
-        List<String> cmd = new java.util.ArrayList<>(List.of("git"));
-        cmd.addAll(List.of(args));
-        Process p = new ProcessBuilder(cmd).directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git timed out: " + String.join(" ", cmd));
-        assertEquals(0, p.exitValue(), "git " + String.join(" ", args) + " failed:\n" + out);
-    }
-
-    /** Pending changes to {@code .mcp.json} in {@code cwd}, empty when git considers it unmodified. */
-    private static String mcpStatus(Path cwd) throws Exception {
-        Process p = new ProcessBuilder("git", "status", "--porcelain", "--", ".mcp.json")
-                .directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git status timed out");
-        return out;
-    }
-
-    /**
-     * The heart of CB-525: a provisioned worktree must not inherit the primary's MCP servers. Without
-     * the isolation step the checked-out {@code .mcp.json} carries them in, and a worker navigating
-     * through the primary's IDE servers edits the primary's tree while building its own.
-     */
-    @Test
-    void aProvisionedWorktreeInheritsNoMcpServers(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-a", "HEAD");
-
-        Path mcp = Path.of(wt).resolve(".mcp.json");
-        assertTrue(Files.exists(mcp), ".mcp.json must still exist — present and explicitly empty");
-        String body = Files.readString(mcp);
-        assertFalse(body.contains("jetbrains"), "worktree inherited the primary's MCP servers:\n" + body);
-        assertTrue(body.replaceAll("\\s+", "").contains("\"mcpServers\":{}"),
-                "expected an explicitly empty server map, got:\n" + body);
-    }
-
-    /** Neutralizing must not look like work in progress, or a worker would commit it into its PR. */
-    @Test
-    void theNeutralizedConfigIsNotAPendingLocalModification(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-b", "HEAD");
-
-        assertEquals("", mcpStatus(Path.of(wt)),
-                "the neutralized .mcp.json shows as modified — --skip-worktree did not take");
-    }
-
-    /** Isolation is the worktree's business only; the primary's own checkout must be untouched. */
-    @Test
-    void thePrimaryCheckoutIsLeftAlone(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-525-c", "HEAD");
-
-        assertEquals(WITH_SERVERS, Files.readString(repo.resolve(".mcp.json")),
-                "the primary's .mcp.json was rewritten — isolation reached out of the worktree");
-    }
-
-    /** A repo that commits no {@code .mcp.json} still gets one, so nothing can be inherited later. */
-    @Test
-    void aRepoWithoutAnMcpConfigStillGetsANeutralOne(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-d", "HEAD");
-
-        // Untracked is the normal case here, so the --skip-worktree branch must be skipped rather
-        // than run and fail: `update-index --skip-worktree` on an unknown path exits non-zero.
-        String body = Files.readString(Path.of(wt).resolve(".mcp.json"));
-        assertTrue(body.replaceAll("\\s+", "").contains("\"mcpServers\":{}"), body);
-    }
-}

bridged/src/test/java/dev/ltms/bridged/session/SessionManagerTest.java

@@ -1,496 +0,0 @@
-package dev.ltms.bridged.session;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.worker.ClaudeCodeLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import org.junit.jupiter.api.Test;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.function.LongSupplier;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-301 / CB-303 acceptance tests for the authoritative session registry, one-shot lifecycle FSM,
- * and configurable lifecycle limits (idle TTL, context cap, drain).
- * No live herdr — everything runs against the same {@link FakeHerdr} the rest of the project uses.
- */
-class SessionManagerTest {
-
-    private SessionManager sessionManager(FakeHerdr herdr) {
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        return new SessionManager(workers);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock) {
-        return sessionManager(herdr, clock, 0);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap) {
-        return sessionManager(herdr, clock, contextCap, false);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap,
-                                          boolean clearAfterTurn) {
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        return new SessionManager(workers, new GitWorktrees(), clock, contextCap, clearAfterTurn);
-    }
-
-    @Test
-    void primaryContactWithNoTerminalIsNotAReadinessSignal() {
-        // The MCP context extractor calls presence.markPresent(p.terminal()) on EVERY request,
-        // and the primary's terminal is null — the presence bridge must treat that as a no-op,
-        // not feed it into the READY transition (which NPEd on the first real primary contact).
-        SessionManager sessions = sessionManager(new FakeHerdr());
-
-        assertDoesNotThrow(() -> sessions.asPresence().markPresent(null));
-        assertDoesNotThrow(() -> sessions.asPresence().markPresent("  "));
-    }
-
-    @Test
-    void acquireRegistersSpawningSessionWithDistinctPaneId() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        WorkerSession a = sessions.acquire("ltms-local", "/work/a", "/caller/a", "term_primary");
-        WorkerSession b = sessions.acquire("ltms-local", "/work/b", "/caller/b", "term_primary");
-
-        assertEquals(WorkerSession.State.SPAWNING, a.state(), "fresh session starts spawning");
-        assertEquals("ltms-local", a.profile());
-        assertEquals("/work/a", a.cwd(), "explicit requested cwd is recorded");
-        assertEquals("term_primary", a.ownerTerminal());
-        assertTrue(a.spawnedAtNanos() > 0);
-        assertNotNull(a.paneId());
-        assertNotNull(a.terminalId());
-
-        assertNotEquals(a.paneId(), b.paneId(), "no pane reuse");
-        assertNotEquals(a.terminalId(), b.terminalId(), "no terminal reuse");
-        assertEquals(2, sessions.roster().size(), "both sessions are registered");
-    }
-
-    @Test
-    void aNullTerminalFromThePrimaryIsANoOpEvenWithSessionsRegistered() {
-        // The primary resolves to a Principal with no terminal, and BridgeMcp's context extractor
-        // forwards that null into markPresent on EVERY MCP call. It only reached the registry scan
-        // once a session existed, so this NPE'd the primary's second spawn while the first passed.
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-
-        assertDoesNotThrow(() -> sessions.asPresence().markPresent(null),
-                "the primary's null terminal must not blow up an unrelated tool call");
-        assertDoesNotThrow(() -> sessions.onDelivered(null));
-        assertDoesNotThrow(() -> sessions.onTurnComplete(null));
-        assertDoesNotThrow(() -> sessions.onTurnFailed(null));
-
-        assertEquals(WorkerSession.State.SPAWNING, sessions.get(session.paneId()).orElseThrow().state(),
-                "and must not transition any registered session");
-    }
-
-    @Test
-    void presenceMovesSpawningToReadyAndDeliveredTurnMovesToDone() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-
-        sessions.asPresence().markPresent(terminal);
-        assertEquals(WorkerSession.State.READY, sessions.get(session.paneId()).orElseThrow().state(),
-                "MCP presence moves SPAWNING → READY");
-        assertTrue(sessions.asPresence().isPresent(terminal), "presence is also recorded");
-
-        sessions.onDelivered(terminal);
-        assertEquals(WorkerSession.State.BUSY, sessions.get(session.paneId()).orElseThrow().state(),
-                "delivery moves READY → BUSY");
-
-        sessions.onTurnComplete(terminal);
-        assertEquals(WorkerSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state(),
-                "turn completion moves BUSY → DONE");
-    }
-
-    @Test
-    void releaseTearsDownWorkerAndRemovesFromRosterAndIsIdempotent() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", null);
-        String paneId = session.paneId();
-
-        sessions.release(paneId);
-
-        assertTrue(herdr.called("pane.close"), "release tears the worker pane down");
-        assertTrue(sessions.get(paneId).isEmpty(), "released session is no longer retrievable");
-        assertTrue(sessions.roster().isEmpty(), "released session is no longer in the roster");
-
-        assertDoesNotThrow(() -> sessions.release(paneId), "a second release is harmless");
-    }
-
-    @Test
-    void onTurnFailedMovesSessionToFailed() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal);
-
-        sessions.onTurnFailed(terminal);
-
-        WorkerSession updated = sessions.get(session.paneId()).orElseThrow();
-        assertEquals(WorkerSession.State.FAILED, updated.state(), "turn failure moves to FAILED");
-        assertTrue(sessions.roster().contains(updated), "FAILED is still in acquired-minus-released roster");
-    }
-
-    @Test
-    void recycleProducesNewPaneIdAndOldOneIsGone() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        WorkerSession oldSession = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String oldPane = oldSession.paneId();
-        String oldTerminal = oldSession.terminalId();
-
-        WorkerSession fresh = sessions.recycle(oldPane);
-
-        assertNotEquals(oldPane, fresh.paneId(), "recycle yields a new pane id");
-        assertNotEquals(oldTerminal, fresh.terminalId(), "recycle yields a new terminal id");
-        assertEquals(oldSession.profile(), fresh.profile(), "profile is preserved");
-        assertEquals(oldSession.cwd(), fresh.cwd(), "cwd is preserved");
-        assertEquals(oldSession.ownerTerminal(), fresh.ownerTerminal(), "owner is preserved");
-
-        assertTrue(sessions.get(oldPane).isEmpty(), "old pane is deregistered");
-        assertEquals(1, sessions.roster().size(), "only the fresh session remains");
-        assertEquals(fresh.paneId(), sessions.roster().getFirst().paneId());
-
-        // The old session was the first spawn → pane w9:pRoot_1 (CB-519: the registry key is the
-        // uuid id, so teardown is asserted on the real pane coordinate).
-        long paneCloseCount = herdr.calls.stream()
-                .filter(c -> "pane.close".equals(c.method()))
-                .filter(c -> "w9:pRoot_1".equals(((Map<?, ?>) c.params()).get("pane_id")))
-                .count();
-        assertEquals(1, paneCloseCount, "the old worker was torn down");
-    }
-
-    @Test
-    void rosterReflectsAcquiredMinusReleased() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        WorkerSession a = sessions.acquire("ltms-local", "/a", "/caller", "ownerA");
-        WorkerSession b = sessions.acquire("ltms-local", "/b", "/caller", "ownerB");
-
-        assertEquals(2, sessions.roster().size());
-        assertTrue(sessions.roster().stream().anyMatch(s -> s.paneId().equals(a.paneId())));
-        assertTrue(sessions.roster().stream().anyMatch(s -> s.paneId().equals(b.paneId())));
-
-        sessions.release(a.paneId());
-
-        assertEquals(1, sessions.roster().size());
-        assertEquals(b.paneId(), sessions.roster().getFirst().paneId());
-    }
-
-    // --- CB-303 lifecycle limits ----------------------------------------------------
-
-    @Test
-    void reapIdleDoesNothingWhenNoSessions() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L);
-
-        assertEquals(0, sessions.reapIdle(10));
-        assertTrue(sessions.roster().isEmpty());
-    }
-
-    @Test
-    void readySessionPastIdleTtlIsReaped() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-
-        clock[0] = 11;
-        assertEquals(1, sessions.reapIdle(10), "READY session past TTL is reaped");
-        assertTrue(sessions.get(session.paneId()).isEmpty(), "reaped session is removed from registry");
-        assertTrue(herdr.called("pane.close"), "reaped session tears the pane down");
-    }
-
-    @Test
-    void readySessionWithinIdleTtlSurvives() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-
-        clock[0] = 5;
-        assertEquals(0, sessions.reapIdle(10), "READY session within TTL is not reaped");
-        assertEquals(WorkerSession.State.READY,
-                sessions.get(session.paneId()).orElseThrow().state(),
-                "READY session survives");
-    }
-
-    @Test
-    void busySessionPastIdleTtlIsNotReaped() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal);
-
-        clock[0] = 100;
-        assertEquals(0, sessions.reapIdle(10), "BUSY session past TTL is never reaped");
-        assertEquals(WorkerSession.State.BUSY,
-                sessions.get(session.paneId()).orElseThrow().state(),
-                "BUSY session remains");
-    }
-
-    @Test
-    void doneSessionPastIdleTtlIsReaped() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal);
-        sessions.onTurnComplete(terminal);
-
-        clock[0] = 21;
-        assertEquals(1, sessions.reapIdle(20), "DONE session past TTL is reaped");
-        assertTrue(sessions.get(session.paneId()).isEmpty(), "DONE session is removed");
-    }
-
-    @Test
-    void reapIdleReturnsCorrectCountAndSkipsBusy() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-
-        WorkerSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "owner1");
-        WorkerSession busy = sessions.acquire("ltms-local", "/busy", "/caller", "owner2");
-        sessions.asPresence().markPresent(ready.terminalId());
-        sessions.asPresence().markPresent(busy.terminalId());
-        sessions.onDelivered(busy.terminalId());
-
-        clock[0] = 50;
-        assertEquals(1, sessions.reapIdle(30), "only READY past TTL is reaped");
-        assertTrue(sessions.get(ready.paneId()).isEmpty(), "READY session is gone");
-        assertEquals(WorkerSession.State.BUSY,
-                sessions.get(busy.paneId()).orElseThrow().state(),
-                "BUSY session is still registered");
-    }
-
-    @Test
-    void contextCapDisabledSessionSurvivesMultipleTurns() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 0);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-
-        sessions.onDelivered(terminal);
-        sessions.onTurnComplete(terminal);
-        sessions.onDelivered(terminal);
-        sessions.onTurnComplete(terminal);
-
-        WorkerSession updated = sessions.get(session.paneId()).orElseThrow();
-        assertEquals(WorkerSession.State.DONE, updated.state(), "session finishes second turn");
-        assertEquals(2, updated.turnCount(), "turn count tracks both deliveries");
-        long releaseCloseCount = paneCloseCallsFor(herdr, "w9:pRoot_1"); // the real pane coordinate
-        assertEquals(0, releaseCloseCount, "cap disabled — no forced release of the worker pane");
-    }
-
-    @Test
-    void contextCapTwoReleasesAfterSecondComplete() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 2);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String terminal = session.terminalId();
-        sessions.asPresence().markPresent(terminal);
-
-        sessions.onDelivered(terminal);
-        sessions.onTurnComplete(terminal);
-        assertEquals(WorkerSession.State.DONE,
-                sessions.get(session.paneId()).orElseThrow().state(),
-                "first turn completes without release");
-
-        sessions.onDelivered(terminal);
-        sessions.onTurnComplete(terminal);
-
-        assertTrue(sessions.get(session.paneId()).isEmpty(), "session released after cap reached");
-        assertTrue(sessions.roster().isEmpty(), "released session leaves roster");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"),
-                "forced release tears the worker pane down exactly once");
-    }
-
-    @Test
-    void clearAfterTurnResetsContextWithoutDoubleCountingTheTurn() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 0, true);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        sessions.asPresence().markPresent(session.terminalId());
-
-        sessions.onDelivered(session.terminalId());
-        assertTrue(sessions.onTurnCompleteWithPostAction(session.terminalId()));
-
-        WorkerSession updated = sessions.get(session.paneId()).orElseThrow();
-        assertEquals(1, updated.turnCount(), "the reset is housekeeping, not a second delegation");
-        assertEquals(List.of("/clear"), promptTexts(herdr));
-    }
-
-    @Test
-    void contextCapReleaseWinsOverClearAfterTurn() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 1, true);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        sessions.asPresence().markPresent(session.terminalId());
-        sessions.onDelivered(session.terminalId());
-
-        assertFalse(sessions.hasPostTurnAction(session.terminalId()),
-                "a session at its cap will be released, not reset for reuse");
-        assertFalse(sessions.onTurnCompleteWithPostAction(session.terminalId()));
-        assertTrue(sessions.get(session.paneId()).isEmpty());
-        assertTrue(promptTexts(herdr).isEmpty(), "never send /clear into a worker being torn down");
-    }
-
-    @Test
-    void clearAfterTurnFalsePreservesCompletionWithoutAControlPrompt() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> 0L, 0, false);
-        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        sessions.asPresence().markPresent(session.terminalId());
-        sessions.onDelivered(session.terminalId());
-
-        sessions.onTurnComplete(session.terminalId());
-
-        assertEquals(WorkerSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state());
-        assertTrue(promptTexts(herdr).isEmpty());
-    }
-
-    @Test
-    void drainAllReleasesBusyAndReadySessionsAndWaitsForBusy() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-
-        WorkerSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "ownerR");
-        WorkerSession busy = sessions.acquire("ltms-local", "/busy", "/caller", "ownerB");
-        sessions.asPresence().markPresent(ready.terminalId());
-        sessions.asPresence().markPresent(busy.terminalId());
-        sessions.onDelivered(busy.terminalId());
-
-        sessions.drainAll(TimeUnit.MILLISECONDS.toNanos(100));
-
-        assertTrue(sessions.roster().isEmpty(), "drain clears the roster");
-        assertTrue(sessions.get(ready.paneId()).isEmpty(), "ready session is released");
-        assertTrue(sessions.get(busy.paneId()).isEmpty(), "busy session is released after timeout");
-        // ready is the first spawn → pane w9:pRoot_1, busy the second → w9:pRoot_2 (FakeHerdr order).
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"),
-                "ready worker pane is torn down");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_2"),
-                "busy worker pane is torn down");
-    }
-
-    private static long paneCloseCallsFor(FakeHerdr herdr, String paneId) {
-        return herdr.calls.stream()
-                .filter(c -> "pane.close".equals(c.method()))
-                .filter(c -> paneId.equals(((Map<?, ?>) c.params()).get("pane_id")))
-                .count();
-    }
-
-    private static List<String> promptTexts(FakeHerdr herdr) {
-        return herdr.calls.stream()
-                .filter(c -> "agent.prompt".equals(c.method()))
-                .map(c -> String.valueOf(((Map<?, ?>) c.params()).get("text")))
-                .toList();
-    }
-
-    // --- CB-306 spawn-readiness gate: no half-registered session on timeout ----------------
-
-    @Test
-    void acquireThrowsPeerUnreachableWhenGateTimesOutAndRegistersNoSession() {
-        FakeHerdr herdr = new FakeHerdr();
-        herdr.agentStatus("unknown"); // never becomes injectable
-        long[] clock = {0};
-
-        // Gate-enabled launcher (1 ms timeout + no-op sleeper that advances clock past deadline)
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(
-                new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
-                1, () -> clock[0], () -> clock[0] += 10);
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(), () -> 0L, 0);
-
-        assertThrows(PeerUnreachableException.class,
-                () -> sessions.acquire("ltms-local", null, "/caller", "term_primary"),
-                "acquire must throw PeerUnreachableException when spawn times out");
-
-        // No half-registered session — the error happened inside spawn, before
-        // SessionManager could put() anything into the registry.
-        assertTrue(sessions.roster().isEmpty(),
-                "no session is registered when spawn times out (roster empty)");
-    }
-
-    // --- CB-516: release must notify, so a blocked send can be failed --------------------------
-
-    @Test
-    void releaseNotifiesTheListenerWithTheReleasedTerminal() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(released::add);
-
-        WorkerSession s = sessions.acquire("ltms-local", null, "/caller", null);
-        sessions.release(s.paneId());
-
-        assertEquals(java.util.List.of(s.terminalId()), released,
-                "every teardown path funnels through release, so one hook must see the terminal");
-    }
-
-    @Test
-    void releasingAnUnknownPaneNotifiesNobody() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(released::add);
-
-        sessions.release("w9:p404"); // idempotent teardown of something already gone
-
-        assertTrue(released.isEmpty(), "no session removed ⇒ no send was waiting on it");
-    }
-
-    @Test
-    void aThrowingReleaseListenerDoesNotBlockTheTeardown() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        sessions.onRelease(_ -> {
-            throw new IllegalStateException("listener blew up");
-        });
-
-        WorkerSession s = sessions.acquire("ltms-local", null, "/caller", null);
-        assertDoesNotThrow(() -> sessions.release(s.paneId()),
-                "a listener failure must never prevent the teardown it is reacting to");
-        assertTrue(sessions.get(s.paneId()).isEmpty(), "and the session is still deregistered");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/session/WorktreeSessionManagerTest.java

@@ -1,227 +0,0 @@
-package dev.ltms.bridged.session;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.worker.ClaudeCodeLauncher;
-import org.junit.jupiter.api.Test;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-301-ext acceptance tests for worktree provisioning and config-parity overlay.
- * No live git — every Worktrees call is handled by {@link FakeWorktrees} and every herdr
- * call by {@link FakeHerdr}, matching the project's fake-based test style.
- */
-class WorktreeSessionManagerTest {
-
-    private static ClaudeCodeLauncher workerService(FakeHerdr herdr) {
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-    }
-
-    private static String startCwd(FakeHerdr herdr) {
-        @SuppressWarnings("unchecked")
-        // Protocol 19: the worker's cwd rides on pane creation (tab.create), not agent.start.
-        Map<String, Object> start = (Map<String, Object>) herdr.lastCall("tab.create").params();
-        Object cwd = start.get("cwd");
-        return cwd == null ? null : cwd.toString();
-    }
-
-    @Test
-    void sharedTreeAcquireMakesNoWorktreesCallsAndRecordsNullWorktree() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees();
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-
-        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary");
-
-        assertTrue(worktrees.addCalls().isEmpty(), "shared-tree acquire never adds a worktree");
-        assertTrue(worktrees.repoRootCalls().isEmpty(), "shared-tree acquire never resolves a repo root");
-        assertTrue(worktrees.overlayCalls().isEmpty(), "shared-tree acquire never overlays parity");
-        assertNull(s.worktree(), "shared-tree session has no worktree");
-        assertNull(s.branch(), "shared-tree session has no branch");
-        assertEquals("/caller/proj", s.cwd(), "shared-tree cwd is the caller's cwd");
-        assertEquals("/caller/proj", startCwd(herdr), "spawn receives the caller's cwd");
-    }
-
-    @Test
-    void worktreeAcquireProvisionsAndRecordsPathAndBranch() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-
-        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
-                new WorktreeRequest("cb-999", null));
-
-        assertEquals(1, worktrees.addCalls().size(), "one worktree was added");
-        FakeWorktrees.AddCall add = worktrees.lastAdd();
-        assertNotNull(add);
-        assertEquals("/repo", add.repoRoot());
-        assertTrue(add.branch().startsWith("worker/cb-999-"), "branch is worker/<slug>-<nonce>: " + add.branch());
-        assertNull(add.baseRef(), "null baseRef is passed through (HEAD default)");
-
-        String expectedPath = "/wt/" + add.branch().replace('/', '_');
-        assertEquals(expectedPath, s.worktree(), "session records the returned worktree path");
-        assertEquals(add.branch(), s.branch(), "session records the branch");
-        assertEquals(expectedPath, startCwd(herdr), "spawn receives the worktree path as cwd");
-        assertEquals(expectedPath, s.cwd(), "session cwd is the worktree path");
-    }
-
-    @Test
-    void worktreeAcquireRunsParityOverlayWithProfileDefaults() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
-                .track(".envrc")
-                .exists(".claude/settings.local.json");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-
-        sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-888", null));
-
-        assertEquals(1, worktrees.overlayCalls().size());
-        FakeWorktrees.OverlayCall overlay = worktrees.lastOverlay();
-        assertNotNull(overlay);
-        assertEquals("/repo", overlay.repoRoot());
-        assertEquals(List.of(".claude/settings.local.json", ".env", ".envrc"),
-                overlay.requested(), "default parity overlay is used when unset");
-        assertFalse(overlay.requested().contains(".mcp.json"),
-                "CB-525: replicating the primary's MCP config gives a worker the primary's IDE "
-                        + "servers, which navigate its edits out of its own worktree");
-        assertEquals(List.of(".claude/settings.local.json", ".envrc"), overlay.copied(),
-                "existing paths are copied; missing paths are skipped");
-        assertEquals(List.of(".envrc"), overlay.skipWorktree(),
-                "tracked copied paths are --skip-worktree'd");
-    }
-
-    @Test
-    void releaseRemovesWorktreeButDoesNotDeleteBranch() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-666", null));
-        String paneId = s.paneId();
-
-        sessions.release(paneId);
-
-        assertTrue(herdr.called("pane.close"), "release still tears the worker pane down");
-        assertEquals(1, worktrees.removeCalls().size(), "worktree session triggers one remove");
-        FakeWorktrees.RemoveCall remove = worktrees.lastRemove();
-        assertNotNull(remove);
-        assertEquals("/repo", remove.repoRoot());
-        assertEquals(s.worktree(), remove.worktreePath());
-        // The fake records no branch-delete calls because Worktrees.remove only removes the checkout.
-        assertTrue(sessions.get(paneId).isEmpty(), "released session is no longer retrievable");
-    }
-
-    @Test
-    void sharedTreeReleaseMakesNoWorktreesCalls() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees();
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", null);
-
-        sessions.release(s.paneId());
-
-        assertTrue(herdr.called("pane.close"), "release tears the worker pane down");
-        assertTrue(worktrees.removeCalls().isEmpty(), "shared-tree release never removes a worktree");
-    }
-
-    @Test
-    void failedWorktreeAddUnwindsWithoutRegisteringSessionOrSpawning() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().failAdd("worktree add failed");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-
-        assertThrows(WorktreeException.class, () ->
-                sessions.acquire("ltms-local", null, "/caller/proj", null,
-                        new WorktreeRequest("cb-555", null)));
-
-        assertEquals(0, sessions.size(), "failed acquire leaves no registry entry");
-        assertFalse(herdr.called("agent.start"), "spawn is never reached when add fails");
-        assertTrue(worktrees.removeCalls().isEmpty(), "no worktree was added, so none is removed");
-    }
-
-    @Test
-    void twoWorktreeAcquiresYieldDistinctBranchesAndPaths() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-
-        WorkerSession a = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-444", null));
-        WorkerSession b = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-444", null));
-
-        assertNotEquals(a.branch(), b.branch(), "branches are distinct");
-        assertNotEquals(a.worktree(), b.worktree(), "paths are distinct");
-        assertEquals(2, worktrees.addCalls().size());
-        assertEquals(2, sessions.roster().size());
-    }
-
-    /**
-     * CB-507 regression. A plain REST spawn supplies neither a requested nor a caller cwd
-     * ({@code BridgedApp} hardcodes {@code callerCwd = null}), and the worktree branch used to
-     * resolve the repo root from just those two — yielding {@code null}, which the real
-     * {@code GitWorktrees} turns into {@code git -C null} and an NPE out of {@code ProcessBuilder}
-     * (HTTP 500).
-     *
-     * <p>Note this asserts on the <em>recorded</em> cwd rather than expecting a throw:
-     * {@link FakeWorktrees#repoRoot} only records its argument and returns a canned root, so a
-     * null flows through the fake harmlessly. That permissiveness is precisely why the whole
-     * suite stayed green while the feature was broken in production — so the assertion has to be
-     * "a usable cwd was passed down", not "an exception was raised".
-     */
-    @Test
-    void worktreeAcquireWithNoRequestedOrCallerCwdStillResolvesANonNullRepoRoot() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees();
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-
-        sessions.acquire("ltms-local", null, null, null, new WorktreeRequest("cb-507", null));
-
-        assertFalse(worktrees.repoRootCalls().isEmpty(),
-                "repoRoot should have been called to resolve the repo root");
-        String cwd = worktrees.repoRootCalls().getFirst().cwd();
-        assertNotNull(cwd, "a null cwd here becomes `git -C null` and NPEs in the real GitWorktrees");
-        assertFalse(cwd.isBlank(), "a blank cwd is as unusable as a null one");
-    }
-
-    /**
-     * The same line carried a second, quieter bug: it never consulted the profile's configured
-     * {@code cwd:}, so a worktree spawn silently ignored a pinned per-profile working directory.
-     * Routing through {@code effectiveCwd} honours it.
-     */
-    @Test
-    void worktreeAcquireHonoursTheProfileConfiguredCwd() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        // Argument order matters: configDir is the 4th parameter, cwd the 11th (after mcpUrl).
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, "/pinned/dir", null);
-        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(
-                new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        SessionManager sessions = new SessionManager(launcher, worktrees);
-
-        sessions.acquire("ltms-local", null, null, null, new WorktreeRequest("cb-507b", null));
-
-        assertEquals(1, worktrees.repoRootCalls().size());
-        assertEquals("/pinned/dir", worktrees.repoRootCalls().getFirst().cwd(),
-                "the profile's configured cwd must reach repoRoot, not be ignored");
-    }
-
-}

bridged/src/test/java/dev/ltms/bridged/worker/ClaudeCodeLauncherTest.java

@@ -1,785 +0,0 @@
-package dev.ltms.bridged.worker;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.GuardException;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
-import org.junit.jupiter.api.Test;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-import java.util.function.Function;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/** The step-4 launch-flag injection: the bridge MCP + reply charter are appended to the argv. */
-class ClaudeCodeLauncherTest {
-
-    private ClaudeCodeLauncher service(FakeHerdr herdr, List<String> argv, String mcpUrl) {
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                argv, "tab", "bridged-workers", "worker: {profile} #{n}", mcpUrl, null, null);
-        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-    }
-
-    /** The {@code args} of the last agent.start — protocol 19: everything after the executable. */
-    @SuppressWarnings("unchecked")
-    private List<String> spawnedArgs(FakeHerdr herdr) {
-        return (List<String>) ((Map<String, Object>) herdr.lastCall("agent.start").params()).get("args");
-    }
-
-    @Test
-    void appendsBridgeMcpAndReplyCharterWhenMcpUrlSet() {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, List.of("claude"), "http://127.0.0.1:8765/mcp").spawn();
-
-        List<String> args = spawnedArgs(herdr);
-        assertTrue(args.contains("--mcp-config"));
-        assertTrue(args.stream().anyMatch(a -> a.contains("\"bridge\"") && a.contains("http://127.0.0.1:8765/mcp")),
-                "inline bridge MCP config present");
-        assertTrue(args.contains("--append-system-prompt"));
-        assertTrue(args.stream().anyMatch(a -> a.contains("bridge_reply")), "reply charter present");
-    }
-
-    @Test
-    void startRetriesWhileTheSeedShellBoots() {
-        // tab.create returns before the seed shell reaches its prompt; herdr refuses agent.start
-        // into a not-ready pane with agent_pane_busy. The launcher must wait it out, not fail.
-        FakeHerdr herdr = new FakeHerdr().agentPaneBusyTimes(2);
-        long[] clock = {0};
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
-                new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")),
-                Map.of("ltms-local", new BridgedConfig.Worker(
-                        "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                        List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null)),
-                "ltms-local", _ -> null,
-                0, () -> clock[0], () -> clock[0] += 50);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
-
-        assertNotNull(handle, "spawn succeeds once the shell is ready");
-        assertEquals(3, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count(),
-                "two busy rejections, then the successful start");
-    }
-
-    @Test
-    void startResolvesTheExecutableFromKindAndDropsArgvZero() {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, List.of("claude"), null).spawn();
-
-        Map<?, ?> start = (Map<?, ?>) herdr.lastCall("agent.start").params();
-        assertEquals("claude", start.get("kind"), "herdr launches the canonical executable by kind");
-        // CB-533: the shared fixture pins model "coder", so the model flag is the whole args list.
-        // What this test guards is that argv[0] is NOT repeated — herdr supplies it from `kind`.
-        assertEquals(List.of("--model", "coder"), start.get("args"),
-                "the configured executable is not repeated in args");
-    }
-
-    @Test
-    void noBridgeFlagsWhenMcpUrlAbsent() {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, List.of("claude", "--verbose"), null).spawn();
-
-        List<String> args = spawnedArgs(herdr);
-        assertFalse(args.contains("--mcp-config"), "no bridge mount without mcpUrl");
-        assertFalse(args.contains("--append-system-prompt"), "no reply charter without mcpUrl");
-        // CB-533: the model flag is independent of the MCP mount — pinning the model is not part of
-        // "mount the bridge", so an unmounted worker still runs the model its profile names.
-        assertEquals(List.of("--verbose", "--model", "coder"), args,
-                "the operator's own args are preserved, in order, ahead of the model flag");
-    }
-
-    private ClaudeCodeLauncher multiProfile(FakeHerdr herdr) {
-        BridgedConfig.Worker gx10 = new BridgedConfig.Worker("gx10", "http://gx10.gw:8000", "coder",
-                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null);
-        BridgedConfig.Worker ollama = new BridgedConfig.Worker("ollama", "http://ollama.ltms.dev", null,
-                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null);
-        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx10.gw", "ollama.ltms.dev")),
-                Map.of("gx10", gx10, "ollama", ollama), "gx10", _ -> "tok");
-    }
-
-    @Test
-    void spawnPicksTheNamedProfilesBaseUrl() {
-        FakeHerdr herdr = new FakeHerdr();
-        multiProfile(herdr).spawn("ollama");
-
-        assertEquals("http://ollama.ltms.dev", startEnv(herdr).get("ANTHROPIC_BASE_URL"),
-                "the named profile's base_url");
-    }
-
-    @Test
-    void spawnRejectsAnUnknownProfile() {
-        try (FakeHerdr herdr = new FakeHerdr()) {
-            assertThrows(IllegalArgumentException.class, () -> multiProfile(herdr).spawn("nope"));
-        }
-    }
-
-    @SuppressWarnings("unchecked")
-    private static String startCwd(FakeHerdr herdr) {
-        // Protocol 19: the worker's cwd is set at pane creation (tab.create), where the seed
-        // shell — which the agent starts into — is rooted.
-        Object v = ((Map<String, Object>) herdr.lastCall("tab.create").params()).get("cwd");
-        return v == null ? null : v.toString();
-    }
-
-    @Test
-    void requestedCwdRootsTheWorker() {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, List.of("ccs", "ltms-local"), null).spawn("ltms-local", "/work/proj", "/caller/home");
-        assertEquals("/work/proj", startCwd(herdr), "an explicit spawn cwd wins over everything");
-    }
-
-    @Test
-    void profileConfigCwdBeatsTheCallerCwd() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker("ltms-local", "http://gx00.gw:8000", "coder",
-                null, "BRIDGED_WORKER_TOKEN", List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "w #{n}", null, "/pinned/dir", null);
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of("ltms-local", cfg), "ltms-local", _ -> null);
-        svc.spawn("ltms-local", null, "/caller/home");
-        assertEquals("/pinned/dir", startCwd(herdr), "a profile-pinned cwd overrides the caller's");
-    }
-
-    @Test
-    void inheritsTheCallerCwdWhenNothingElseIsSet() {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, List.of("ccs", "ltms-local"), null).spawn("ltms-local", null, "/primary/project");
-        assertEquals("/primary/project", startCwd(herdr), "no explicit/config cwd → inherit the primary's");
-    }
-
-    // --- CB-302 git-forge token injection (worker checkpoint grant) ------------
-
-    /** Protocol 19: the worker's env is injected at pane creation (tab.create), not agent.start. */
-    @SuppressWarnings("unchecked")
-    private static Map<String, String> startEnv(FakeHerdr herdr) {
-        return (Map<String, String>) ((Map<String, Object>) herdr.lastCall("tab.create").params()).get("env");
-    }
-
-    @Test
-    void injectsForgeTokenAndHostWhenProfileGrantsIt() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "impl", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "impl"), "tab", "bridged-workers", "w #{n}", null, null, null,
-                "GITEA_ACCESS_TOKEN", null); // parityOverlay null; gitHostEnv null → defaults to GITEA_HOST
-        Function<String, String> host = name -> switch (name) {
-            case "GITEA_ACCESS_TOKEN" -> "gt-secret";
-            case "GITEA_HOST" -> "git.ltms.dev";
-            default -> null;
-        };
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of("impl", cfg), "impl", host).spawn();
-
-        Map<String, String> env = startEnv(herdr);
-        assertEquals("gt-secret", env.get("GITEA_TOKEN"), "the forge token is injected for a granting profile");
-        assertEquals("git.ltms.dev", env.get("GITEA_HOST"), "the paired forge host rides along with the token");
-    }
-
-    @Test
-    void noForgeTokenWhenProfileDoesNotGrantIt() {
-        FakeHerdr herdr = new FakeHerdr();
-        // gitTokenEnv unset (12-arg ctor); the env would resolve a token if asked, proving the gate
-        // is the profile config, not a missing env var.
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker("ltms-local", "http://gx00.gw:8000", "coder",
-                null, "BRIDGED_WORKER_TOKEN", List.of("ccs"), "tab", "bridged-workers", "w #{n}",
-                null, null, null);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of("ltms-local", cfg), "ltms-local",
-                _ -> "would-be-secret").spawn();
-
-        Map<String, String> env = startEnv(herdr);
-        assertNull(env.get("GITEA_TOKEN"), "no forge token when the profile does not opt in");
-        assertNull(env.get("GITEA_HOST"), "no forge host without a granted token");
-    }
-
-    // --- CB-117 orphan reap: the pure predicate --------------------------------
-
-    @Test
-    void isForeignWorkerMatchesOurSchemeWithANonSelfNonce() {
-        assertTrue(ClaudeCodeLauncher.isForeignWorker("claude-ollama-be09c2-2", "aaaaaa"),
-                "a bridge worker name with a different nonce is a prior daemon's orphan");
-        assertTrue(ClaudeCodeLauncher.isForeignWorker("claude-gx10-4127af-11", "aaaaaa"),
-                "profile and multi-digit seq are still parsed; foreign nonce ⇒ reap");
-    }
-
-    @Test
-    void isForeignWorkerSparesOurOwnLiveWorkersAndNonWorkers() {
-        assertFalse(ClaudeCodeLauncher.isForeignWorker("claude-ollama-abcdef-3", "abcdef"),
-                "a worker with THIS process's nonce is ours and live — never reap it");
-        assertFalse(ClaudeCodeLauncher.isForeignWorker(null, "abcdef"), "an unnamed agent is not a worker");
-        assertFalse(ClaudeCodeLauncher.isForeignWorker("claude", "abcdef"), "a bare kind name is not a worker");
-        assertFalse(ClaudeCodeLauncher.isForeignWorker("my-repl", "abcdef"), "a user's own label is not a worker");
-        assertFalse(ClaudeCodeLauncher.isForeignWorker("claude-ollama-XYZ123-2", "abcdef"),
-                "a non-hex nonce does not match our scheme");
-    }
-
-    // --- CB-117 orphan reap: the wiring through stop() -------------------------
-
-    private static long paneCloseCount(FakeHerdr herdr, String paneId) {
-        return herdr.calls.stream()
-                .filter(c -> c.method().equals("pane.close"))
-                .filter(c -> paneId.equals(((Map<?, ?>) c.params()).get("pane_id")))
-                .count();
-    }
-
-    @Test
-    void reapsAForeignOrphanButSparesOurOwnWorkerAndUserSessions() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = multiProfile(herdr);
-        herdr.withAgent("claude-ollama-be09c2-2", "term_orphan", "wQ:pF", "wQ:t8") // prior daemon's leak
-             .withAgent("claude-gx10-" + svc.nameNonce() + "-1", "term_mine", "wQ:pMine", "wQ:tMine"); // ours, live
-        // (the fake's default unnamed term_a stands in for a user's own Claude session)
-
-        int reaped = svc.reapOrphanWorkers();
-
-        assertEquals(1, reaped, "exactly the one foreign-nonce orphan is reaped");
-        assertEquals(1, paneCloseCount(herdr, "wQ:pF"), "the orphan's pane is closed");
-        assertEquals(0, paneCloseCount(herdr, "wQ:pMine"), "our own live worker's pane is left running");
-        assertEquals(0, paneCloseCount(herdr, "w2:p7"), "a user's own session is never touched");
-        assertTrue(herdr.called("tab.close"), "the orphan's now-empty dedicated tab is closed too");
-    }
-
-    @Test
-    void reapCountsAnAlreadyGoneOrphanAsReaped() {
-        FakeHerdr herdr = new FakeHerdr().paneCloseFailsWith("pane_not_found");
-        ClaudeCodeLauncher svc = multiProfile(herdr);
-        herdr.withAgent("claude-ollama-0d856d-3", "term_gone", "wQ:pS", "wQ:tD");
-
-        assertEquals(1, svc.reapOrphanWorkers(),
-                "a pane that vanished between list and close is a successful reap, not a failure");
-    }
-
-    @Test
-    void reapIsSkippedWhenHerdrCannotBeListed() {
-        FakeHerdr herdr = new FakeHerdr().healthy(false); // agent.list throws
-        assertEquals(0, multiProfile(herdr).reapOrphanWorkers(), "a listing failure reaps nothing and does not throw");
-    }
-
-    // --- PeerHandle indirection ----------------------------------------------------------------
-
-    @Test
-    void spawnReturnsPeerHandleWithHostUniqueOpaqueId() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
-
-        assertNotNull(handle, "spawn must return a non-null handle");
-        // CB-519: id() is a host-unique opaque UUID, decoupled from the herdr pane coordinate.
-        assertNotEquals("w9:pRoot_1", handle.id(),
-                "handle.id() must NOT be the herdr pane id");
-        assertDoesNotThrow(() -> UUID.fromString(handle.id()),
-                "handle.id() must be a UUID: " + handle.id());
-    }
-
-    @Test
-    void spawnReturnsPeerHandleWithCorrectTerminalId() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, "/caller"));
-
-        assertEquals("term_new_1", handle.terminalId(), "handle.terminalId() must equal the agent's terminalId");
-    }
-
-    @Test
-    void capabilitiesIncludeMidTurnAskWorktreeOrphanReap() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        Set<Capability> caps = svc.capabilities();
-
-        assertTrue(caps.contains(Capability.MID_TURN_ASK), "every Claude Code peer supports mid-turn ask");
-        assertTrue(caps.contains(Capability.WORKTREE), "every CLI peer supports worktree cwd");
-        assertTrue(caps.contains(Capability.ORPHAN_REAP), "every herdr launcher supports orphan reap");
-        assertTrue(caps.contains(Capability.CONTEXT_RESET), "Claude Code supports /clear");
-    }
-
-    @Test
-    void clearContextUsesTheClaudeCommandThroughTheOwningHandle() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("claude"), null);
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
-
-        assertTrue(svc.clearContext(handle.id()));
-
-        Map<?, ?> prompt = (Map<?, ?>) herdr.lastCall("agent.prompt").params();
-        assertEquals("/clear", prompt.get("text"));
-        assertEquals("w9:pRoot_1", prompt.get("target"));
-    }
-
-    @Test
-    void capabilitiesIncludeSelfPrWhenProfileHasGitToken() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "impl", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "impl"), "tab", "bridged-workers", "w #{n}", null, null, null,
-                "GITEA_ACCESS_TOKEN", null);
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of("impl", cfg), "impl",
-                _ -> "tok");
-
-        assertTrue(svc.capabilities().contains(Capability.SELF_PR),
-                "a profile with a git token grants SELF_PR");
-    }
-
-    @Test
-    void capabilitiesExcludeSelfPrWhenNoGitToken() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        assertFalse(svc.capabilities().contains(Capability.SELF_PR),
-                "no git token profile → no SELF_PR capability");
-    }
-
-    @Test
-    void effectiveCwdViaSpawnRequestMatchesExistingResolution() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        String cwd = svc.effectiveCwd(new SpawnRequest("ltms-local", "/work/proj", "/caller/home"));
-
-        assertEquals("/work/proj", cwd, "effectiveCwd via SpawnRequest must match the three-arg resolution");
-    }
-
-    // --- CB-547a: durable session identity (mint / resume / no-identity legacy) -----------------
-
-    @Test
-    void freshSpawnMintsASessionIdAndPassesTheName() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, null, "my-session", null));
-
-        List<String> args = spawnedArgs(herdr);
-        int flag = args.indexOf("--session-id");
-        assertTrue(flag >= 0 && flag + 1 < args.size(), "--session-id present: " + args);
-        String minted = args.get(flag + 1);
-        assertDoesNotThrow(() -> UUID.fromString(minted), "--session-id is a valid UUID: " + minted);
-        assertEquals("my-session", args.get(args.indexOf("-n") + 1), "the logical name rides as -n");
-        assertEquals(minted, handle.agentSessionId(),
-                "the resume handle is the minted id, known before the agent has written anything");
-        assertEquals("my-session", handle.sessionName(), "the handle carries the logical name");
-    }
-
-    @Test
-    void resumeSpawnPassesDashRAndNeverASessionId() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, null, "my-session", "cb-resume-1"));
-
-        List<String> args = spawnedArgs(herdr);
-        assertFalse(args.contains("--session-id"), "--session-id must NOT be passed on a resume (conflicts with -r)");
-        assertEquals("cb-resume-1", args.get(args.indexOf("-r") + 1), "-r carries the prior session id");
-        assertEquals("cb-resume-1", handle.agentSessionId(), "a resume adopts the prior id as its own");
-        assertEquals("my-session", handle.sessionName(), "the logical name survives a resume");
-    }
-
-    @Test
-    void noIdentitySpawnKeepsTheLegacyArgvAndCarriesNoSessionHandle() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, null));
-
-        List<String> args = spawnedArgs(herdr);
-        assertFalse(args.contains("--session-id"), "no identity → no --session-id");
-        assertFalse(args.contains("-n"), "no identity → no -n");
-        assertFalse(args.contains("-r"), "no identity → no -r");
-        assertNull(handle.agentSessionId(), "no identity → no resume handle");
-        assertNull(handle.sessionName(), "no identity → no logical name");
-    }
-
-    @Test
-    void capabilitiesIncludeSessionNameAndSessionResume() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        Set<Capability> caps = svc.capabilities();
-        assertTrue(caps.contains(Capability.SESSION_NAME), "Claude Code surfaces the bridge's logical name (-n)");
-        assertTrue(caps.contains(Capability.SESSION_RESUME), "Claude Code can relaunch onto a prior conversation (-r)");
-    }
-
-    @Test
-    void profilesViaPeerLauncherMatchesExistingApi() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = multiProfile(herdr);
-
-        assertEquals(Set.of("gx10", "ollama"), svc.profiles(), "profiles() via PeerLauncher must match");
-    }
-
-    @Test
-    void defaultProfileViaPeerLauncherMatches() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = multiProfile(herdr);
-
-        assertEquals("gx10", svc.defaultProfile(), "defaultProfile() via PeerLauncher must match");
-    }
-
-    @Test
-    void stopViaPeerLauncherTearsDownByHandleId() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
-
-        svc.stop(handle.id());
-
-        assertTrue(herdr.called("pane.close"), "stop via handle.id() must close the pane");
-    }
-
-    // --- CB-519: host-unique id, decoupled from the pane coordinate ------------------------------
-
-    @Test
-    void twoSpawnsOnTheSamePaneNeverCollideOnHostUniqueId() {
-        // Two spawns may be placed on the same herdr pane coordinate (e.g. a pane that was reused
-        // or re-reported after a restart); the host-unique id must not collide even then.
-        FakeHerdr herdr = new FakeHerdr().pinNextStarts(2, "term_shared", "w9:pShared");
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        PeerHandle a = svc.spawn(new SpawnRequest(null, null, null));
-        PeerHandle b = svc.spawn(new SpawnRequest(null, null, null));
-
-        assertNotEquals(a.id(), b.id(),
-                "two spawns on the same pane coordinate get distinct host-unique ids");
-        assertNotEquals("w9:pShared", a.id(), "id is not the pane coordinate");
-        assertNotEquals("w9:pShared", b.id(), "id is not the pane coordinate");
-    }
-
-    @Test
-    void stopResolvesTheHostUniqueIdToThePaneThatSpawnedIt() {
-        // CB-519: id() != paneId, so stop(id) must tear down the exact pane the id names — and no
-        // other live peer's pane.
-        FakeHerdr herdr = new FakeHerdr(); // deterministic panes w9:pRoot_1, w9:pRoot_2 per spawn
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        PeerHandle a = svc.spawn(new SpawnRequest(null, null, null));
-        PeerHandle b = svc.spawn(new SpawnRequest(null, null, null));
-
-        svc.stop(b.id());
-
-        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_2"), "stop(b.id()) closes only b's pane");
-        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"), "a's pane is untouched");
-    }
-
-    // --- CB-306 spawn-readiness gate -----------------------------------------------------------
-
-    private static Map<String, BridgedConfig.Worker> workerConfigMap(String profile, String mcpUrl) {
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                profile, "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", profile), "tab", "bridged-workers",
-                "worker: {profile} #{n}", mcpUrl, null, null);
-        return Map.of(cfg.profile(), cfg);
-    }
-
-    @Test
-    void spawnWaitsUntilInjectableThenReturnsHandle() {
-        FakeHerdr herdr = new FakeHerdr();
-        herdr.agentStatus("unknown"); // first status call sees UNKNOWN
-        long[] clock = {0};
-        boolean[] firstSleep = {true};
-        // The sleeper: advance the fake clock, and on the first call flip the
-        // agent status to IDLE so the next poll succeeds.
-        Runnable sleeper = () -> {
-            clock[0] += 300;
-            if (firstSleep[0]) {
-                herdr.agentStatus("idle");
-                firstSleep[0] = false;
-            }
-        };
-
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
-                new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")),
-                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
-                5000, () -> clock[0], sleeper);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
-
-        assertNotNull(handle, "spawn returns a handle when worker becomes injectable");
-        assertNotEquals("w9:pRoot_1", handle.id(),
-                "handle id is a host-unique opaque id, not the started pane");
-        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
-                "no pane.close when worker becomes injectable before timeout");
-    }
-
-    @Test
-    void spawnThrowsPeerUnreachableWhenNeverInjectableAndReapsPane() {
-        FakeHerdr herdr = new FakeHerdr();
-        herdr.agentStatus("unknown"); // always UNKNOWN
-        long[] clock = {0};
-
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
-                new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")),
-                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
-                1000, () -> clock[0], () -> clock[0] += 50);
-
-        PeerUnreachableException ex = assertThrows(
-                PeerUnreachableException.class,
-                () -> svc.spawn(new SpawnRequest(null, null, null)));
-
-        assertTrue(ex.getMessage().contains("w9:pRoot_1"),
-                "exception message references the paneId: " + ex.getMessage());
-        assertTrue(ex.getMessage().contains("1000"),
-                "exception message references the timeout: " + ex.getMessage());
-        assertTrue(clock[0] >= 1000, "fake clock advanced past the timeout: " + clock[0]);
-        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_1"),
-                "pane was closed on timeout (no orphan left behind)");
-    }
-
-    @Test
-    void spawnReturnsImmediatelyWhenGateIsDisabled() {
-        FakeHerdr herdr = new FakeHerdr();
-        // The default 6-arg constructor has spawnReadyTimeoutMs=0 (gate disabled).
-        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
-
-        assertNotNull(handle, "spawn returns a handle when the gate is disabled");
-        assertFalse(herdr.called("agent.get"),
-                "agent.get is never called when the gate is disabled (no polling)");
-    }
-
-    @Test
-    void spawnGateRespectsZeroTimeoutEvenWithFullConstructor() {
-        FakeHerdr herdr = new FakeHerdr();
-        long[] clock = {0};
-
-        // Explicit zero timeout with the full testability constructor — should
-        // skip polling entirely, just like the legacy default path.
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
-                new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")),
-                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
-                0, () -> clock[0], () -> clock[0] += 1);
-
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
-
-        assertNotNull(handle, "spawn still succeeds with zero timeout");
-        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
-                "no orphan pane close from the gate path");
-        assertDoesNotThrow(() -> UUID.fromString(handle.id()));
-    }
-
-    // --- CB-511: worker environment seeding -----------------------------------------------------
-
-    @Test
-    void workerInheritsTheDaemonPath() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                k -> "PATH".equals(k) ? "/opt/tools/bin:/usr/bin" : null).spawn();
-
-        assertEquals("/opt/tools/bin:/usr/bin", startEnv(herdr).get("PATH"),
-                "a worker with no PATH cannot run the build it is asked to run");
-    }
-
-    @Test
-    void profileEnvIsInjectedIntoTheWorker() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null, null, null,
-                null, Map.of("JAVA_HOME", "/opt/jdk", "PATH", "/profile/bin"), null, null);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                k -> "PATH".equals(k) ? "/daemon/bin" : null).spawn();
-
-        Map<String, String> env = startEnv(herdr);
-        assertEquals("/opt/jdk", env.get("JAVA_HOME"), "profile env: is passed through");
-        assertEquals("/profile/bin", env.get("PATH"), "an explicit profile PATH overrides the daemon's");
-    }
-
-    /**
-     * The security-relevant ordering. {@code SubscriptionGuard} is checked against the profile's
-     * {@code baseUrl} only, so if a profile's {@code env:} could overwrite ANTHROPIC_BASE_URL a
-     * worker could be pointed at an unguarded host while the guard passed on a benign one.
-     */
-    @Test
-    void profileEnvCannotOverrideGuardCheckedAnthropicVars() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null, null, null,
-                null, Map.of("ANTHROPIC_BASE_URL", "http://evil.example.com"), null, null);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> null).spawn();
-
-        assertEquals("http://gx00.gw:8000", startEnv(herdr).get("ANTHROPIC_BASE_URL"),
-                "the guard-checked baseUrl must win over any env: entry, or the boundary is bypassable");
-    }
-
-    // ── CB-533: the model is pinned on the command line, not only in the environment ────────────
-
-    /** A launcher for a profile identical but for its {@code model:} — the only variable here. */
-    private ClaudeCodeLauncher serviceWithModel(FakeHerdr herdr, String model) {
-        BridgedConfig.Worker cfg = profileWithModel(model);
-        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> null);
-    }
-
-    private static BridgedConfig.Worker profileWithModel(String model) {
-        return new BridgedConfig.Worker("sonnet", "http://gx00.gw:8000", model, null,
-                "BRIDGED_WORKER_TOKEN", List.of("ccs", "sonnet"), "tab", "bridged-workers",
-                "w #{n}", "http://127.0.0.1:8765/mcp", null, null);
-    }
-
-    @Test
-    void aConfiguredModelIsPassedAsAModelFlagAsWellAsTheEnvVar() {
-        // ANTHROPIC_MODEL alone loses to `ccs`, which exports its own model family over whatever it
-        // inherited — so a profile that set model: was silently overruled by its own launcher.
-        FakeHerdr herdr = new FakeHerdr();
-        serviceWithModel(herdr, "claude-sonnet-5").spawn("sonnet", null, null);
-
-        assertEquals("claude-sonnet-5", startEnv(herdr).get("ANTHROPIC_MODEL"));
-        List<String> args = spawnedArgs(herdr);
-        int flag = args.indexOf("--model");
-        assertTrue(flag >= 0, "the flag is what survives a wrapper argv like [ccs, sonnet]");
-        assertEquals("claude-sonnet-5", args.get(flag + 1));
-    }
-
-    @Test
-    void theModelFlagComesLastSoItOutranksTheOperatorsOwnArgv() {
-        FakeHerdr herdr = new FakeHerdr();
-        serviceWithModel(herdr, "claude-sonnet-5").spawn("sonnet", null, null);
-
-        List<String> args = spawnedArgs(herdr);
-        assertEquals(args.size() - 2, args.indexOf("--model"));
-    }
-
-    @Test
-    void aProfileWithNoModelGetsNoModelFlag() {
-        // gx10 deliberately leaves model: unset so ccs owns selection; adding a flag would make
-        // this file a second source of truth for exactly the thing it declines to decide.
-        FakeHerdr herdr = new FakeHerdr();
-        serviceWithModel(herdr, null).spawn("sonnet", null, null);
-
-        assertFalse(spawnedArgs(herdr).contains("--model"));
-        assertNull(startEnv(herdr).get("ANTHROPIC_MODEL"));
-    }
-
-    // --- CB-539: subscription-profile opt-in ----------------------------------------------------
-
-    /** A claude-code profile on the subscription: no baseUrl (by design), no off-sub endpoint. */
-    private static BridgedConfig.Worker subscriptionCfg(String profile, String baseUrl) {
-        return new BridgedConfig.Worker(
-                profile, baseUrl, "sonnet", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", profile), "tab", "bridged-workers", "w #{n}", null, null, null,
-                null, null, null, Map.of(), null, null, true);
-    }
-
-    @Test
-    void defaultRefusalIsPreservedForClaudeProfileWithNoBaseUrl() {
-        // Requirement 1: absent subscription:true ⇒ byte-identical refusal to today. A claude-code
-        // profile with no baseUrl and no subscription must still be refused (it would bill the sub).
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "ltms-local", null, "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers", "w #{n}", null, null, null);
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-
-        GuardException ex = assertThrows(GuardException.class, () -> svc.spawn("ltms-local", null, null));
-        assertTrue(ex.getMessage().contains("no ANTHROPIC_BASE_URL"),
-                "the refusal names the missing baseUrl: " + ex.getMessage());
-        assertEquals(0, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count(),
-                "nothing was spawned before the refusal");
-    }
-
-    @Test
-    void subscriptionProfileSpawnsWithoutInjectedAnthropicVars() {
-        // Requirement on subscription:true: no baseUrl is required (or injected), and neither
-        // ANTHROPIC_BASE_URL nor ANTHROPIC_AUTH_TOKEN is injected even though the token env would
-        // resolve one if asked.
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = subscriptionCfg("sonnet", null);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> "would-be-token").spawn();
-
-        Map<String, String> env = startEnv(herdr);
-        assertNull(env.get("ANTHROPIC_BASE_URL"), "no baseUrl injected for a subscription profile");
-        assertNull(env.get("ANTHROPIC_AUTH_TOKEN"), "no auth token injected for a subscription profile");
-        assertEquals("sonnet", env.get("ANTHROPIC_MODEL"),
-                "the model alias is still injected; only the subscription-boundary vars are dropped");
-    }
-
-    @Test
-    void subscriptionPlusBaseUrlIsRefused() {
-        // Requirement 2: subscription:true + a baseUrl state opposite intents — refuse at spawn,
-        // naming the profile, rather than silently picking a winner.
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = subscriptionCfg("sonnet", "http://gx00.gw:8000");
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-
-        IllegalStateException ex = assertThrows(IllegalStateException.class,
-                () -> svc.spawn("sonnet", null, null));
-        assertTrue(ex.getMessage().contains("sonnet"), "refusal names the profile: " + ex.getMessage());
-        assertTrue(ex.getMessage().contains("subscription"), "refusal explains the contradiction: " + ex.getMessage());
-        assertEquals(0, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count(),
-                "nothing was spawned before the contradiction was refused");
-    }
-
-    @Test
-    void nonSubscriptionProfilesAreStillAllowlistChecked() {
-        // Requirement 3: the guard keeps its teeth for every other profile — a base_url whose host is
-        // not on the allowlist is still refused, whether or not any subscription profile exists.
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker rogue = new BridgedConfig.Worker(
-                "rogue", "http://evil.example.com:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "rogue"), "tab", "bridged-workers", "w #{n}", null, null, null);
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(rogue.profile(), rogue), rogue.profile(), _ -> null);
-
-        GuardException ex = assertThrows(GuardException.class, () -> svc.spawn("rogue", null, null));
-        assertTrue(ex.getMessage().contains("not on the"), "refusal cites the allowlist: " + ex.getMessage());
-        assertEquals(0, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count(),
-                "nothing was spawned before the allowlist refusal");
-    }
-
-    @Test
-    void aSubscriptionProfileHasAnEnvSuppliedAnthropicBindingStripped() {
-        // CB-542: even a subscription profile whose env: carries ANTHROPIC_BASE_URL (or AUTH_TOKEN)
-        // must not hand them to the worker — on the subscription path no guard would vet them. Config
-        // load refuses this loudly; this launcher-side strip is the belt-and-braces that makes the
-        // invariant hold for a profile built in code that never passed through that validation.
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
-                "sonnet", null, "sonnet", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "sonnet"), "tab", "bridged-workers", "w #{n}", null, null, null,
-                null, null, null,
-                Map.of("ANTHROPIC_BASE_URL", "http://evil.example.com",
-                        "ANTHROPIC_AUTH_TOKEN", "sk-ant-bad", "JAVA_HOME", "/opt/jdk"),
-                null, null, true);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> "would-be-token").spawn();
-
-        Map<String, String> env = startEnv(herdr);
-        assertNull(env.get("ANTHROPIC_BASE_URL"),
-                "the unguarded endpoint must not survive into the worker");
-        assertNull(env.get("ANTHROPIC_AUTH_TOKEN"),
-                "the unguarded token must not survive into the worker");
-        assertEquals("/opt/jdk", env.get("JAVA_HOME"),
-                "only the Anthropic binding keys are stripped; the rest of env: still applies");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/worker/CompositePeerLauncherTest.java

@@ -1,395 +0,0 @@
-package dev.ltms.bridged.worker;
-
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
-import dev.ltms.bridged.placement.PlacementException;
-import dev.ltms.bridged.placement.PlacementPolicies;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.EnumSet;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.function.Function;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * The composite router: profile → owning adapter for spawn/cwd/parity, pane id → owner for stop,
- * and fleet-wide union/dedup for list/reap/caps/profiles. Exercised through two real adapters —
- * claude-code + opencode — over one FakeHerdr, so each call is observed reaching the right adapter
- * (the started herdr agent name carries that adapter's {@code claude-}/{@code opencode-} prefix).
- */
-class CompositePeerLauncherTest {
-
-    private ClaudeCodeLauncher claudeAdapter(FakeHerdr herdr) {
-        // 12-arg back-compat Worker ctor → kind defaults to claude-code.
-        BridgedConfig.Worker claude = new BridgedConfig.Worker("claude", "http://gx00.gw:8000", "coder",
-                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers", "w #{n}",
-                null, null, null);
-        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of("claude", claude), "claude", _ -> null);
-    }
-
-    private OpenCodeLauncher opencodeAdapter(FakeHerdr herdr) {
-        BridgedConfig.Worker gemini = new BridgedConfig.Worker("gemini", null, "google/gemini-2.5-pro",
-                null, "BRIDGED_WORKER_TOKEN", List.of("opencode"), "tab", "bridged-workers", "w #{n}",
-                null, null, null, "GITEA_ACCESS_TOKEN", null, BridgedConfig.Worker.KIND_OPENCODE);
-        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of("gemini", gemini), "gemini", _ -> "tok");
-    }
-
-    private CompositePeerLauncher composite(FakeHerdr herdr) {
-        return new CompositePeerLauncher(
-                List.of(claudeAdapter(herdr), opencodeAdapter(herdr)), "claude");
-    }
-
-    /**
-     * A minimal concrete HerdrPeerLauncher for policy tests. It either returns a fake handle for the
-     * requested profile or throws, depending on {@code failProfiles}. buildLaunch is a stub; only
-     * spawn/stop/list/caps/reap are exercised by the composite.
-     */
-    private static final class StubLauncher extends HerdrPeerLauncher {
-        private final Set<String> failProfiles;
-        private final Map<String, Integer> spawnCounts = new HashMap<>();
-
-        StubLauncher(String prefix, FakeHerdr herdr,
-                     Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
-                     Set<String> failProfiles) {
-            super(prefix, new AgentControl(herdr), new WorkspaceControl(herdr),
-                    profiles, defaultProfile, _ -> null, 0L, System::currentTimeMillis, () -> { });
-            this.failProfiles = Set.copyOf(failProfiles);
-        }
-
-        @Override
-        protected Launch buildLaunch(BridgedConfig.Worker cfg) {
-            return new Launch(Map.of(), List.of());
-        }
-
-        @Override
-        public PeerHandle spawn(SpawnRequest req) {
-            String p = (req.profileName() == null || req.profileName().isBlank())
-                    ? defaultProfile() : req.profileName();
-            spawnCounts.merge(p, 1, Integer::sum);
-            if (failProfiles.contains(p)) {
-                throw new PeerUnreachableException(p + " is down");
-            }
-            return new PeerHandle() {
-                @Override public String id() { return "pane-" + p; }
-                @Override public String terminalId() { return "term-" + p; }
-                @Override public String profile() { return p; }
-            };
-        }
-
-        @Override
-        public void stop(String id) { }
-
-        @Override
-        public List<Agent> list() { return List.of(); }
-
-        @Override
-        public Set<Capability> capabilities() { return EnumSet.noneOf(Capability.class); }
-
-        @Override
-        public int reapOrphanWorkers() { return 0; }
-
-        int spawnCount(String profile) {
-            return spawnCounts.getOrDefault(profile, 0);
-        }
-    }
-
-    private static BridgedConfig.Worker stubWorker(String profile) {
-        return new BridgedConfig.Worker(profile, "http://gx00.gw:8000", "coder",
-                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers",
-                "w #{n}", null, null, null, null, null, null, null, null, null);
-    }
-
-    private static BridgedConfig.Worker stubWorker(String profile, float weight, Integer maxLoad) {
-        return new BridgedConfig.Worker(profile, "http://gx00.gw:8000", "coder",
-                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers",
-                "w #{n}", null, null, null, null, null, null, null,
-                weight, maxLoad);
-    }
-
-    /**
-     * An <em>order-preserving</em> profile map. Never {@code Map.of} here: its iteration order is
-     * salted per JVM run, and the weighted policy breaks an exact-weight tie on candidate order —
-     * so a {@code Map.of} would make "which profile is tried first" a coin flip per run and any
-     * assertion about the first attempt intermittently false.
-     */
-    private static Map<String, BridgedConfig.Worker> ordered(String first, BridgedConfig.Worker a,
-                                                             String second, BridgedConfig.Worker b) {
-        Map<String, BridgedConfig.Worker> m = new LinkedHashMap<>();
-        m.put(first, a);
-        m.put(second, b);
-        return m;
-    }
-
-    @SuppressWarnings("unchecked")
-    private static String startedName(FakeHerdr herdr) {
-        return (String) ((Map<String, Object>) herdr.lastCall("agent.start").params()).get("name");
-    }
-
-    @Test
-    void spawnRoutesEachProfileToItsOwningAdapter() {
-        FakeHerdr herdr = new FakeHerdr();
-        PeerLauncher composite = composite(herdr);
-
-        composite.spawn(new SpawnRequest("gemini", null, null));
-        assertTrue(startedName(herdr).startsWith("opencode-"),
-                "the gemini profile is spawned by the opencode adapter: " + startedName(herdr));
-
-        composite.spawn(new SpawnRequest("claude", null, null));
-        assertTrue(startedName(herdr).startsWith("claude-"),
-                "the claude profile is spawned by the claude-code adapter: " + startedName(herdr));
-    }
-
-    @Test
-    void nullProfileResolvesTheDefaultAndRoutesToItsOwner() {
-        FakeHerdr herdr = new FakeHerdr();
-        composite(herdr).spawn(new SpawnRequest(null, null, null));
-        assertTrue(startedName(herdr).startsWith("claude-"),
-                "a no-profile spawn resolves the default (claude) and routes to its adapter");
-    }
-
-    @Test
-    void unknownProfileIsRejected() {
-        FakeHerdr herdr = new FakeHerdr();
-        PeerLauncher composite = composite(herdr);
-        assertThrows(IllegalArgumentException.class,
-                () -> composite.spawn(new SpawnRequest("nope", null, null)),
-                "a profile no adapter declares is an error");
-    }
-
-    @Test
-    void profilesAndDefaultAreExposedAcrossAdapters() {
-        FakeHerdr herdr = new FakeHerdr();
-        PeerLauncher composite = composite(herdr);
-        assertEquals(Set.of("claude", "gemini"), composite.profiles(),
-                "profiles are the union of every adapter's profiles");
-        assertEquals("claude", composite.defaultProfile());
-    }
-
-    @Test
-    void capabilitiesAreTheUnionOfEveryAdapter() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher claude = claudeAdapter(herdr);
-        OpenCodeLauncher opencode = opencodeAdapter(herdr);
-        PeerLauncher composite = new CompositePeerLauncher(List.of(claude, opencode), "claude");
-
-        assertTrue(composite.capabilities().containsAll(claude.capabilities()),
-                "the fleet offers every claude-code capability");
-        assertTrue(composite.capabilities().containsAll(opencode.capabilities()),
-                "the fleet offers every opencode capability (incl. SELF_PR from its git-token profile)");
-    }
-
-    @Test
-    void listIsDeduplicatedByPaneIdAcrossAdaptersSharingHerdr() {
-        FakeHerdr herdr = new FakeHerdr();
-        PeerLauncher composite = composite(herdr);
-        // Both adapters wrap the same herdr, so each list() returns the same global agent set;
-        // the composite must return each pane once, not once per adapter.
-        assertEquals(1, composite.list().size(),
-                "the single herdr-tracked pane appears once, not duplicated per adapter");
-    }
-
-    @Test
-    void reapSumsAcrossAdaptersAndEachAdapterReapsOnlyItsOwnPrefix() {
-        // One foreign opencode orphan + one foreign claude orphan, from a prior daemon (different nonce).
-        FakeHerdr herdr = new FakeHerdr()
-                .withAgent("opencode-gemini-ffffff-1", "term_o", "wQ:pO", "wQ:tO")
-                .withAgent("claude-claude-eeeeee-1", "term_c", "wQ:pC", "wQ:tC");
-        PeerLauncher composite = composite(herdr);
-        assertEquals(2, composite.reapOrphanWorkers(),
-                "both orphans are reaped — one by each adapter, summed by the composite");
-    }
-
-    @Test
-    void stopTearsDownAPaneSpawnedThroughTheComposite() {
-        // CB-519: handle.id() is a host-unique opaque UUID, not the herdr pane — stop(id) must
-        // resolve it through the owning adapter down to the actual pane coordinate it spawned.
-        FakeHerdr herdr = new FakeHerdr();
-        PeerLauncher composite = composite(herdr);
-        PeerHandle handle = composite.spawn(new SpawnRequest("gemini", null, null));
-        assertNotEquals("w9:pRoot_1", handle.id(), "the id is decoupled from the pane coordinate");
-
-        composite.stop(handle.id());
-        assertTrue(herdr.calls.stream()
-                        .anyMatch(c -> c.method().equals("pane.close")
-                                && "w9:pRoot_1".equals(((Map<?, ?>) c.params()).get("pane_id"))),
-                "stop routes to the spawning adapter and closes exactly that worker's pane");
-    }
-
-    @Test
-    void opencodeContextResetIsANoOpAndWarnsOnlyOnce() {
-        FakeHerdr herdr = new FakeHerdr();
-        CompositePeerLauncher composite = composite(herdr);
-        PeerHandle handle = composite.spawn(new SpawnRequest("gemini", null, null));
-        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        try {
-            assertFalse(composite.clearContext(handle.id()));
-            assertFalse(composite.clearContext(handle.id()));
-        } finally {
-            logger.detachAppender(appender);
-        }
-
-        assertFalse(opencodeAdapter(herdr).capabilities().contains(Capability.CONTEXT_RESET));
-        assertTrue(herdr.calls.stream().noneMatch(c -> "agent.prompt".equals(c.method())),
-                "never type Claude's /clear into an opencode prompt");
-        assertEquals(1, appender.list.stream()
-                .filter(e -> e.getFormattedMessage().contains("context reset is unsupported"))
-                .count(), "unsupported reset is logged once per adapter, not once per turn");
-    }
-
-    @Test
-    void constructorRejectsAProfileClaimedByTwoAdapters() {
-        FakeHerdr herdr = new FakeHerdr();
-        // Two opencode adapters both declaring "gemini" — a profile-name collision.
-        OpenCodeLauncher a = opencodeAdapter(herdr);
-        OpenCodeLauncher b = opencodeAdapter(herdr);
-        assertThrows(IllegalArgumentException.class,
-                () -> new CompositePeerLauncher(List.of(a, b), "gemini"),
-                "a profile two adapters both claim is a configuration error");
-    }
-
-    @Test
-    void constructorRejectsAnEmptyAdapterList() {
-        assertThrows(IllegalArgumentException.class,
-                () -> new CompositePeerLauncher(List.of(), "claude"),
-                "at least one adapter must be configured");
-    }
-
-    @Test
-    void fixedDefaultIsNoOpForUnqualifiedSpawns() {
-        FakeHerdr herdr = new FakeHerdr();
-        CompositePeerLauncher composite = composite(herdr);
-
-        PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
-        assertTrue(startedName(herdr).startsWith("claude-"),
-                "fixed placement still routes an unqualified spawn to the default profile");
-        assertEquals("claude", h.profile(), "the returned handle carries the resolved default profile");
-    }
-
-    @Test
-    void weightedPolicyGatesProfileAtMaxLoad() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Worker> profiles = ordered(
-                "a", stubWorker("a", 1.0f, 1),
-                "b", stubWorker("b", 1.0f, null));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> "a".equals(name) ? 1 : 0);
-
-        for (int i = 0; i < 5; i++) {
-            PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
-            assertEquals("b", h.profile(), "profile a is at maxLoad, so every spawn must land on b");
-        }
-    }
-
-    @Test
-    void weightedPolicyDistributesAccordingToWeightRatio() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Worker> profiles = ordered(
-                "a", stubWorker("a", 0.75f, null),
-                "b", stubWorker("b", 0.25f, null));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> 0);
-
-        int a = 0, b = 0;
-        for (int i = 0; i < 40; i++) {
-            String p = composite.spawn(new SpawnRequest(null, null, null)).profile();
-            if ("a".equals(p)) a++;
-            else if ("b".equals(p)) b++;
-        }
-        assertEquals(30, a, "weighted distribution should hold the 3:1 ratio");
-        assertEquals(10, b);
-    }
-
-    @Test
-    void failoverRetriesNextCandidateWhenProfileIsUnreachable() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Worker> profiles = ordered(
-                "a", stubWorker("a"),
-                "b", stubWorker("b"));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of("a"));
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> 0);
-
-        PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
-        assertEquals("b", h.profile(), "the spawn must fail over from unreachable a to b");
-        assertEquals(1, adapter.spawnCount("a"), "a was tried once and failed");
-        assertEquals(1, adapter.spawnCount("b"), "b was tried once and succeeded");
-    }
-
-    /**
-     * Definition order — not hash order — decides an exact-weight tie. Paired with the test above
-     * (same two profiles, opposite declaration order, opposite expected first attempt) this pins the
-     * ordering contract from both sides: under a salted map one of the two must fail on every run.
-     */
-    @Test
-    void reversingDefinitionOrderReversesWhichProfileIsTriedFirst() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Worker> profiles = ordered(
-                "b", stubWorker("b"),
-                "a", stubWorker("a"));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of("b"));
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), _ -> 0);
-
-        PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
-        assertEquals("a", h.profile(), "b is declared first and unreachable, so the spawn lands on a");
-        assertEquals(1, adapter.spawnCount("b"), "b, declared first, is the one tried first");
-    }
-
-    @Test
-    void failoverBoundedByCandidateCount() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Worker> profiles = ordered(
-                "a", stubWorker("a"),
-                "b", stubWorker("b"));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of("a", "b"));
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> 0);
-
-        PeerUnreachableException e = assertThrows(PeerUnreachableException.class,
-                () -> composite.spawn(new SpawnRequest(null, null, null)));
-        assertTrue(e.getMessage().contains("no reachable worker profile"), e.getMessage());
-        assertEquals(1, adapter.spawnCount("a"));
-        assertEquals(1, adapter.spawnCount("b"));
-    }
-
-    @Test
-    void emptyCandidateSetThrowsClearException() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Worker> profiles = ordered(
-                "a", stubWorker("a", 1.0f, 1),
-                "b", stubWorker("b", 1.0f, 1));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> 1);
-
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> composite.spawn(new SpawnRequest(null, null, null)));
-        assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
-    }
-}

bridged/src/test/java/dev/ltms/bridged/worker/OpenCodeLauncherTest.java

@@ -1,275 +0,0 @@
-package dev.ltms.bridged.worker;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Map;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * The opencode adapter's launch build: a file-based MCP mount + reply-charter instructions (no
- * inline flags, no {@code ANTHROPIC_*}, no guard), the {@code -m} model flag, and the shared base
- * transport (naming, reap, readiness gate) proving the {@link HerdrPeerLauncher} SPI is neutral.
- */
-class OpenCodeLauncherTest {
-
-    private static BridgedConfig.Worker opencodeCfg(String model, String mcpUrl, String gitTokenEnv) {
-        return new BridgedConfig.Worker("gemini", null, model, null, "BRIDGED_WORKER_TOKEN",
-                List.of("opencode"), "tab", "bridged-workers", "opencode: {model} #{n}", mcpUrl,
-                null, null, gitTokenEnv, null, BridgedConfig.Worker.KIND_OPENCODE);
-    }
-
-    /** Gate-disabled launcher whose per-spawn config dirs land under an inspectable temp root. */
-    private OpenCodeLauncher service(FakeHerdr herdr, Path configRoot, BridgedConfig.Worker cfg) {
-        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), k -> "GITEA_ACCESS_TOKEN".equals(k) ? "tok" : null,
-                0, System::currentTimeMillis, () -> { }, configRoot);
-    }
-
-    @SuppressWarnings("unchecked")
-    private static Map<String, Object> lastStart(FakeHerdr herdr) {
-        return (Map<String, Object>) herdr.lastCall("agent.start").params();
-    }
-
-    /** Protocol 19: the worker's env is injected at pane creation (tab.create), not agent.start. */
-    @SuppressWarnings("unchecked")
-    private static Map<String, String> startEnv(FakeHerdr herdr) {
-        Map<String, String> env =
-                (Map<String, String>) ((Map<String, Object>) herdr.lastCall("tab.create").params()).get("env");
-        return env == null ? Map.of() : env;
-    }
-
-    /** Protocol 19: agent.start carries only the args after the kind-resolved executable. */
-    @SuppressWarnings("unchecked")
-    private static List<String> startArgs(FakeHerdr herdr) {
-        return (List<String>) lastStart(herdr).get("args");
-    }
-
-    @Test
-    void writesRemoteMcpConfigAndCharterInstructionsWhenMcpUrlSet(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null))
-                .spawn();
-
-        Map<String, String> env = startEnv(herdr);
-        assertNull(env.get("ANTHROPIC_BASE_URL"), "opencode carries no ANTHROPIC_* / subscription boundary");
-        String cfgPath = env.get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "OPENCODE_CONFIG points the worker at the generated config file");
-        assertTrue(Path.of(cfgPath).startsWith(root), "config file is generated under the injected root");
-
-        // Assert on parsed structure, not substrings: the generated config is real JSON and its
-        // whitespace is the formatter's business, not the contract's.
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        JsonNode bridge = json.path("mcp").path("bridge");
-        assertEquals("remote", bridge.path("type").asText(), "bridge is mounted as a remote MCP server");
-        assertEquals("http://127.0.0.1:8765/mcp", bridge.path("url").asText(),
-                "the profile's bridge MCP url is present");
-        assertTrue(bridge.path("enabled").asBoolean(), "the bridge server is enabled");
-        assertTrue(json.path("instructions").isArray() && !json.path("instructions").isEmpty(),
-                "the reply charter is mounted via instructions");
-
-        // The instructions entry is a real file path holding the reply charter.
-        Path charter = Path.of(cfgPath).resolveSibling("reply-charter.md");
-        assertTrue(Files.exists(charter), "the charter file the config references was written");
-        assertTrue(Files.readString(charter).contains("bridge_reply"),
-                "the charter instructs the worker to answer via bridge_reply");
-    }
-
-    @Test
-    void noConfigFileWhenMcpUrlAbsent(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null)).spawn();
-
-        assertNull(startEnv(herdr).get("OPENCODE_CONFIG"),
-                "no bridge MCP url → no config file and no OPENCODE_CONFIG");
-    }
-
-    @Test
-    void passesTheModelAsDashMFlagAlongsideAutoApprove(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null)).spawn();
-
-        List<String> args = startArgs(herdr);
-        assertTrue(args.contains("--auto"),
-                "--auto is present alongside -m so a spawned peer never blocks on approval");
-        int m = args.indexOf("-m");
-        assertTrue(m >= 0, "model is selected with -m");
-        assertEquals("google/gemini-2.5-pro", args.get(m + 1), "the provider/model selector follows -m");
-    }
-
-    @Test
-    void autoApproveIsUnconditionalWhenModelBlank(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg(null, null, null)).spawn();
-        assertEquals(List.of("--auto"), startArgs(herdr),
-                "--auto is unconditional: a model-less worker still must never block on approval");
-    }
-
-    @Test
-    void injectsForgeTokenWhenProfileGrantsIt(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg(null, null, "GITEA_ACCESS_TOKEN")).spawn();
-        assertEquals("tok", startEnv(herdr).get("GITEA_TOKEN"),
-                "a git-token profile gets the peer-neutral GITEA_TOKEN grant, same as Claude");
-    }
-
-    @Test
-    void capabilitiesDeclareOrphanReapAndMcpAskAndConditionalSelfPr(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        assertEquals(java.util.Set.of(Capability.MID_TURN_ASK, Capability.WORKTREE, Capability.ORPHAN_REAP),
-                service(herdr, root, opencodeCfg(null, null, null)).capabilities(),
-                "no git token → no SELF_PR");
-        assertTrue(service(herdr, root, opencodeCfg(null, null, "GITEA_ACCESS_TOKEN"))
-                        .capabilities().contains(Capability.SELF_PR),
-                "a git-token profile adds SELF_PR");
-    }
-
-    @Test
-    void foreignWorkerMatchesOpencodePrefixButNotClaude() {
-        String nonce = "abc123";
-        assertTrue(OpenCodeLauncher.isForeignWorker("opencode-gemini-def456-1", nonce),
-                "an opencode pane from another process is foreign");
-        assertFalse(OpenCodeLauncher.isForeignWorker("opencode-gemini-" + nonce + "-1", nonce),
-                "our own opencode pane (same nonce) is not foreign");
-        assertFalse(OpenCodeLauncher.isForeignWorker("claude-ltms-local-def456-1", nonce),
-                "a claude pane is never reaped by the opencode adapter");
-    }
-
-    @Test
-    void productionConstructorsWireThroughToTheBase() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Worker cfg = opencodeCfg(null, null, null);
-        // 5-arg (gate disabled) and 7-arg (gate enabled) production constructors both expose the profile.
-        OpenCodeLauncher disabled = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        OpenCodeLauncher gated = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null, 5000, 100);
-        assertEquals(java.util.Set.of("gemini"), disabled.profiles());
-        assertEquals("gemini", gated.defaultProfile());
-    }
-
-    @Test
-    void spawnGateThrowsPeerUnreachableWhenNeverInjectable(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        herdr.agentStatus("unknown"); // never injectable
-        long[] clock = {0};
-        OpenCodeLauncher svc = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of("gemini", opencodeCfg(null, null, null)), "gemini", _ -> null,
-                1000, () -> clock[0], () -> clock[0] += 50, root);
-
-        PeerUnreachableException ex = assertThrows(PeerUnreachableException.class,
-                () -> svc.spawn(new SpawnRequest(null, null, null)));
-        assertTrue(clock[0] >= 1000, "the fake clock advanced past the timeout: " + clock[0]);
-        long closes = herdr.calls.stream()
-                .filter(c -> c.method().equals("pane.close"))
-                .filter(c -> "w9:pRoot_1".equals(((Map<?, ?>) c.params()).get("pane_id")))
-                .count();
-        assertEquals(1, closes, "the worker pane was reaped on timeout (no orphan)");
-        assertNotNull(ex.getMessage());
-    }
-
-    @Test
-    void spawnReturnsHandleWhenGateDisabled(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        PeerHandle handle = service(herdr, root, opencodeCfg(null, null, null))
-                .spawn(new SpawnRequest(null, null, null));
-        assertNotNull(handle, "spawn returns a handle when the gate is disabled");
-        assertFalse(herdr.called("agent.get"), "no polling when the gate is disabled");
-    }
-
-    // --- CB-508: pinned OpenAI-compatible endpoint (e.g. a local vLLM) ---------------------------
-
-    /** A profile with a baseUrl but no model provider prefix cannot be resolved — fail loudly. */
-    private static BridgedConfig.Worker pinnedCfg(String model, String baseUrl, String mcpUrl) {
-        return new BridgedConfig.Worker("local", baseUrl, model, null, "BRIDGED_WORKER_TOKEN",
-                List.of("opencode"), "tab", "bridged-workers", "opencode: {model} #{n}", mcpUrl,
-                null, null, null, null, BridgedConfig.Worker.KIND_OPENCODE);
-    }
-
-    @Test
-    void baseUrlDeclaresACustomOpenAiCompatibleProvider(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, pinnedCfg("local-vllm/deepseek-v4-flash", "http://127.0.0.1:8000", null))
-                .spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "a pinned endpoint needs a config file even with no bridge MCP url");
-        JsonNode provider = new ObjectMapper().readTree(Path.of(cfgPath).toFile())
-                .path("provider").path("local-vllm");
-
-        assertFalse(provider.isMissingNode(), "the provider id comes from the model selector");
-        assertEquals("@ai-sdk/openai-compatible", provider.path("npm").asText());
-        assertEquals("http://127.0.0.1:8000/v1", provider.path("options").path("baseURL").asText(),
-                "a bare host:port gets /v1 appended — that is where these servers mount the API");
-        assertFalse(provider.path("options").path("apiKey").asText().isBlank(),
-                "the AI SDK requires a non-empty key even when the server ignores it");
-        assertFalse(provider.path("models").path("deepseek-v4-flash").isMissingNode(),
-                "the model half of the selector is declared under the provider");
-    }
-
-    @Test
-    void aBaseUrlThatAlreadyCarriesAPathIsUsedVerbatim(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, pinnedCfg("local-vllm/m", "http://127.0.0.1:8000/openai/v1", null)).spawn();
-
-        JsonNode json = new ObjectMapper()
-                .readTree(Path.of(startEnv(herdr).get("OPENCODE_CONFIG")).toFile());
-        assertEquals("http://127.0.0.1:8000/openai/v1",
-                json.path("provider").path("local-vllm").path("options").path("baseURL").asText(),
-                "an endpoint mounted on a custom path must not have /v1 bolted on");
-    }
-
-    @Test
-    void aPinnedEndpointRejectsAModelWithNoProviderPrefix(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        OpenCodeLauncher launcher =
-                service(herdr, root, pinnedCfg("deepseek-v4-flash", "http://127.0.0.1:8000", null));
-
-        // Silently falling back to the default gateway would point the worker at the wrong LLM
-        // while looking healthy — the one failure mode worth being loud about.
-        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, launcher::spawn);
-        assertTrue(e.getMessage().contains("<provider>/<model>"), "the error says how to fix it");
-    }
-
-    @Test
-    void aPinnedEndpointAndTheBridgeMcpCoexistInOneConfig(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, pinnedCfg("local-vllm/deepseek-v4-flash",
-                "http://127.0.0.1:8000", "http://127.0.0.1:8766/mcp")).spawn();
-
-        JsonNode json = new ObjectMapper()
-                .readTree(Path.of(startEnv(herdr).get("OPENCODE_CONFIG")).toFile());
-        assertEquals("remote", json.path("mcp").path("bridge").path("type").asText(),
-                "pinning an endpoint must not drop the bridge MCP mount");
-        assertFalse(json.path("provider").path("local-vllm").isMissingNode(),
-                "and the provider block is still declared alongside it");
-        assertTrue(json.path("instructions").isArray() && !json.path("instructions").isEmpty(),
-                "the reply charter survives too");
-    }
-
-    @Test
-    void noBaseUrlDeclaresNoProviderSoTheDefaultGatewayIsUsed(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg("opencode/some-free-model", "http://127.0.0.1:8766/mcp", null))
-                .spawn();
-
-        JsonNode json = new ObjectMapper()
-                .readTree(Path.of(startEnv(herdr).get("OPENCODE_CONFIG")).toFile());
-        assertTrue(json.path("provider").isMissingNode(),
-                "without a baseUrl opencode resolves its own provider as before");
-    }
-}

deploy/bridged.service

@@ -1,61 +0,0 @@
-# CB-504 — systemd unit for bridged (Linux).
-#
-# The macOS launchd agent (deploy/dev.ltms.bridged.plist) is the supervision target for the
-# current single-host deployment. This unit exists for the per-host gateways CB-308 introduces,
-# which will run on Linux.
-#
-# Install (user service — bridged drives the user's herdr, not a system daemon):
-#   mkdir -p ~/.config/systemd/user
-#   cp deploy/bridged.service ~/.config/systemd/user/
-#   # edit ExecStart / WorkingDirectory / Environment below, then:
-#   systemctl --user daemon-reload
-#   systemctl --user enable --now bridged
-#   journalctl --user -u bridged -f
-
-[Unit]
-Description=bridged — claude-bridge message server
-Documentation=https://git.ltms.dev/lms/claude-bridge/wiki
-# Ordering only: herdr is a user process and its socket may appear after us. This is advisory —
-# bridged retries the herdr socket rather than exiting, which is what actually makes a late
-# socket survivable. Do NOT add Requires=: a herdr restart must not take bridged down with it.
-After=herdr.service
-Wants=herdr.service
-
-[Service]
-Type=simple
-WorkingDirectory=%h/src/claude-bridge/bridged
-ExecStart=/usr/lib/jvm/temurin-25-jdk/bin/java -jar target/bridged.jar bridged.yaml
-
-Environment=HERDR_SOCKET_PATH=%h/.config/herdr/herdr.sock
-# PATH matters more than it looks (CB-511): bridged propagates its own PATH to every worker it
-# spawns, so this line decides whether the fleet can run a build at all. systemd does not source a
-# login shell, so without it the daemon — and every worker — gets a bare default with no JDK/Maven.
-Environment=PATH=/usr/lib/jvm/temurin-25-jdk/bin:/usr/share/maven/bin:/usr/local/bin:/usr/bin:/bin
-# Secrets are NOT set here — this file is committed. Put the API/worker tokens in a private
-# drop-in that systemd reads with restrictive permissions:
-#   systemctl --user edit bridged     →  [Service] / Environment=BRIDGED_API_TOKEN=...
-# or point EnvironmentFile at a 0600 file:
-# EnvironmentFile=%h/.config/bridged/env
-
-Restart=on-failure
-RestartSec=10s
-# A bad config (e.g. a non-loopback bind without token auth) makes bridged fail fast by design.
-# Give up rather than restart-loop on a permanent error.
-StartLimitBurst=5
-StartLimitIntervalSec=120
-
-# The daemon reads the repo, writes worktrees, and talks to a Unix socket — it needs no more.
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=read-write
-ProtectKernelTunables=true
-ProtectControlGroups=true
-RestrictSUIDSGID=true
-
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=bridged
-
-[Install]
-WantedBy=default.target

deploy/dev.ltms.bridged.plist

@@ -1,80 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<!--
-  CB-504 — launchd agent for bridged (macOS).
-
-  This is the real supervision target today: the dogfooded daemon runs on macOS, where there is
-  no systemd. A systemd unit ships alongside (deploy/bridged.service) for the Linux gateways
-  CB-308 introduces.
-
-  Install:
-    cp deploy/dev.ltms.bridged.plist ~/Library/LaunchAgents/
-    # edit the paths + JAVA_HOME below to match this host, then:
-    launchctl load -w ~/Library/LaunchAgents/dev.ltms.bridged.plist
-    launchctl list | grep bridged
-
-  Note on ordering: launchd has no "start after herdr" primitive for user agents, and neither
-  does systemd in a way that survives a socket appearing late. bridged retries the herdr socket
-  on startup instead, so an agent that comes up before herdr converges rather than dying — that
-  retry is the actual fix; KeepAlive below is the backstop.
--->
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>dev.ltms.bridged</string>
-
-    <key>ProgramArguments</key>
-    <array>
-        <string>/Users/CHANGEME/Tool/jdk-25.0.2.jdk/Contents/Home/bin/java</string>
-        <string>-jar</string>
-        <string>/Users/CHANGEME/src/claude-bridge/bridged/target/bridged.jar</string>
-        <string>bridged.yaml</string>
-    </array>
-
-    <!-- Config path in ProgramArguments is relative, so the working directory must be the module. -->
-    <key>WorkingDirectory</key>
-    <string>/Users/CHANGEME/src/claude-bridge/bridged</string>
-
-    <key>EnvironmentVariables</key>
-    <dict>
-        <key>JAVA_HOME</key>
-        <string>/Users/CHANGEME/Tool/jdk-25.0.2.jdk/Contents/Home</string>
-        <key>HERDR_SOCKET_PATH</key>
-        <string>/Users/CHANGEME/.config/herdr/herdr.sock</string>
-        <!--
-          PATH matters more than it looks (CB-511): bridged propagates its own PATH to every worker
-          it spawns, so this line decides whether the fleet can run a build at all. launchd does NOT
-          source .zprofile/.zshrc, so without this the daemon (and therefore every worker) gets a
-          bare /usr/bin:/bin and no JDK or Maven. Keep the toolchain entries first.
-        -->
-        <key>PATH</key>
-        <string>/Users/CHANGEME/Tool/jdk-25.0.2.jdk/Contents/Home/bin:/Users/CHANGEME/Tool/apache-maven-3.9.16/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
-        <!--
-          Worker/API tokens are NOT set here: this file is committed. Export them from a private
-          launchd override or a wrapper script. bridged reads the API token from the env var named
-          by auth.tokenEnv (default BRIDGED_API_TOKEN) and only in auth.mode: token.
-        -->
-    </dict>
-
-    <key>RunAtLoad</key>
-    <true/>
-
-    <!-- Restart on crash, but not in a tight loop if the config is bad (bridged fails fast on a
-         non-loopback bind without token auth — that is a config error, not a transient one). -->
-    <key>KeepAlive</key>
-    <dict>
-        <key>SuccessfulExit</key>
-        <false/>
-    </dict>
-    <key>ThrottleInterval</key>
-    <integer>10</integer>
-
-    <key>StandardOutPath</key>
-    <string>/Users/CHANGEME/src/claude-bridge/bridged/logs/bridged.out.log</string>
-    <key>StandardErrorPath</key>
-    <string>/Users/CHANGEME/src/claude-bridge/bridged/logs/bridged.err.log</string>
-
-    <key>ProcessType</key>
-    <string>Background</string>
-</dict>
-</plist>

deploy/dev.ltms.fleetd.plist

@@ -0,0 +1,127 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+  CB-504 / CB-594 — launchd agent for fleetd (macOS).
+
+  This is the real supervision target today: the dogfooded daemon runs on macOS, where there is
+  no systemd. A systemd unit ships alongside (deploy/fleetd.service) for the Linux gateways
+  CB-308 introduces.
+
+  Install:
+    cp deploy/dev.ltms.fleetd.plist ~/Library/LaunchAgents/
+    launchctl load -w ~/Library/LaunchAgents/dev.ltms.fleetd.plist
+    launchctl list | grep fleetd
+
+  The paths below are already filled in for this host (resolved 2026-08-16 from
+  `/usr/libexec/java_home`... except that reported the system Applet-plugin JVM, not the jenv-
+  managed JDK 25 actually used to build/run fleetd, so JAVA_HOME here is the real one:
+  `JENV_VERSION=25.0.3 java -XshowSettings:properties -version 2>&1 | grep java.home`; `which mvn`;
+  `echo $HOME`). If this file is copied to a different host, re-resolve all three paths and check
+  no placeholder path is left behind; scripts/redeploy-fleetd.sh's check mode does not (and
+  cannot) check this file for you.
+
+  CB-594 — launchd cannot run a login shell (see the PATH comment on EnvironmentVariables below,
+  and scripts/fleetd-launchd-wrapper.sh for the fix): ProgramArguments below execs THAT wrapper,
+  not java directly, so WORKER_GITEA_TOKEN and AI_GATEWAY_TOKEN still get sourced from
+  ${SHARED_ENV}/tools/secrets.sh even though launchd itself never sources anything.
+
+  Note on ordering: launchd has no "start after herdr" primitive for user agents, and neither
+  does systemd in a way that survives a socket appearing late. fleetd retries the herdr socket
+  on startup instead, so an agent that comes up before herdr converges rather than dying — that
+  retry is the actual fix; KeepAlive below is the backstop.
+
+  CB-594 — KeepAlive vs. scripts/redeploy-fleetd.sh: a bare SIGTERM makes this JVM exit 143 even
+  with its shutdown hook running to completion (measured, see the CB-594 report), which
+  SuccessfulExit:false below reads as a crash and races to restart the OLD jar. The redeploy
+  script now detects a loaded agent and uses `launchctl unload`/`load` instead of a raw kill, so
+  only one supervisor ever touches the process at a time — read that script's own output on a
+  redeploy for the confirmation.
+-->
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>dev.ltms.fleetd</string>
+
+    <key>ProgramArguments</key>
+    <array>
+        <string>/Users/dai.ha/LTMS/claude-bridge/scripts/fleetd-launchd-wrapper.sh</string>
+        <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin/java</string>
+        <string>-jar</string>
+        <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/target/fleetd.jar</string>
+        <string>fleetd.yaml</string>
+    </array>
+
+    <!-- Config path in ProgramArguments is relative, so the working directory must be the module. -->
+    <key>WorkingDirectory</key>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd</string>
+
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>JAVA_HOME</key>
+        <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home</string>
+        <key>HERDR_SOCKET_PATH</key>
+        <string>/Users/dai.ha/.config/herdr/herdr.sock</string>
+        <!--
+          PATH matters more than it looks (CB-511): fleetd propagates its own PATH to every worker
+          it spawns, so this line decides whether the fleet can run a build at all. launchd does NOT
+          source .zprofile/.zshrc, so without this the daemon (and therefore every worker) gets a
+          bare /usr/bin:/bin and no JDK or Maven. Keep the toolchain entries first.
+        -->
+        <key>PATH</key>
+        <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin:/Users/dai.ha/Softwares/apache-maven/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+        <!--
+          Worker/API tokens are NOT set here: this file is committed. CB-594 —
+          scripts/fleetd-launchd-wrapper.sh (named in ProgramArguments above) is what supplies
+          them, by execing a login shell that sources ${SHARED_ENV}/tools/secrets.sh before the
+          daemon itself starts. fleetd also reads the API token from the env var named by
+          auth.tokenEnv (default FLEETD_API_TOKEN) and only in auth.mode: token — the wrapper
+          covers that one too, since it is the same login shell.
+        -->
+    </dict>
+
+    <key>RunAtLoad</key>
+    <true/>
+
+    <!--
+      CB-600 — read this before assuming ThrottleInterval bounds anything. It paces restarts to at
+      most one per 10s; it does NOT cap how many times launchd retries. If fleetd fails fast on
+      every start — a bad fleetd.yaml, for example auth.mode: token with the token env var unset,
+      which throws in main() before the daemon ever binds a port — launchd restarts it forever,
+      once every 10s, until a human intervenes. LaunchAgents have no "give up after N attempts"
+      primitive, so this is not something a config change here can fix.
+
+      That loop stops only two ways: (1) `launchctl unload -w ~/Library/LaunchAgents/dev.ltms.fleetd.plist`,
+      or (2) the underlying cause gets fixed, so the process starts successfully and stays up (no
+      more exits to restart). scripts/redeploy-fleetd.sh does not add a third way — it does not
+      make fleetd self-disable on a config error, on purpose: a fail-fast exit path that
+      sometimes decides "this is unrecoverable, stop trying" is one more thing that can misfire,
+      and a wrongly self-disabled daemon needs the exact same manual `launchctl load -w` recovery
+      this comment already names — so it buys nothing an operator watching for the crash loop
+      doesn't already have, at the cost of a new way to be silently down. Watch for it with
+      `launchctl list dev.ltms.fleetd` (a high restart count) or by tailing fleetd.out for the
+      same startup error repeating every ~10s.
+    -->
+    <key>KeepAlive</key>
+    <dict>
+        <key>SuccessfulExit</key>
+        <false/>
+    </dict>
+    <key>ThrottleInterval</key>
+    <integer>10</integer>
+
+    <!--
+      CB-594 — same file scripts/redeploy-fleetd.sh already tails ($BRIDGED/fleetd.out), and both
+      streams point at it, not two separate log files: the script's fresh-line / ERROR-count checks
+      after a restart read this one path regardless of whether launchd or the script started the
+      process, and a stdout/stderr split would make half of what happens during a launchd-driven
+      restart invisible to it.
+    -->
+    <key>StandardOutPath</key>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/fleetd.out</string>
+    <key>StandardErrorPath</key>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/fleetd.out</string>
+
+    <key>ProcessType</key>
+    <string>Background</string>
+</dict>
+</plist>

deploy/fleetd.service

@@ -0,0 +1,85 @@
+# CB-504 — systemd unit for fleetd (Linux).
+#
+# fleetd #360: the previous version of this file started clean and broke the daemon in three ways
+# that nothing logs (see the DO NOT block and the ExecStart/PrivateTmp comments below for what and
+# why). The unit below, plus its companion deploy/herdr.service, is the version that has actually
+# run on fleet01 without those failures. Do not "improve" it back toward the old shape without
+# re-reading why each line is the way it is.
+#
+# Install (user service — fleetd drives the user's herdr, not a system daemon):
+#   mkdir -p ~/.config/systemd/user
+#   cp deploy/fleetd.service deploy/herdr.service ~/.config/systemd/user/
+#   # edit WorkingDirectory / ExecStart below for your host's paths and java location
+#   systemctl --user daemon-reload
+#   systemctl --user enable --now herdr fleetd
+#   loginctl enable-linger $USER      # REQUIRED -- see below
+#   journalctl --user -u fleetd -f
+#
+# `loginctl enable-linger` is not optional and is easy to miss, because leaving it out looks like
+# success: `systemctl --user enable` reports "enabled" and both units run for as long as you stay
+# logged in. A user manager without lingering starts at your first login and stops at your last
+# logout, so the fleet simply does not come back after a reboot -- which is the whole reason to
+# use systemd here rather than the setsid scripts these units replaced. Check it with
+# `loginctl show-user $USER -p Linger`; the answer must be `Linger=yes`.
+#
+# Secrets (AI_GATEWAY_TOKEN, WORKER_GITEA_TOKEN, LAVINMQ_URI, COORD_AMQP_URI, ...) are not set
+# here and need no systemd drop-in: ExecStart runs a login shell, so they come from wherever your
+# login shell already sources them (this host: ~/.fleet/secrets.sh via ~/.zprofile). If a token is
+# missing there, fleetd still starts — the daemon reports every secret a configured profile
+# references, by name, never by value:
+#   journalctl --user -u fleetd | grep 'startup secret'
+# A resolved one logs "startup secret NAME: set (profile 'x' tokenEnv)"; a missing one logs
+# "startup secret NAME: MISSING" at WARN and the daemon starts anyway — the first visible symptom
+# is a member that cannot open a pull request, hours later and in a different component.
+
+[Unit]
+Description=fleetd — fleet message server
+Documentation=https://git.ltms.dev/fleet/fleetd/wiki
+# Ordering only. fleetd retries the herdr socket rather than exiting, which is what actually makes
+# a late socket survivable. Do NOT add Requires=: a herdr restart must not take fleetd down too.
+After=herdr.service
+Wants=herdr.service
+
+[Service]
+Type=simple
+WorkingDirectory=%h/LTMS/fleetd/fleetd
+
+# A LOGIN shell, not java directly. Every secret this daemon needs (AI_GATEWAY_TOKEN,
+# WORKER_GITEA_TOKEN, LAVINMQ_URI, COORD_AMQP_URI) lives in ~/.fleet/secrets.sh, which only
+# ~/.zprofile sources. systemd runs no login shell. Started any other way the daemon boots fine
+# and looks healthy, and the failure appears hours later as a member that cannot open a pull
+# request. exec keeps it one process, so systemd tracks the right PID.
+# This also avoids a SECOND copy of the secrets in a systemd drop-in: one source of truth.
+ExecStart=/bin/zsh -lc "exec java -jar target/fleetd.jar fleetd.yaml"
+
+# PrivateTmp MUST stay false -- see herdr.service. fleetd creates the member ZDOTDIR scrub dir and
+# the opencode config dir under java.io.tmpdir, and the member pane (a herdr child, a different
+# unit) has to read them. A private /tmp turns the credential scrub into a silent no-op.
+PrivateTmp=false
+
+Restart=on-failure
+RestartSec=10s
+# A bad config makes fleetd fail fast by design. Give up rather than restart-loop forever.
+StartLimitBurst=5
+StartLimitIntervalSec=120
+
+# DO NOT add ProtectSystem=, ProtectHome=, ProtectKernelTunables= or ProtectControlGroups=.
+# Measured on fleet01 2026-09-05: each of those gives the unit its own mount namespace, and
+# fleetd resolves a caller role by running lsof to find the loopback peer PID
+# (mcp/LsofPeerPidLookup). Inside such a namespace lsof returns nothing, every caller falls back
+# to ANONYMOUS, and the primary is refused every orchestration call with
+# "unauthenticated: anonymous may not SPAWN".
+# The daemon still starts, healthz still returns ok and the secrets still resolve - the only
+# symptom is that the fleet cannot be driven at all. Verified by bisecting the directives:
+#   no sandbox 3 lsof lines | ProtectSystem=strict 0 | ProtectHome=read-only 0
+#   ProtectKernelTunables 0 | ProtectControlGroups 0 | RestrictSUIDSGID 3 | NoNewPrivileges 3
+# The two below add no mount namespace and are safe.
+NoNewPrivileges=true
+RestrictSUIDSGID=true
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=fleetd
+
+[Install]
+WantedBy=default.target

deploy/herdr-inner.sh

@@ -0,0 +1,19 @@
+#!/bin/zsh
+# fleetd #360 — template for the script deploy/herdr.service's ExecStart wraps in a pty.
+#
+# `script -qfec <this> /dev/null` needs a real command to run, and that command has to be a LOGIN
+# shell script: herdr itself needs the same secrets fleetd.service's login shell picks up (this
+# host: ~/.fleet/secrets.sh via ~/.zprofile), because members it spawns inherit its environment.
+# systemd's own Environment= lines in herdr.service are not enough for that -- they set TERM and a
+# bare PATH so the pty starts at all, nothing more.
+#
+# Copy this file to the path deploy/herdr.service's ExecStart names
+# (%h/LTMS/fleetd/fleetd-run/herdr-inner.sh by default) and `chmod +x` it. Not committed under
+# that path itself because the session name below is host-specific.
+
+# A 0x0 pty makes every pane spawn fail with "ghostty error -2" (see herdr-multi-instance-facts /
+# fleet01-headless-herdr-standup) -- give it a real size before herdr ever touches it.
+stty rows 50 cols 200
+
+# -l: login shell, so herdr and everything it spawns gets the real secrets and PATH.
+exec zsh -lc 'exec herdr --session <name>'

deploy/herdr.service

@@ -0,0 +1,40 @@
+# fleetd #360 — systemd unit for herdr (Linux), the terminal multiplexer fleetd drives.
+#
+# This is fleetd.service's companion: fleetd.service's After=/Wants=herdr.service assumes this
+# unit exists. Before this ticket it did not, so on a fresh host fleetd started against a herdr
+# that systemd never supervised at all.
+#
+# Install: see deploy/fleetd.service's header comment (both units install the same way).
+#
+# ExecStart below runs deploy/herdr-inner.sh (copy the template of that name from this directory
+# to the path in ExecStart, or point ExecStart at wherever you keep it, and make it executable).
+# It is a separate file rather than an inline command because it must itself be a login shell (see
+# its own header for why) and systemd's ExecStart does not run one.
+
+[Unit]
+Description=herdr terminal multiplexer (fleet session)
+Documentation=https://git.ltms.dev/fleet/fleetd/wiki
+
+[Service]
+Type=simple
+# script(1) gives herdr a real pty. Without it the client reports a 0x0 window and every pane
+# spawn fails with "ghostty error -2" -- which surfaces as a fleetd spawn failure, not a herdr one.
+ExecStart=/usr/bin/script -qfec %h/LTMS/fleetd/fleetd-run/herdr-inner.sh /dev/null
+StandardInput=null
+Environment=TERM=xterm-256color
+Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
+
+# PrivateTmp MUST stay false. fleetd writes the member ZDOTDIR scrub dir and the opencode config
+# dir under its own java.io.tmpdir, and the member pane -- a child of THIS process -- has to read
+# them. A private /tmp here silently breaks the credential scrub instead of failing loudly.
+PrivateTmp=false
+
+Restart=on-failure
+RestartSec=5s
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=herdr
+
+[Install]
+WantedBy=default.target

deploy/lavinmq/compose.yaml

@@ -1,8 +1,8 @@
-# LavinMQ — the AMQP broker behind bridged's durable ReplyInbox (CB-307 Stage 2).
+# LavinMQ — the AMQP broker behind fleetd's durable ReplyInbox (CB-307 Stage 2).
 #
 # Why this file exists: the broker was previously run ad hoc and simply vanished from the host,
-# which takes bridged down with it — AmqpReplyInbox.open throws on an unreachable broker and
-# Bridged.java:187 does not guard it, so a missing broker is a hard startup failure, not a
+# which takes fleetd down with it — AmqpReplyInbox.open throws on an unreachable broker and
+# Fleetd.java:187 does not guard it, so a missing broker is a hard startup failure, not a
 # degraded mode. This pins the version, keeps the data, and brings itself back after a reboot.
 #
 # Usage:
@@ -14,27 +14,27 @@
 #
 # Management UI: http://127.0.0.1:15672  (guest / guest)
 #
-# This is bridged's OWN broker. Do not point bridged at any other AMQP server on this host —
+# This is fleetd's OWN broker. Do not point fleetd at any other AMQP server on this host —
 # notably not the `local-rabbitmq` container, which belongs to a different project and would end
 # up carrying this project's queues.
 
-name: bridged-broker
+name: fleetd-broker
 
 services:
   lavinmq:
     # Pinned deliberately: :latest silently moves the broker under a running daemon.
     image: cloudamqp/lavinmq:2.9.1
-    container_name: bridged-lavinmq
+    container_name: fleetd-lavinmq
 
     # The failure this deployment exists to prevent — survive reboots and Docker restarts, but
     # stay down if it was stopped on purpose.
     restart: unless-stopped
 
     # Loopback-bound on purpose. LavinMQ ships a default guest/guest account, which is only
-    # acceptable because nothing off-host can reach it. bridged connects over 127.0.0.1, and
+    # acceptable because nothing off-host can reach it. fleetd connects over 127.0.0.1, and
     # binding 0.0.0.0 here would expose a broker with default credentials to the network.
     ports:
-      - "127.0.0.1:5672:5672"      # AMQP — bridged.yaml broker.uri points here
+      - "127.0.0.1:5672:5672"      # AMQP — fleetd.yaml broker.uri points here
       - "127.0.0.1:15672:15672"    # HTTP management API + UI
 
     # The whole point of Stage 2. Held-but-unacked replies live here; without a named volume a
@@ -57,4 +57,4 @@ services:
 
 volumes:
   lavinmq-data:
-    name: bridged-lavinmq-data
+    name: fleetd-lavinmq-data

docs/CB-201-227-Refinement.md

@@ -0,0 +1,531 @@
+# CB-201 and CB-227 refinement
+
+Date: 2026-09-03
+
+## Decision
+
+#201 and #227 are one delivery program, but they are not one implementation unit.
+
+#201 has a real seam: `CompletionResolver` can publish a typed backend-error event only after its
+waiter resolution wins. #227 can consume that event without knowing any pane text. The classifier
+must land before the final #227 wiring. However, the policy engine, roster state, and lead nudge can
+be built in parallel with the classifier.
+
+I propose five units. Units 1 to 4 own separate files and can run in parallel. Unit 5 owns all
+composition files and lands after them. It also depends on the #234 defect 2 fix named in the task.
+
+```mermaid
+flowchart LR
+    U1["Unit 1: typed backend-error classification"] --> U5["Unit 5: wire policy, spawn gate, and fleet views"]
+    U2["Unit 2: credential outage policy"] --> U5
+    U3["Unit 3: lead outage nudge"] --> U5
+    U4["Unit 4: durable member outcome"] --> U5
+    D234["#234 defect 2: fail-loud target resolution"] --> U5
+```
+
+*Figure 1. Four file-disjoint foundations feed one composition unit.*
+
+This split keeps `Fleetd.java` under one owner. It also keeps every other production file under one
+unit in this plan.
+
+## Evidence checked in the current branch
+
+I read both issue pages in full. Each page reports zero comments.
+
+| Evidence | What the code says now |
+|---|---|
+| `inject/CompletionResolver.java:229-237` | A turn below two seconds fails before normal scrape classification. A matching fast backend error is therefore only a generic failure today. |
+| `inject/CompletionResolver.java:260-276` and `:332-367` | #211 already added raw-screen classification when `lastAssistantBlock` is empty. The “dead-code question” in #201 is stale on this branch. |
+| `inject/CompletionResolver.java:288-317` | Exhaustion wins before the hard-coded `API Error:` match. A backend error then goes through generic `fail(...)`. |
+| `inject/CompletionResolver.java:311-316` | The code admits that the pattern is a heuristic. A member report which quotes an API error may match it. |
+| `inject/CompletionResolver.java:449-467` | Startup coverage exists only for `exhaustedPattern`. |
+| `inject/ExhaustedPatternLookup.java:13-25` | The current lookup and explicit `none()` value are a good shape for the new classifier seam. |
+| `Fleetd.java:196-207` | One `BackendQuarantine` is shared by placement and the exhaustion sink. Its cooldown comes from `quarantineCooldownSeconds`. |
+| `Fleetd.java:322-363` | Pattern compilation, target-to-profile lookup, and the live `ExhaustionSink` are composed in `Fleetd.main`. The sink on this branch still ends in `.ifPresent(...)`. This plan assumes #234 replaces that silent path. |
+| `placement/BackendQuarantine.java:60-87` | A repeated exhaustion restarts one long quarantine. The store is credential-keyed and uses an injected monotonic clock. |
+| `member/CompositePeerLauncher.java:260-317` | Explicit and policy-selected spawns have separate gates. Both paths must learn about outage cool-off. |
+| `member/CompositePeerLauncher.java:347-379` | Exhaustion refusal already checks a credential for explicit spawns and filters policy candidates. Its error text says “exhausted”. |
+| `placement/PlacementContext.java:10-22` and `PlacementPolicyUtil.java:14-83` | Automatic placement has only one transient exclusion set named `quarantined`. Reusing it would make outage errors say “backend exhausted”. |
+| `mcp/FleetMcp.java:913-1025` | `fleet_list` sets `free: 0` and adds `credentialId` plus `quarantinedForSeconds` when quarantine is active. |
+| `session/MemberSession.java:51-59` | The roster has `DONE` and generic `FAILED`, but no backend-error state or stored reason. |
+| `session/SessionManager.java:695-773` | A normal boundary moves `BUSY` to `DONE`. A failure moves any non-released session to `FAILED`. The async completion resolver can race the `DONE` update. |
+| `session/SessionManager.java:648-687` | `rosterView` reports the session state, but it reports no terminal reason. |
+| `msg/MessageService.java:922-940` | CB-588 already nudges for every terminal async ticket, including failures. Current code would report failed tickets, but it would not report one correlated outage. |
+| `msg/ReplyPushLoop.java:20-48` | Replies, terminal tickets, and questions share one per-lead schedule. This prevents two push sources from injecting competing turns. |
+| `msg/ReplyPushLoop.java:305-395` | Each push entry point resolves the owning lead through `PrimaryRegistry`. Missing ownership is logged and the durable or pending item remains the backstop. |
+| `msg/ReplyPushLoop.java:496-547` | One tick builds one combined nudge. Pending items have separate reminder counts. |
+| `health/FleetHealthMonitor.java:91-143` | Health is a slow periodic observer of members and message-layer facts. It does not receive completion classifications. |
+| `health/FleetHealthMonitor.java:206-208` | `healthCoverage` means health enabled plus webhook configured. It does not describe lead-pane alerts. |
+| `Fleetd.java:465-486` | Health stays `detection-only` without the webhook notification setting. |
+
+I also read the related unit tests for `CompletionResolver`, `ReplyPushLoop`, `BackendQuarantine`,
+`CompositePeerLauncher`, `PlacementPolicyUtil`, `SessionManager`, `MessageService`, and `FleetMcp`.
+
+I did not inspect the in-progress #234 branch. I only used the two measured facts in the task. No
+peer architect was named, so I did not exchange a design with one.
+
+## Required behaviour
+
+The policy should use these first values:
+
+- Threshold: **2** classified backend errors.
+- Window: **60 seconds**, measured from the first error to the second.
+- Cool-off: **60 seconds**, starting when the threshold is reached.
+- Correlation key: `credentialId`, never profile name and never error text.
+- Incident rule: one active incident per credential. Errors during its cool-off do not extend it and
+  do not create more lead notices.
+- Rearm rule: after cool-off ends, two fresh errors are needed for another incident.
+
+Two errors are the smallest threshold which protects the honest one-turn failure. A 60-second window
+fits the measured two-member outage. A 60-second cool-off blocks immediate repeat spawns without
+turning a short backend fault into the default 1,800-second exhaustion quarantine.
+
+A single classified error still fails its send and marks its member `backend_error`. It does not
+cool a credential and does not send an outage notice. This is what “a single error changes nothing”
+must mean at the credential level. It cannot mean that the failed member still looks successful.
+
+```mermaid
+sequenceDiagram
+    participant R1 as Resolver for member A
+    participant R2 as Resolver for member B
+    participant P as Outage policy
+    participant S as Spawn gate
+    participant N as Lead push loop
+    participant L as Lead pane
+
+    R1->>P: backend error for credential C
+    Note over P: Count 1, no cool-off
+    R2->>P: backend error for credential C within 60s
+    P->>P: Start one 60s incident
+    P->>S: Credential C is cooling off
+    P->>N: Queue one incident notice
+    N->>L: Inject when lead is idle, blocked, or done
+    L->>S: Request another spawn on credential C
+    S-->>L: Refuse and report remaining cool-off
+```
+
+*Figure 2. The second independent classification creates the fleet-level event.*
+
+Against the 2026-09-01 case, the second failed member would start cool-off. `fleet_list` would show
+zero free capacity and both members as `backend_error`. The push loop would inject one outage notice
+even if the lead had not polled either ticket yet. The design reports the outage. It does not recover
+uncommitted work from the members.
+
+## Unit 1 — Typed backend-error classification
+
+### Scope
+
+Replace the direct hard-coded check inside `CompletionResolver` with a lookup and a sink. Keep the
+public send result as a failed send. The typed internal event is the seam #227 consumes.
+
+The lookup returns the pattern for a target. The sink receives the target, matched line, and full
+failure reason. It fires only after `Rendezvous.resolveFailure(...)` wins for that exact captured
+waiter. This copies the race rule already used by `ExhaustionSink`.
+
+The classifier must run in all three current paths:
+
+1. a normal non-empty assistant block;
+2. the #211 raw scrape fallback;
+3. a turn inside `MIN_TURN_NANOS`, before it becomes a generic too-fast failure.
+
+In every path, the order stays: stale-baseline guard, exhaustion, backend error, then generic
+failure or completion. A fast turn still fails when no configured pattern matches.
+
+Keep `(?i)\bAPI Error\s*:` as a compatibility pattern for profiles without `errorPattern` until the
+operator config is updated. Do not call this full coverage. Startup reporting in Unit 5 must name
+profiles using this weaker legacy default.
+
+### Files owned
+
+- Add `fleetd/src/main/java/dev/ltms/fleet/inject/BackendErrorPatternLookup.java`.
+- Add `fleetd/src/main/java/dev/ltms/fleet/inject/BackendErrorSink.java`.
+- Change `fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/inject/CompletionResolverTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. A target-specific error pattern matches a normal assistant block and resolves the send as failed.
+2. The same match calls `BackendErrorSink` exactly once after the waiter resolution wins.
+3. A late classification which loses to `fleet_reply` does not call the sink.
+4. An exhausted line that also matches the generic error pattern stays `BACKEND_EXHAUSTED`. It calls
+   only `ExhaustionSink`.
+5. A raw pane with leading Terminal User Interface (TUI) chrome and no assistant marker still uses
+   the #211 fallback and calls the backend-error sink.
+6. A matching error inside the two-second floor is typed and sent to the sink. A non-matching fast
+   turn stays a generic failure.
+7. An unchanged delivery baseline which contains old backend-error text is suppressed. It never
+   increments outage evidence.
+8. A non-match keeps the existing completion result and text.
+9. Constructors used by current callers keep compiling. They use the legacy default lookup and an
+   explicit inert sink until Unit 5 supplies the production objects.
+10. Unit tests pass. The developer runs the focused test first, then `mvn clean install` from
+    `fleetd/`.
+
+### Dependencies
+
+None. Unit 1 can run with Units 2, 3, and 4.
+
+Unit 5 depends on its new lookup, sink, and constructor.
+
+### What to report back
+
+- The exact classifier order in all three paths.
+- The focused test command and result.
+- The test which proves a losing waiter race does not publish an event.
+- The test which proves a fast matching failure is typed.
+- The final `mvn clean install` result.
+- Any constructor kept only for transition and where Unit 5 replaces it.
+
+## Unit 2 — Credential outage policy
+
+### Scope
+
+Build a small credential-keyed state machine. It accepts already-classified backend-error events.
+It does not read pane text, profiles, sessions, or lead state.
+
+Use an injected monotonic clock. A call records `credentialId`, target, and reason. It returns a new
+incident only on the threshold crossing. The incident contains a stable event id, credential id,
+the distinct affected targets, evidence count, window, and remaining cool-off.
+
+This class owns both correlation and short cool-off. Keeping them together makes threshold crossing
+and the cool-off deadline one atomic state change.
+
+### Files owned
+
+- Add `fleetd/src/main/java/dev/ltms/fleet/placement/BackendOutagePolicy.java`.
+- Add `fleetd/src/test/java/dev/ltms/fleet/placement/BackendOutagePolicyTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. One error creates no incident and no cool-off.
+2. Two errors for one credential within 60 seconds create exactly one incident and a 60-second
+   cool-off.
+3. Two errors more than 60 seconds apart do not create an incident.
+4. The exact 60-second boundary has a pinned result. Use inclusive `<= 60s` so scheduler delay does
+   not discard evidence at the boundary.
+5. Different credentials never share evidence.
+6. Different profiles which supply the same credential id do share evidence. The policy itself only
+   sees the credential id.
+7. More errors during active cool-off do not extend its deadline and do not return another incident.
+8. After expiry, old evidence is cleared. Two fresh errors are needed to create the next incident.
+9. Remaining seconds round up, matching `BackendQuarantine` reporting.
+10. Concurrent second and third errors cannot return two incidents.
+11. The focused tests and `mvn clean install` pass.
+
+### Dependencies
+
+None. Unit 2 can run with Units 1, 3, and 4.
+
+Unit 5 depends on the policy API.
+
+### What to report back
+
+- The state transition table and locking method.
+- The exact threshold, window, cool-off, and boundary rule.
+- The test which proves one incident under concurrent calls.
+- The focused test and `mvn clean install` results.
+
+## Unit 3 — Lead outage nudge
+
+### Scope
+
+Add backend incidents as a fourth pending source in `ReplyPushLoop`. Do not create another scheduler
+or call `AgentControl.send` from `Fleetd`. The existing combined per-lead schedule is the control
+which prevents competing injected turns.
+
+The entry point takes an incident id, affected worker targets, credential id, affected profile
+names, and remaining cool-off. It resolves distinct owning leads through `PrimaryRegistry`.
+
+Each `(incidentId, lead)` item is one-shot. It waits while the lead is not injectable. After one
+successful `agents.send`, remove it. A send exception keeps it pending for a bounded retry. It never
+uses the repeated reminder behaviour of an uncollected ticket.
+
+Also add a fail-loud entry point for a classified target that Unit 5 cannot map to a credential. It
+uses `PrimaryRegistry.nudgeTargetFor(target)` and says that correlation could not run. If no lead is
+known, log at `WARN`, not `DEBUG`.
+
+### Files owned
+
+- Change `fleetd/src/main/java/dev/ltms/fleet/msg/ReplyPushLoop.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/msg/ReplyPushLoopTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. One incident affecting two workers owned by one lead causes one successful pane injection.
+2. Two affected workers owned by two leads cause one successful injection per affected lead. This
+   is one notice per event per lead, not one notice per member.
+3. Repeating the same incident id is idempotent.
+4. A busy or unknown lead is not injected. The item stays pending until the lead becomes injectable
+   or its attempt cap is reached.
+5. After one successful injection, later ticks do not mention that incident again.
+6. A failed `agents.send` is retried within the existing bound. A successful retry still gives only
+   one successful send.
+7. A pending ticket and an outage incident for one lead appear in one combined nudge, not two
+   competing turns.
+8. The text names the credential, profiles, affected workers, and remaining cool-off. It tells the
+   lead to run `fleet_list`.
+9. An unmapped target produces a direct warning notice when a lead is known. If no lead is known,
+   the code logs a `WARN` naming the target and reason.
+10. `stop()` clears incident state as it clears other push state.
+11. Existing reply, ticket, and question tests stay green. The focused tests and
+    `mvn clean install` pass.
+
+### Dependencies
+
+None. The API uses plain values, not the Unit 2 incident class. This lets Unit 3 run in parallel.
+
+Unit 5 adapts the Unit 2 incident into this entry point.
+
+### What to report back
+
+- The exact one-shot and retry rules.
+- The test showing one combined nudge with a failed ticket.
+- The test showing one successful send for two affected workers.
+- The focused test and `mvn clean install` results.
+
+## Unit 4 — Durable member backend-error outcome
+
+### Scope
+
+Make a classified backend failure remain visible after its ticket is collected or expires.
+
+Add `BACKEND_ERROR` to `MemberSession.State`. Add a nullable failure detail to `MemberSession` and
+render it as `failureReason` in `SessionManager.rosterView`. Add
+`SessionManager.onBackendError(target, reason)`.
+
+The transition must handle both completion orderings:
+
+- `BUSY -> BACKEND_ERROR` when classification wins before the normal completion state update;
+- `DONE -> BACKEND_ERROR` when the async resolver runs after `SessionManager.onTurnComplete`.
+
+It must use a compare-and-set retry or another atomic update. `RELEASED` must never return to the
+roster. A backend-error member is terminal and cannot accept another delivery.
+
+### Files owned
+
+- Change `fleetd/src/main/java/dev/ltms/fleet/session/MemberSession.java`.
+- Change `fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. `onBackendError` moves a `BUSY` member to `BACKEND_ERROR` and stores the reason.
+2. It also moves `DONE` to `BACKEND_ERROR`, covering the resolver race.
+3. A later normal `onTurnComplete` cannot change `BACKEND_ERROR` back to `DONE`.
+4. A released or unknown member is not recreated. The unknown case logs at `WARN` and returns an
+   explicit false result to its caller.
+5. `onDelivered` refuses a `BACKEND_ERROR` member, just as it refuses generic `FAILED`.
+6. `rosterView` reports `state: backend_error` and `failureReason` after the send ticket is gone.
+7. Ordinary members do not gain a blank or invented `failureReason` field.
+8. Existing constructors keep source compatibility for tests and adapters.
+9. The focused tests and `mvn clean install` pass.
+
+### Dependencies
+
+None. Unit 4 can run with Units 1, 2, and 3.
+
+Unit 5 calls the new session method from the production sink.
+
+### What to report back
+
+- The two race orderings and the tests for both.
+- The exact roster JSON shape.
+- The unknown-target result and log level.
+- The focused test and `mvn clean install` results.
+
+## Unit 5 — Production wiring, spawn gate, and fleet views
+
+### Scope
+
+Compose Units 1 to 4 in production. This is the only unit which edits `Fleetd.java`.
+
+Add per-profile `errorPattern` config beside `exhaustedPattern`. Compile both once at startup. A
+configured pattern wins over the legacy default. Report configured profiles and legacy-default
+profiles separately at startup. A bad regex must stop startup with the profile and key in the
+message.
+
+Wire one production `BackendErrorSink` with this order:
+
+1. mark the member `backend_error` with its reason;
+2. resolve the profile and its current `effectiveCredentialId()` through the fail-loud #234 seam;
+3. record the error in `BackendOutagePolicy`;
+4. on a new incident, submit one event to `ReplyPushLoop`.
+
+If target metadata cannot be resolved, do not end in `Optional.ifPresent`. Log an error and call the
+Unit 3 unmapped-target notice. The failed send still reaches its ticket through CB-588.
+
+Teach both spawn paths about a separate cool-off source. Exhaustion quarantine has priority when
+both states are active. Automatic placement needs a distinct `coolingOff` set so its refusal does
+not say “exhausted”.
+
+Extend the MCP (Model Context Protocol) views:
+
+- A cooling profile has `free: 0`, `credentialId`, and `coolingOffForSeconds` in `fleet_list`.
+- It does not have `quarantinedForSeconds` unless exhaustion quarantine is also active.
+- `fleet_profiles` has a separate `coolingOff` map, not an entry in `quarantined`.
+- A direct spawn refusal says the credential is cooling off after repeated backend errors and gives
+  the remaining seconds.
+
+Do not change `FleetHealthMonitor.coverage`. It still describes the periodic health webhook path.
+Lead-pane outage delivery is a separate capability.
+
+### Files owned
+
+- `fleetd/src/main/java/dev/ltms/fleet/Fleetd.java`
+- `fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java`
+- `fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java`
+- `fleetd/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java`
+- `fleetd/src/main/java/dev/ltms/fleet/placement/PlacementContext.java`
+- `fleetd/src/main/java/dev/ltms/fleet/placement/PlacementPolicyUtil.java`
+- `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java`
+- `fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/member/CompositePeerLauncherTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/placement/PlacementPolicyTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java`
+- Add `fleetd/src/test/java/dev/ltms/fleet/BackendOutageFlowTest.java`.
+- `fleetd/fleetd.example.yaml`
+- `CLAUDE.md`
+
+No earlier unit edits these files.
+
+The lead, not a worker, must update `wiki/7-Use-Cases.md`, `wiki/9-Implementation.md`, and
+`wiki/11-Features.md`. Project rules forbid workers from committing `wiki/`. The portable block in
+`CLAUDE.md` and `wiki/7-Use-Cases.md` must remain byte-identical.
+
+### Acceptance criteria
+
+1. `errorPattern` binds per profile. Blank uses the legacy default and is reported as degraded
+   coverage. A config reload which changes it is reported as deferred because patterns are compiled
+   at startup.
+2. A malformed `errorPattern` stops startup and names `profiles.<name>.errorPattern`.
+3. The real production sink never silently drops an unknown target. A test captures its error log
+   and the fallback notice call.
+4. One real backend-error classification through `CompletionResolver` marks only its member. It does
+   not cool the credential and does not send an outage notice.
+5. Two real classifications for one credential within 60 seconds start one incident.
+6. The integration test then calls the real explicit-profile spawn gate. It is refused before any
+   adapter spawn call, with “cooling off” and remaining seconds in the message.
+7. The same test calls an automatic placement path. A cooling candidate is skipped. If every
+   candidate is cooling, the error names cool-off rather than exhaustion.
+8. Profiles sharing the credential are all blocked. A profile on another credential stays usable.
+9. `fleet_list` from the same fixture shows both members as `backend_error`, preserves each failure
+   reason, and reports `free: 0`, the credential, and `coolingOffForSeconds`.
+10. `fleet_profiles` reports cool-off separately from quarantine.
+11. The real `ReplyPushLoop` receives one incident and makes one successful lead-pane send. Existing
+    failed-ticket notice content may share that same combined send.
+12. Exhaustion still wins when a line matches both patterns. A simultaneous exhaustion quarantine
+    also wins in spawn errors and fleet views.
+13. After the 60-second cool-off, spawn is allowed again. A new incident needs two fresh errors.
+14. `healthCoverage` has the same value before and after this change for the same health config.
+15. `fleetd.example.yaml` explains `errorPattern`, the legacy fallback, 2/60/60 policy, and the
+    difference between cool-off and exhaustion quarantine.
+16. `CLAUDE.md` tells leads how `fleet_profiles` and `fleet_list` report cool-off. The lead later
+    applies the matching wiki updates and runs the documented byte-sync check.
+17. The developer records the new end-to-end test failing before implementation, then passing. The
+    focused suites and `mvn clean install` pass.
+
+### Dependencies
+
+Unit 5 starts only after Units 1 to 4 are merged or rebased into its branch. It also starts after the
+#234 defect 2 fix lands, because both areas touch the same target-resolution control path.
+
+### What to report back
+
+- The exact commits used for Units 1 to 4 and #234.
+- The startup coverage line with one configured and one legacy-default profile.
+- The red test output before the implementation and its green result after.
+- The explicit and automatic spawn refusal text.
+- Sample `fleet_list` and `fleet_profiles` JSON for cool-off and exhaustion.
+- The number and text of lead-pane sends in the real-path test.
+- The focused test commands and final `mvn clean install` result.
+- The exact `CLAUDE.md` change and the wiki edits the lead must apply.
+
+## File ownership summary
+
+| Area | Unit | Shared edit risk |
+|---|---:|---|
+| Completion classification | 1 | Only Unit 1 edits `CompletionResolver` and its test. |
+| Correlation and cool-off state | 2 | New files only. |
+| Lead push scheduling | 3 | Only Unit 3 edits `ReplyPushLoop` and its test. |
+| Member terminal state | 4 | Only Unit 4 edits `MemberSession`, `SessionManager`, and their test. |
+| Main composition, config, placement, MCP views, shipped prompt | 5 | Only Unit 5 edits `Fleetd`, `FleetConfig`, `CompositePeerLauncher`, placement context, `FleetMcp`, and `CLAUDE.md`. |
+| Wiki propagation | Lead after Unit 5 | Workers do not commit the wiki submodule. |
+
+## What I would not build
+
+1. **Do not reuse `BackendQuarantine` for outages.** Its repeat call restarts a long credential
+   quarantine. Its fields and errors say “exhausted”. That is wrong for a short outage.
+2. **Do not merge the exhaustion and generic error patterns.** Exhaustion must win because it has a
+   different policy and duration.
+3. **Do not group by error string.** One outage can produce different text. The shared operational
+   limit is the credential.
+4. **Do not mark a profile unusable until config changes.** The current classifier cannot safely
+   tell a permanent malformed request from a transient service fault. A permanent state would need
+   a stronger error taxonomy first.
+5. **Do not quarantine on the first generic backend error.** That would turn one bad request or one
+   false pattern match into a fleet-wide capacity loss.
+6. **Do not add this to `FleetHealthMonitor`.** The monitor samples slow member health. The exact
+   backend event already exists at completion resolution, and moving it to polling would lose type
+   and time.
+7. **Do not add another direct lead injector.** `ReplyPushLoop` already owns status gating,
+   per-lead coalescing, retry bounds, and heartbeat stand-down.
+8. **Do not change `healthCoverage` to `full`.** That field still means a webhook notification sink
+   exists for periodic health. A backend outage nudge does not make every health event visible.
+9. **Do not persist incident history across daemon restart in this work.** Existing exhaustion
+   quarantine is also in memory. A 60-second state does not justify a new durable store.
+10. **Do not build work recovery.** The PR-body survival story proves why checkpoint-first work is
+    useful, but these tickets are about detection, capacity, and signalling.
+11. **Do not remove the legacy `API Error:` fallback in the first release.** Doing so would turn an
+    unedited config back into a false successful completion. Report it as degraded coverage instead.
+12. **Do not reorder or add the old `visibleTurn` fallback from #201.** #211 already implemented the
+    narrow raw-scrape fallback at `CompletionResolver.classifyRawScrapeFallback`.
+
+## Riskiest assumption and cheapest experiment
+
+The riskiest assumption is that a configured error regex means “the backend failed this turn”. The
+current code and test already show the counterexample: a worker may quote `API Error:` while writing
+a valid report. Two such false matches on one credential would now remove capacity for 60 seconds.
+
+The cheapest experiment is a replay corpus before Unit 5 ships:
+
+1. Save the full pane text from the measured 2026-09-01 outage.
+2. Produce one safe failure per backend with a disposable invalid endpoint or request.
+3. Save one valid member report which quotes each error line.
+4. Replay all samples through the real `CompletionResolver` test fixture.
+5. Require outage samples to match and quoted-report samples not to match after assistant-block
+   extraction and baseline checks.
+
+This costs no outage deployment and no real sleep. If quoted reports still match, narrow the profile
+patterns before enabling correlation. Do not raise the threshold to hide a bad classifier.
+
+## Sequencing with three developers
+
+First wave:
+
+1. Developer A: Unit 1, typed classification.
+2. Developer B: Unit 2, credential outage policy.
+3. Developer C: Unit 3, lead outage nudge.
+
+As soon as one slot is free, start Unit 4. It is file-disjoint from every first-wave unit. Merge and
+review Units 1 to 4 independently.
+
+Start Unit 5 only after all four foundations and #234 are available. Unit 5 is the only high-conflict
+integration branch, so no other active unit should touch its file list.
+
+## Checks performed for this refinement
+
+- Read issue #201 and issue #227 through their Gitea pages. Both showed zero comments.
+- Read the source and tests named in the evidence section.
+- Ran `git status --short --branch`; the branch was clean before this document was added.
+- Ran `git log --oneline -12` to identify the branch base.
+- I did not run Maven because this change adds only a design document.
+- Rendered both Mermaid blocks with `npx @mermaid-js/mermaid-cli`; both commands succeeded.

docs/CB-301-Session-Manager.md

@@ -2,7 +2,7 @@
 
 **Status:** design spec for review → delegate implementation.
 **Grounded in:** `WorkerService`, `Injector`/`StatusPoller`/`TurnListener`, `MessageService`,
-`BridgeMcp`, `BridgedApp` (see [wiki 9. Implementation](../wiki/9-Implementation.md)).
+`FleetMcp`, `FleetApp` (see [wiki 9. Implementation](../wiki/9-Implementation.md)).
 
 ## Problem
 
@@ -15,7 +15,7 @@ Consequences today:
   since when?" without shelling to herdr for a raw agent list (no state, no ownership, no age).
 - Cleanup of a worker that outlived its owning process depends entirely on the boot-time
   name-nonce **reaper** (CB-117) — there is no live, authoritative roster during a run.
-- `bridge_list` (CB-304) can only surface herdr's view, not a bridge-owned roster.
+- `fleet_list` (CB-304) can only surface herdr's view, not a bridge-owned roster.
 - There is no seam for per-session policy (checkpoint on teardown → CB-302; idle_ttl /
   context_cap / drain → CB-303).
 
@@ -35,7 +35,7 @@ build on.
 - **No checkpoint content.** Writing `STATE.md` + commit on teardown is CB-302; CB-301 only exposes
   the release hook it will attach to.
 
-"Recycle" under no-reuse is simply **release + fresh acquire** — a helper, not a pool operation.
+Under no-reuse, a released session is terminal. A new `acquire` always creates a fresh session.
 
 ## Design
 
@@ -43,14 +43,9 @@ build on.
 subscription-guarded spawn/teardown mechanics; `SessionManager` adds the registry, lifecycle, and
 ownership on top.
 
-**Package:** new `dev.ltms.bridged.session` — keeps the registry/lifecycle concern separate from
+**Package:** new `dev.ltms.fleet.session` — keeps the registry/lifecycle concern separate from
 the `worker` spawn mechanics. Holds `SessionManager` + `WorkerSession`.
 
-**`recycle` is IN SCOPE for CB-301** (decided): implement `recycle(paneId, …)` = `release` the old
-session then `acquire` a fresh one, asserting a new distinct paneId (the no-reuse invariant). It is
-a thin convenience over the two primitives, shipped now so the no-reuse teardown+respawn path is
-covered by a test from day one.
-
 ### `WorkerSession` (record or small mutable holder)
 
 | Field | Source | Notes |
@@ -88,7 +83,6 @@ SPAWNING|READY|BUSY|DONE --vanished/drop--> FAILED
 final class SessionManager {
     WorkerSession acquire(String profile, String requestedCwd, String callerCwd, String ownerTerminal);
     void          release(String paneId);          // deterministic teardown + deregister
-    WorkerSession recycle(String paneId, ...);      // release + acquire (no-reuse convenience)
     Optional<WorkerSession> get(String paneId);
     List<WorkerSession> roster();                   // bridge-owned view (CB-304 consumes this)
     // lifecycle hooks (package-private): onReady/onDelivered/onComplete/onFailed(target)
@@ -102,13 +96,13 @@ final class SessionManager {
 
 ### Integration points
 
-- **`Bridged.main`** — construct `SessionManager(workerService, ...)`; wire it as/decorating the
+- **`Fleetd.main`** — construct `SessionManager(workerService, ...)`; wire it as/decorating the
   `TurnListener` alongside `CompletionResolver` so it sees turn boundaries, and give it the
   `WorkerPresence` signal for `READY`.
-- **`BridgeMcp.spawn` / `BridgedApp.spawnWorker`** — route spawn through `SessionManager.acquire`
-  (carry `callerTerminal` as `ownerTerminal`). **`bridge_stop` / `DELETE /workers/{paneId}`** →
+- **`FleetMcp.spawn` / `FleetApp.spawnWorker`** — route spawn through `SessionManager.acquire`
+  (carry `callerTerminal` as `ownerTerminal`). **`fleet_stop` / `DELETE /workers/{paneId}`** →
   `SessionManager.release`.
-- **`bridge_list` / `GET /sessions` (CB-304 later)** — read `SessionManager.roster()`.
+- **`fleet_list` / `GET /sessions` (CB-304 later)** — read `SessionManager.roster()`.
 - **`MessageService`** — no change required for one-shot; a later CB-303 auto-release hook can call
   `release` from `onTurnComplete` under policy.
 
@@ -120,12 +114,11 @@ final class SessionManager {
 3. `release` tears the worker down via `WorkerService.stop` and removes it from `roster()`;
    a second `release` on the same paneId is a harmless no-op.
 4. `onTurnFailed` / drop moves the session to `FAILED` and it is absent from the live roster.
-5. `recycle` produces a new paneId and the old one is gone (no-reuse invariant).
-6. `roster()` reflects exactly the sessions acquired-minus-released, joined with live status.
+5. `roster()` reflects exactly the sessions acquired-minus-released, joined with live status.
 
 ## Seams left open (deliberately)
 
 - **CB-302** — attach a checkpoint step (`STATE.md` + commit) to the `release` path.
 - **CB-303** — a policy loop over `roster()` using `spawnedAtNanos`/state to auto-`release` on
   `idle_ttl`, or drain on `context_cap`.
-- **CB-304** — `bridge_list` reads `roster()` for a bridge-owned roster + live join.
+- **CB-304** — `fleet_list` reads `roster()` for a bridge-owned roster + live join.

docs/CB-301-ext-Worktree-Provisioning.md

@@ -2,12 +2,12 @@
 
 **Status:** ✅ shipped — implemented at commit `97ecc71` (per-worker git worktree + config-parity
 overlay). As-built: `session/GitWorktrees.java` behind the `Worktrees` port, wired in
-`Bridged.main` and configurable via `worktreeRoot` / per-profile `parityOverlay`
-(see `bridged.example.yaml`). Branch/worktree surface in `bridge_list` landed with CB-304
+`Fleetd.main` and configurable via `worktreeRoot` / per-profile `parityOverlay`
+(see `fleetd.example.yaml`). Branch/worktree surface in `fleet_list` landed with CB-304
 (`9fe04bf`); the worker-opened-PR checkpoint landed as CB-302 (`64e70ef`).
 **Extends:** [CB-301 Session Manager](CB-301-Session-Manager.md) (shipped, commit `54d907c`).
 **Realizes:** the config-parity requirement in [Worker Git Workflow](Worker-Git-Workflow.md).
-**Grounded in:** `SessionManager`, `WorkerService.spawn/effectiveCwd`, `BridgedConfig.Worker`,
+**Grounded in:** `SessionManager`, `WorkerService.spawn/effectiveCwd`, `FleetConfig.Worker`,
 `inject/…LsofPeerPidLookup` (the `ProcessBuilder` exec pattern).
 
 ## Problem
@@ -43,7 +43,7 @@ provider.
 ### `WorktreeRequest` (new, nullable = "no worktree")
 
 ```java
-package dev.ltms.bridged.session;
+package dev.ltms.fleet.session;
 /** Ask acquire() to provision an isolated worktree. null ⇒ run in the shared primary tree. */
 public record WorktreeRequest(String ticketSlug, String baseRef) {
     // ticketSlug seeds the branch name; baseRef null/blank ⇒ current HEAD of the repo.
@@ -63,7 +63,7 @@ untouched.
 ### `Worktrees` seam (new)
 
 ```java
-package dev.ltms.bridged.session;
+package dev.ltms.fleet.session;
 public interface Worktrees {
     /** git -C <repoRoot> worktree add <path> -b <branch> <baseRef|HEAD>. Returns the worktree path. */
     String add(String repoRoot, String branch, String baseRef);
@@ -112,7 +112,7 @@ public void release(String paneId) {
 }
 ```
 
-### Config — `BridgedConfig.Worker.parityOverlay` + a `worktreeRoot`
+### Config — `FleetConfig.Worker.parityOverlay` + a `worktreeRoot`
 
 - Add `List<String> parityOverlay` to the `Worker` record (12th field). Compact-constructor default
   when null/empty: `[".mcp.json", ".claude/settings.local.json", ".env", ".envrc"]` (missing paths are
@@ -122,7 +122,7 @@ public void release(String paneId) {
 
 ### Surface: MCP + REST
 
-- `bridge_spawn` gains an optional `worktree` arg: `true`, or a ticket slug string. Truthy ⇒ build a
+- `fleet_spawn` gains an optional `worktree` arg: `true`, or a ticket slug string. Truthy ⇒ build a
   `WorktreeRequest(slug, null)` and call the 5-arg `acquire`.
 - `POST /workers` gains `worktree` (+ optional `ticket`) in the body/query, same mapping.
 - `workerView`/`view(WorkerSession)` include `worktree` and `branch` **when non-null** (omit for

docs/CB-306-Spawn-Readiness-Gate.md

@@ -1,16 +1,16 @@
 # CB-306 — Spawn-Readiness Gate (launcher-owned terminal readiness)
 
 **Status:** design note / delegation spec (branch `worker/cb-306-readiness`)
-**Issue:** gitea `lms/claude-bridge` #4
+**Issue:** gitea `fleet/fleetd` #4
 **Owner of the behaviour:** `ClaudeCodeLauncher` (the `PeerLauncher` adapter) — NOT core.
 
 ## 1. Problem
 
-`bridge_spawn` today returns a session the instant the herdr pane is started. The pane is not
+`fleet_spawn` today returns a session the instant the herdr pane is started. The pane is not
 yet a usable Claude REPL — it may still be sitting at the folder-trust prompt, or the CLI may
 never come up at all. Nothing blocks or times out on that. Consequences:
 
-- A `bridge_send` to a not-yet-ready worker surfaces as a **~60 s MCP-client timeout** (the send
+- A `fleet_send` to a not-yet-ready worker surfaces as a **~60 s MCP-client timeout** (the send
   blocks waiting for a turn that can't start) instead of a fast, explicit spawn failure.
 - A worker stuck at the folder-trust prompt lingers in `SPAWNING` forever; nothing fails it.
 
@@ -55,7 +55,7 @@ a crash, and a slow start all present as "never becomes injectable" and all corr
    or `spawnReadyTimeoutMs` elapses.
 3. **Ready** → return the `WorkerHandle(paneId, terminalId)` as today.
 4. **Timeout** → the launcher **closes the pane it started** (and its tab, via the same path
-   `release`/`stop` uses) and throws **`PeerUnreachableException`** (new, in `dev.ltms.bridged.peer`).
+   `release`/`stop` uses) and throws **`PeerUnreachableException`** (new, in `dev.ltms.fleet.peer`).
    No orphan pane is left behind — the launcher cleans up its own failed birth.
 
 `spawnReadyTimeoutMs == 0` (or unset) **disables** the gate = legacy non-blocking behaviour, so the
@@ -79,8 +79,8 @@ Unit tests (add to the existing `ClaudeCodeLauncher` test):
 
 ## 5. Config
 
-Add to the launcher-level config (a bridged-level knob, not per-profile) in `bridged.yaml` +
-`BridgedConfig`:
+Add to the launcher-level config (a fleetd-level knob, not per-profile) in `fleetd.yaml` +
+`FleetConfig`:
 
 ```yaml
 spawn_ready_timeout_ms: 20000   # 0 disables the gate (legacy non-blocking spawn)
@@ -88,7 +88,7 @@ spawn_ready_poll_ms: 300
 ```
 
 Jackson ignores unknown keys, so omitting them in existing YAML is safe; pick sane defaults in code
-(`20000` / `300`). Keep the names consistent with existing config field style in `BridgedConfig`.
+(`20000` / `300`). Keep the names consistent with existing config field style in `FleetConfig`.
 
 ## 6. Core / MCP propagation
 
@@ -99,11 +99,11 @@ Jackson ignores unknown keys, so omitting them in existing YAML is safe; pick sa
   `spawn` throws — verify the new exception flows through it (worktree removed, nothing registered).
 - The **non-worktree** path registers the session only *after* `spawn` returns, so a throw means no
   half-live `SPAWNING` session is ever registered — confirm this and add a test.
-- `bridge_spawn` (MCP verb) must return an **error result** carrying the exception message, not a
-  success with a dead session. Trace `BridgeMcp`/`BridgedApp` spawn handlers and make sure the
+- `fleet_spawn` (MCP verb) must return an **error result** carrying the exception message, not a
+  success with a dead session. Trace `FleetMcp`/`FleetApp` spawn handlers and make sure the
   exception becomes a clean tool error, not an uncaught 500 with a stack trace.
 
-**Out of scope (do NOT do here):** gating `bridge_send` on session `READY` (existing status-gate +
+**Out of scope (do NOT do here):** gating `fleet_send` on session `READY` (existing status-gate +
 this spawn gate already close the window), MCP-handshake-as-readiness signal, the CB-307 broker,
 any config `kind:` discriminator, any second adapter.
 
@@ -111,7 +111,7 @@ any config `kind:` discriminator, any second adapter.
 
 - `ClaudeCodeLauncher.spawn` blocks until injectable or throws `PeerUnreachableException` +
   self-reaps the pane; gate disabled when timeout is 0.
-- New `PeerUnreachableException` in `dev.ltms.bridged.peer`.
+- New `PeerUnreachableException` in `dev.ltms.fleet.peer`.
 - Config knobs wired (`spawn_ready_timeout_ms`, `spawn_ready_poll_ms`) with safe defaults.
 - Existing `SPAWNING→READY` MCP-contact transition untouched.
 - New unit tests (ready / timeout+reap / disabled) green; **all existing tests still pass unchanged**.

docs/CB-307-Reliable-Delivery.md

@@ -13,28 +13,28 @@ Stage 2 (the AMQP/LavinMQ adapter behind the same port) is explicitly **out of s
 ## 1. The bug this fixes (grounded in current code)
 
 The reverse (worker→primary) path is `Rendezvous` — a `ConcurrentHashMap<session, CompletableFuture<Resolution>>`
-of **live blocking waiters only**. No queue, no store. When a worker calls `bridge_reply` and **no send
+of **live blocking waiters only**. No queue, no store. When a worker calls `fleet_reply` and **no send
 is currently open** for that worker:
 
 - `Rendezvous.resolve(session, content)` → `complete(...)` → `waiters.get(session) == null` →
   returns `false` (`msg/Rendezvous.java:212-215`).
 - The `content` string is **never retained** — it is dropped. The worker is told it failed:
-  `BridgeMcp.reply` returns `error("no send is awaiting a reply for this worker")` (`mcp/BridgeMcp.java:270-272`);
-  REST returns `409 no_pending_send` (`rest/BridgedApp.java:339-345`).
+  `FleetMcp.reply` returns `error("no send is awaiting a reply for this worker")` (`mcp/FleetMcp.java:270-272`);
+  REST returns `409 no_pending_send` (`rest/FleetApp.java:339-345`).
 
-This is the observed "communication break": a worker that finishes just after its `bridge_send` timed
+This is the observed "communication break": a worker that finishes just after its `fleet_send` timed
 out (the ~60s sync window) replies into the void. There is **no message-id, dedup, or ack** anywhere in
 the message path today.
 
 ## 2. What to build
 
-### 2.1 The port — `dev.ltms.bridged.msg.ReplyInbox`
+### 2.1 The port — `dev.ltms.fleet.msg.ReplyInbox`
 
 A thin interface owned by the `msg` layer. The in-memory adapter is Stage 1; the AMQP adapter (Stage 2)
 implements the **same** interface, so keep it broker-agnostic.
 
 ```java
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
 import java.util.List;
 
@@ -70,7 +70,7 @@ public interface ReplyInbox {
   seen-set — your call; preserve insertion order).
 - `peek` returns an immutable copy; `ack` removes by `msgId`. Thread-safe (concurrent publish vs. drain).
 - **This is soft-state, NOT persistence.** Lost on a `java -jar` bounce — that is correct and consistent
-  with "bridged stays soft-state." Do **not** add any file/DB backing.
+  with "fleetd stays soft-state." Do **not** add any file/DB backing.
 
 ### 2.3 Publish seam — route reply through the service layer
 
@@ -79,7 +79,7 @@ in `MessageService`, which already owns the `Rendezvous` and will own the `Reply
 
 - Add `MessageService.reply(String session, String content)`:
   ```java
-  /** Route a worker's explicit bridge_reply: resolve an open send, or queue it in the inbox if none. */
+  /** Route a worker's explicit fleet_reply: resolve an open send, or queue it in the inbox if none. */
   public boolean reply(String session, String content) {
       if (rendezvous.resolve(session, content)) {
           return true;                       // a live send took it — unchanged fast path
@@ -89,12 +89,12 @@ in `MessageService`, which already owns the `Rendezvous` and will own the `Reply
   }
   ```
 - Repoint the two callers off the bare `rendezvous.resolve(...)` onto `messages.reply(...)`:
-  - `BridgeMcp.reply` (`mcp/BridgeMcp.java:262-273`) — on success return a normal ack; **remove** the
+  - `FleetMcp.reply` (`mcp/FleetMcp.java:262-273`) — on success return a normal ack; **remove** the
     `error("no send is awaiting a reply…")` branch (that case is now a successful queue).
-  - `BridgedApp.replyMessage` (`rest/BridgedApp.java:330-346`) — return `200` (queued) instead of
+  - `FleetApp.replyMessage` (`rest/FleetApp.java:330-346`) — return `200` (queued) instead of
     `409 no_pending_send`.
 
-**DO NOT touch the QUESTION path.** `bridge_ask` / `rendezvous.resolveQuestion` must keep today's
+**DO NOT touch the QUESTION path.** `fleet_ask` / `rendezvous.resolveQuestion` must keep today's
 `NO_WAITER` behaviour — a mid-turn question is **interactive** (the worker blocks synchronously and cannot
 consume a late answer), so it must **never** be queued. Only terminal `REPLY`s go to the inbox.
 
@@ -110,27 +110,27 @@ The primary re-checks a worker it delegated to. Expose a drain keyed by **worker
 - Add `MessageService.drainReplies(String target)`: `peek` the inbox, `ack` each returned `msgId`, hand
   back the `List<InboxMessage>` (or just the contents). At-least-once: peek→deliver→ack (ack only after
   the caller has them, so an in-flight failure re-surfaces them).
-- **DECISION (required default): expose via the existing poll verb, keyed by target.** Extend `bridge_poll`
+- **DECISION (required default): expose via the existing poll verb, keyed by target.** Extend `fleet_poll`
   to accept an optional `target` (worker session) and, when present, return that worker's drained replies —
   alongside a matching REST route `GET /sessions/{id}/replies`. Do **not** change `send`/`answer` semantics
   (do not drain inside `send` — that conflates "deliver to worker" with "collect its mail"). Keep the
-  existing ticket-based `bridge_poll(ticket)` path working unchanged. If you see a cleaner surface, still
+  existing ticket-based `fleet_poll(ticket)` path working unchanged. If you see a cleaner surface, still
   ship this default and note the alternative for review.
 
 ## 3. Config
 
 **None for Stage 1.** The in-memory adapter is the unconditional default — wire `new InMemoryReplyInbox()`
-into `MessageService` in `Bridged.main`. Do **not** add a `broker:` config block (that arrives with the
+into `MessageService` in `Fleetd.main`. Do **not** add a `broker:` config block (that arrives with the
 Stage-2 AMQP adapter: absent → in-memory, present → AMQP).
 
 ## 4. Acceptance criteria (what the primary will verify)
 
-1. New `ReplyInbox` + `InboxMessage` + `InMemoryReplyInbox` in `dev.ltms.bridged.msg`.
-2. `bridge_reply` with **no open send** now **succeeds and queues** (no more `error` / `409`); the reply is
+1. New `ReplyInbox` + `InboxMessage` + `InMemoryReplyInbox` in `dev.ltms.fleet.msg`.
+2. `fleet_reply` with **no open send** now **succeeds and queues** (no more `error` / `409`); the reply is
    later retrievable and identical.
 3. The queued reply is drainable by the primary keyed by target; draining **acks** it (a second drain
    returns nothing); dedup by `msgId` (re-publishing the same id does not double-queue).
-4. **QUESTION path unchanged** — `bridge_ask` with no open send still returns `NO_WAITER` (add/keep a test
+4. **QUESTION path unchanged** — `fleet_ask` with no open send still returns `NO_WAITER` (add/keep a test
    proving a question is never queued).
 5. Completion/failure fallbacks unchanged.
 6. Unit tests covering: `InMemoryReplyInbox` publish/peek/ack/dedup/FIFO/concurrency; `MessageService.reply`
@@ -140,7 +140,7 @@ Stage-2 AMQP adapter: absent → in-memory, present → AMQP).
 
 ## 5. Build & verification (worker side)
 
-- Build with Maven from the worktree's `bridged/` dir. **Capture the exit code without a masking pipe**
+- Build with Maven from the worktree's `fleetd/` dir. **Capture the exit code without a masking pipe**
   (`mvn clean install; echo "MVN_EXIT=$?"` — never `mvn … | tail`, which hides failures).
 - Read the real test totals from `target/surefire-reports/TEST-*.xml`, not from stdout scroll.
 - You do **not** have IDE MCP access — do not claim `ide_diagnostics` results. The **primary** runs the
@@ -152,7 +152,7 @@ Stage-2 AMQP adapter: absent → in-memory, present → AMQP).
 - **`.mcp.json` is `--skip-worktree` in your worktree — never edit, `git add`, or commit it.**
 - **`wiki/` is a submodule — never run git in it; never touch it.**
 - Commit only your feature changes (the new port/adapter, the `msg`/`mcp`/`rest` wiring, tests, and if
-  you add config wiring in `Bridged.java`). Nothing else.
+  you add config wiring in `Fleetd.java`). Nothing else.
 - Work only inside your assigned worktree on your feature branch. The primary fast-forwards `main` after
   re-gating — do not touch `main`.
 - Java 25 idioms are welcome (unnamed `_` params, records). Keep the diff minimal and match surrounding style.
@@ -171,7 +171,7 @@ removal, msgId dedup, cross-restart redelivery). It is `@Tag("contract")`, so th
 untouched. Run it explicitly when Docker (or a broker) is available:
 
 ```bash
-cd bridged
+cd fleetd
 mvn -Pcontract test -Dtest=AmqpReplyInboxContractTest   # local: spins a RabbitMQ Testcontainers fixture
 ```
 

docs/CB-308-Multi-Host-Federation.md

@@ -18,7 +18,7 @@ The design rests on three pieces (the shape this ticket proposes):
 1. **Dedicated per-agent channels** — every agent has its own addressable inbox on the broker.
 2. **A federated agent directory** — a global "who/where/status" lookup, assembled from per-host
    presence, not a central database.
-3. **A per-host gateway** — each host runs a `bridged` that owns its local herdr, registers/manages
+3. **A per-host gateway** — each host runs a `fleetd` that owns its local herdr, registers/manages
    its own sessions, and proxies messages to/from other hosts over the broker.
 
 ## 2. What is single-host today (the assumptions to break)
@@ -27,7 +27,7 @@ The design rests on three pieces (the shape this ticket proposes):
 flowchart TB
     subgraph host["Single host (today)"]
         primary["primary<br/>(MCP client)"]
-        daemon["bridged daemon<br/>127.0.0.1:8765"]
+        daemon["fleetd daemon<br/>127.0.0.1:8765"]
         reg["in-process registry<br/>keyed by PeerHandle.id() == paneId"]
         herdr["herdr<br/>(local unix-socket PTY mux)"]
         w1["worker pane wQ:p1"]
@@ -48,21 +48,21 @@ Three concrete bake-ins assume one host:
 |---|---|---|
 | **herdr is local** | `herdr/` unix socket `~/.config/herdr/herdr.sock` | You cannot drive another host's PTYs → each host **must** own its herdr. This is why a per-host gateway is mandatory. |
 | **registry is in-process, keyed by `paneId`** | `session/SessionManager` | `paneId` (e.g. `wQ:p2B`) is a herdr-local coordinate — meaningless off-host. Routing needs a host-unique id. |
-| **loopback, no authn** | `rest/BridgedApp` binds `127.0.0.1:8765` | Fine on one host; the moment a second host can talk to a gateway, that link is a trust boundary. |
+| **loopback, no authn** | `rest/FleetApp` binds `127.0.0.1:8765` | Fine on one host; the moment a second host can talk to a gateway, that link is a trust boundary. |
 
 ## 3. Target architecture
 
 ```mermaid
 flowchart TB
     subgraph hostA["HOST A"]
-        gA["gateway = bridged A"]
+        gA["gateway = fleetd A"]
         regA["local registry + herdr"]
         primary["primary (MCP client)"]
         gA --- regA
         primary --- gA
     end
     subgraph hostB["HOST B"]
-        gB["gateway = bridged B"]
+        gB["gateway = fleetd B"]
         regB["local registry + herdr"]
         wb["worker panes"]
         gB --- regB
@@ -96,13 +96,13 @@ host's terminals.*
   delayed-message exchange (the remind/backoff loop for free) — the same reasons CB-307 picked it.
 
 - **Federated agent directory** = a **soft-state, bridge-owned** roster, *not* a broker-stored
-  database. Per the persistence-boundary decision (bridged is soft-state; the broker owns *message*
+  database. Per the persistence-boundary decision (fleetd is soft-state; the broker owns *message*
   durability, not *who/where/status*), each gateway announces its local agents `(globalId, host,
   status, capabilities)` on a `roster.*` presence topic with periodic heartbeats. Every gateway
   builds an eventually-consistent **union view** — literally CB-304's `rosterView`, federated. A
   stale entry expires by missed heartbeat (reuses CB-303's idle/TTL thinking).
 
-- **Per-host gateway** = today's `bridged` daemon, evolved. It already registers/manages sessions
+- **Per-host gateway** = today's `fleetd` daemon, evolved. It already registers/manages sessions
   and controls its local herdr; multi-host adds exactly two responsibilities: (a) a broker client
   that consumes its agents' inboxes and injects into local herdr, and (b) presence announce +
   union-roster assembly. Evolution, not rewrite.
@@ -111,7 +111,7 @@ host's terminals.*
 
 ```mermaid
 flowchart LR
-    send["bridge_send(globalId, msg)"] --> lookup{"directory:<br/>is globalId local?"}
+    send["fleet_send(globalId, msg)"] --> lookup{"directory:<br/>is globalId local?"}
     lookup -->|"yes"| local["inject via local herdr<br/>(today's Injector path)"]
     lookup -->|"no"| pub["publish agent.&lt;id&gt;.inbox<br/>(broker routes to owning gateway)"]
     pub --> consume["owning gateway consumes<br/>→ injects into its local herdr"]
@@ -123,7 +123,7 @@ broker. A sender is oblivious to which branch it took.*
 ## 4. What CB-307 already provides vs. what is net-new
 
 **CB-307 delivers the transport half** and is independently valuable on a single host: the AMQP
-broker fabric, the `bridged → broker` client/adapter, at-least-once + idempotent (dedup-by-id)
+broker fabric, the `fleetd → broker` client/adapter, at-least-once + idempotent (dedup-by-id)
 delivery, DLQ, and delayed-retry (remind). That *is* the "proxy cross-host message" backbone;
 extending the same broker from "worker→primary reliability" to "gateway↔gateway" is incremental.
 
@@ -158,17 +158,17 @@ sequenceDiagram
     participant BR as broker
     participant GA as gateway A
     participant P as primary (host A, MCP client)
-    W->>GB: bridge_reply
+    W->>GB: fleet_reply
     GB->>BR: publish primary-bound (durable, msg id)
     BR->>GA: route to A's primary inbox
     Note over GA: held durably until the primary pulls
-    P->>GA: blocking bridge_send resolves / bridge_poll
+    P->>GA: blocking fleet_send resolves / fleet_poll
     GA-->>P: reply (then ACK to broker)
 ```
 
 *Figure 4 — the broker makes the middle hop lossless, ordered, and idempotent; the **final** hop
 into the primary is still a **pull** (gateway A holds the message until the primary's blocking
-`bridge_send` or `bridge_poll`). Cross-host neither improves nor worsens this — it just spans hosts.
+`fleet_send` or `fleet_poll`). Cross-host neither improves nor worsens this — it just spans hosts.
 This is precisely the gap CB-307 closes on one host and CB-308 stretches across hosts.*
 
 ## 6. Staging & dependencies
@@ -207,8 +207,8 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
    gateway's host. This extends the single-host invariant — *identity comes from the connection,
    never an argument* — across the broker: cross-host, identity comes from the key. Complements
    (not replaces) per-gateway broker logins over TLS.
-2. **Profiles are owned by the worker's host.** `bridge_spawn(profile, host)` resolves the name in
-   the *target* gateway's `bridged.yaml`. Gateways advertise their profile names in presence
+2. **Profiles are owned by the worker's host.** `fleet_spawn(profile, host)` resolves the name in
+   the *target* gateway's `fleetd.yaml`. Gateways advertise their profile names in presence
    heartbeats, so a leader sees what each host offers before spawning; an unknown name is a clear
    error from the target. Secrets (base URLs, tokens) never leave the host that uses them.
 3. **Repo provisioning — clone from the forge, pinned.** A cross-host spawn names the repo URL and
@@ -259,7 +259,7 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
    serialize acks fleet-wide. Ordering caveat: a *return* (unroutable) arrives **before** the
    confirm, so "confirmed" ≠ "routed"; the sender checks the returned-set at confirm time.
    `mandatory` is false only for `BROADCAST`, where an empty group is legal silence.
-10. **Queue lifecycle is session lifecycle.** `bridge_stop`/reap deletes the worker's inbox queue
+10. **Queue lifecycle is session lifecycle.** `fleet_stop`/reap deletes the worker's inbox queue
     (its `broadcast.*` bindings die with it — no broadcasts to the dead); `x-expires` collects
     queues orphaned by a crashed gateway (long for main/orchestrator inboxes, short for workers).
     Queue names carry a version suffix (`.v2`): AMQP refuses to redeclare an existing durable
@@ -275,11 +275,11 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
 - **Gateway discovery:** how gateways find the broker and each other (static config vs. discovery).
 - **Control authorization — THE GATE ON U4.** Signing (§7.1) settles *who sent it*; authorization
   is *who may do what*. **Cross-host spawn must not land before the minimal version exists**: a
-  per-host allowlist in `bridged.yaml` — beside the peer public keys — of gateway ids permitted to
+  per-host allowlist in `fleetd.yaml` — beside the peer public keys — of gateway ids permitted to
   publish control to this host, checked against the verified signature. A few lines of config and
   check; without them, any principal holding broker credentials can start processes on every host
   in the fleet.
-- **Key distribution & rotation:** static config (host → public key in each `bridged.yaml`) is
+- **Key distribution & rotation:** static config (host → public key in each `fleetd.yaml`) is
   fine at the current 2–3 host scale; rotation is manual. A refinement, not a blocker.
 - **Gateway death mid-turn:** the roster reaps it by missed heartbeat, and in-flight primary-bound
   messages survive by broker durability; still open is reconciling *worker* state when the dead

docs/CB-401-Peer-Launcher-SPI.md

@@ -7,7 +7,7 @@ the core learning any one peer's environment.
 ## 1. Why
 
 `claude-bridge` is a **communication bus between heterogeneous AI agents** — its stable surface is
-the protocol (`bridge_spawn / send / poll / reply / ask / list / stop / status`), and that surface
+the protocol (`fleet_spawn / send / poll / reply / ask / list / stop / status`), and that surface
 should stay provider-neutral. Today the daemon can only materialize one kind of peer: an
 off-subscription Claude Code CLI over herdr. Everything specific to *how that peer is set up*
 (`ANTHROPIC_BASE_URL`, the subscription guard, `--mcp-config`/system-prompt flags, `claude-*`
@@ -60,7 +60,7 @@ Where Claude/herdr specifics actually live today:
 | `claude-<profile>-<nonce>-<seq>` naming, `WORKER_NAME` regex, orphan reap (CB-117) | `WorkerService` | **→ adapter** (naming is a herdr-label detail) |
 | `GITEA_TOKEN` / `GITEA_HOST` injection (CB-302 checkpoint) | `WorkerService.spawn` | **→ adapter** + a **capability** (§6) |
 | tab/pane placement, worker space, tab labels | `WorkerService.spawnInTab/spawnAsPane` via herdr `WorkspaceControl` | **→ adapter** (herdr transport detail) |
-| `BridgedConfig.Worker` profile shape (`baseUrl`, `model`, `configDir`, …) | `config` | **mostly adapter-shaped** — see §5 |
+| `FleetConfig.Worker` profile shape (`baseUrl`, `model`, `configDir`, …) | `config` | **mostly adapter-shaped** — see §5 |
 | FSM, registry, roster, `reapIdle`/`drainAll`/`contextCap`, `rosterView` | `SessionManager` | **stays core** |
 | turn/completion detection (`TurnListener`, `CompletionResolver`, `StatusPoller`, `WorkerPresence`) | `inject/` | **stays core**, but reads herdr terminal output → transport-coupled (§4b) |
 | message store & routing | `msg/` | **stays core** |
@@ -118,7 +118,7 @@ hard-wire "turns come from herdr".
 
 ## 5. Config shape
 
-`BridgedConfig.Worker` is Claude-shaped (`baseUrl`, `model`, `configDir`, `tokenEnv`). Rather than
+`FleetConfig.Worker` is Claude-shaped (`baseUrl`, `model`, `configDir`, `tokenEnv`). Rather than
 break existing YAML, CB-401 keeps `workers:` exactly as-is and treats those fields as the
 **ClaudeCodeLauncher's** profile schema. A future peer kind adds a `kind:` discriminator
 (default `"claude-code"`) selecting the launcher; unknown-kind → clear config error. No migration of
@@ -126,7 +126,7 @@ existing configs. (Jackson already ignores unknown keys, so adding `kind` is bac
 
 ```mermaid
 sequenceDiagram
-    participant MCP as bridge_spawn (MCP/REST)
+    participant MCP as fleet_spawn (MCP/REST)
     participant SM as SessionManager
     participant L as PeerLauncher (by profile.kind)
     participant T as transport (herdr)
@@ -150,7 +150,7 @@ degrades gracefully when a launcher lacks one:
 
 | Capability | Meaning | Claude Code | Codex (likely) | Human |
 |---|---|---|---|---|
-| `MID_TURN_ASK` | supports `bridge_ask` rendezvous | ✓ | ? | ✗ |
+| `MID_TURN_ASK` | supports `fleet_ask` rendezvous | ✓ | ? | ✗ |
 | `SELF_PR` | can open its own PR at checkpoint (CB-302) | ✓ (opt-in token) | ? | ✗ |
 | `WORKTREE` | can run in a provisioned git worktree | ✓ | ✓ | ✗ |
 | `ORPHAN_REAP` | spawner can reconcile orphaned peers on boot | ✓ | ? | ✗ |
@@ -185,13 +185,13 @@ messages, not verified facts.
 Deliverable for CB-401 Stage A — mechanical, behaviour-preserving:
 
 1. `PeerLauncher` interface + `PeerHandle` (opaque id) + `SpawnRequest` (profile, requestedCwd,
-   callerCwd) + `Capability` enum, new package `dev.ltms.bridged.peer`.
+   callerCwd) + `Capability` enum, new package `dev.ltms.fleet.peer`.
 2. `ClaudeCodeLauncher implements PeerLauncher` = today's `WorkerService`, adapted: `spawn(...)`
    returns a `PeerHandle` (id = paneId), `capabilities()` declares
    `MID_TURN_ASK, SELF_PR(when token), WORKTREE, ORPHAN_REAP`.
 3. `SessionManager` depends on `PeerLauncher`, not `WorkerService` concretely; routing keys on
    `PeerHandle.id()` (== paneId today, so zero value change).
-4. `Bridged.main` wires the concrete `ClaudeCodeLauncher` behind the interface.
+4. `Fleetd.main` wires the concrete `ClaudeCodeLauncher` behind the interface.
 5. **No behaviour change, no config change.** Full green gate: `ide_sync` → `ide_diagnostics`
    (0 errors/0 warnings) → `mvn clean install` with `MVN_EXIT` captured (no masking pipe). All
    existing tests pass unchanged; add tests only for the new `PeerHandle` indirection.

docs/CB-402-OpenCode-Adapter.md

@@ -11,7 +11,7 @@ All five increments of §4 are done, including increment 5 (the §5 live checkli
 
 ## 1. Goal
 
-Prove the [`PeerLauncher`](../bridged/src/main/java/dev/ltms/bridged/peer/PeerLauncher.java) SPI
+Prove the [`PeerLauncher`](../fleetd/src/main/java/dev/ltms/fleet/peer/PeerLauncher.java) SPI
 actually holds for a **non-Claude** coding agent by shipping a second, first-class in-tree
 adapter: **opencode** (`opencode` 1.1.31, a provider-agnostic terminal coding agent).
 
@@ -56,8 +56,8 @@ flowchart TB
 
 *Figure 1 — the two concerns tangled inside today's single launcher; CB-402 splits them.*
 
-There is also a **Stage-A deferral** to finish: `Bridged.main` still casts
-`(ClaudeCodeLauncher) workers` at the `BridgeMcp` and `BridgedApp` constructors. Those two
+There is also a **Stage-A deferral** to finish: `Fleetd.main` still casts
+`(ClaudeCodeLauncher) workers` at the `FleetMcp` and `FleetApp` constructors. Those two
 callers only invoke `profiles()`, `defaultProfile()`, and `list()` — **all already on the
 `PeerLauncher` interface**. The cast survives for one reason only: `PeerLauncher.list()`
 returns `List<?>` (element type erased) while the callers use `Agent` element methods in their
@@ -68,7 +68,7 @@ roster join. Finishing the migration is therefore small and contained (§4.D).
 ## 3. Target design
 
 Template-Method base + two thin adapters + a routing composite that keeps the Stage-A seam
-(one `PeerLauncher` reference held by `SessionManager` / `BridgeMcp` / `BridgedApp`) intact.
+(one `PeerLauncher` reference held by `SessionManager` / `FleetMcp` / `FleetApp`) intact.
 
 ```mermaid
 flowchart TB
@@ -114,7 +114,7 @@ Two adapter **hooks** (abstract):
 protected abstract String namePrefix();               // "claude" | "opencode"
 
 /** Build the peer-specific launch: env map + argv. Runs any pre-spawn guard here. */
-protected abstract Launch buildLaunch(BridgedConfig.Worker cfg, SpawnRequest req);
+protected abstract Launch buildLaunch(FleetConfig.Worker cfg, SpawnRequest req);
 record Launch(Map<String,String> env, List<String> argv) {}
 ```
 
@@ -126,7 +126,7 @@ so the opencode adapter never reaps a `claude-*` pane and vice-versa. The compos
 
 ### B. `kind:` config discriminator
 
-Add one field to `BridgedConfig.Worker`:
+Add one field to `FleetConfig.Worker`:
 
 ```java
 String kind          // "claude-code" (default) | "opencode"
@@ -138,7 +138,7 @@ String kind          // "claude-code" (default) | "opencode"
   so the record stays declarative.)
 - Keep the existing back-compat constructors; `kind` is additive and optional.
 
-`bridged.example.yaml` documents a two-kind `workers:` block.
+`fleetd.example.yaml` documents a two-kind `workers:` block.
 
 ### C. `OpenCodeLauncher` — the adapter hooks for opencode
 
@@ -164,13 +164,13 @@ String kind          // "claude-code" (default) | "opencode"
 
 ### D. `CompositePeerLauncher` + finish the Stage-A migration
 
-- `Bridged.main` groups configured profiles by `kind`, instantiates one launcher per kind
+- `Fleetd.main` groups configured profiles by `kind`, instantiates one launcher per kind
   present, and wraps them in `CompositePeerLauncher implements PeerLauncher`.
 - Routing methods (`spawn(req)`, `effectiveCwd(req)`, `parityOverlay(name)`) dispatch by the
   profile's kind. Fan-out methods (`list()`, `reapOrphanWorkers()`, `capabilities()`,
   `profiles()`, `defaultProfile()`) merge across sub-launchers. `stop(id)` tries each (teardown
   only knows the pane id) — already best-effort/idempotent.
-- **Migrate `BridgeMcp` + `BridgedApp` to the `PeerLauncher` interface**, dropping both
+- **Migrate `FleetMcp` + `FleetApp` to the `PeerLauncher` interface**, dropping both
   `(ClaudeCodeLauncher)` casts. Only friction is `list()`'s `List<?>`; resolve by giving the SPI
   a typed roster element (small neutral `PeerAgent` view exposing `id()`/`name()`/status) that
   the CB-304 roster join consumes — or, minimally, narrow at the callsite. Prefer the typed view.
@@ -179,12 +179,12 @@ String kind          // "claude-code" (default) | "opencode"
 sequenceDiagram
     autonumber
     participant P as Primary
-    participant M as BridgeMcp / REST
+    participant M as FleetMcp / REST
     participant C as CompositePeerLauncher
     participant O as OpenCodeLauncher
     participant B as HerdrPeerLauncher (base)
     participant H as herdr
-    P->>M: bridge_spawn(profile="oc-impl")
+    P->>M: fleet_spawn(profile="oc-impl")
     M->>C: spawn(SpawnRequest)
     C->>C: kind(profile)=="opencode"
     C->>O: spawn(req)
@@ -208,7 +208,7 @@ sequenceDiagram
    `ClaudeCodeLauncher` extend it with `namePrefix()="claude"` and `buildLaunch()` wrapping
    today's guard+env+argv logic. Green build, identical tests — pure refactor. *(IDE
    `refactor` where possible; the primary re-runs the gate workers can't.)*
-2. **`kind:` discriminator.** Add the field + normalization + `bridged.example.yaml`. Default
+2. **`kind:` discriminator.** Add the field + normalization + `fleetd.example.yaml`. Default
    path unchanged (`kind=claude-code`).
 3. **`OpenCodeLauncher`.** Implement the three hooks; unit-test `buildLaunch` (env has no
    `ANTHROPIC_BASE_URL`; `OPENCODE_CONFIG` points at a file carrying the bridge MCP block +
@@ -226,11 +226,11 @@ until it is "major" (Stage-B whole), per the CB-401 bar.
 - **opencode TUI ⇄ herdr injection.** herdr drives a pane by typing into a TUI. Must confirm
   opencode's TUI accepts injected keystrokes/submit the way `claude` does, and reaches an
   `injectable` status the CB-306 gate recognizes. *Validation:* spawn one opencode worker,
-  watch the readiness gate pass, `bridge_send` a trivial task.
+  watch the readiness gate pass, `fleet_send` a trivial task.
 - **Bridge MCP visibility in opencode.** Confirm `OPENCODE_CONFIG` (or `opencode mcp add`)
-  actually surfaces the `bridge_*` tools inside the opencode session, and that `bridge_reply`
+   actually surfaces the `fleet_*` tools inside the opencode session, and that `fleet_reply`
   is callable — the reply-charter is worthless if the tool isn't mounted. *Validation:* the
-  worker completes a task by calling `bridge_reply`; the reply lands via the CB-307 path.
+  worker completes a task by calling `fleet_reply`; the reply lands via the CB-307 path.
 - **opencode MCP/config schema drift.** opencode is fast-moving (1.1.31 today). Pin the config
   schema we generate against the installed version; treat the exact keys (`type: "remote"` vs
   `"http"`, `instructions` shape) as a dogfood-verified fact, not an assumption.
@@ -244,7 +244,7 @@ until it is "major" (Stage-B whole), per the CB-401 bar.
 
 - **Unit (hermetic):** base-extraction regression (existing `ClaudeCodeLauncher` tests pass
   unchanged); `OpenCodeLauncher.buildLaunch` env/argv/config assertions; `kind` normalization
-  in `BridgedConfigTest`; `CompositePeerLauncher` routing + fan-out (merge of `profiles()`,
+  in `FleetConfigTest`; `CompositePeerLauncher` routing + fan-out (merge of `profiles()`,
   summed `reapOrphanWorkers()`, per-kind reap isolation) with fake sub-launchers.
 - **Live (dogfood, manual):** the §5 checklist on the running daemon.
 - **Gate (primary):** IDE diagnostics 0/0 on every changed file, `mvn clean install` green with
@@ -269,7 +269,7 @@ until it is "major" (Stage-B whole), per the CB-401 bar.
 
 ## 8. As-built — live dogfood (2026-07-29)
 
-Run against `bridged` on `127.0.0.1:8766` at main `19cdf8d`, with opencode **1.18.5** installed
+Run against `fleetd` on `127.0.0.1:8766` at main `19cdf8d`, with opencode **1.18.5** installed
 via Homebrew. Every §5 risk is now a verified fact rather than an assumption.
 
 **The version-drift risk was the real one, and it did not bite.** This adapter was designed against
@@ -281,7 +281,7 @@ as a dogfood-verified fact for 1.18.5.
 | §5 risk | Result |
 |---|---|
 | opencode TUI ⇄ herdr injection; CB-306 gate | ✅ `peer pane=wD:p3 reached injectable state` ~0.6s after `agent.start` |
-| Bridge MCP visible + `bridge_reply` callable | ✅ MCP `initialize` from `Implementation[name=opencode, version=1.18.5]`; worker replied through the tool |
+| Bridge MCP visible + `fleet_reply` callable | ✅ MCP `initialize` from `Implementation[name=opencode, version=1.18.5]`; worker replied through the tool |
 | Config schema drift (1.1.31 → 1.18.5) | ✅ unchanged, see above |
 | Provider credentials | ✅ free tier, zero credentials |
 
@@ -291,7 +291,7 @@ Full lifecycle exercised through the REST surface:
    to `OpenCodeLauncher` (`spawning opencode profile=opencode-free`), pane `wD:p3`.
 2. Readiness: `{"ready":true,"status":"idle"}`, roster state `ready`.
 3. `POST /sessions/{id}/message` → **`{"replySource":"reply","reply":"391"}`** — a *structured*
-   `bridge_reply`, not the CB-115 completion-fallback transcript scrape. The clean path.
+   `fleet_reply`, not the CB-115 completion-fallback transcript scrape. The clean path.
 4. `DELETE /workers/wD:p3` → `204`, roster empty, tolerant teardown (`tab_not_found` ignored —
    opencode had already closed its own tab).
 
@@ -301,5 +301,5 @@ identity (loopback peer PID → herdr pane) classified an **opencode** process a
 opencode-specific handling — confirming the identity model is peer-kind-agnostic, which is exactly
 what CB-308 needs when it stretches the roster across hosts.
 
-CB-502 counters for the same run: `bridged_sends_total{outcome="replied"} 1`,
-`bridged_replies_total{path="rendezvous"} 1`, `bridged_inbox_depth{...} 0`.
+CB-502 counters for the same run: `fleet_sends_total{outcome="replied"} 1`,
+`fleet_replies_total{path="rendezvous"} 1`, `fleet_inbox_depth{...} 0`.

docs/CB-500-Multi-Tier-Coordination.md

@@ -1,6 +1,8 @@
 # CB-500 — Multi-Tier Coordination (Stage 6)
 
-**Status:** design note (proposal — ticket split deferred)
+**Status:** design note. Developments A/B remain proposals; Development C (§6 and Figures 7–8) is
+**SUPERSEDED** by the advisory-architect design in Gitea issue #16 and the `architects:` configuration
+block (CB-548).
 **Depends on:** CB-401/402 (Peer Launcher SPI + composite router — placement-neutral spawn),
 CB-308 (per-agent broker channels + global id + federated roster — the addressing substrate),
 CB-307 (durable inbox + push loop), CB-301/303 (session FSM + context-cap/idle-ttl), CB-304
@@ -16,8 +18,9 @@ workers) into a **multi-tier** one, along three axes the lead has asked for:
 1. **Sandboxed workers** — each worker runs in a **separated, peer-owned sandbox** carrying its own
    toolchain (Claude routed via `ANTHROPIC_BASE_URL`, a headless IDE, git, MCP, dev-tools), with
    **per-role** sandboxes (a backend-agent image, a frontend-agent image).
-2. **Main-agent pairs** — the "main" tier becomes a **pair** (on-subscription Opus + one cloud
-   module) collaborating, instead of a lone primary.
+2. **Main-agent pairs** — **SUPERSEDED.** The considered model made the "main" tier a pair
+   (on-subscription Opus + one cloud module). The actual fleet is one human-driven lead plus two
+   short-lived advisory architects on different model families.
 3. **An orchestrator tier** — a supervisor **above** the mains that owns their **session identity**
    (naming, resume) and **curates context**, so every main→worker delegation carries the *exact*
    slice of context it needs and nothing else.
@@ -35,14 +38,14 @@ never toolchain ownership (§7).
 flowchart TB
     human["human (types)"]
     primary["PRIMARY (Opus)<br/>MCP client — pull-only"]
-    daemon["bridged daemon<br/>127.0.0.1:8765 (single host)"]
+    daemon["fleetd daemon<br/>127.0.0.1:8765 (single host)"]
     comp["CompositePeerLauncher<br/>routes by kind"]
     cc["ClaudeCodeLauncher"]
     oc["OpenCodeLauncher"]
     w1["worker pane (gx00 vLLM)"]
     w2["worker pane (ollama)"]
     human --> primary
-    primary -->|"bridge_send / spawn / ask"| daemon
+    primary -->|"fleet_send / spawn / ask"| daemon
     daemon --> comp
     comp --> cc
     comp --> oc
@@ -63,6 +66,10 @@ Four concrete bake-ins assume a single tier:
 
 ## 3. Target multi-tier architecture
 
+> **SUPERSEDED fleet sketch.** Figure 2 records the former two-main model. The actual fleet is one
+> lead, two independent advisory architects, and N workers; architects are sideways peers, not leads
+> and not a tier above the lead. See Gitea issue #16 and the `architects:` block.
+
 ```mermaid
 flowchart TB
     human["human"]
@@ -73,7 +80,7 @@ flowchart TB
         m1["main A: Opus<br/>MCP client"]
         m2["main B: cloud module<br/>MCP client"]
     end
-    subgraph bus["bridged fabric (CB-307/308 substrate)"]
+    subgraph bus["fleetd fabric (CB-307/308 substrate)"]
         chan["per-agent inbox channels<br/>agent.&lt;globalId&gt;.inbox"]
         roster["federated roster (union view)"]
     end
@@ -93,10 +100,9 @@ flowchart TB
     chan --- roster
 ```
 
-*Figure 2 — three tiers. Tier 0 owns the mains' session identity + context scope; Tier 1 is a
-collaborating pair, each an MCP client with its own pull inbox; Tier 2 is peer-owned sandboxes the
-bus launches into. The middle is CB-308's per-agent-channel + federated-roster substrate, now
-carrying tier-to-tier traffic, not just host-to-host.*
+*Figure 2 — **SUPERSEDED historical fleet sketch.** It proposed a collaborating pair of managed mains.
+The actual fleet keeps one human-driven lead and uses two independent, short-lived advisory architects
+on different model families, so agreement is evidence rather than correlated echo.*
 
 The recursion is the key idea: **`orchestrator : mains :: main : workers`** — the same
 spawn/name/resume/scope verbs at two levels.
@@ -140,11 +146,11 @@ env-manager" rule (§7).*
 ```mermaid
 sequenceDiagram
     participant M as main (delegator)
-    participant D as bridged
+    participant D as fleetd
     participant SL as SandboxLauncher
     participant SB as sandbox (peer-owned)
     participant A as agent in sandbox
-    M->>D: bridge_spawn(profile=backend, role=backend)
+    M->>D: fleet_spawn(profile=backend, role=backend)
     D->>SL: spawn(SpawnRequest)
     SL->>SB: start entrypoint (image = backend role)
     Note over SL,SB: bridge injects guarded ANTHROPIC_BASE_URL,<br/>mounts bridge MCP url + reply charter
@@ -166,6 +172,11 @@ gateway, because herdr keystroke-injection needs a locally-owned PTY.**
 
 ## 5. Development B — Main-agent pairs
 
+> **SUPERSEDED — do not implement this model.** The two-main fleet was replaced by one human-driven
+> lead and two independent advisory architects. They are deliberately different model families (Claude
+> Sonnet 5 and GPT-5.6 through opencode), receive the same brief, and work independently so agreement
+> is evidence rather than correlated echo. See Gitea issue #16 and `architects:`.
+
 Both mains are MCP **clients**, so **neither can be called into** — each needs a **pull-based
 per-agent inbox**, which is precisely CB-308 item #1 (per-agent AMQP channels). The primary machinery
 that is singular today (single-slot `PrimaryRegistry`, a push-loop aimed at one terminal, "these
@@ -178,7 +189,7 @@ flowchart TB
         m2["main B: cloud module<br/>MCP client (pull-only)"]
     end
     reg["PrimaryRegistry → multi-slot<br/>(terminal per main)"]
-    subgraph fabric["bridged"]
+    subgraph fabric["fleetd"]
         ca["agent.A.inbox"]
         cb["agent.B.inbox"]
         push["ReplyPushLoop → N terminals"]
@@ -200,14 +211,14 @@ transport is already peer-neutral — what was missing is N pull endpoints).*
 ```mermaid
 sequenceDiagram
     participant MA as main A (Opus)
-    participant BR as bridged / broker
+    participant BR as fleetd / broker
     participant MB as main B (cloud)
-    MA->>BR: bridge_send(to = main B, msg)
+    MA->>BR: fleet_send(to = main B, msg)
     BR->>BR: publish agent.B.inbox (durable, msg id)
     Note over BR: held until B pulls (B is a client too)
-    MB->>BR: blocking bridge_send / poll resolves
+    MB->>BR: blocking fleet_send / poll resolves
     BR-->>MB: msg (then ACK)
-    MB->>BR: bridge_reply(to = main A)
+    MB->>BR: fleet_reply(to = main A)
     BR->>BR: publish agent.A.inbox
     MA->>BR: poll resolves
     BR-->>MA: reply
@@ -221,6 +232,19 @@ push-loop fan-out; relax "orchestration tools only the primary calls" to "any re
 
 ## 6. Development C — Orchestrator tier
 
+> **SUPERSEDED — do not implement this model.** The operator rejected a supervisor above the lead.
+> The human continues to drive the pre-existing lead directly; fleetd neither spawns nor resumes that
+> lead. What replaced this proposal is **one lead, two short-lived advisory architects, and N workers**:
+> the lead engages architects sideways for a strong-model assessment, then discards them. Architect
+> slots are declared in `architects:` (see Gitea issue #16), rather than making leads managed sessions.
+> The two architects deliberately use different model families — Claude Sonnet 5 and GPT-5.6 through
+> opencode — and receive the same brief independently. Agreement is evidence, not correlated echo
+> from one provider or one conversation.
+
+> **Historical alternative retained.** The text and figures below record the considered model and why it
+> was rejected: it re-rooted the human-facing session above the lead, violating the still-true premise
+> that configured leaders pre-exist, are recognised, and cannot be resumed by fleetd.
+
 The orchestrator is **`SessionManager` recursed one tier up**: today it spawns/names/reaps *worker*
 sessions; the orchestrator does the same for *main* sessions, and adds **context scoping**.
 
@@ -249,11 +273,10 @@ flowchart TB
     m2 -->|"scoped delegation"| w
 ```
 
-*Figure 7 — the recursion. Tiers 1 and 2 run the identical spawn/name/resume machinery; the
-orchestrator merely operates it one level higher. **Re-rooting caveat:** today the primary IS the
-human's live session; here the human drives the orchestrator, and the mains become managed,
-resumable sessions. That moves the human-facing top up a tier — an intentional re-root, not an
-add-on.*
+*Figure 7 — **SUPERSEDED historical alternative.** The recursion re-rooted the human-facing session:
+the human drove an orchestrator and the mains became managed, resumable sessions. The operator rejected
+that re-root. The replacement keeps the human-driven, pre-existing lead and engages architects sideways
+as short-lived advisory peers; see Gitea issue #16 and `architects:`.*
 
 ```mermaid
 sequenceDiagram
@@ -264,16 +287,15 @@ sequenceDiagram
     H->>O: high-level goal (large context)
     O->>O: name/resume main A session
     O->>MA: task + SCOPED context slice (not the whole history)
-    MA->>W: bridge_send(delegation, carrying only the relevant slice)
+    MA->>W: fleet_send(delegation, carrying only the relevant slice)
     W-->>MA: result
     MA-->>O: rollup
     O->>O: fold into orchestrator context, pick next main/turn
 ```
 
-*Figure 8 — context focus. The orchestrator holds the global context and hands each main only the
-slice a given delegation needs, so the main→worker conversation stays on-point. Context *scoping* is
-coordination (the bus already owns session/turn lifecycle) — it stays inside the identity boundary
-(§7), unlike toolchain ownership which does not.*
+*Figure 8 — **SUPERSEDED historical alternative.** This proposed an orchestrator holding global context
+and slicing it for managed mains. The replacement has the human-driven lead send the same advisory brief
+issue #16 and `architects:`.*
 
 **Deltas:** a second, higher `SessionManager` instance whose "peers" are mains; the orchestrator
 becomes the top MCP client; context-slice selection (new) layered on CB-303's `context_cap` +
@@ -315,7 +337,7 @@ flowchart LR
     cb402["CB-401/402<br/>Peer Launcher SPI + composite<br/>(DONE / in-flight)"]
     A["A · SandboxLauncher<br/>(placement-neutral, independent)"]
     cb308["CB-308 substrate<br/>per-agent channels + global id<br/>+ federated roster"]
-    B["B · main-agent pair<br/>(multi-slot PrimaryRegistry)"]
+    B["B · main-agent pair (SUPERSEDED)<br/>(multi-slot PrimaryRegistry)"]
     C["C · orchestrator tier<br/>(SessionManager recursed up)"]
     cb402 --> A
     cb402 --> cb308
@@ -333,7 +355,7 @@ flowchart LR
 2. **A · SandboxLauncher** — independent; a second proof of the SPI (placement-neutral). Ships anytime.
 3. **CB-308 substrate** — per-agent channels + global id + federated roster (the multi-host work,
    promoted from host-to-host to tier-to-tier).
-4. **B · main-agent pair** — multi-slot `PrimaryRegistry` + per-main inbox routing, on the substrate.
+4. **B · main-agent pair** — **SUPERSEDED** by lead + two advisory architects.
 5. **C · orchestrator tier** — the capstone; the recursive session manager + context scoping.
 
 ## 9. Open questions (to resolve at ticket-split)
@@ -341,8 +363,8 @@ flowchart LR
 - **Sandbox mechanism:** container (`docker exec`) vs devcontainer — how the role→image mapping is
   expressed on the profile. *(Topology **resolved** in §11: distributed = gateway-per-host × local
   sandboxes; the remaining choice is only the local launch mechanism, not the shape.)*
-- **Pair semantics:** are the two mains fully symmetric peers, or is one a co-primary that may also
-  delegate? Affects how `PrimaryRegistry` and the "orchestration tools" identity relax.
+- **Pair semantics:** **SUPERSEDED.** The two-main question is replaced by the architect role's
+  least-privilege boundary: advisory architects can send/reply/ask/read but cannot spawn/stop/drain.
 - **Orchestrator drivenness:** the mains become programmatically spawned/resumed — does the human
   still ever type directly into a main, or only into the orchestrator? (The re-root caveat, Fig 7.)
 - **Context-slice selection:** who decides the slice — orchestrator heuristics, explicit tool args,
@@ -363,7 +385,7 @@ ticket is an extension of an existing pattern (CB-402 for A, CB-308 for B/C).
 
 The follow-up question — *"clarify the architecture when we have distributed agents in sandboxes"* —
 resolves the fork left open in §4 and §9. **Decision: Development A (sandbox launcher) and CB-308
-(per-host federation) *compose*, not compete — each host runs a `bridged` gateway whose launcher
+(per-host federation) *compose*, not compete — each host runs a `fleetd` gateway whose launcher
 spawns agents into that host's *local* sandboxes.** A sandbox is never reached across the network; it
 is reached by the gateway sitting next to it.
 
@@ -371,7 +393,7 @@ is reached by the gateway sitting next to it.
 
 The bus delivers a turn by **herdr keystroke-injection** — `Injector → AgentControl.send` writes into
 a PTY that its **local** herdr owns. The broker moves *messages and presence*, **never keystrokes**.
-So an agent's PTY must live in a herdr that *some* `bridged` instance drives locally: a remote
+So an agent's PTY must live in a herdr that *some* `fleetd` instance drives locally: a remote
 container with no local herdr **cannot be injected into**. That rules out a central daemon reaching
 remote PTYs, and collapses the design to a single identity:
 
@@ -381,7 +403,7 @@ remote PTYs, and collapses the design to a single identity:
 flowchart TB
     subgraph hostA["HOST A — gateway"]
         mA["main / orchestrator<br/>MCP client → LOCAL gateway"]
-        gA["bridged A<br/>herdr + CompositePeerLauncher<br/>(incl. SandboxLauncher)"]
+        gA["fleetd A<br/>herdr + CompositePeerLauncher<br/>(incl. SandboxLauncher)"]
         cBEa["sandbox: backend<br/>(local container)"]
         cFEa["sandbox: frontend<br/>(local container)"]
         mA --- gA
@@ -393,7 +415,7 @@ flowchart TB
         roster["roster.* (federated presence)"]
     end
     subgraph hostB["HOST B — gateway"]
-        gB["bridged B<br/>herdr + SandboxLauncher"]
+        gB["fleetd B<br/>herdr + SandboxLauncher"]
         cBEb["sandbox: backend<br/>(local container)"]
         gB -->|"spawn → PTY in B's herdr"| cBEb
     end
@@ -418,13 +440,13 @@ sequenceDiagram
     participant BR as broker
     participant GB as gateway B
     participant SB as sandbox agent (host B, container)
-    MA->>GA: bridge_send(globalId on B, msg)
+    MA->>GA: fleet_send(globalId on B, msg)
     GA->>GA: directory lookup - is globalId local? NO
     GA->>BR: publish agent.ID.inbox (durable)
     BR->>GB: route to the owning gateway
     GB->>SB: inject via B's LOCAL herdr (keystrokes)
     Note over GB,SB: SandboxLauncher already spawned the container -<br/>its PTY is in B's herdr, CB-306 readiness passed
-    SB-->>GB: bridge_reply (to B's LOCAL MCP endpoint)
+    SB-->>GB: fleet_reply (to B's LOCAL MCP endpoint)
     GB->>BR: publish primary-bound (durable, msg id)
     BR->>GA: route back to A
     Note over GA: held until the main pulls (the main is a client)
@@ -448,7 +470,7 @@ unchanged — the sandbox is transparent to it.*
 
 | Concern | Provided by |
 |---|---|
-| Per-host gateway (owns local herdr + sessions) | **CB-308** (today's `bridged`, evolved) |
+| Per-host gateway (owns local herdr + sessions) | **CB-308** (today's `fleetd`, evolved) |
 | Spawn into a local sandbox / role→image | **Development A** `SandboxLauncher` (§4), routed by `CompositePeerLauncher` |
 | Addressing a remote sandboxed agent | **CB-308** global id + federated roster (host + role as metadata) |
 | Orphan reap after a gateway restart | **CB-117** per-gateway, summed by the composite — each reaps only its **local** herdr |

docs/CB-591-Gateway-Migration.md

@@ -0,0 +1,485 @@
+# CB-591 — move the fleet onto the LLM and MCP gateway
+
+**Status: DONE — the fleet is on the gateway as of 2026-08-15.** `local` runs on `/anthropic` and
+`gx` on `/v1`, both at `weight: 100`; `local-direct` stays at `weight: 0` as the escape hatch. Getting
+here took a revert and two upstream fixes — see §7.1, which is the useful part of this document. One
+risk is **accepted rather than solved**: a stream cut by any mid-response timer arrives as HTTP 200
+with no terminator, and our third-party members cannot detect it (§7.2).
+
+> **Superseded in part — 2026-09-13.** Two claims on this page are no longer true of the live fleet.
+> I measured both on this host today.
+>
+> 1. **The model is named `acoder` now, not `deepseek-v4-flash`.** `acoder` is a stable alias, and
+>    the model behind it changed on 2026-08-28: it is Qwen3.8-27B, not DeepSeek. The old name is
+>    still served, so nothing broke — the gateway answers it and reports `"model": "acoder"` in the
+>    reply, which is how you can see for yourself that it is an alias. `fleetd.yaml` moved to
+>    `acoder` on 2026-09-13. Do not guess behaviour from the name; ask the gateway's own manifest,
+>    `GET https://llm.ltms.dev/v1/deployment`, and read its `generation` field.
+> 2. **`local` sits at `weight: 0`, not 100.** Only `gx` is auto-selected today.
+>
+> §2 and §3 below are the plan as written in August. They are the record of the migration, so they
+> stay as they are. If this note stops matching `fleetd.yaml`, re-measure and rewrite the note.
+
+· **Upstream:** [systems/vms wiki → LLM and MCP Gateway](https://git.ltms.dev/systems/vms/wiki/LLM-and-MCP-Gateway)
+· **Upstream issue:** [systems/vms#31](https://git.ltms.dev/systems/vms/issues/31)
+
+The gateway went live on 2026-08-15 and replaced Bifrost. This plan says what that means for a
+**member definition** in `fleetd.yaml`, because that is the part of this repo the change actually
+touches.
+
+---
+
+## 1. What changed upstream
+
+One front door for every LLM and MCP client: `https://llm.ltms.dev`, one token per consumer.
+
+| Surface | URL |
+|---|---|
+| OpenAI chat | `https://llm.ltms.dev/v1/chat/completions` |
+| OpenAI models | `https://llm.ltms.dev/v1/models` |
+| **Anthropic messages** | `https://llm.ltms.dev/anthropic/v1/messages` |
+| MCP, all servers multiplexed | `https://llm.ltms.dev/mcp` |
+
+Anything outside that list returns **404 before any token is checked**, on purpose — the gateway must
+never become a blanket proxy.
+
+The model backend is unchanged: GX10 vLLM at `10.10.10.26:8000` (`gx00.gw`), model name exactly
+`deepseek-v4-flash`. The direct LAN path stays open on purpose as an escape hatch.
+
+---
+
+## 2. Where claude-bridge sits today
+
+We do **not** use the gateway. The `local` profile talks straight to the vLLM:
+
+```yaml
+local:
+  kind: claude-code
+  baseUrl: http://gx00.gw:8000     # direct vLLM — no auth, LAN only
+  model: deepseek-v4-flash
+  configDir: /Users/dai.ha/.ccs/instances/gx10
+```
+
+Three facts about our side that decide the shape of this work:
+
+1. **`baseUrl` becomes `ANTHROPIC_BASE_URL`** in the member's environment, and `tokenEnv` becomes
+   `ANTHROPIC_AUTH_TOKEN` (the value is read from a host env var and never stored in config).
+   `local` sets no `tokenEnv` today, because a direct vLLM needs no token.
+2. **`SubscriptionGuard` refuses any host not on an allowlist**, and that allowlist is
+   `guard.offSubscriptionHosts: [gx00.gw]`. It is built once in `Fleetd.java:93` and handed to the
+   launcher, so **it is a restart-required key**, not a hot one. Changing `baseUrl` without changing
+   this makes every `local` spawn throw.
+3. **The wiki names us as a blocker.** Under *Not done yet*: retiring the shared `legacy` token is
+   blocked because "kb, brain, **claude-bridge** and the workstation still share it. Each needs its
+   own consumer first."
+
+Context7 is mounted twice today, both times straight at `https://ct7.ltms.dev/mcp` — once in
+`.mcp.json` (the primary) and once in `opencode.json` (the `sol` and `terra` members).
+
+```mermaid
+flowchart LR
+    subgraph now["Today"]
+        M1["local member<br/>claude-code"] -->|"ANTHROPIC_BASE_URL"| V1["vLLM gx00.gw:8000<br/>no auth, LAN only"]
+        M2["sol / terra<br/>opencode"] --> CT1["ct7.ltms.dev/mcp"]
+        P1["primary"] --> CT1
+    end
+    subgraph after["Proposed"]
+        M3["local member"] -->|"ANTHROPIC_BASE_URL<br/>+ ANTHROPIC_AUTH_TOKEN"| G["llm.ltms.dev/anthropic<br/>consumer: claude-bridge"]
+        G --> V2["vLLM gx00.gw:8000"]
+        M4["local-direct<br/>weight 0, escape hatch"] --> V2
+    end
+```
+
+*The member definition is the only thing that moves. The model behind it does not.*
+
+---
+
+## 3. The member definition change
+
+The gateway serves an Anthropic surface *and* an OpenAI surface, so **both member kinds can point at
+it**. That is the main opportunity here, and it is bigger than the `local` profile alone.
+
+### 3a. `local` — claude-code, on `/anthropic`
+
+| Key | Today | After | Note |
+|---|---|---|---|
+| `baseUrl` | `http://gx00.gw:8000` | `https://llm.ltms.dev/anthropic` | see the schema warning below |
+| `tokenEnv` | *(unset)* | `AI_GATEWAY_TOKEN` | new consumer token, `llmk-claude-bridge-<32 hex>` |
+| `model` | `deepseek-v4-flash` | unchanged | must stay **exact**; a regex match returns an empty `/v1/models` while completions keep working |
+| `guard.offSubscriptionHosts` | `[gx00.gw]` | `[gx00.gw, llm.ltms.dev]` | **restart required** |
+
+### 3b. A new opencode profile on `/v1` — no code needed
+
+`OpenCodeLauncher` already supports a pinned OpenAI-compatible endpoint (CB-508). Given `baseUrl` it
+writes a custom provider block into the worker's opencode config:
+
+- `baseUrl` → `options.baseURL`. `openAiBaseUrl` appends `/v1` to a bare host, and takes a URL that
+  already has a path **as-is** — so `https://llm.ltms.dev/v1` works unchanged.
+- `tokenEnv` → `options.apiKey` (falls back to a placeholder when unset, since a local vLLM ignores it).
+- `model:` **must** be `<provider>/<model>` when `baseUrl` is set — a bare name is rejected loudly
+  rather than silently falling back to opencode's default gateway.
+
+So the profile is pure config:
+
+```yaml
+gx:
+  kind: opencode
+  baseUrl: https://llm.ltms.dev/v1
+  tokenEnv: AI_GATEWAY_TOKEN
+  model: gx/deepseek-v4-flash        # provider id is ours to choose; the half after / is the model
+  argv: ["opencode"]
+  mcpUrl: http://127.0.0.1:8765/mcp
+  gitTokenEnv: WORKER_GITEA_TOKEN
+  weight: 100                        # same tier as `local` — free
+  maxLoad: 2
+  # deliberately NO credentialId — this is our own box, not the shared OpenAI account
+```
+
+**Why this matters more than it looks.** Today every opencode member is `sol` or `terra`, and those
+are two models on **one** OpenAI account sharing `credentialId: openai-shared` — so an exhaustion on
+either locks out both, and half the fleet's opencode capacity dies at once. A gateway-backed opencode
+profile is free, is not on that credential, and therefore is not in that quarantine pair. It removes
+a single point of failure rather than just adding capacity.
+
+**Note the asymmetry, it is deliberate:** `SubscriptionGuard` does not apply to opencode at all — the
+guard exists to stop a *Claude* worker borrowing the operator's subscription, and opencode reads its
+own provider credentials. So 3b needs **no allowlist change**; only 3a does.
+
+**Both still need a restart, for a different reason.** `tokenEnv` is resolved by
+`HerdrPeerLauncher.resolveEnv` → `env.apply(name)`, which reads the **daemon's own process
+environment**. The running `fleetd` inherited its environment when it started, so a variable added to
+`secrets.sh` afterwards is simply not there — the launcher would inject an empty token and the
+gateway would answer 401. This is the same failure as trap 1 in `scripts/redeploy-fleetd.sh`
+(`WORKER_GITEA_TOKEN`), and it has the same fix: **restart from a login shell**, and use
+`scripts/redeploy-fleetd.sh --check` to confirm the name resolves before restarting anything.
+
+### 3c. What this does to `ccs`
+
+Once a profile carries `baseUrl`, `tokenEnv` and `model` itself, the ccs instance stops being what
+routes a member. Be precise about what is left, though: `configDir` still supplies **folder trust**
+and `settings.json`, and dropping it is what produced the trust dialog and the wrong-model error
+recorded in `fleetd.yaml`. So ccs goes from *deciding where the tokens go* to *holding client-side
+state*. Less load-bearing, not removable.
+
+### Why `/anthropic` and never `/v1/chat/completions`
+
+The gateway declares its Anthropic backend as `schema.name: Anthropic`, which means **no
+translation** — streaming, tool use and thinking blocks pass through exactly as they do against vLLM
+directly.
+
+Declared as `OpenAI`, Envoy's translator looks for a `thinking_blocks` field that our vLLM does not
+send (it sends `reasoning_content`), and **every thinking delta disappears silently**. Claude Code
+speaks the Anthropic protocol, so `/anthropic` is both correct and the only safe choice.
+
+This is the exact failure shape this repo keeps hitting: it compiles, it answers, it looks healthy,
+and a capability is quietly off. Treat it as a `silent-default` risk, not a config preference.
+
+**Open question for 3b — ANSWERED, 2026-08-15.** The worry was that the OpenAI surface might drop
+reasoning the way the wiki documents for a mis-declared Anthropic backend. It does not. Checked at
+the API before any profile was switched:
+
+| surface | request | result |
+|---|---|---|
+| `/anthropic/v1/messages` | `deepseek-v4-flash`, 64 tokens | 200, response carries a real `"type":"thinking"` block |
+| `/v1/chat/completions` | same | 200, message carries a populated `reasoning_content` (and a `reasoning` field) |
+| `/v1/models` | — | 200, exactly `["deepseek-v4-flash"]` — the exact-name trap is clear |
+| `/v1/models`, **no token** | — | **401** — Caddy is gating, as designed |
+
+So reasoning survives on **both** surfaces, and the `/anthropic` choice for `local` is about protocol
+correctness rather than a repair for a known loss. The last row matters on its own: the wiki warns
+the gateway's own `SecurityPolicy` fails open, so it is worth knowing the proxy in front really does
+refuse an unauthenticated request here.
+
+---
+
+## 4. Decisions
+
+### D1 — switch, but keep the direct path as an explicit profile · **recommended**
+
+Switching buys four things we do not have:
+
+- **Free opencode capacity, off the shared credential.** The largest single win. See §3b — it retires
+  a real single point of failure, not just a cost line.
+- **Per-consumer usage figures.** The cockpit counts requests per consumer. That is the first real
+  measurement of what the fleet consumes, and it feeds [CB-589](https://git.ltms.dev/fleet/fleetd/issues/74) Gap 2 directly.
+- **Our own revocable token.** One consumer to revoke if a worker ever leaks it, instead of a shared
+  `legacy` token used by four systems.
+- **It works off-LAN.** `gx00.gw` resolves on the LAN only.
+
+The cost is honest and worth stating: we add a TLS edge, an auth proxy and a gateway to the path of
+every member spawn. The wiki keeps the direct route open precisely because "if the gateway breaks,
+nothing that matters is blocked."
+
+So keep it. Add a second profile `local-direct` pointing at `http://gx00.gw:8000` with **`weight: 0`**
+— never auto-selected, still spawnable with an explicit `fleet_spawn{profile: "local-direct"}`.
+That is exactly what CB-554 made `weight: 0` mean, and it turns the escape hatch into something the
+lead can actually reach during an incident.
+
+### D2 — do members also mount the gateway's `/mcp`? · **OPEN, operator's call**
+
+Not a detail. `CLAUDE.md` states in two places that a member mounts **only** the bridge MCP, and a
+worker's honesty rule leans on it ("never claim the result of a check you had no way to run").
+
+- **Keep bridge-only.** The invariant stays true and simple. Workers stay cheap and narrow.
+- **Add the gateway MCP.** Implementers get context7 documentation lookups, which is genuinely useful
+  for library work. But `mcpUrl` in `FleetConfig.Profile` is a **single `String`**, so a
+  claude-code member can mount exactly one MCP — this needs a code change, not a config edit.
+
+Note the invariant is **already inaccurate**: `opencode.json` gives `sol` and `terra` both context7
+and gitea. So the choice is really "make the rule true" or "make the rule match reality". Either is
+defensible; picking one is not mine to do.
+
+### D3 — token scope
+
+One consumer, `claude-bridge`, its token in `${SHARED_ENV}/tools/secrets.sh` as `AI_GATEWAY_TOKEN`,
+referenced by name only. Never the literal value in `fleetd.yaml` — `tokenEnv` exists for this.
+
+---
+
+## 5. Units of work
+
+```mermaid
+flowchart TB
+    U1["U1 · consumer token<br/>issue via cockpit, add to secrets.sh"]
+    U2["U2 · profile + guard<br/>fleetd.yaml, restart"]
+    U3["U3 · verify live<br/>spawn, prove thinking survives"]
+    U4["U4 · context7 via gateway<br/>.mcp.json + opencode.json"]
+    U5["U5 · docs<br/>CLAUDE.md, wiki 11-Features"]
+    U1 --> U2 --> U3
+    U4 --> U5
+    U3 --> U5
+```
+
+| # | Scope | Who | Why |
+|---|---|---|---|
+| U1 | Issue the `claude-bridge` consumer at `auth.ltms.dev`; store as `AI_GATEWAY_TOKEN` | **operator** | touches secrets and a host we do not own |
+| U2a | New `gx` opencode profile on `/v1` — pure config, no guard change | **lead** | `fleetd.yaml` is gitignored, so a worker cannot see or edit it |
+| U2b | `local` → `/anthropic`; add `local-direct` weight 0; add `llm.ltms.dev` to the guard allowlist | **lead** | same |
+| U2c | One restart from a **login shell**, after U2a and U2b | **lead** | picks up `AI_GATEWAY_TOKEN` into the daemon env *and* the guard allowlist, in one stop |
+| U3 | Live spawn on both new profiles; confirm reasoning survives on each surface | **lead** | needs real spawns and the running daemon |
+| U4 | Point `.mcp.json` and `opencode.json` context7 at the gateway `/mcp`; rename pinned tools | delegatable | tracked files, self-contained |
+| U5 | Fix the "members mount only the bridge" claim; add a `wiki/11-Features.md` entry | delegatable | writing, clear criteria |
+
+U1 blocks U2a, U2b and U3. U4 and U5 do not depend on it.
+
+**Write U2a and U2b, then restart once (U2c), then verify `gx` before `local`.** Since both profiles
+need the same restart there is no reason to do two, but there is still a reason to *verify* in order:
+`gx` exercises the token and the gateway with no guard involved, so if it fails the cause is upstream.
+`local` adds the guard allowlist on top, so a failure there points at our config instead. Testing them
+in that order separates the two causes instead of confusing them.
+
+> **U1 status, 2026-08-15:** the operator issued the consumer and exported it as `AI_GATEWAY_TOKEN`
+> (one key for every agent and MCP client behind `llm.ltms.dev`). Confirmed: it resolves in a login
+> shell, is 48 characters and carries the documented `llmk-` prefix. The value was never printed.
+
+---
+
+## 6. Traps carried over from the wiki
+
+Each of these cost someone real debugging time upstream. They apply to us.
+
+1. **Rotating a token restarts the auth proxy, which drops in-flight streaming responses.** For us
+   that means rotating `AI_GATEWAY_TOKEN` kills every live member mid-turn, and an async ticket's
+   report goes with it. This is the same rule as a daemon redeploy: **drain the fleet first**
+   (`fleet_list` → `fleet_poll` anything wanted → `fleet_stop`), then rotate.
+2. **The gateway's own `SecurityPolicy` fails open.** Standalone `aigw run` accepts it and silently
+   ignores it — an unauthenticated request returned **200**. Auth is the Caddy proxy in front, and
+   nothing else. Never reason as if the gateway authenticates.
+3. **Exact model name.** A regex match routes fine but returns an **empty** `/v1/models` list while
+   completions keep working. A wrong name returns a bare 404 that reads exactly like a dead gateway.
+4. **MCP tool names changed prefix separator.** Bifrost used one dash (`ct7-resolve-library-id`); the
+   gateway uses **two underscores** (`ct7__resolve-library-id`). Relevant only if U4 is done.
+5. **`/v1/models` 404 vs empty list are different faults.** 404 means no route loaded at all; empty
+   means the model match is a regex. Do not conflate them when diagnosing.
+
+---
+
+## 7. Verification — what would prove this works
+
+Merging config is not proving it. The checks, in order:
+
+1. `fleet_spawn{profile: "gx"}` succeeds and the member completes a real turn ending in
+   `fleet_reply`. This is the first proof of the token, the URL and the model name, and it risks
+   nothing the fleet depends on.
+2. `fleet_spawn{profile: "local"}` succeeds. If the guard allowlist was missed, this **throws** — a
+   loud, self-correcting failure, which is the good kind. If the restart was missed, it also throws,
+   for the same reason.
+3. A `local` member completes a turn. That exercises streaming through two TLS edges, the auth proxy
+   and the gateway.
+4. **Reasoning survives, checked separately on each surface.** For `local` on `/anthropic` this is
+   the check that catches the `/v1` versus `/anthropic` mistake, and it is the only one that does —
+   nothing else distinguishes a working passthrough from a translator quietly dropping thinking
+   deltas. For `gx` on `/v1`, this answers the open question in §3 rather than assuming it.
+5. The cockpit at `auth.ltms.dev` shows requests counted against the `claude-bridge` consumer, not
+   `legacy`. That is the whole point of taking our own token.
+6. `fleet_spawn{profile: "local-direct"}` still works, so the escape hatch is real rather than
+   theoretical.
+7. `fleet_list` shows `gx` carrying no `credentialId`, so a `sol`/`terra` exhaustion cannot
+   quarantine it. This is the single-point-of-failure claim in §3b, checked rather than asserted.
+
+---
+
+## 7.1 What the live run actually found — 2026-08-15
+
+U1–U2c were done, the daemon restarted onto them, and both new profiles were spawned for real. The
+migration was then **reverted**. This section is the result, so none of it has to be re-derived.
+
+### The blocker
+
+`llm.ltms.dev` answers **HTTP 413 Request Entity Too Large** above **32 KiB (32768 bytes)**, on both
+surfaces:
+
+```
+/v1        32695 bytes -> 200        /anthropic  32095 bytes -> 200
+/v1        32795 bytes -> 413        /anthropic  32855 bytes -> 413
+```
+
+32 KiB is far below one real agent turn.
+
+**Root cause — confirmed by the systems/vms side, 2026-08-15.** My guess that it was a Caddy
+`request_body max_size` was **wrong**. It is Envoy, inside `aigw` on `llm.vm`. Envoy Gateway defaults
+a listener's `per_connection_buffer_limit_bytes` to **32768**, and the AI Gateway buffers the *whole*
+request body before it can route on the model name — so that default is not a network tuning knob
+here, it is a hard ceiling on prompt size. Read out of the live Envoy `config_dump`:
+
+```
+listener default/llm/http    per_connection_buffer_limit_bytes: 32768
+```
+
+Nobody chose 32 KiB; it was inherited from the default. Both TLS edges are innocent: the same
+boundary reproduces on the LAN path and the internet path, and both 413s carry an `x-llm-consumer`
+header their auth proxy sets only *after* authenticating — so the body cleared both edges and the
+auth. Directly on `llm.vm`, `aigw` 413s at 39 KB while the vLLM backend accepts the same 39 KB and
+answers 200.
+
+**Do not plan around 32 KiB.** The intended ceiling is far higher. Their fix — a `ClientTrafficPolicy`
+setting `bufferLimit: 8Mi` — is written but **not deployed** as of this note, pending their operator's
+approval. I have not re-tested and will not until they confirm, so as not to measure a half-changed
+system. Fixed in **systems/vms**, not here.
+
+### The part worth remembering
+
+Two members were spawned at the same moment with the same message:
+
+| | `local` (claude-code, `/anthropic`) | `gx` (opencode, `/v1`) |
+|---|---|---|
+| READY → BUSY | 19:07:26 | 19:07:45 |
+| BUSY → DONE | **19:08:51 (66s)** | **never — 10+ min, ticket FAILED** |
+
+**`local` passed.** It passed only because the probe was three trivial questions in a fresh session,
+so the request fit under 32 KiB. The profile looked healthy and was a landmine set to fire on the
+first turn that reads a file.
+
+So §7's checklist was not wrong, it was **too easy**. Any future run of it must use a task that reads
+a real file. A liveness probe proves the token and the URL; it does not prove the path.
+
+`gx` did not fail loudly either. Reproduced outside the bridge by running `opencode` by hand with the
+launcher's own generated config:
+
+```
+Error: Request Entity Too Large
+...compacts context, retries...
+Error: Request Entity Too Large
+```
+
+opencode **catches the 413, compacts, and retries — indefinitely**. A member that fails loudly costs
+one turn; this one costs the whole task and is indistinguishable from a slow worker.
+
+> **Diagnosing a stuck opencode member.** Do not read its pane. The launcher writes its config to a
+> temp dir and passes it as `OPENCODE_CONFIG` — find it with
+> `ls -dt /var/folders/*/*/T/fleetd-opencode-* | head -1`, check the provider block and the key's
+> length and prefix (never its value), then reproduce with `opencode run --auto -m <provider>/<model>`
+> using the same `OPENCODE_CONFIG`. That is what turned "it hangs" into a one-line error.
+
+### What checked out, and needs no re-testing
+
+- Token accepted on both surfaces. **Unauthenticated → 401**, so the Caddy proxy really does gate —
+  the wiki's "SecurityPolicy fails open" warning is about the gateway itself, not the edge.
+- `/v1/models` returned exactly `["deepseek-v4-flash"]` **on 2026-08-15**, so trap 3 was clear
+  then. It returns 6 ids now — `acoder`, `qwen3.8-27b-nvfp4`, `deepseek-v4-flash` and three
+  embedding names — measured on this host 2026-09-13. The exact-name rule still holds; the
+  one-item list does not.
+- **Reasoning survives both surfaces** — see §3b above.
+- The launcher's generated opencode provider block is correct, carrying a real 48-character `llmk-`
+  key rather than the `fleetd-local-noauth` placeholder.
+- `SubscriptionGuard` accepted `llm.ltms.dev` after the allowlist edit and the restart: `local`
+  spawned without throwing, which is the check that catches a missed restart.
+
+### Resolution — both ceilings fixed, migration completed
+
+systems/vms fixed both, and each was re-checked from this side rather than taken on trust:
+
+| ceiling | was | now | our own check |
+|---|---|---|---|
+| listener buffer | 32 KiB | 32 Mi | 1.2 MB body → **200** (was 413) |
+| LLM route timeout | 60s | 86400s | the request that truncated: **101s, `message_stop` present, 4000/4000** |
+
+The timeout moved in two steps on 2026-08-15: 60s → 1800s, then 1800s → **86400s (24 hours)** after
+the truncation risk below was discussed. They tried `request: 0s` first, which removes the
+total-duration timer completely. It works, but on an `AIGatewayRoute` the **idle timeout is derived
+from the request timeout**, so `0s` also removed any bound on a stalled connection. 86400s keeps a
+reaper for dead connections while putting the truncation timer out of practical reach.
+
+Neither was deliberate. The 32 KiB was Envoy Gateway's default `per_connection_buffer_limit_bytes`;
+the 60s was Envoy AI Gateway's own documented default. The 60s bounded **generation** as well as
+prompt size — a tiny prompt with a long answer returned 504 at 60.05s.
+
+Two configuration facts worth keeping, from their bisection:
+
+- **`ClientTrafficPolicy` is honoured in standalone `aigw run`; `BackendTrafficPolicy` is NOT.** A
+  `BackendTrafficPolicy` setting `requestTimeout` is accepted, logs nothing, and leaves the routes
+  unchanged (upstream `envoyproxy/gateway#9513`). What works is `timeouts: {request: …}` on each
+  `AIGatewayRoute` rule. Nothing from the outside distinguishes the two — the same silent-default
+  shape as their `SecurityPolicy` caveat.
+- In that stack, "the config was accepted" proves nothing. Read the live `config_dump`.
+
+## 7.2 The risk we accepted, and why we could not remove it
+
+Raising the timeout made the failure **rare, not impossible**, and the residual failure is silent.
+
+On a mid-response timeout over chunked HTTP/1.1, Envoy ends the chunked encoding *cleanly* instead of
+resetting the connection, so the client receives what looks like a complete transfer
+(`envoyproxy/envoy#17186` — acknowledged as a bug in 2021, closed by a stale bot, never fixed). The
+December 2025 fix `envoyproxy/envoy#42269` changes locally-originated resets from `NO_ERROR` to
+`INTERNAL_ERROR`, but it is **HTTP/2 only** and SSE clients here speak HTTP/1.1.
+
+Measured on our side while the timeout was still 60s:
+
+```
+HTTP 200   61.07s   141992 bytes
+  message_stop 0    message_delta 0    error events 0
+  emitted 2473 of 4000, ending on a WELL-FORMED SSE frame
+```
+
+A syntactically valid stream that simply stops. Any timer firing mid-stream — route timeout, idle
+timeout, `max_stream_duration` — fails this same way.
+
+**The recommended defence does not transfer to us.** The right fix is to treat a stream with no
+`message_stop` / `[DONE]` / `finish_reason` as failed. We cannot: our members are Claude Code and
+opencode, third-party clients whose SSE parsing we do not own, and there is no seam to insert the
+check. Whether either detects a missing terminator is unverified — and opencode's handling of the 413
+(swallow, compact, retry forever, never surface an error) does not suggest it is strict.
+
+So the honest statement of our position:
+
+> Gateway traffic is acceptable at 86400s because a single request would have to run for 24 hours to
+> trip the bug — **not** because we could detect it if it did.
+
+At 86400s our **own** limit binds first, which is the ordering we want. `MessageService.ASYNC_TIMEOUT_MS`
+caps a turn at 30 minutes, so a runaway request ends as a clean `FAILED` ticket that we raised, rather
+than as a silently truncated `200` that we cannot see. While the gateway sat at 1800s the two numbers
+were equal and did not nest, so a gateway-side stall could have been misread as a bug in our own ticket
+handling. That ambiguity is now gone.
+
+**If a member ever returns a confident but truncated answer, suspect this before anything in our own
+code.** That is the whole reason this section exists.
+
+---
+
+## 8. Related
+
+- [CB-589 / #74](https://git.ltms.dev/fleet/fleetd/issues/74) — cost-first placement and a
+  gateway that reports live capacity. The per-consumer figures this migration unlocks are the first
+  input that ticket actually needs.
+- `docs/CB-500-Multi-Tier-Coordination.md` §11 — the distributed-sandbox topology this gateway is
+  part of.

docs/CB-5xx-Hardening.md

@@ -12,12 +12,12 @@ not after it.
 
 ## 1. Why this stage is not optional bookkeeping
 
-`bridged` today has **exactly one security control: the loopback bind**. Every other guarantee
+`fleetd` today has **exactly one security control: the loopback bind**. Every other guarantee
 rests on it.
 
 The identity model (`mcp/ConnectionIdentity.java`) resolves a caller from the connection alone —
 the OS reports the connecting PID, herdr owns the PID→pane map, so a worker cannot forge another
-worker. Its own javadoc is explicit: *"Single-host only (the herd shares the `bridged` host); the
+worker. Its own javadoc is explicit: *"Single-host only (the herd shares the `fleetd` host); the
 token path is the split-host fallback."* The token path does not exist yet.
 
 That leaves a seam that is **latent today and load-bearing the moment the bind moves**:
@@ -67,7 +67,7 @@ it will be disabled and the stage is wasted. So:
 auth:
   mode: loopback-trust   # default — behaves exactly like today: loopback ⇒ PRIMARY, no token needed
   # mode: token          # every non-worker caller must present a valid bearer token
-  # tokenEnv: BRIDGED_API_TOKEN   # host env var holding the token; never the literal value
+  # tokenEnv: FLEETD_API_TOKEN   # host env var holding the token; never the literal value
 ```
 
 `mode: loopback-trust` is the current behaviour, named honestly and now *chosen* rather than
@@ -112,9 +112,9 @@ The roadmap says "systemd unit". **This host is macOS — there is no systemd on
 not found), and the daemon that has been dogfooded for weeks runs as a bare foreground
 `java -jar`. Ship **both**:
 
-- `deploy/dev.ltms.bridged.plist` — launchd agent, the *actual* runtime here, with `KeepAlive` and
+- `deploy/dev.ltms.fleet.plist` — launchd agent, the *actual* runtime here, with `KeepAlive` and
   ordered start after herdr.
-- `deploy/bridged.service` — systemd unit for the Linux gateways CB-308 introduces.
+- `deploy/fleetd.service` — systemd unit for the Linux gateways CB-308 introduces.
 
 Ordering after herdr is advisory in both: the herdr socket may not exist at boot, so the daemon
 must **retry the socket rather than exit** — supervision ordering is a nicety, socket-retry is the
@@ -158,10 +158,10 @@ configured. It already leaks nothing but herdr's version and up/down.
 ### 3.1 There are TWO entry paths, and only one of them has identity today
 
 The wiki describes MCP as "a thin adapter over the REST core". **At the code level that is not
-literally true, and the difference is security-relevant.** `BridgeMcp` calls `MessageService` /
+literally true, and the difference is security-relevant.** `FleetMcp` calls `MessageService` /
 `SessionManager` *directly*; it never issues an HTTP request against a Javalin route. And `/mcp` is
 mounted as a raw servlet on Jetty's `ServletContextHandler`
-(`BridgedApp.build → cfg.jetty.modifyServletContextHandler`), so it does **not** pass through
+(`FleetApp.build → cfg.jetty.modifyServletContextHandler`), so it does **not** pass through
 Javalin's `before` filters at all.
 
 The current split is the mirror image of what you'd expect:
@@ -172,7 +172,7 @@ The current split is the mirror image of what you'd expect:
 | REST routes | ❌ **none at all** — the session id is taken from the URL path and trusted | ❌ none |
 
 So REST is the *more* exposed surface: `POST /sessions/{id}/reply` accepts any `{id}` from the
-path, whereas the MCP `bridge_reply` derives the worker from the connection and refuses to read it
+path, whereas the MCP `fleet_reply` derives the worker from the connection and refuses to read it
 from an argument. Loopback-only bind is what makes this safe today.
 
 **Therefore CB-505 must enforce on both paths against one shared resolver** — not at a single
@@ -188,15 +188,15 @@ Deliberately small; every one maps to a failure mode we have actually hit.
 
 | Metric | Type | Why it exists |
 |---|---|---|
-| `bridged_sends_total{outcome}` | counter | outcome ∈ replied\|completion_fallback\|timeout\|failed — the completion-fallback rate is the health signal for turn detection (CB-115/116/118) |
-| `bridged_send_duration_seconds` | histogram | delegated turn latency |
-| `bridged_replies_total{path}` | counter | path ∈ rendezvous\|inbox — how often a reply strands (CB-307's whole reason to exist) |
-| `bridged_inbox_depth{target}` | gauge | undrained replies; steady-state should be 0 |
-| `bridged_push_nudges_total{outcome}` | counter | outcome ∈ delivered\|exhausted — a rising `exhausted` means the primary is not draining |
-| `bridged_spawns_total{kind,outcome}` | counter | outcome ∈ ready\|timeout\|guard_rejected; per peer kind (CB-402) |
-| `bridged_sessions{state}` | gauge | SPAWNING/READY/BUSY/DONE census |
-| `bridged_herdr_calls_total{method,outcome}` | counter | socket health — the dependency everything rests on |
-| `bridged_auth_failures_total{reason}` | counter | only meaningful once CB-501 lands; catches misconfigured workers |
+| `fleet_sends_total{outcome}` | counter | outcome ∈ replied\|completion_fallback\|timeout\|failed — the completion-fallback rate is the health signal for turn detection (CB-115/116/118) |
+| `fleet_send_duration_seconds` | histogram | delegated turn latency |
+| `fleet_replies_total{path}` | counter | path ∈ rendezvous\|inbox — how often a reply strands (CB-307's whole reason to exist) |
+| `fleet_inbox_depth{target}` | gauge | undrained replies; steady-state should be 0 |
+| `fleet_push_nudges_total{outcome}` | counter | outcome ∈ sent\|exhausted — a rising `exhausted` means the primary is not draining. `sent` was called `delivered` until fleetd #365; it counts the herdr paste-and-submit call returning, never a confirmation the pane read it |
+| `fleet_spawns_total{kind,outcome}` | counter | outcome ∈ ready\|timeout\|guard_rejected; per peer kind (CB-402) |
+| `fleet_sessions{state}` | gauge | SPAWNING/READY/BUSY/DONE census |
+| `fleet_herdr_calls_total{method,outcome}` | counter | socket health — the dependency everything rests on |
+| `fleet_auth_failures_total{reason}` | counter | only meaningful once CB-501 lands; catches misconfigured workers |
 
 ---
 
@@ -226,7 +226,7 @@ was answered from the forge itself. Kept here as the decision record.*
 
 1. ✅ **TLS scope (D3) — confirmed.** Bearer auth + the fail-fast bind guard ship in the daemon;
    TLS terminates at a reverse proxy, documented with a worked example. AMQP gets TLS via an
-   `amqps://` URI. No keystore handling in `bridged`.
+   `amqps://` URI. No keystore handling in `fleetd`.
 2. ✅ **Micrometer (D4) — confirmed dropped.** Zero-dependency Prometheus text renderer, for the
    reasons in D4 (pom reconciliation burden + the mandated CVE gate being un-runnable this
    session). Revisit if a push-gateway or JVM-metrics requirement appears; the endpoint is the

docs/M4-Fleet-Health.md

@@ -0,0 +1,972 @@
+# M4 - Fleet health, recovery, routing, and capacity
+
+**Status:** Design accepted on 2026-08-15. CB-573 part 1 has shipped the classification model and
+the `fleet_list` capacity view; the remaining M4 units are not yet shipped. See
+[Unit 2 — what has landed so far](#unit-2---what-has-landed-so-far) before planning Unit 2 work:
+some of its criteria were met by separate CB tickets, and one of them contradicts the unit text.
+**Scope:** Fleet evidence, safe mechanical repair, lead routing, capacity reporting, and optional
+human notification.
+**Grounded in:** `health/FleetHealth`, `health/PaneBudget`, `inject/StatusPoller`,
+`inject/StatusRefiner`, `inject/CompletionResolver`, `inject/Injector`, `session/SessionManager`,
+`msg/MessageService`, `msg/ReplyInbox`, `msg/ReplyPushLoop`, `msg/LeadHeartbeatLoop`,
+`mcp/PrimaryRegistry`, and `herdr/AgentControl`.
+
+## 1. Problem and decision boundary
+
+The operator asked the bridge to detect idle agents, exceptions, stopped work, and broken
+communication. The bridge may read an agent pane from time to time. It must notify a person when
+the fleet cannot move forward.
+
+The four operator terms are not four equal health states. `IDLE` is a normal mode. An exception is
+sometimes visible only as pane text. Stopped work may look the same as slow work. Broken
+communication can occur on several links.
+
+M4 uses this boundary:
+
+- The bridge detects facts and joins evidence.
+- The bridge repairs only mechanical failures with no judgement.
+- The lead decides whether to stop, retry, replace, or reassign a member.
+- A human is notified only when no healthy lead can act.
+- n8n may route an outbound incident. It never classifies state or chooses recovery.
+
+An inbound n8n decider would need bridge authority. No narrow machine-decider role exists. Giving a
+workflow engine lead authority is unsafe, while adding a new role is a separate authorization
+design. An outbound sink needs no bridge role.
+
+The bridge must never replay a delivered task. That task may already have changed files, pushed a
+branch, opened a pull request, or changed external state. A replay can run those side effects twice.
+This rule must remain true even if later code stores delivered prompt text.
+
+## 2. Evidence model
+
+A health state is mainly a comparison between two views:
+
+- **herdr view:** current agents and raw live status from one `AgentControl.list()` call.
+- **bridge view:** session FSM, MCP presence, accepted turns, tasks, inbox state, and lead ownership.
+
+A strong fault often appears as a disagreement between those views. For example, `BUSY` in the
+session FSM and `DONE` in herdr means the bridge missed a turn boundary. Pane reads support this
+model, but they are not the main monitor.
+
+`SessionManager.rosterView` already joins session state and live status. `AgentControl.list()`
+already gets the whole live fleet in one call. M4 makes that join persistent and adds timers,
+accepted-turn state, and incident state.
+
+### 2.1 Real traces behind the design
+
+The first trace was an architect that stopped making progress:
+
+```text
+profile=opus role=architect state=busy liveStatus=done
+```
+
+The session moved from `DONE` to `BUSY` for turn 2. Eighteen minutes later, the session still said
+`BUSY`, herdr still said `DONE`, the async task still said `PENDING`, and no completion fallback had
+run. This is `TURN_BOUNDARY_LOST`, not a general slow-turn guess.
+
+The second trace had two async sends to the same pane, one second apart. The pane was then stopped.
+One ticket became failed. The other stayed `pending - worker unknown`. Current
+`MessageService.abandon` resolves only `Rendezvous.currentWaiter(target)`, while async tasks live in
+a separate ticket map. CB-568 is intended to fix that bug. M4 still keeps an independent
+post-teardown invariant so a later regression becomes `DELEGATION_ORPHANED`.
+
+### 2.2 Corrections made during design
+
+The first state table missed `BUSY` in fleetd plus `IDLE` or `DONE` in herdr. It would have found
+the real trace only through a late, weak stall timer. The final model adds
+`TURN_BOUNDARY_LOST` as a strong disagreement state.
+
+The first notification design also required a webhook before `health.enabled` could turn on. That
+removed useful local detection to avoid a narrower human-notification gap. The final design splits
+detection from notification. Missing human escalation is shown as partial coverage instead of
+disabling health.
+
+## 3. Classification precedence
+
+Evidence is applied in this order. A lower rule cannot hide a higher one.
+
+1. **Control link:** failed fleet list plus failed ping becomes `CONTROL_LINK_DOWN`.
+2. **Definitive target loss:** `_not_found` becomes `GONE` or `LEAD_UNREACHABLE` when the control
+   link is healthy.
+3. **Startup and teardown invariants:** readiness expiry becomes `NEVER_READY`; surviving tasks
+   after teardown become `DELEGATION_ORPHANED`.
+4. **Bridge/live disagreement:** `BUSY` plus stable raw `IDLE` or `DONE` becomes
+   `TURN_BOUNDARY_LOST`.
+5. **Known screen evidence:** a tested fatal signature becomes `ERROR_ON_SCREEN`.
+6. **Timed suspicion:** unchanged sparse pane probes may become `STALL_SUSPECTED`.
+7. **Communication quality:** completion fallback becomes `MUTE`; an old inbox entry becomes
+   `REPLY_STRANDED`.
+8. **Normal mode:** `STARTING`, `IDLE`, `WORKING`, `WORK_PENDING`, or `BLOCKED_AMBIGUOUS`.
+
+The member flow in Figure 1 shows lifecycle states and the main fault exits. Fault states are
+reported beside the session FSM; most are not new FSM values.
+
+```mermaid
+flowchart TD
+    Registered["Member registered"] --> Starting["STARTING"]
+    Starting -->|"MCP presence"| Idle["IDLE"]
+    Starting -->|"Readiness grace expires"| NeverReady["NEVER_READY"]
+    Idle -->|"Accepted delivery"| Working["WORKING"]
+    Working -->|"Trusted turn boundary"| Idle
+    Working -->|"Bridge BUSY and herdr IDLE or DONE"| Lost["TURN_BOUNDARY_LOST"]
+    Working -->|"Known fatal screen"| Error["ERROR_ON_SCREEN"]
+    Working -->|"Long age and unchanged sparse probes"| Stall["STALL_SUSPECTED"]
+    Working -->|"Target not found"| Gone["GONE"]
+    Idle -->|"Inbox or queued delivery exists"| Pending["WORK_PENDING"]
+    Pending -->|"Delivery or collection finishes"| Idle
+    Idle -->|"Raw BLOCKED with an open turn"| Blocked["BLOCKED_AMBIGUOUS"]
+    Lost -->|"Strict guarded repair"| Repaired["DONE with reconciled completion"]
+    Lost -->|"Repair refused"| LeadDecision["Lead decision required"]
+```
+
+*Figure 1. The member lifecycle and the main health exits. Pane-based states never authorise an
+automatic retry of the task.*
+
+## 4. State model
+
+### 4.1 Normal and transitional member states
+
+| State | Exact evidence | Meaning and certainty |
+|---|---|---|
+| `STARTING` | Session is `SPAWNING`; MCP presence is absent | Normal inside the startup grace. MCP contact is the readiness signal. |
+| `IDLE` | Session is `READY` or `DONE`; live status is `IDLE` or `DONE`; no open turn or inbox item exists | Normal. Idle is not a fault. |
+| `WORKING` | Session is `BUSY`; raw live status is `WORKING`; the accepted turn is open | Certain that herdr sees work. It does not prove useful progress. |
+| `WORK_PENDING` | Queued delivery or inbox content exists while the target is injectable | Transitional. Existing injector or push logic should move it. |
+| `BLOCKED_AMBIGUOUS` | An open turn exists and raw live status is `BLOCKED` | The bridge cannot tell whether this is permission, input, or a settled screen. |
+
+Idle may drive configured resource cleanup. It never opens an incident and never pages a person.
+
+### 4.2 Member fault and quality states
+
+| State | Exact evidence | Certainty and action |
+|---|---|---|
+| `NEVER_READY` | `SPAWNING`, no MCP presence, and an accepted delivery waits through the existing readiness grace | Delivery never became possible. The exact cause is unknown. Fail the send, stop the process, and preserve a provisioned worktree. |
+| `GONE` | Per-target herdr call returns `_not_found` while fleet list or ping works | Certain target loss. Fail all target work. Do not replay it. |
+| `TURN_BOUNDARY_LOST` | Same session turn stays `BUSY`; same accepted task stays open; two raw snapshots show `IDLE` or `DONE` | Strong disagreement. Strict reconciliation may repair it. |
+| `ERROR_ON_SCREEN` | Suspicious non-working state survives grace; `detection` matches a tested adapter-specific fatal signature | Certain only for the matched signature. A bare word such as `Exception` is not enough. |
+| `STALL_SUSPECTED` | Open turn is older than the configured threshold; two normalised `recent_unwrapped` digests are unchanged; no boundary or reply occurs | Not certain. A long valid API call can look the same. Lead decides. |
+| `MUTE` | Turn resolves through completion fallback instead of `fleet_reply` | Certain that no structured reply won. It does not prove an MCP failure. A single event is a metric, not an incident. |
+| `REPLY_STRANDED` | Typed reply or health message remains after owning-lead push reaches its cap | Collection failed. This does not explain whether the lead is busy, dead, or ignoring the nudge. |
+| `DELEGATION_ORPHANED` | Target is gone, failed, or released, but one or more tasks remain `PENDING` after reconciliation grace | Certain bridge invariant failure. This is not an inbox-drain fault. |
+| `WORK_PRODUCT_AT_RISK` | Provisioned branch has commits after its recorded base; member is `DONE`, `FAILED`, or preserved after release; no turn or inbox item remains; long-idle threshold passed | A warning, not proof of loss. Work may already have an open pull request or a squash merge. |
+
+`MUTE` opens an incident only after a small fixed rate threshold for one target or profile, or when
+it appears with another fault.
+
+`WORK_PRODUCT_AT_RISK` must not become `WORK_PRODUCT_UNCOLLECTED`. The bridge does not know pull
+request or merge state. If committed work appears with `REPLY_STRANDED` or
+`DELEGATION_ORPHANED`, the existing incident gains `committedWorkAtRisk: true`.
+
+### 4.3 Control-link state
+
+| State | Exact evidence | Certainty and action |
+|---|---|---|
+| `CONTROL_LINK_DOWN` | Two full-fleet `agent.list` calls fail across the grace, and herdr `ping` also fails | Certain for the fleetd-to-herdr link. Retry calls, record the incident, and use human escalation if no lead can be reached. |
+
+A failed fleet list alone is not a dead-member claim. A single `_not_found` with a healthy global
+link is a target fault, not a control-link fault.
+
+### 4.4 Lead states
+
+| State | Exact evidence | Meaning and action |
+|---|---|---|
+| `LEAD_IDLE` | Expected lead is present with raw injectable status; no actionable state waits | Normal. Existing heartbeat may run under its own policy. |
+| `LEAD_WORKING` | Expected lead is present with raw `WORKING`; stall threshold is not met | Reachable and busy. Never inject into the live turn. |
+| `LEAD_STATUS_UNKNOWN` | Expected lead is present with raw `UNKNOWN` | Neither dead nor a healthy routing target. Retain evidence and retry. |
+| `LEAD_UNREACHABLE` | Expected lead is absent from two successful live-agent snapshots while ping works, or targeted lookup returns `_not_found` with a healthy control link | Route to a healthy peer. If none exists, use human escalation. |
+| `LEAD_UNRESPONSIVE` | Actionable state waits; lead stays injectable; bounded nudges exhaust; inbox remains uncollected | Route to a healthy peer or a person. |
+| `LEAD_STALL_SUSPECTED` | Lead stays `WORKING` past threshold; two sparse pane probes show no progress | Not certain. Never kill or restart automatically. Route to peer or person. |
+
+The monitor retains the lead name and terminal, last successful sighting, raw status and age,
+consecutive list absences, targeted errors, pane-probe facts, pending incident age, and nudge
+outcomes. Current heartbeat and push loops discard much of this history.
+
+Expected lead identity comes from the same supplier used by `CallerResolver`. It is not liveness
+evidence. `LeadTabScanner` keeps cached identity after a failed scan, so the health monitor compares
+that identity with a fresh successful agent list. A dynamic identity also survives a two-successful-
+snapshot retirement grace. This stops a dead lead from escaping health by disappearing from one map.
+
+### 4.5 Evidence limits
+
+M4 cannot tell these cases apart with current evidence:
+
+- A valid long call and a hung call may have the same status and pane digest.
+- `BLOCKED` does not explain which input is needed.
+- An idle prompt after failure may look like an idle prompt after success.
+- A missing structured reply does not prove a broken MCP connection.
+- An undrained inbox does not explain why the lead did not collect it.
+- Arbitrary pane text cannot safely classify arbitrary exceptions.
+- A branch ahead of its base does not prove that work was not collected.
+
+Logs are outputs, not classifier inputs. The monitor never parses its own logs.
+
+## 5. Automatic action and lead action
+
+### 5.1 Actions the bridge may take
+
+The bridge may:
+
+- retry transient herdr status, list, ping, and pane-read failures with bounded backoff;
+- re-submit Enter after the existing paste/submit race;
+- fail queued delivery after `NEVER_READY`;
+- stop a never-ready process while preserving its provisioned worktree;
+- fail all queued, accepted, and async tasks for a gone or released target;
+- reconcile one lost boundary when every strict gate in Section 8 passes;
+- hold typed messages, nudge the owning lead, and stop at the configured cap;
+- use the existing bounded idle-lead heartbeat;
+- deduplicate, route, update, and resolve incidents.
+
+These actions do not choose new work and do not replay old work.
+
+### 5.2 Decisions reserved for the lead
+
+Only the lead may:
+
+- stop or continue `BLOCKED_AMBIGUOUS`;
+- stop, inspect, or wait on `ERROR_ON_SCREEN`;
+- kill or continue `STALL_SUSPECTED`;
+- spawn a replacement or reassign work;
+- retry a delivered task;
+- choose how to use partial work in a worktree;
+- restart herdr or change network, model, credentials, backend, or configuration.
+
+Reports include literal safe tool calls such as `fleet_status(sessionId="...")`,
+`fleet_poll(ticket="...")`, `fleet_list()`, and optional `fleet_stop(paneId="...")`. A judgement
+state never presents stop as the only action.
+
+### 5.3 Release causes and worktree safety
+
+| Release cause | Process action | Provisioned worktree |
+|---|---|---|
+| `SPAWN_ROLLBACK` before registration or delivery | Stop and clean up | Remove |
+| `COMPLETED` for `READY` or `DONE` without pending work, idle TTL, or successful context-cap completion | Stop | Remove only if clean; preserve a dirty worktree (CB-576) |
+| `NEVER_READY` | Stop | Preserve |
+| `GONE` | Best-effort stop | Preserve |
+| `TURN_FAILED` or lead abort while `BUSY` or `FAILED` | Stop | Preserve |
+| `RELEASE_WITH_PENDING_TASKS` | Stop | Preserve |
+| `SHUTDOWN` | Stop | Preserve |
+
+Explicit stop is state-aware. `SPAWNING`, `BUSY`, `FAILED`, or any target with pending tasks uses a
+preserving cause.
+
+Before abnormal release removes the live session, M4 writes an atomic manifest under the worktree
+root. It records session identity, owner, role, profile, repository, path, branch, base commit,
+release cause, release time, state, and pending task ids. `fleet_list.preservedWorktrees` loads these
+manifests after restart. Stop output and WARN logs also name the path and cause. M4 never
+auto-deletes a preserved worktree.
+
+## 6. Fleet health monitor
+
+Add `FleetHealthMonitor`. Do not widen `StatusPoller` into a policy loop.
+
+`StatusPoller` has a 250 ms delivery cadence and samples only injector targets with outstanding
+work. Health needs all sessions, all leads, task state, inbox age, and global control evidence. One
+loop cannot serve both cadences safely.
+
+Build the monitor like `LeadHeartbeatLoop`:
+
+- pure `decide(snapshot, priorState, now)` logic;
+- a thin scheduler;
+- an injected clock;
+- edge-triggered state changes;
+- no network work in the pure function;
+- no sleeping in tests.
+
+Each enabled fleet tick reads:
+
+- one `AgentControl.list()` result for the whole fleet;
+- one in-memory `SessionManager.roster()` snapshot;
+- accepted turns and async task state;
+- typed inbox depth, kind, and age;
+- push and heartbeat outcomes;
+- configured and discovered leads.
+
+Existing failure paths publish structured evidence to the monitor. The monitor does not infer events
+from log text.
+
+### 6.1 Pane budget
+
+Healthy idle members, recent working members, and quiet leads cause no pane reads.
+
+A pane is eligible only for a stable lost boundary, sustained `BLOCKED` or `UNKNOWN`, work older
+than the suspect threshold, or one final evidence read for a confirmed fault when the pane exists.
+
+Compiled brakes apply even if config asks for more:
+
+- per-target pane cooldown is at least 60 seconds;
+- working age before the first progress probe is at least 300 seconds;
+- at most two pane reads occur in one fleet tick;
+- targets rotate fairly;
+- only a normalised digest and optional clipped local excerpt are stored;
+- no pane excerpt leaves fleetd in a human webhook.
+
+Use `detection` for tested screen signatures. Use normalised `recent_unwrapped` only for progress
+comparison.
+
+## 7. Typed inbox and routing
+
+### 7.1 Semantic record
+
+The typed inbox record carries:
+
+```text
+schemaVersion
+kind: reply | health
+msgId, target, subjectTerminal, recipientLead
+severity, state, evidence
+createdAtEpochMillis, firstSeenEpochMillis, lastSeenEpochMillis
+recoveryTried, suggestedToolCalls, content
+```
+
+A health message never calls `Rendezvous.resolve`. It cannot look like the member's task result.
+
+Both inbox adapters share field preservation, first-id-wins dedup, FIFO among decoded messages,
+explicit ownership, ack, and release rules. The in-memory adapter stores typed records directly. It
+does not copy AMQP migration logic.
+
+### 7.2 AMQP migration
+
+The reader uses AMQP `content_type`, never body sniffing:
+
+```text
+Legacy v0: text/plain
+Typed family: application/vnd.ltms.fleet.inbox-message+json
+```
+
+A legacy reply may begin with `{`. It remains plain text because its media type is `text/plain`.
+Legacy text becomes `kind=reply` with exact UTF-8 content and absent typed metadata.
+
+Typed JSON has required integer `schemaVersion: 1`. Version 1 ignores unknown optional fields.
+Missing required fields, invalid enums, malformed UTF-8 or JSON, and property/body identity mismatch
+are invalid data.
+
+An unknown schema version is not partly decoded. It remains unacknowledged on the original queue and
+creates one operator-visible `unsupported_version` failure. A newer daemon may read it later.
+
+Invalid known-format data is copied byte-for-byte to durable queue
+`agent.<target>.inbox.quarantine`. A dedicated confirm-mode publisher confirms the persistent copy
+before the original is acknowledged. A failed quarantine handoff leaves the original unacknowledged.
+The raw body never enters logs.
+
+Decode failure creates a redacted WARN, metric, `fleet_list` summary, and routed health incident.
+One bad entry never escapes the consumer callback and never stops later valid messages.
+
+Safe downgrade is not supported. The previous build ignores `content_type` and would show typed JSON
+as ordinary reply text. If drained, it would acknowledge the message and lose typed meaning. Typed
+queues must be drained or preserved before an old jar runs.
+
+The existing contract suite uses RabbitMQ. Production uses LavinMQ. The migration and lead-key
+ownership cases must run once against production LavinMQ before release, or the release must state
+that LavinMQ was not checked.
+
+### 7.3 Member routing
+
+A member incident first goes to the exact lead that owns its accepted delegation.
+`PrimaryRegistry` needs a no-fallback `delegatingLeadFor(memberTarget)` query. Health routing must not
+use the old singular-primary fallback when several leads exist.
+
+Publish the incident under the affected member target. Trigger the existing bounded push route. The
+push waits until the owning lead is injectable, so it does not interrupt a live lead turn.
+
+### 7.4 Peer lead routing
+
+Figure 2 shows the route from incident to lead, peer, or person.
+
+```mermaid
+flowchart TD
+    Incident["Open incident"] --> Member{"Member incident?"}
+    Member -->|"yes"| Known{"Exact delegation owner known?"}
+    Known -->|"no"| Sink{"Human webhook enabled and healthy?"}
+    Known -->|"yes"| Owner{"Owner lead healthy?"}
+    Owner -->|"yes"| OwnerInbox["Publish to owner lead path"]
+    Owner -->|"no"| PeerSet["Build healthy peer candidate set"]
+    Member -->|"no, lead incident"| PeerSet
+    PeerSet --> Peer{"Healthy peer exists?"}
+    Peer -->|"yes"| Select["Choose fewest assigned incidents<br/>then stable name and terminal id"]
+    Select --> PeerInbox["Publish to peer lead inbox<br/>and status-gated push"]
+    Peer -->|"no"| Sink
+    Sink -->|"yes"| Webhook["Send classified outbound incident"]
+    Sink -->|"no"| Passive["Keep incident open<br/>show partial coverage on local surfaces"]
+```
+
+*Figure 2. Routing keeps delegation ownership separate from temporary peer fallback.*
+
+Peer candidates exclude the incident subject, failed owner, absent leads, raw-unknown leads, and
+leads with an open unhealthy state. A reachable `WORKING` peer may be selected; its push waits for an
+injectable window.
+
+Choose the candidate with the fewest assigned foreign incidents. Break ties by stable lead name,
+then terminal id. Pin the recipient. Reassign only if that peer becomes unhealthy or retires. A
+routing generation marks a reassignment, and old pending assignments become superseded.
+
+`fleet_list` lead rows show health, health age, assigned foreign incident count, and a bounded list
+of incident id, subject, state, severity, age, and routing generation. The top-level view also shows
+owner, recipient, and routing reason.
+
+A peer incident is published under the recipient lead's inbox key, not the failed subject's key. Its
+status-gated nudge names the failed lead and gives the exact
+`fleet_poll(target="<recipient-terminal>")` call.
+
+### 7.5 Lead inbox ownership
+
+Add `LeadInboxRegistry`, driven by the same expected-lead supplier as `CallerResolver`.
+
+It calls `replyInbox.own(leadTerminal)` at startup for configured leads, after successful discovery,
+after config adds a lead, and before publication. Ownership is not an authorization side effect.
+
+A missing lead keeps its key owned. Release happens only after confirmed retirement, all incidents
+are reassigned or resolved, typed health messages move or ack, and the queue is empty. Own a
+replacement terminal before moving messages from the old key. Never release a non-empty in-memory
+lead key, because in-memory release clears local data.
+
+### 7.6 Single-lead deployment
+
+One lead and no peer is a normal mode, not an edge case.
+
+An idle, reachable lead may receive the existing bounded nudge. An unreachable or stalled sole lead
+has no safe in-loop recovery. The bridge must not restart or replace it. A new lead would not have the
+failed lead's plan or context, and an uncertain relaunch could create two orchestrators.
+
+With no webhook, only `fleet_list`, `/healthz`, metrics, WARN logs, and the incident journal remain.
+These are passive surfaces. They are not a human notification.
+
+## 8. Lost-boundary reconciliation
+
+This is the only M4 path that reconstructs a result. It must prefer a visible stall over a fabricated
+reply.
+
+### 8.1 Why normal completion rules are not enough
+
+Current `CompletionResolver.resolve` has two fail-open rules. It resolves when the delivery baseline
+is missing. It also resolves an empty completion when the pane read fails. Those choices are valid
+after a trusted `WORKING -> IDLE` boundary because the bridge knows the turn ran. They are unsafe
+when health only guesses that a boundary was lost.
+
+M4 gives each accepted send an internal `TurnToken`. It ties target, exact waiter, session turn,
+delivery baseline, and task outcome together.
+
+### 8.2 Delivery baseline
+
+Capture the baseline immediately after prompt send and before the delivery future completes. Store:
+
+```text
+TurnToken
+exact waiter identity
+capture time and pane source
+normalised assistant block clipped to MAX_SCRAPE_CHARS
+whether a supported assistant marker was recognised
+capture result: PRESENT | READ_FAILED | UNRECOGNISED
+```
+
+A failed or missing baseline never authorises repair. A late baseline is not valid evidence. After a
+daemon restart, the old waiter, task, token, and baseline are gone, so the old turn cannot be
+repaired.
+
+Automatic repair is enabled only for agent kinds with tested assistant-block fixtures. Current
+extraction is Claude Code-specific and falls back to arbitrary raw text without `⏺`. That raw fallback
+cannot authorise repair. OpenCode repair stays disabled until live pane fixtures exist.
+
+### 8.3 Strict gates and resolver result
+
+Figure 3 shows the repair gates. Any failed gate keeps the waiter unchanged.
+
+The two raw snapshots must describe the same `TurnToken` and session turn. No `WORKING`,
+`BLOCKED`, `UNKNOWN`, missing-agent, reply, failure, or new-delivery observation may occur between
+them.
+
+```mermaid
+flowchart TD
+    Candidate["TURN_BOUNDARY_LOST candidate"] --> Stable{"Same TurnToken and BUSY turn<br/>across two raw IDLE or DONE snapshots?"}
+    Stable -->|"no"| Resnapshot["Take a fresh snapshot"]
+    Stable -->|"yes"| Waiter{"Exact captured waiter<br/>still open by identity?"}
+    Waiter -->|"no"| Stale["STALE_TURN or ALREADY_RESOLVED"]
+    Waiter -->|"yes"| Baseline{"Successful recognised<br/>delivery baseline exists?"}
+    Baseline -->|"no"| Refuse["Refuse repair<br/>leave ticket pending"]
+    Baseline -->|"yes"| Read{"Fresh pane read succeeds?"}
+    Read -->|"no"| Refuse
+    Read -->|"yes"| Output{"Recognised non-blank assistant block<br/>differs from clipped baseline?"}
+    Output -->|"no"| Refuse
+    Output -->|"yes"| Resolve["Shared CompletionResolver guard core<br/>resolves exact waiter"]
+    Resolve -->|"won race"| Repaired["RECONCILED_COMPLETION<br/>same turn becomes DONE"]
+    Resolve -->|"lost race"| Resnapshot
+```
+
+*Figure 3. Repair needs stronger evidence than a normal observed turn boundary.*
+
+Refactor the current resolver into one guard core with two policies:
+
+```text
+resolveCaptured(target, inFlight, OBSERVED_BOUNDARY)
+resolveCaptured(target, inFlight, LOST_BOUNDARY_REPAIR)
+```
+
+The health monitor calls only:
+
+```text
+CompletionResolver.reconcileLostBoundary(target, expectedTurnToken)
+```
+
+It returns `REPAIRED`, `ALREADY_RESOLVED`, `REFUSED_NO_CAPTURE`, `REFUSED_NO_BASELINE`,
+`REFUSED_UNREADABLE`, `REFUSED_UNCHANGED`, `REFUSED_AMBIGUOUS_OUTPUT`, `STALE_TURN`, or
+`RACE_LOST`.
+
+Only `REPAIRED` and same-turn `ALREADY_RESOLVED` may move that turn from `BUSY` to `DONE`. A
+per-target reconciliation gate stops a queued second send from being accepted between waiter
+resolution and the FSM transition.
+
+### 8.4 Lead-visible marker and refusal
+
+A repaired result uses distinct `RECONCILED_COMPLETION` values in `Rendezvous`, `MessageService`,
+task poll source, and metrics. The lead sees:
+
+```text
+[repaired completion - fleetd detected a lost turn boundary. The member did not call
+fleet_reply; pane-derived text follows and may be partial]
+```
+
+Clipped text also keeps the existing clipped-tail marker.
+
+A refused repair leaves `TURN_BOUNDARY_LOST` open and the ticket pending. The report states that no
+reply was reconstructed and no task was replayed. `UNCHANGED`, `UNREADABLE`, and
+`AMBIGUOUS_OUTPUT` get at most one delayed retry for the same token. Missing capture or baseline gets
+no retry. After two refused scrapes, automatic repair stops for that token.
+
+### 8.5 Target-wide teardown invariant
+
+CB-568 owns the multi-ticket cancellation mechanism. M4 routes every terminal cause through that one
+idempotent operation and checks this independent invariant after teardown:
+
+- no injector entry exists for the target;
+- no accepted turn or completion record exists;
+- no rendezvous waiter or ask exists;
+- every async task is terminal or was already terminal;
+- no thread waiting for the target send lock can later accept it;
+- new sends fail immediately;
+- each old task has one terminal outcome and one metric count.
+
+A violation becomes `DELEGATION_ORPHANED`. The monitor may call the same idempotent target-wide
+failure operation once. It never recreates the task.
+
+## 9. Capacity and utilisation
+
+Capacity is a view, not a health state.
+
+`fleet_list` adds one block per profile:
+
+```text
+profile, maxLoad, live, free, reclaimable
+```
+
+For an unlimited profile, `maxLoad` and `free` are null. `free` is
+`max(0, maxLoad - live)` for a capped profile.
+
+The view must use the exact live-count function used by placement. A second calculation could show a
+free slot that placement then refuses. Member rows add `idleForSeconds` only when state is `READY` or
+`DONE`, no accepted turn exists, and the inbox is empty. `reclaimable` means only that the member
+holds capacity without open bridge work.
+
+The existing idle-lead nudge gains a bounded capacity summary. It lists per-profile live, cap, free,
+and reclaimable counts, plus at most three long-idle members. Capacity does not make
+`FleetState.hasPending()` true. A changed capacity fingerprint may re-arm one capped heartbeat
+sequence. The fingerprint excludes changing idle durations, so a static idle fleet cannot reset the
+cap forever. Reply-push stand-down remains first.
+
+The bridge must never:
+
+- spawn a member because a slot is free;
+- generate a task or acceptance criteria;
+- move queued work to another member or profile;
+- treat a free slot or idle member as an incident;
+- stop an idle member only to improve utilisation.
+
+The bridge knows capacity facts but has no work list. Only the lead has the plan, task context,
+side-effect history, and acceptance criteria.
+
+Capacity calculation is in memory and adds no pane reads. Work-product checks run on a terminal
+session edge, not every fleet tick.
+
+This capacity design adds no automatic stop. The accepted `NEVER_READY` cleanup can still stop a
+very slow startup after the existing grace, which is a known risk. Free capacity and long idle time
+never trigger that path.
+
+## 10. Human escalation and notification
+
+### 10.1 Escalation rule
+
+Notify a person only when no healthy lead can act:
+
+- `CONTROL_LINK_DOWN` survives grace;
+- a lead is unhealthy and no healthy peer can receive the incident;
+- a member incident has no known owning lead;
+- the only owning lead becomes unreachable, unresponsive, or stalled;
+- incident publication or routing itself fails.
+
+Do not page a person for a member fault while a healthy owning lead exists. An uncollected member
+incident feeds lead-health evidence. If the lead then becomes unhealthy, peer or human routing starts.
+
+### 10.2 Detection and notification switches
+
+`health.enabled` controls detection and bridge-local reporting. It does not require a webhook.
+
+`health.notifications.mode` is `disabled` or `webhook`. Disabled is valid and is the default.
+Webhook mode requires a resolved environment variable. Turning notification off stops outbound
+attempts but keeps incidents. Turning it back on resumes still-open human incidents.
+
+Without a sink, `fleet_list.healthCoverage` states that human escalation is unavailable. `/healthz`
+keeps its existing HTTP liveness result and adds a nested `fleetHealth.status=partial` component.
+Metrics and one startup or reload WARN expose the same limit.
+
+### 10.3 Incident and delivery deduplication
+
+One open incident uses this key:
+
+```text
+(scope, subjectStableId, state, causeFingerprint)
+```
+
+The cause fingerprint includes stable error codes, dependency names, signature ids, or invariant
+names. It excludes times, ages, retry counts, pane text, and changing digests. A later recurrence
+after resolution gets a new generation and incident id.
+
+Each outbound event uses:
+
+```text
+Idempotency-Key = hash(incidentId, eventType, eventRevision)
+```
+
+Event types are `open`, `severity_changed`, `reminder`, and `resolved`. Transport retries keep the
+same key.
+
+An atomic owner-only journal beside the active config stores open incidents, routing, delivered
+revisions, retry state, and resolution state. It stores no pane or task content. Journal failure does
+not stop detection, but notification coverage becomes degraded.
+
+### 10.4 Retry, reminder, and resolve
+
+Send the first event immediately. Retry network errors, timeouts, HTTP 408, HTTP 429, and HTTP 5xx
+with full-jitter exponential backoff:
+
+```text
+base: 5 seconds
+factor: 3
+maximum delay: 15 minutes
+one outstanding attempt per event
+```
+
+Respect `Retry-After` up to 15 minutes. Other HTTP 4xx responses are permanent for that event until
+config changes or a person requests replay.
+
+Transport retry is not an incident reminder. `humanRepeatSeconds` creates a new reminder revision
+for an unresolved critical incident after the last successful human event. Disabled mode does not
+build an unbounded reminder queue.
+
+Send `resolved` only if at least one human event for that incident was delivered. If an incident
+resolves before its first successful delivery, cancel the pending open event and record local
+resolution.
+
+### 10.5 Outbound payload boundary
+
+An outbound payload may contain incident id and event type, severity, state, scope, stable bridge
+ids, role or profile, times, duration, structured evidence type and counts, recovery attempted,
+routing reason, coverage, and safe tool calls.
+
+It must never contain:
+
+- raw pane text, pane excerpts, or pane digests;
+- task briefs, prompts, or member reply content;
+- source files, diffs, or worktree file content;
+- worktree paths;
+- environment values, tokens, credentials, headers, or webhook URL;
+- raw exception messages or stack traces;
+- arbitrary model output.
+
+The sink response body is ignored. A webhook cannot direct recovery. n8n remains outbound-only.
+
+### 10.6 Metrics
+
+M4 adds bounded-label series:
+
+```text
+fleet_health_incidents{scope,state,severity}
+fleet_health_incidents_total{event}
+fleet_health_notifications_total{event,outcome}
+fleet_health_notification_queue_depth
+fleet_health_notification_last_success_seconds
+fleet_health_notification_capability{mode,status}
+fleet_lead_health{lead,state}
+fleet_lead_assigned_incidents{lead}
+```
+
+Metric labels never include terminal ids, incident ids, URLs, or error text.
+
+## 11. Configuration
+
+The optional `health:` block is absent or disabled by default. The dormant monitor scheduler does no
+herdr or pane work while disabled. Every listed key is hot because the monitor reads `ConfigRef` on
+each tick or notification.
+
+| Key | Class | Default and hard bound | Purpose |
+|---|---|---|---|
+| `health.enabled` | Hot | `false` | Enable detection and bridge-local reporting. |
+| `health.snapshotIntervalSeconds` | Hot | default 30, minimum 15 | Whole-fleet comparison cadence. |
+| `health.workingSuspectAfterSeconds` | Hot | default 600, minimum 300 | Age before working-pane probes. |
+| `health.paneProbeIntervalSeconds` | Hot | default 60, minimum 60 | Per-target pane cooldown. |
+| `health.leadUnresponsiveAfterSeconds` | Hot | default 300, minimum 120 | Delay after exhausted actionable nudges before lead fault. |
+| `health.humanRepeatSeconds` | Hot | default 3600, minimum 900 | Minimum repeat period for one open human incident. |
+| `health.capacityLongIdleAfterSeconds` | Hot | default 900, minimum 300 | Long-idle threshold for capacity summaries. |
+| `health.includePaneExcerpt` | Hot | `false` | Allow a clipped excerpt in local lead reports only. Human payloads still exclude it. |
+| `health.notifications.mode` | Hot | `disabled` | Select `disabled` or `webhook`. |
+| `health.notifications.webhookUrlEnv` | Hot | required in webhook mode | Name of the environment variable that holds the sink URL. |
+| `health.notifications.requestTimeoutMs` | Hot | default 10000, range 1000-30000 | Whole webhook request limit. |
+
+Two consecutive snapshots are compiled floors for lost boundary, lead disappearance, and control
+link failure. The two-pane-reads-per-tick limit is also compiled and cannot be weakened by config.
+
+## 12. Delivery units and acceptance
+
+### Unit 1 - Evidence model and fleet snapshot
+
+Scope: health state model, fleet join, clocks, evidence retention, and pane budget.
+
+Acceptance criteria:
+
+1. One `agent.list` call covers one enabled fleet tick.
+2. Pure decision tests cover every state and every evidence limit in Section 4.
+3. `BUSY` plus stable raw `DONE` opens `TURN_BOUNDARY_LOST` after two snapshots.
+4. Healthy fleet snapshots perform zero pane reads.
+5. Pane cooldown, two-read fleet budget, and fair rotation cannot be disabled by config.
+6. Logs are outputs only; no log parsing exists.
+7. Fleet snapshots expose the same profile live-count calculation that placement uses.
+8. Capacity rows report cap, live, free, and reclaimable values without opening incidents.
+
+### Unit 2 - Lost boundary and task reconciliation
+
+Scope: accepted-turn identity, guarded repair, target-wide teardown, release causes, and preserved
+worktree discovery.
+
+Acceptance criteria:
+
+1. Every accepted send receives a stable `TurnToken` tied to target, exact waiter, and delivery
+   baseline.
+
+   **Corrected during implementation (2026-08-15).** This criterion first also required the session
+   turn number and the task outcome. That is not implementable at this layer, and the implementer
+   refused it three times rather than fabricate a value — correctly. The reason is an ordering fact
+   that is invisible from any single class: `MessageService` owns acceptance and holds the waiter and
+   the async `Task`, but it learns nothing about delivery, because the delivery event goes to
+   `CompletionResolver` through `TurnListener.onDelivered`. And `CompletionResolver.onDelivered` runs
+   *before* `SessionManager.onDelivered`, so the session turn number does not exist yet at the only
+   point where the token could capture it.
+
+   Two ways out were rejected. A shared registry keyed by target reintroduces exactly the "whichever
+   send happens to be waiting" ambiguity the token exists to remove — the same weak claim
+   `Rendezvous.currentWaiter` warns about. Injecting a turn counter into `MessageService` adds a
+   required cross-layer dependency to populate a field that nothing in this slice reads, which is
+   speculative coupling across a boundary already shown to be fragile.
+
+   So the token identifies the **accepted send**, and `SessionManager` keeps verifying its own
+   delivery separately. Repair (criterion 2) does need the session turn; binding it means resolving
+   that acceptance-versus-delivery ordering first, and that work belongs to the repair unit, not
+   here. The token record carries a comment saying the field is deliberately absent.
+2. Repair requires the same `BUSY` token, two raw `IDLE` or `DONE` snapshots, no conflicting
+   observation, exact open waiter, successful baseline, and new recognised assistant output.
+3. Missing, failed, late, or post-restart baseline never authorises repair.
+4. Repair is enabled only for agent kinds with tested assistant-block extraction. Raw-text fallback
+   without a recognised marker refuses repair.
+5. Normal completion and repair use one resolver guard core. Waiter, scrape, clipping, unchanged, and
+   exact-turn guards are not duplicated.
+6. `reconcileLostBoundary` returns every typed result named in Section 8.3.
+7. Only `REPAIRED` and same-turn `ALREADY_RESOLVED` may move the same turn to `DONE`.
+8. A per-target reconciliation gate blocks a queued second send during repair and FSM update.
+9. Repaired completion has distinct rendezvous kind, message outcome, poll source, lead marker, and
+   metric. Clipping keeps its extra marker.
+10. Unchanged, unreadable, or ambiguous evidence gets at most one delayed retry. Missing capture or
+    baseline gets none.
+11. Refusal leaves the ticket pending and tells the lead that no result was rebuilt or replayed.
+12. Release, gone, never-ready, and abnormal stop use CB-568's one idempotent target-wide failure
+    operation.
+13. The post-teardown invariant in Section 8.5 is tested independently of CB-568 internals.
+14. A violated teardown invariant creates `DELEGATION_ORPHANED` and retries only the idempotent
+    failure operation.
+15. `SPAWN_ROLLBACK` and normal `COMPLETED` remove worktrees. Abnormal and shutdown causes preserve
+    them.
+16. Explicit stop is state-aware. Any pending task or non-terminal state preserves the worktree.
+17. Atomic preserved-worktree manifests reload after restart and appear in lead-only
+    `fleet_list.preservedWorktrees`.
+18. Manifest failure preserves the worktree and opens an operator-visible health failure.
+19. Provision records the base commit. Terminal, long-idle worktrees report
+    `WORK_PRODUCT_AT_RISK` only under the evidence in Section 4.2 and never auto-delete work.
+20. No path replays a delivered task, rebuilds its brief, or retargets it, even when prompt text is
+    available.
+21. Tests cover both real traces, all repair refusals, clipping, explicit-reply and next-turn races,
+    restart without capture, concurrent send and release, and preserved discovery after restart.
+
+#### Unit 2 - what has landed so far
+
+Checked against `main` at `e09cac6` on 2026-08-15. Unit 2 was written as one block, but parts of it
+have since been built by separate CB tickets. Read this before planning the rest, or that work gets
+done twice.
+
+The check was a symbol survey of `fleetd/src/main/java` plus the merge history. It tells you whether
+the machinery exists at all. It is **not** a line-by-line audit of whether each criterion is fully
+met, and I did not run one.
+
+| Criterion | Marker searched for | Found in main source | Reading |
+|---|---|---|---|
+| 1 | `TurnToken` | 8 files | **Done** — unit 2a, merged as `fec284e`. Criterion 1 was corrected first; see the note under it. |
+| 2-5, 9 | `REPAIRED` | 0 files | Not started. The whole guarded-repair path is absent. |
+| 6, 7, 10 | `reconcileLostBoundary` | 0 files | Not started. |
+| 12 | CB-568 failure operation | via CB-580 | **Partial.** CB-580 (`0af902e`) routes `GONE` and `NEVER_READY` into the one idempotent target-wide failure. I did not check that release and abnormal stop go through the same call. |
+| 14 | `DELEGATION_ORPHANED` | 3 files | **Partial.** The health state exists. The teardown-invariant check that creates it, and the retry rule, do not. |
+| 15 | `SPAWN_ROLLBACK` | 0 files | **Contradicted — see below.** |
+| 16 | — | — | Partial at best. CB-576 made release preserve a dirty worktree; whether explicit stop is state-aware is not checked. |
+| 17, 18 | `preservedWorktrees` | 0 files | Not started. No manifest, and no lead-only `fleet_list` field. |
+| 19 | `WORK_PRODUCT_AT_RISK` | 0 files | Not started. |
+
+**Criterion 15 no longer matches the code, and the code is right.** It says "normal `COMPLETED`
+remove worktrees". Since CB-576 (`500bfa2`) that is false on purpose: a `COMPLETED` release now
+preserves the worktree when it still holds uncommitted work, because deleting it destroys work
+nobody can get back. CB-576 was filed after exactly that loss. CB-581 goes further — if the
+dirty-check itself fails, the worktree is preserved rather than removed, since "we could not tell"
+must not be treated as "it is clean".
+
+So criterion 15 should be rewritten as: `SPAWN_ROLLBACK` and a `COMPLETED` release with a **clean**
+worktree remove it; abnormal causes, shutdown, a dirty worktree, and a failed dirty-check all
+preserve it. `SPAWN_ROLLBACK` itself does not exist yet.
+
+### Unit 3 - Typed inbox and member routing
+
+Scope: semantic record, AMQP migration, both adapters, member routing, polling, and member health in
+`fleet_list`.
+
+Acceptance criteria:
+
+1. AMQP selects legacy or typed decoding only from `content_type`; it never sniffs the body.
+2. Persistent `text/plain` from the old build becomes `kind=reply` with exact UTF-8 content,
+   including content beginning with `{`.
+3. New entries use the vendor media type, `schemaVersion: 1`, UTF-8, persistent delivery, and AMQP
+   message ids.
+4. Version 1 ignores unknown optional fields but rejects missing fields and identity mismatch.
+5. Unknown versions are not decoded or acked. They remain on the original queue and create one
+   deduplicated failure.
+6. Invalid known data never escapes the callback, appears as a reply, or blocks later valid messages.
+7. Invalid data reaches durable per-target quarantine before original ack. Failed handoff leaves the
+   original unacked.
+8. Decode failures create redacted WARN, metric, `fleet_list` summary, and routed incident without
+   raw content.
+9. Both adapters pass one semantic contract for fields, FIFO, dedup, ownership, ack, and release.
+10. Lead keys require explicit ownership. Publication never claims a queue.
+11. Unit codec tests cover legacy `{`, Unicode, malformed UTF-8, typed round trip, additive fields,
+    malformed JSON, missing fields, identity mismatch, media type, version, and dedup.
+12. A live broker contract writes old wire data and reads it with the new adapter after reconnect.
+13. Live contract tests cover mixed entries, quarantine confirm-before-ack, unsupported redelivery,
+    later progress past poison, property persistence, lead ownership, and ack removal.
+14. Safe downgrade is documented as unsupported.
+15. RabbitMQ contract tests pass with `mvn test -Pcontract`. The same cases run once on production
+    LavinMQ, or the release states that LavinMQ was not checked.
+16. Member incidents route to the exact delegating lead and never resolve a task rendezvous.
+17. `fleet_list` shows compact member health and capacity without pane content. Member
+    `idleForSeconds` is present only when no accepted turn or inbox item exists.
+
+### Unit 4 - Lead health and peer routing
+
+Scope: lead evidence, exact ownership, peer selection, explicit-recipient push, and lead inbox
+lifecycle.
+
+Acceptance criteria:
+
+1. Lead identity uses the `CallerResolver` supplier. Liveness uses successful current agent data.
+2. Two successful-list absences with healthy ping become `LEAD_UNREACHABLE`; global link failure does
+   not.
+3. Raw `WORKING`, raw `UNKNOWN`, first-seen time, failures, last success, and error class persist
+   across ticks.
+4. Heartbeat and push publish status and nudge outcomes before safe no-injection decisions.
+5. Dynamic lead identity survives a two-successful-snapshot retirement grace.
+6. Member incidents first use exact delegation ownership with no singular-primary fallback.
+7. Peer selection follows the exclusions, load rule, and stable tie break in Section 7.4.
+8. A selected working peer is not interrupted. Its push waits for an injectable window.
+9. Recipient assignment stays pinned. Reassignment increments generation and supersedes old pending
+   assignment.
+10. `fleet_list` shows bounded foreign assignments, recipient, reason, and generation without pane
+    content.
+11. `LeadInboxRegistry` owns configured and discovered lead keys before publication.
+12. Missing leads keep ownership. Retirement needs an empty queue and handled incidents.
+13. Replacement owns the new key before messages move. Non-empty in-memory keys are not released.
+14. Tests cover dead versus busy, unknown, global failure, stale scan cache, disappearance, one peer,
+    several peers, reassignment, and no peer.
+15. Adapter tests cover lead ownership, restart re-ownership, retirement, and terminal replacement.
+    LavinMQ is checked or named as unchecked.
+16. A sole unreachable or stalled lead is never restarted or replaced. Without a sink, only passive
+    evidence remains and every coverage surface says so.
+
+### Unit 5 - Human sink, hot config, metrics, and operator coverage
+
+Scope: generic webhook, config split, incident journal, retry, resolve, metrics, example config, and
+operator documentation.
+
+Acceptance criteria:
+
+1. `health.enabled` works without a human sink.
+2. Notification mode is hot, defaults to disabled, and supports disabled or webhook.
+3. Webhook mode requires a resolved environment value. Bad notification config does not disable an
+   already valid detector.
+4. Mode changes keep open incidents. Re-enable resumes eligible incidents.
+5. `fleet_list`, `/healthz`, metrics, and one WARN show partial coverage without a sink. HTTP
+   liveness behavior stays unchanged.
+6. One-lead, no-sink coverage states that lead failure has no active notification or recovery.
+7. Incident and outbound dedupe use the stable keys in Section 10.3.
+8. The owner-only local journal survives restart and contains no pane or task content.
+9. Journal failure keeps detection running but marks notification coverage degraded.
+10. Retry tests cover network failure, timeout, 408, 429, `Retry-After`, 5xx, permanent 4xx, jitter,
+    delay cap, config re-arm, and one outstanding attempt.
+11. Reminders and transport retries remain separate. Disabled mode does not build an unbounded queue.
+12. Resolve sends only after an earlier human event succeeded. Resolve-before-delivery cancels stale
+    open delivery.
+13. Metrics use bounded labels and exclude ids, URLs, and error text.
+14. Payload tests reject every content type forbidden in Section 10.5.
+15. Webhook response bodies are ignored and cannot direct recovery.
+16. Tests cover disabled mode, one lead without sink, open/update/reminder/resolve, restart, dedup,
+    reassignment, disable/re-enable, and sink failure while local health continues.
+17. `fleetd.example.yaml` documents all hot keys and compiled floors.
+18. The operator Features wiki is updated separately. The portable `CLAUDE.md` block is checked and
+    changed only if shipped tool or inbox semantics make it untrue.
+19. `mvn clean install` passes.
+
+## 13. Not checked and release gates
+
+These limits are part of the design, not optional follow-up notes.
+
+- **OpenCode pane status and assistant markers were not checked.** OpenCode lost-boundary repair is
+  disabled until live fixtures exist.
+- **Permission-prompt status was not checked** for Claude Code or OpenCode. `BLOCKED` remains
+  ambiguous and has no automatic action.
+- **`recent_unwrapped` stability was not checked** across all supported agent kinds. If normalisation
+  is not stable, `STALL_SUSPECTED` must say its evidence is weaker.
+- **The real `BUSY + DONE` trace was not replayed against live herdr.** The design uses the observed
+  production trace and current poller behavior.
+- **CB-568 was not present when Unit 2 was designed.** Unit 2 must inspect the landed API and keep its
+  independent teardown invariant.
+- **Production LavinMQ was not checked.** Existing durable-inbox contracts use RabbitMQ. Migration,
+  quarantine, redelivery, lead ownership, and reassignment must run on LavinMQ before release or be
+  recorded as unchecked.
+- **Live multi-lead routing was not checked.** Peer choice and reassignment are design rules backed by
+  fake-clock and adapter tests until a live exercise runs.
+- **A live sole-lead failure with a webhook was not checked.** The no-peer path is a design result,
+  not a tested recovery.
+- **No n8n, Slack, PagerDuty, or other receiver was checked.** The webhook remains generic and
+  outbound-only.
+- **Deployment supervisor behavior for nested `/healthz` fields was not checked.** HTTP liveness
+  status stays unchanged to reduce this risk.
+- **Incident-journal crash behavior was not checked** because the journal does not exist yet. Unit 5
+  must test atomic replacement and restart recovery.
+- **Worktree merge state cannot be checked reliably** without forge or explicit collection evidence.
+  `WORK_PRODUCT_AT_RISK` stays a warning.
+
+## 14. Locked exclusions
+
+M4 does not expose `agent.read` as a bridge tool. It does not add a workflow engine, inbound n8n
+authority, automatic task assignment, task replay, automatic lead replacement, or automatic member
+spawn for free capacity.
+
+The bridge remains a message bus with evidence and bounded mechanical repair. The lead remains the
+place where judgement and work planning happen.

docs/MCP-Contract.md

@@ -1,296 +1,162 @@
-# MCP Contract — `bridged`'s unified gateway
+# MCP flows and error model — `fleetd`
 
-> **Status:** 🟡 Design (2026-07-14). Greenfield — no MCP code exists yet; the pom carries
-> only Javalin/Jackson. This page defines the tool surface that CB-104 and its followers
-> implement. It supersedes nothing; it fills the "MCP server face" left open by the
-> [Architecture](1-Architecture) page.
-
-`bridged` is the **sole communication gateway** for every Claude session in the bridge. Both
-the **primary** (Opus, on subscription) and every **worker** (off-subscription Claude Code)
-mount the *same* MCP server with a single `claude mcp add` line, and talk only through its
-tools. No Claude session ever addresses a broker, a peer, or the network directly.
-
-This document defines every MCP tool that face must expose, who may call it, its blocking
-semantics, and how it maps onto the code already in the tree.
+> **What this page is.** The **flows**: how a delegation, a clarification, a detached task and a
+> silent member each travel through `fleetd`. These shapes are what shipped, and they are hard to
+> read off the code because they span the MCP face, the rendezvous registry, the `Injector` and
+> herdr.
+>
+> **What this page is NOT: a tool reference.** It deliberately holds no tool catalogue, no
+> parameter tables and no REST paths. **The live MCP schema is the authority** — each tool's own
+> description and parameters, as mounted — with the intent→tool table in `CLAUDE.md` as the short
+> form.
+>
+> That absence is the fix for fleetd #114 (CB-609), and it is worth stating why. This page used to
+> carry a full tool catalogue written in July 2026, before any MCP code existed. The code shipped;
+> the page did not follow. By August it named two tools that do not exist, omitted five that do,
+> had the wrong name for nearly every parameter, pointed at REST paths the daemon does not serve,
+> and — worst — still described an identity model (*"any connection that does not map to a known
+> worker is treated as a primary"*) that was a real privilege bug, fixed since by the ancestry
+> walk in fleetd #161. Every one of those errors is the same error: **a second, hand-maintained
+> copy of something the code already states**. So the second copy is gone rather than corrected.
+> Only the flows remain, because a flow is a shape rather than a name, and shapes are what this
+> page was ever good for.
+>
+> The names that do appear below are checked by `McpContractDocTest`, which fails if this page
+> names a `fleet_*` tool the server does not register. That test is the whole reason it is safe to
+> write a tool name here at all.
 
 ---
 
-## 1. Design constraints (non-negotiable)
+## 1. Rendezvous flows
 
-These come from the project's core invariants and bound every decision below.
+### 1.1 Delegation — happy path
 
-1. **One server, both roles.** The primary and all workers mount an identical server. The
-   catalog must serve both, and `bridged` must decide *who is calling* from the connection —
-   never from a caller-supplied argument that could be spoofed.
-2. **Subscription-safe by construction.** No MCP tool ever reads, sets, or forwards
-   `ANTHROPIC_BASE_URL`. Mounting the bridge cannot move a session off subscription.
-   Enforced today by [`SubscriptionGuard`](1-Architecture).
-3. **Blocking rendezvous, no busy-poll.** The primary consumes a worker's reply through a
-   *single* MCP call that `bridged` holds open — never a cross-turn poll loop that would burn
-   subscription quota.
-4. **Status-gated delivery.** Anything that puts text into a worker flows through the existing
-   [`Injector`](1-Architecture): delivered only when the worker is `idle`/`blocked`, at most
-   one message per turn.
-5. **`bridged` owns policy; herdr owns PTYs.** MCP tools express *intent*; `bridged`
-   translates it into guard checks, rendezvous bookkeeping, and herdr `agent.*` calls.
-
----
-
-## 2. Topology
-
-Both faces live in the one daemon. The **north face** is MCP (this document); the **south
-face** is the herdr Unix socket. REST/SSE remains only for non-Claude clients and dashboards.
-
-```mermaid
-flowchart LR
-    OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["bridged — standalone daemon"]
-        MCP["MCP server (north face)<br/>bridge_send · bridge_reply<br/>bridge_ask · bridge_status · lifecycle"]
-        RDV["rendezvous registry<br/>(blocking-call waiters)"]
-        INJ["Injector + StatusPoller<br/>(status-gated writer)"]
-        SOCK["herdr socket client (south face)"]
-        MCP --> RDV
-        RDV --> INJ
-        INJ --> SOCK
-        MCP --> SOCK
-    end
-    HERDR["herdr<br/>panes · agent-status"]
-    W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
-
-    OPUS -->|"bridge_send (blocks)"| MCP
-    W -.->|"bridge_reply / bridge_ask"| MCP
-    SOCK -->|"agent.start · agent.send<br/>agent.get · pane.close"| HERDR
-    HERDR -->|"drives PTY"| W
-
-    classDef ext fill:#2b6cb0,stroke:#1a365d,color:#ffffff;
-    classDef core fill:#2f855a,stroke:#22543d,color:#ffffff;
-    class OPUS,W ext
-    class MCP,RDV,INJ,SOCK core
-```
-
----
-
-## 3. Identity & addressing
-
-Because the same server is mounted by everyone, `bridged` resolves the caller's role on every
-request — this is the linchpin of the whole contract and has no code yet.
-
-- **Workers are known.** `bridged` spawns every worker
-  ([`WorkerService`](1-Architecture)) and records its herdr session UUID / `terminal_id` on
-  the returned [`Agent`]. When a call arrives on a connection that maps to a known worker,
-  the caller is *that* worker — so **workers never pass a target**; routing is implicit.
-- **The primary is "not a worker".** Any connection that does not map to a known worker is
-  treated as a primary. It addresses workers **explicitly** by `target` — a session UUID,
-  a `terminal_id`, or a friendly `profile` name.
-- **Turn correlation.** A blocking `bridge_send` registers a *waiter* keyed by worker
-  identity. A worker's later `bridge_reply` / `bridge_ask` on the same identity resolves that
-  waiter. A `turn_id` is minted per exchange so a clarification round-trip
-  (§6.2) rejoins the right turn.
-
----
-
-## 4. Transport
-
-`bridged` is a long-lived daemon serving **multiple** concurrent clients (one primary + N
-workers), so a per-client stdio child is the wrong shape. The recommended transport is
-**streamable-HTTP / SSE** on the same bind as the REST face:
-
-```bash
-# identical on primary and every worker
-claude mcp add --transport http bridged http://127.0.0.1:8080/mcp
-```
-
-This adds an MCP-server dependency the pom does not yet carry. See [Open decisions](#10-open-decisions).
-
----
-
-## 5. Tool catalog
-
-| Tool | Caller | Blocks? | Backing (exists today?) |
-|---|---|---|---|
-| [`bridge_send`](#bridge_send) | primary | yes (default) | `Injector.enqueue` ✅ · rendezvous registry ❌ (CB-104) |
-| [`bridge_reply`](#bridge_reply) | worker | no | rendezvous ❌ · pane injection via `Injector` ✅ |
-| [`bridge_ask`](#bridge_ask) | worker | yes | reverse rendezvous ❌ |
-| [`bridge_status`](#bridge_status) | either | no | `AgentControl.status` ✅ · `Injector.activeTargets` ✅ |
-| [`bridge_spawn`](#lifecycle) | primary | no | `WorkerService.spawn` ✅ (`POST /workers`) |
-| [`bridge_list`](#lifecycle) | either | no | `WorkerService.list` ✅ (`/agents`) |
-| [`bridge_stop`](#lifecycle) | primary | no | `WorkerService.stop` ✅ (`DELETE /workers/{paneId}`) |
-| [`bridge_read`](#bridge_read) | primary | no | `AgentControl.read` ✅ |
-| [`bridge_cancel`](#bridge_cancel) | primary | no | — ❌ (future) |
-
-### Core: delegation & rendezvous
-
-#### `bridge_send`
-*(primary → worker — the headline tool, CB-104)*
-
-- **Params:** `message` (required); `target` (optional — defaults to the sole worker / default
-  profile); `timeout_seconds` (default 600); `block` (default `true`); `auto_spawn`
-  (default `true`); `turn_id` (optional — supplied when answering a worker's `bridge_ask`).
-- **Blocking (`block:true`):** enqueue `message` via the `Injector`, then hold the call open
-  until exactly one of:
-  - worker calls `bridge_reply` → `{ outcome:"reply", text }`
-  - worker calls `bridge_ask` → `{ outcome:"question", text, turn_id }`
-  - worker's `agent_status` reaches done/idle with no reply → `{ outcome:"turn_done", text:<terminal tail> }`
-  - deadline elapses → `{ outcome:"timeout" }`
-  - worker gone → error `worker_gone`
-- **Detached (`block:false`):** enqueue and return `{ outcome:"dispatched", dispatch_id }`
-  immediately. The eventual reply is injected into the primary's idle pane (§6.3), or drained
-  via `bridge_status` on a split-host primary.
-
-#### `bridge_reply`
-*(worker → primary)*
-
-- **Params:** `text` (required); `final` (default `true`).
-- **Behavior:** resolve the primary waiter registered against this worker with `text`. If no
-  waiter exists (detached delegation), `bridged` **injects the primary's idle pane** instead.
-  Returns `{ delivered:true, mode:"resolved"|"injected" }`. No `target` — identity is implicit.
-
-#### `bridge_ask`
-*(worker → primary — the reverse rendezvous)*
-
-- **Params:** `question` (required); `timeout_seconds`.
-- **Behavior:** blocks the *worker's* call. Surfaces the question to the primary (resolving its
-  open `bridge_send` with `outcome:"question"`, or injecting its pane). When the primary
-  answers — a `bridge_send` carrying the matching `turn_id` — that unblocks this call and
-  returns `{ answer }` to the worker, which continues **in the same turn**.
-
-### Worker lifecycle
-<a id="lifecycle"></a>
-Thin adapters over [`WorkerService`](1-Architecture) — parity with the existing REST routes.
-
-- **`bridge_spawn`** — `{ profile? }` → worker view (`sessionId`, `terminalId`, `paneId`,
-  `status`). Guard-checked; a boundary breach returns error `subscription_boundary` (the
-  REST `403`).
-- **`bridge_list`** — no params → all workers + `agent_status`. Read-only, either role.
-- **`bridge_stop`** — `{ target }` → tears down the pane and its dedicated tab. Idempotent.
-
-### Observability
-
-#### `bridge_status`
-*(either role — the README's 4th named tool)*
-
-- **Params:** `target?`.
-- **Behavior:** per-worker `agent_status`, queue depth (`Injector.activeTargets`), whether a
-  rendezvous is open, and ids. For the *calling* session it also reports/drains **pending
-  messages addressed to me** — the path a split-host primary's `Stop`-hook uses to wake and
-  collect replies without being injectable. Read-only, non-blocking.
-
-#### `bridge_read`
-*(primary)*
-
-- **Params:** `target`; `source` ∈ `visible | recent | recent_unwrapped | detection`.
-- **Behavior:** returns the worker's terminal text so the primary can peek at a *detached*
-  worker's progress. Adapter over `AgentControl.read`.
-
-### Control (future)
-
-#### `bridge_cancel`
-*(primary)*
-
-- **Params:** `target`. Interrupt the worker's current turn / abandon the rendezvous. No
-  backing code yet.
-
----
-
-## 6. Rendezvous flows
-
-### 6.1 Delegation — happy path
-
-One blocking call, zero polls.
+One blocking call, zero polls. The lead's call is held open by `fleetd` until the member answers.
 
 ```mermaid
 sequenceDiagram
-    participant P as Primary (Opus)
-    participant B as bridged (MCP + Injector)
+    participant P as "Lead (primary)"
+    participant B as "fleetd (MCP + Injector)"
     participant H as herdr
-    participant W as Worker (Claude)
+    participant W as "Member"
 
-    P->>B: bridge_send("do X", target=w) — blocks
-    B->>B: register waiter(w)
-    B->>H: agent.send(w, "do X")  (idle window)
-    H-->>W: prompt injected
-    W->>W: works the turn
-    W->>B: bridge_reply("result")
-    B->>B: resolve waiter(w)
-    B-->>P: { outcome:"reply", text:"result" }
+    P->>B: "fleet_send{sessionId, content} — blocks"
+    B->>B: "register waiter(sessionId)"
+    B->>H: "agent.send — only in an injectable window"
+    H-->>W: "prompt injected"
+    W->>W: "works the turn"
+    W->>B: "fleet_reply{content}"
+    B->>B: "resolve waiter"
+    B-->>P: "{ outcome: reply }"
 ```
 
-### 6.2 Clarification — reverse rendezvous (`bridge_ask`)
+**The cap that matters:** a blocking `fleet_send` is bounded by the *caller's own* MCP client
+timeout, about 60 seconds — not by the task. Anything slower than that must use the detached flow
+in §1.3, or the lead's call returns while the member is still working.
 
-The worker pauses mid-turn to ask; the primary answers; the worker resumes in the same turn.
+### 1.2 Clarification — reverse rendezvous
+
+The member pauses mid-turn to ask, the lead answers, and the member resumes **the same turn** with
+its context intact.
 
 ```mermaid
 sequenceDiagram
-    participant P as Primary
-    participant B as bridged
-    participant W as Worker
+    participant P as "Lead"
+    participant B as fleetd
+    participant W as "Member"
 
-    P->>B: bridge_send("do X", target=w) — blocks
-    B-->>W: "do X" (injected)
-    W->>B: bridge_ask("which config?") — worker blocks
-    B-->>P: { outcome:"question", text:"which config?", turn_id }
-    P->>B: bridge_send("config.yaml", target=w, turn_id) — blocks again
-    B-->>W: resolve bridge_ask → { answer:"config.yaml" }
-    W->>W: resumes same turn
-    W->>B: bridge_reply("done")
-    B-->>P: { outcome:"reply", text:"done" }
+    P->>B: "fleet_send{sessionId, content} — blocks"
+    B-->>W: "content injected"
+    W->>B: "fleet_ask{question} — member blocks"
+    B-->>P: "{ outcome: question, turnId }"
+    P->>B: "fleet_send{turnId, content} — answers THIS turn"
+    B-->>W: "fleet_ask returns the answer"
+    W->>W: "resumes the same turn"
+    W->>B: "fleet_reply{content}"
+    B-->>P: "{ outcome: reply }"
 ```
 
-### 6.3 Detached delegation — pane injection
+**Answer with `turnId`, never `sessionId`.** A `sessionId` send starts a new turn; it does not
+resolve the waiting `fleet_ask`.
 
-The primary does not block; the reply arrives later in its idle pane.
+**The window is about 55 seconds and no nudge extends it.** So never brief a member to "ask me":
+decide before delegating, or give the member an explicit default to fall back on.
+
+### 1.3 Detached delegation — the lead does not block
+
+The lead gets a ticket immediately and collects the answer later. This is the flow for any real
+task, because of the ~60s cap in §1.1.
 
 ```mermaid
 sequenceDiagram
-    participant P as Primary
-    participant B as bridged
-    participant W as Worker
+    participant P as "Lead"
+    participant B as fleetd
+    participant W as "Member"
 
-    P->>B: bridge_send("do X", target=w, block=false)
-    B-->>P: { outcome:"dispatched", dispatch_id }
-    P->>P: continues its own work
-    W->>B: bridge_reply("result")
-    Note over B: no waiter → detached path
-    B->>B: Injector.enqueue(primary_pane, "result")
-    B-->>P: injected into idle pane (status-gated)
+    P->>B: "fleet_send{sessionId, content, wait:false}"
+    B-->>P: "accepted — ticket"
+    P->>P: "continues its own work"
+    W->>B: "fleet_reply{content}"
+    Note over B: "no waiter is blocked — the reply is held"
+    B->>B: "nudge the lead's own pane (status-gated)"
+    P->>B: "fleet_poll{ticket}"
+    B-->>P: "the member's report"
+    P->>B: "fleet_ack{target, msgId}"
 ```
 
-### 6.4 Uncooperative worker — turn-done fallback
+A terminal ticket nudges the lead's pane by itself, so a detached task does not need watching. The
+nudge needs an injectable lead pane and is capped, so it is a convenience rather than a guarantee.
 
-A worker that never calls `bridge_reply` still returns a result: `bridged` reads its terminal
-tail when the turn completes.
+### 1.4 The member never replies — turn-done fallback
+
+A member that ends its turn without `fleet_reply` still produces something: `fleetd` reads its
+pane tail. This is a **fallback, not a channel** — it is lossy in three separate ways, and every
+one of them has produced a wrong answer in practice.
 
 ```mermaid
 sequenceDiagram
-    participant P as Primary
-    participant B as bridged
-    participant W as Worker
+    participant P as "Lead"
+    participant B as fleetd
+    participant W as "Member"
 
-    P->>B: bridge_send("do X", target=w) — blocks
-    B-->>W: "do X" (injected)
-    W->>W: works, never calls bridge_reply
-    B->>B: StatusPoller sees agent_status → idle/done
-    B->>B: AgentControl.read(w, "recent")
-    B-->>P: { outcome:"turn_done", text:<terminal tail> }
+    P->>B: "fleet_send — blocks or detaches"
+    B-->>W: "content injected"
+    W->>W: "works, never calls fleet_reply"
+    B->>B: "StatusPoller sees the turn end"
+    B->>B: "read the pane tail"
+    B->>B: "classify: exhausted? echoed brief? real report?"
+    B-->>P: "{ outcome: turn_done } or a named failure"
 ```
 
+The three ways it goes wrong, and what each looks like now:
+
+| What happened | What the lead used to get | What it gets today |
+|---|---|---|
+| The report is longer than the scrape window | The **end** silently cut off | Still clipped, but marked partial |
+| The member never started — spent credential | The lead's **own brief** echoed back as a report | A named failure: backend exhausted |
+| The member is simply slow | A tail of work in progress | Unchanged — read it as a hint, not a result |
+
+The echoed-brief case is the one to remember: it reads as a long, on-topic report with nothing in
+it from the member. It is suppressed now, but the general rule stands — **check the member's
+worktree with `git log` before believing a report you did not watch arrive.**
+
 ---
 
-## 7. Status gating
+## 2. Status gating
 
-Delivery only happens in a safe window. This is the state machine the `Injector` already
-enforces via `AgentStatus.injectable()`; MCP `bridge_send` is simply its producer.
+Delivery only happens in a safe window. `fleet_send` is a producer for the `Injector`, which
+already enforces this through `AgentStatus.injectable()`.
 
 ```mermaid
 stateDiagram-v2
     [*] --> IDLE
-    IDLE --> WORKING: message delivered / picks up
-    WORKING --> IDLE: turn done
-    WORKING --> BLOCKED: awaits input
-    BLOCKED --> WORKING: input delivered
-    IDLE --> UNKNOWN: detection glitch
-    BLOCKED --> UNKNOWN: detection glitch
-    UNKNOWN --> IDLE: re-detected
+    IDLE --> WORKING: "message delivered, picked up"
+    WORKING --> IDLE: "turn done"
+    WORKING --> BLOCKED: "awaits input"
+    BLOCKED --> WORKING: "input delivered"
+    IDLE --> UNKNOWN: "detection glitch"
+    BLOCKED --> UNKNOWN: "detection glitch"
+    UNKNOWN --> IDLE: "re-detected"
 
     note right of IDLE
         injectable — deliver head of FIFO
@@ -306,69 +172,17 @@ stateDiagram-v2
     end note
 ```
 
-At most one message is delivered per turn: after a send the `Injector` waits for a `WORKING`
-pickup before delivering the next, with a `PICKUP_GRACE_POLLS` fallback for turns faster than
-the poll interval. A herdr `events.subscribe` stream can later replace the sampling without
-touching this state machine.
+**At most one message per turn.** After a send, the `Injector` waits for a `WORKING` pickup before
+delivering the next, with a grace-poll fallback for turns that finish faster than the poll
+interval.
 
----
+Two consequences a lead feels directly:
 
-## 8. Error model
+- **A second send to a busy member never lands.** It reports as queued and times out. The member
+  is fine; the message simply waits, and then restarts the member when it next goes idle.
+- **A spawned member is not deliverable until it has mounted the MCP.** Until then a send waits on
+  that gate for about 60 seconds and then fails without ever reaching the pane.
 
-| Condition | `bridge_send` result | Notes |
-|---|---|---|
-| Worker replies | `{ outcome:"reply" }` | normal |
-| Worker asks | `{ outcome:"question", turn_id }` | answer with `bridge_send(turn_id)` |
-| Turn ends, no reply | `{ outcome:"turn_done" }` | terminal tail as text |
-| Deadline elapsed | `{ outcome:"timeout" }` | message may still be queued/delivered |
-| Worker vanished | error `worker_gone` | `Injector.drop` fails the queued future |
-| Guard breach on spawn | error `subscription_boundary` | REST `403` parity |
-| Delivery failed at herdr | error, message dropped | poisoned message not left blocking the FIFO |
-
-`bridge_reply` from a worker with no open waiter is **not** an error — it falls through to
-detached pane injection (§6.3).
-
----
-
-## 9. Mapping to existing code
-
-The MCP face is a thin adapter layer; nearly every capability already exists behind the REST
-seam. Only the **rendezvous registry** and the **caller-identity resolver** are new.
-
-| MCP tool | Existing collaborator | New work |
-|---|---|---|
-| `bridge_send` | `Injector.enqueue`, `AgentControl.send` | waiter registry, timeout, outcome mux (CB-104) |
-| `bridge_reply` / `bridge_ask` | `Injector` (pane injection) | reverse rendezvous, identity resolver |
-| `bridge_status` | `AgentControl.status`, `Injector.activeTargets` | pending-drain projection |
-| `bridge_spawn` / `list` / `stop` | `WorkerService.{spawn,list,stop}` | MCP adapter only |
-| `bridge_read` | `AgentControl.read` | MCP adapter only |
-
-Because the REST routes in `BridgedApp` already exercise the collaborators, MCP tools are
-validated by **parity** against those routes, not by re-testing behavior.
-
----
-
-## 10. Open decisions
-
-1. **`bridge_ask` direction.** This page defines it as *worker-asks-primary* (a genuine reverse
-   channel, matching the "inject the primary's pane" language). The alternative — a synonym for
-   a blocking primary→worker send — is weaker and produces different plumbing. **Recommend
-   worker-asks-primary.**
-2. **Detached delivery shape.** A `block:false` param on `bridge_send` (keeps the catalog
-   small) vs. a separate `bridge_dispatch` tool. **Recommend the param.**
-3. **Auto-spawn on send.** `bridge_send` provisions a worker per profile when none exists
-   (simplest primary UX) vs. requiring an explicit `bridge_spawn` first. **Recommend
-   auto-spawn, defaulting on.**
-4. **Transport & SDK.** Streamable-HTTP/SSE co-located with the REST bind (recommended) vs.
-   stdio. Requires choosing a Java MCP server SDK and adding it to the pom.
-
----
-
-## 11. Implementation staging
-
-- **CB-104** — blocking `bridge_send` + rendezvous registry + caller-identity resolver
-  (the producer that finally drives the inert `StatusPoller`).
-- **CB-1xx** — `bridge_reply` / `bridge_ask` reverse rendezvous + detached pane injection.
-- **CB-1xx** — lifecycle + observability adapters (`bridge_spawn/list/stop/status/read`).
-- **CB-1xx** — transport wiring + `claude mcp add` docs; parity tests vs. REST.
-- **Later** — `bridge_cancel`; swap `StatusPoller` for herdr `events.subscribe`.
+`UNKNOWN` is deliberately neither injectable nor a pickup. A pane whose status cannot be read is
+not a pane that is safe to write to — see fleetd #176 for what happens when a gate treats an
+unreadable pane as a ready one.

docs/RELEASE-NOTES-1.0.0.md

@@ -1,8 +1,8 @@
 # v1.0.0 — One leader, one host, complete
 
-This is the first release of **`bridged`**.
+This is the first release of **`fleetd`**.
 
-`bridged` lets one main Claude Code session (the **leader**, on your Pro/Max subscription)
+`fleetd` lets one main Claude Code session (the **leader**, on your Pro/Max subscription)
 run a team of **workers** — extra Claude Code sessions on a cheaper or local model, and
 non-Claude agents too. The leader's own session is never touched: it stays on subscription,
 with a clean environment.
@@ -19,12 +19,12 @@ of this one.
 ## One gateway for all messages
 
 - **Everyone talks through the same door.** The leader and every worker connect to the same
-  MCP server and use only its tools: `bridge_whoami` · `bridge_profiles` · `bridge_spawn` ·
-  `bridge_list` · `bridge_status` · `bridge_send` · `bridge_reply` · `bridge_ask` ·
-  `bridge_poll` · `bridge_ack` · `bridge_stop`.
+  MCP server and use only its tools: `fleet_whoami` · `fleet_profiles` · `fleet_spawn` ·
+  `fleet_list` · `fleet_status` · `fleet_send` · `fleet_reply` · `fleet_ask` ·
+  `fleet_poll` · `fleet_ack` · `fleet_stop`.
 - **You are who your connection says you are.** The bridge finds out who is calling from the
   connection itself, never from a name the caller sends. So a worker cannot pretend to be
-  someone else, and `bridge_whoami` tells each agent its own role — no guessing.
+  someone else, and `fleet_whoami` tells each agent its own role — no guessing.
 - **The subscription line cannot be crossed.** Only a spawned worker gets
   `ANTHROPIC_BASE_URL`; the leader never does. Each worker profile has a list of allowed
   model hosts, checked before anything starts.
@@ -59,7 +59,7 @@ had to ask for its replies. That gap is now closed on a single machine:
 - **The leader gets a tap on the shoulder.** When a reply lands, the bridge nudges the
   leader's own pane — only when the leader is free, and only a few times. If the leader is on
   another machine, this quietly falls back to pick-up mode; the reply still waits.
-- **Workers can ask questions.** With `bridge_ask`, a worker can pause mid-task, ask the
+- **Workers can ask questions.** With `fleet_ask`, a worker can pause mid-task, ask the
   leader something, and continue the *same* task with the answer.
 
 ## More than one kind of worker

docs/Team.md

@@ -1,9 +1,9 @@
 # Team — lead orchestrating a mixed Claude + local-LLM fleet
 
-The message server (`bridged`) delivers **one turn into one worker**. A **team** is the
+The message server (`fleetd`) delivers **one turn into one worker**. A **team** is the
 layer above it: a **Claude team-lead** that fans a job out across a **mixed fleet** of
 workers — some on Claude, some on the remote local LLM — and reduces their replies. Same
-`bridged` delivery, same subscription boundary; this doc is only about **orchestration** —
+`fleetd` delivery, same subscription boundary; this doc is only about **orchestration** —
 who the workers are, how the lead picks one, and how it runs many at once.
 
 > Delivery mechanics (blocking `POST /message`, status-gated reply envelope) live in the
@@ -12,12 +12,12 @@ who the workers are, how the lead picks one, and how it runs many at once.
 ## The team
 
 - **Team-lead** — the primary **Opus** (Claude Code, env **CLEAN**, on Pro/Max). Not a
-  worker; a **thin client of `bridged`**. It plans, routes, dispatches, and integrates, and
+  worker; a **thin client of `fleetd`**. It plans, routes, dispatches, and integrates, and
   never sets `ANTHROPIC_BASE_URL`.
-- **Workers** — a herd of `claude` panes in herdr, each an addressable `bridged` session
+- **Workers** — a herd of `claude` panes in herdr, each an addressable `fleetd` session
   with its **own model/env**:
   - **Claude workers** (clean env, e.g. Sonnet) — reasoning-heavy or high-accuracy subtasks.
-  - **Local workers** (`ANTHROPIC_BASE_URL=https://ollama.ltms.dev`) — bulk, cheap, or
+  - **Local workers** (`ANTHROPIC_BASE_URL=https://llm.ltms.dev/anthropic`) — bulk, cheap, or
     embarrassingly parallel subtasks.
 
 Every worker is still a *real Claude Code process* (inherits `CLAUDE.md`, hooks, skills,
@@ -28,14 +28,14 @@ MCP) — only its model differs. Scale each kind horizontally by adding panes.
 ```mermaid
 flowchart TB
     LEAD["lead — Opus<br/>(Claude Code, env CLEAN)"]
-    BD["bridged<br/>message server + router"]
+    BD["fleetd<br/>message server + router"]
     HERDR["herdr<br/>panes · agent-status"]
     WC1["w-claude-1<br/>Sonnet · CLEAN"]
     WC2["w-claude-2<br/>Sonnet · CLEAN"]
     WL1["w-local-1<br/>ANTHROPIC_BASE_URL set"]
     WL2["w-local-2<br/>ANTHROPIC_BASE_URL set"]
     ANT["api.anthropic.com<br/>(Pro/Max)"]
-    OLL["ollama.ltms.dev<br/>(local model)"]
+    OLL["llm.ltms.dev<br/>(gateway to the local model)"]
 
     LEAD -->|"blocking POST /message (target role)"| BD
     BD -->|"Unix socket · send_text · events.subscribe"| HERDR
@@ -62,14 +62,14 @@ flowchart TB
 | `w-local-*` | `ANTHROPIC_BASE_URL` set | local LLM | task is bulk / cheap / embarrassingly parallel |
 
 The lead applies this rubric itself, guided by its `CLAUDE.md` team charter (below). Worker
-selection is **policy in the lead**, not a `bridged` concern — `bridged` just delivers to
+selection is **policy in the lead**, not a `fleetd` concern — `fleetd` just delivers to
 the session the lead names.
 
 ## Subscription boundary in a team
 
 Unchanged from the base architecture, and it scales with the fleet: **only local-worker
 panes** launch with `ANTHROPIC_BASE_URL`. The lead and every Claude worker stay env-clean on
-the subscription. `bridged` enforces which panes may carry the off-subscription env, so
+the subscription. `fleetd` enforces which panes may carry the off-subscription env, so
 adding workers never widens the boundary.
 
 ## Parallel fan-out (map / reduce)
@@ -80,7 +80,7 @@ different workers at once, then results are gathered.
 ```mermaid
 sequenceDiagram
     participant L as lead (Opus)
-    participant B as bridged
+    participant B as fleetd
     participant WC as w-claude-1
     participant WL as w-local-1
 
@@ -100,26 +100,26 @@ sequenceDiagram
 ```
 
 - **Map:** the lead issues N concurrent blocking `POST /message` calls (one per subtask → its
-  chosen worker). Each call blocks only *that* request; `bridged` holds it open until the
+  chosen worker). Each call blocks only *that* request; `fleetd` holds it open until the
   worker's turn completes (status-gated) and returns the reply envelope.
 - **Reduce:** the lead collects the N envelopes and integrates. A slow local worker never
   blocks a fast Claude worker — wall-clock ≈ the slowest single subtask, not the sum.
 - **Detached / long jobs** use the async broker path instead of a held request (Channel 2 in
   the base architecture), so the lead never busy-polls across turns.
 
-Fan-out is bounded by the herd size (pane count) and `bridged`'s concurrency policy, not by
+Fan-out is bounded by the herd size (pane count) and `fleetd`'s concurrency policy, not by
 the lead.
 
 ## Knowing the roster
 
-The lead discovers its team from `bridged` (session list / roles) rather than hard-coding
+The lead discovers its team from `fleetd` (session list / roles) rather than hard-coding
 pane ids, so workers can be added or restarted without editing the lead. A minimal charter
 in the lead's `CLAUDE.md` turns Opus into the orchestrator:
 
 ```markdown
-## Your team (via bridged)
-You are the team-lead. Delegate through the bridged client — never launch workers yourself.
-Roster: ask bridged for current sessions/roles.
+## Your team (via fleetd)
+You are the team-lead. Delegate through the fleetd client — never launch workers yourself.
+Roster: ask fleetd for current sessions/roles.
 - w-claude-* — Claude Sonnet. Reasoning-heavy / high-accuracy subtasks.
 - w-local-*  — remote local LLM. Bulk, cheap, or parallelizable subtasks.
 
@@ -133,22 +133,22 @@ tool instead of hand-rolling the HTTP request.
 
 ## What this layer does NOT change
 
-- **Delivery** is still `bridged` → herdr `pane.send_text` + status events (Message-Server).
+- **Delivery** is still `fleetd` → herdr `pane.send_text` + status events (Message-Server).
 - **Completion timing** is still the worker status event; **reply content** still rides the
   worker `Stop`-hook envelope.
 - **Single-host** still applies: herdr's socket is local, so the whole herd lives on the
-  `bridged` host. The lead may be remote — it only needs HTTP to `bridged`.
+  `fleetd` host. The lead may be remote — it only needs HTTP to `fleetd`.
 
 ## Open questions
 
-- **Routing intelligence:** rubric-in-`CLAUDE.md` (lead decides) vs. a `bridged` role-router
+- **Routing intelligence:** rubric-in-`CLAUDE.md` (lead decides) vs. a `fleetd` role-router
   (label-based). Start with the former; promote to the latter if routing logic grows.
-- **Backpressure:** per-role concurrency caps in `bridged` so a fan-out can't exhaust the
+- **Backpressure:** per-role concurrency caps in `fleetd` so a fan-out can't exhaust the
   local gateway.
 - **Result schema:** whether reply envelopes should carry structured metadata (worker, model,
   tokens) to help the lead's reduce step.
 
 ## Status
 
-🟡 Design (2026-07-11). Orchestration layer over the selected `bridged` server; inherits
+🟡 Design (2026-07-11). Orchestration layer over the selected `fleetd` server; inherits
 herdr (chosen) + AgentAPI (fallback). Delivery unchanged — see the Message-Server design.

docs/Worker-Git-Workflow.md

@@ -20,7 +20,7 @@ requirement, not a nice-to-have.**
 - **Worktree provisioned by the daemon** — `SessionManager` creates a dedicated git worktree +
   branch per session, **hydrates it to full config parity** (below), and tears it down on release.
 - **Worker opens its own PR** — the worker commits, pushes its branch, and opens the PR/MR itself,
-  returning the PR URL in its `bridge_reply`.
+  returning the PR URL in its `fleet_reply`.
 
 ## Why worktrees (the hazard being fixed)
 
@@ -76,7 +76,7 @@ worktree checks out anyway. Amber is the real gap — untracked local config the
 3. **Never overlay the git plumbing** — the worktree's own `.git` file/branch is what gives
    isolation; that's the *one* thing that must differ from the main tree.
 
-The overlay set lives in config (`BridgedConfig.Worker.parityOverlay` — a list of repo-relative
+The overlay set lives in config (`FleetConfig.Worker.parityOverlay` — a list of repo-relative
 paths, with sane defaults) so it's auditable and per-repo tunable.
 
 > **Trust note (deliberate).** Hydrating local config means the primary's local secrets/tokens
@@ -103,7 +103,7 @@ sequenceDiagram
     Note over W: implement in the isolated worktree
     W->>G: git commit + git push (SSH, same user)
     W->>G: open PR (branch to main)
-    W-->>P: bridge_reply (prUrl, branch, summary, tests)
+    W-->>P: fleet_reply (prUrl, branch, summary, tests)
     P->>SM: release(paneId)
     SM->>G: git worktree remove wt
     Note over G: branch + PR persist for review/merge
@@ -115,9 +115,9 @@ earlier `STATE.md` idea — a PR is reviewable, mergeable, and self-describing.*
 
 ## Infra facts (verified this session)
 
-- **Remote:** `ssh://git@git.ltms.dev:2224/lms/claude-bridge.git` (gitea). Push is over **SSH** —
+- **Remote:** `ssh://git@git.ltms.dev:2224/fleet/fleetd.git` (gitea). Push is over **SSH** —
   a worker running as the same user with the same keys can `git push` **with no extra credential**.
-- **gitea is NOT in the project `.mcp.json`** (only `jetbrains`, `intellij-index`, `bridged`). The
+- **gitea is NOT in the project `.mcp.json`** (only `jetbrains`, `intellij-index`, `fleetd`). The
   primary's gitea MCP comes from a global/user config, so **workers do not inherit it**. A worker
   gets only the `bridge` MCP mounted (via `--mcp-config` launch flag).
 - **No gitea CLI** (`tea`) installed; `glab` is present but is the GitLab CLI (wrong backend).
@@ -128,7 +128,7 @@ earlier `STATE.md` idea — a PR is reviewable, mergeable, and self-describing.*
 
 | Option | Mechanism | Trade-off |
 |---|---|---|
-| **A. gitea REST + token** | Worker `curl`s `POST /api/v1/repos/lms/claude-bridge/pulls` with a scoped token injected by the daemon into the worker env | Minimal, no new server; token lives in the off-subscription worker's env (scope it tightly) |
+| **A. gitea REST + token** | Worker `curl`s `POST /api/v1/repos/fleet/fleetd/pulls` with a scoped token injected by the daemon into the worker env | Minimal, no new server; token lives in the off-subscription worker's env (scope it tightly) |
 | **B. mount gitea MCP into workers** | Add the gitea MCP to the worker's `--mcp-config` alongside `bridge` | Clean tool call, but the gitea MCP's own auth/token must be provisioned per worker; more moving parts |
 | **C. install `tea` CLI** | Worker runs `tea pr create` with a token | Another dependency to install + configure; same token question as A |
 
@@ -140,7 +140,7 @@ and the token is a single scoped secret the daemon injects like it already injec
 
 - Off-subscription workers already *could* push (SSH, same user). The **incremental grant is
   PR-create**, i.e. a gitea API token.
-- Scope the token **minimally**: the `lms/claude-bridge` repo, `write:repository` (create branch +
+- Scope the token **minimally**: the `fleet/fleetd` repo, `write:repository` (create branch +
   PR), **not** merge/admin/org. A leaked token can open PRs, not merge them — the primary/human is
   still the merge gate.
 - Inject via the daemon (env var, e.g. `GITEA_TOKEN`), never written to the worker's config dir —
@@ -153,11 +153,11 @@ and the token is a single scoped secret the daemon injects like it already injec
 |---|---|---|
 | Worktree provision/teardown | **CB-301 ext** — `SessionManager.acquire`/`release`; `WorkerSession` gains `worktree`, `branch` | daemon shells out to `git worktree add/remove` |
 | **Config-parity overlay** | **CB-301 ext** — `SessionManager.acquire`, after `git worktree add` | symlink/copy the `parityOverlay` set into the worktree so the worker is a full peer; **this is what makes worktrees viable, not a dead-end** |
-| Overlay config | `BridgedConfig.Worker.parityOverlay` — repo-relative paths, sane defaults | auditable, per-repo tunable; keep explicit + minimal (trust) |
+| Overlay config | `FleetConfig.Worker.parityOverlay` — repo-relative paths, sane defaults | auditable, per-repo tunable; keep explicit + minimal (trust) |
 | Branch naming | `worker/<ticket-slug>-<nonce>` off `main` (or a configured base) | one branch per session |
 | Commit + push + PR handoff | **CB-302** — worker-driven, guided by the skill | push = SSH; PR = option A |
 | Implementer skill | `.claude/skills/implementer/SKILL.md` | worktree-aware playbook (see below); mounts automatically since workers inherit repo cwd |
-| gitea token injection | `WorkerService` env + `BridgedConfig` | repo-scoped, minimal perms |
+| gitea token injection | `WorkerService` env + `FleetConfig` | repo-scoped, minimal perms |
 | PR review + merge | Primary (has gitea MCP + judgment) | merge on green; the human/primary gate stays |
 
 ## Implementer skill (outline)
@@ -170,7 +170,7 @@ A worker-facing playbook (sibling to the existing `reviewer` skill):
 3. **Push** your branch (`git push -u origin HEAD`).
 4. **Open a PR** to `main` (option A `curl`, or the decided mechanism) with a title/body describing
    the change and referencing the ticket.
-5. **Reply** via `bridge_reply` with the **PR URL**, branch name, files changed, and test names —
+5. **Reply** via `fleet_reply` with the **PR URL**, branch name, files changed, and test names —
    that reply is the whole handoff.
 6. Do **not** merge; do **not** touch `.mcp.json` or `wiki/`.
 

docs/Worker-Startup-and-Trust.md

@@ -1,6 +1,6 @@
 # Worker startup: working directory & the folder-trust prompt
 
-When `bridged` spawns a worker, the worker CLI may show an **interactive startup prompt** before it
+When `fleetd` spawns a worker, the worker CLI may show an **interactive startup prompt** before it
 is ready to accept a task — most importantly a *"Do you trust the files in this folder?"* dialog. An
 unattended worker parked on that prompt never becomes injectable: the status-gated injector waits for
 `idle`/`blocked`, the task is never delivered, and (worst case) a stray Enter answers the dialog
@@ -14,11 +14,11 @@ rule that **a worker inherits the primary's directory** (never `$HOME`), and how
 
 ```mermaid
 flowchart TD
-    A["bridge_spawn / POST /workers"] --> B{"explicit cwd?<br/>(profile cwd or spawn arg)"}
+    A["fleet_spawn / POST /workers"] --> B{"explicit cwd?<br/>(profile cwd or spawn arg)"}
     B -->|"yes — told otherwise"| C["use that cwd"]
     B -->|"no"| D{"caller PID resolvable?<br/>(MCP peer PID)"}
     D -->|"yes"| E["cwd = the primary's cwd<br/>lsof -a -p PID -d cwd"]
-    D -->|"no (REST / off-host)"| F["cwd = bridged daemon cwd<br/>(never $HOME by assumption)"]
+    D -->|"no (REST / off-host)"| F["cwd = fleetd daemon cwd<br/>(never $HOME by assumption)"]
     C --> G["ensureWorkspace → tab.create → agent.start {cwd}"]
     E --> G
     F --> G
@@ -51,10 +51,10 @@ only affect the seed shell, which the bridge closes).
 | # | Source | When |
 |---|--------|------|
 | 1 | Explicit `cwd` — a per-profile `cwd:` in config, or a spawn argument | "told otherwise" — pin a fixed workdir |
-| 2 | The **primary's cwd**, auto-detected from the `bridge_spawn` caller | normal MCP spawn from the primary |
-| 3 | The `bridged` daemon's own cwd | REST spawn / off-host caller — **never `$HOME`** |
+| 2 | The **primary's cwd**, auto-detected from the `fleet_spawn` caller | normal MCP spawn from the primary |
+| 3 | The `fleetd` daemon's own cwd | REST spawn / off-host caller — **never `$HOME`** |
 
-The primary's cwd (source 2) is discoverable with no new plumbing: `bridged` already resolves the MCP
+The primary's cwd (source 2) is discoverable with no new plumbing: `fleetd` already resolves the MCP
 caller's loopback **peer PID** for connection identity (`ConnectionIdentity` → `LsofPeerPidLookup`);
 the same PID yields its cwd via `lsof -a -p <pid> -d cwd -Fn` (the `n…` line). The primary maps to no
 worker pane (it is not a worker), but its PID and cwd are still readable.
@@ -62,10 +62,10 @@ worker pane (it is not a worker), but its PID and cwd are still readable.
 ```mermaid
 sequenceDiagram
     participant P as "Primary (main)"
-    participant B as "bridged"
+    participant B as "fleetd"
     participant O as "OS (lsof)"
     participant H as "herdr"
-    P->>B: "bridge_spawn {profile} (no cwd)"
+    P->>B: "fleet_spawn {profile} (no cwd)"
     B->>O: "peer PID for this connection's port"
     O-->>B: "pid"
     B->>O: "cwd of pid (lsof -d cwd)"
@@ -77,9 +77,9 @@ sequenceDiagram
 
 *Figure 2 — a no-cwd spawn inherits the primary's directory from the caller's PID.*
 
-> **Status:** implemented (CB-112). `bridged` threads the resolved `cwd` onto **`agent.start {cwd}`**
+> **Status:** implemented (CB-112). `fleetd` threads the resolved `cwd` onto **`agent.start {cwd}`**
 > (verified: the worker process is rooted there), keeping the single shared worker space. On an MCP
-> `bridge_spawn` the primary's cwd is auto-detected from the caller's PID; over REST (no MCP caller)
+> `fleet_spawn` the primary's cwd is auto-detected from the caller's PID; over REST (no MCP caller)
 > it is the explicit `cwd` param else the daemon's cwd. Both placements (`tab` and legacy `pane`)
 > carry it, since it rides `agent.start`.
 
@@ -133,5 +133,5 @@ unattended.
 
 ## See also
 
-- `docs/MCP-Contract.md` — the tool surface (`bridge_spawn`, `bridge_profiles`, …).
+- `docs/MCP-Contract.md` — the tool surface (`fleet_spawn`, `fleet_profiles`, …).
 - `wiki/2-Message-Server.md` — the herdr `agent.*` / `workspace.*` schema (`workspace.create {cwd}`).

docs/wiki-audit.md

@@ -0,0 +1,208 @@
+# Wiki audit for #168
+
+**Source checked:** `.wiki-snapshot/` at `68e32c6` (2026-08-31). I did not use
+`wiki/`. Code references below are from the current `fleetd` source tree. A quoted
+line is a concrete claim that needs correction, unless the table says `KEEP`.
+
+| Page | Verdict | One-line reason |
+|---|---|---|
+| `Home.md` | REVISE | Good overview, but it still names the retired product. |
+| `_Sidebar.md` | REVISE | The heading still says `claude-bridge`. |
+| `1-Architecture.md` | REBUILD | Its component contract mixes current names with removed tools, routes, and planned backends. |
+| `2-Message-Server.md` | REBUILD | The claimed MCP schema, mount command, REST/SSE surface, and fallback paths are pre-build design. |
+| `3-Approaches.md` | REVISE | Useful research history, but it presents unbuilt AgentAPI as a selectable fallback. |
+| `4-Setup.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `5-Operations.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `6-Team.md` | REBUILD | It teaches role-addressed sends and a Claude-only team model that the shipped API does not have. |
+| `7-Use-Cases.md` | REBUILD | Its flagship flow depends on removed `ccs` profiles and removed send parameters. |
+| `8-Roadmap.md` | REBUILD | It is a historical plan, but it presents old implementation choices and planned work as the current stack. |
+| `9-Implementation.md` | REBUILD | Its package, class, endpoint, and outcome map has drifted from the source. |
+| `10-Cross-Host-Messaging.md` | REVISE | It labels most federation work proposed, but misses the shipped `coordinator:` lead channel. |
+| `11-Features.md` | REVISE | It is the right catalogue, but code-path names are old and it misses the second-herdr-daemon capability. |
+| `12-Claude-to-OpenCode.md` | REVISE | The porting guide is mostly current, but calls the product and spawned-member path a bridge. |
+| `13-User-Guide.md` | REVISE | It is the best operator page, but needs the product rename and the second-herdr-daemon setup. |
+
+## Pages needing work
+
+### `Home.md` — REVISE
+
+- Quote: `# claude-bridge` (line 1) and `` `claude-bridge` keeps`` (line 11).
+  The product is `fleet` / `fleetd`. The MCP server identifies itself as `fleet` in
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:313-315`.
+- Quote: `AgentAPI ... swappable fallback injector` (lines 73-76).
+  There is no AgentAPI implementation under `fleetd/src/main/java`; the actual
+  launchers are selected by `Profile.kind` in
+  `fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java:265-270`.
+
+### `_Sidebar.md` — REVISE
+
+- Quote: `### 📖 claude-bridge` (line 1).
+  Rename it to `fleet`. `FleetMcp` registers the current product-facing tool set at
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:301-326`.
+
+### `1-Architecture.md` — REBUILD
+
+- Quote: `` `claude-bridge` lets`` (line 3). The product was renamed; the MCP
+  server name is `fleet` (`FleetMcp.java:313-315`).
+- Quote: ``fleet_read`` in the tool list (line 102). No such tool is registered.
+  The complete registered list is `fleet_send` through `fleet_whoami` at
+  `FleetMcp.java:301-326`; `fleet_read` is absent.
+- Quote: `SSE (GET /events)` (line 143). `FleetApp.build()` registers no `/events`
+  route; its routes are listed at `FleetApp.java:143-159`.
+- Quote: `Redis Streams / NATS JetStream, or an embedded queue` (line 106).
+  The shipped durable inbox is AMQP, configured by `broker`, at
+  `FleetConfig.java:49-50` and `FleetConfig.java:655-714`.
+- Quote: `AgentAPI (fallback)` (line 107). No AgentAPI adapter exists; shipped
+  launcher kinds are `claude-code` and `opencode` (`FleetConfig.java:265-270`).
+
+### `2-Message-Server.md` — REBUILD
+
+- Quote: `claude mcp add --transport http bridge http://127.0.0.1:8080/mcp`
+  (line 67). The daemon defaults to port `8765` in `FleetConfig.java:183-187`,
+  and identifies its server as `fleet` at `FleetMcp.java:313-315`.
+- Quote: ``fleet_send(message, target?, {block, timeout_seconds, auto_spawn,
+  turn_id})`` (line 80). The real parameters are `sessionId`, `content`,
+  `timeoutMs`, `wait`, `turnId`, and `coordId` (`FleetMcp.java:1096-1108`).
+- Quote: ``fleet_read(target, source)`` (line 85). It is not registered; see the
+  complete registration at `FleetMcp.java:301-326`.
+- Quote: `docs/MCP-Contract.md ... normative` (lines 87-88). That is not a valid
+  reference: only §6 is current, as the current operator guide itself says at
+  `.wiki-snapshot/13-User-Guide.md:466`.
+- Quote: `SSE (GET /events)` (line 45). No route exists in the built REST surface,
+  `FleetApp.java:143-159`.
+
+### `3-Approaches.md` — REVISE
+
+- Quote: `AgentAPI ... remains a swappable fallback injector` (lines 78-84).
+  It was never built. The shipped adapter selection is only `claude-code` or
+  `opencode` (`FleetConfig.java:265-270`). Keep it as discarded research, not an
+  operational fallback.
+- Quote: `claude-bridge` (line 109). Rename the product to `fleet`; the runtime
+  package is `dev.ltms.fleet`, for example `FleetMcp.java:1`.
+
+### `4-Setup.md` — RETIRE
+
+It is a 25-line redirect and says its procedure was never written (lines 3-9).
+Chapter 13 is the maintained install procedure. Keeping a second navigation page
+adds no working documentation.
+
+### `5-Operations.md` — RETIRE
+
+It is a 35-line redirect and says its runbook was never written (lines 3-14).
+Chapter 13 now owns run and recovery instructions.
+
+### `6-Team.md` — REBUILD
+
+- Quote: `fleet_send {role: w-claude, prompt: A}` (line 98). `fleet_send` accepts
+  `sessionId` and `content`, not `role` or `prompt` (`FleetMcp.java:1096-1108`).
+- Quote: `some on Claude, some on the remote local LLM` (lines 3-5) and `Every
+  worker is ... Claude Code` (line 25). `opencode` is a first-class launcher kind,
+  not a Claude worker (`FleetConfig.java:265-270`).
+- Quote: `fleetd's concurrency policy` (line 121). The configured capacity control
+  is per-profile `maxLoad` (`FleetConfig.java:251-264`), not the role routing model
+  described here.
+
+### `7-Use-Cases.md` — REBUILD
+
+- Quote: `ccs profile` (line 10), `ccs + herdr` (line 22), and `ccs-spawn`
+  (line 45). The configuration has `profiles` and `fleet`, not `ccs`:
+  `FleetConfig.java:34-58` and `FleetConfig.java:81-101`.
+- Quote: `fleet_send({"to", "kind", "body", "block"})` (lines 55-62).
+  None of those are the shipped send parameters. The schema is
+  `FleetMcp.java:1096-1108`.
+- Quote: `fleet_list() → { "profiles": ... }` (lines 74-80). `fleet_list` is a
+  roster view; `fleet_profiles` is the configured-backend view, as registered at
+  `FleetMcp.java:307-311` and described at `FleetMcp.java:1176-1182`.
+
+### `8-Roadmap.md` — REBUILD
+
+- Quote: `Java 21+` (line 43). The current project guidance and source use Java 25;
+  the `FleetConfig` source itself uses Java 25 unnamed lambda parameters, for
+  example `FleetConfig.java:102`.
+- Quote: `herdr 0.7.0 / protocol 14` (line 46). The current REST health endpoint
+  reports the live protocol returned by herdr (`FleetApp.java:240-244`), while the
+  current operator guide records protocol 19 at
+  `.wiki-snapshot/13-User-Guide.md:76-85`.
+- Quote: `ccs <profile> claude` and `ccs env <profile>` (lines 47-48). Shipped
+  configuration uses `Profile` records and launcher `kind`,
+  `FleetConfig.java:313-330` and `FleetConfig.java:265-270`.
+- Quote: `Redis Streams via Lettuce` (line 50). The actual durable inbox is AMQP
+  `broker`, `FleetConfig.java:655-714`.
+
+### `9-Implementation.md` — REBUILD
+
+- Quote: `rest.FleetdApp` and `mcp.BridgeMcp` (lines 29-30). The classes are
+  `rest.FleetApp` and `mcp.FleetMcp` (`FleetApp.java:46`; `FleetMcp.java:67`).
+- Quote: `dev.ltms.fleetd` (line 67). The source package is `dev.ltms.fleet`
+  (`FleetMcp.java:1`).
+- Quote: `WorkerPresence` (line 110). The current class is `MemberPresence`, as
+  imported and used by `FleetMcp` at `FleetMcp.java:12` and `465-469`.
+- Quote: the outcome list ending in `STALE_TURN` (lines 128-131). The code also
+  has `BACKEND_EXHAUSTED` (`FleetMcp.java:550-554`) and async `ASKING` handling
+  (`FleetMcp.java:664-668`).
+- Quote: `FleetdApp` (line 207) and `FleetdConfig` (line 211). These names do not
+  resolve; current classes are `FleetApp` and `FleetConfig`.
+
+### `10-Cross-Host-Messaging.md` — REVISE
+
+- Quote: the chapter says the cross-host fabric is proposed except for the
+  single-host inbox (lines 3-8). Cross-host **lead-to-lead** delivery shipped:
+  `fleet_send` accepts `coordId` (`FleetMcp.java:1094-1107`) and publishes it at
+  `FleetMcp.java:616-641`; configuration has `coordinator` at
+  `FleetConfig.java:74-78` and `99-101`.
+- Quote: `bridge.dlx` (line 90). This product name is stale. The shipped lead path
+  uses `LeadChannel`, not the proposed exchange flow (`FleetMcp.java:95-96` and
+  `616-641`). Keep the proposed federation design, but add a clear shipped/proposed
+  boundary for CB-637.
+
+### `11-Features.md` — REVISE
+
+- Quote: `mcp/BridgeMcp` (line 22), `config/FleetdConfig` (lines 25-27), and other
+  index references. These paths no longer resolve; the source classes are
+  `mcp/FleetMcp` (`FleetMcp.java:67`) and `config/FleetConfig`
+  (`FleetConfig.java:81`).
+- Quote: `fleet_whoami` returns only `primary` or `worker` (lines 99-100).
+  It also returns `architect` (`FleetMcp.java:1235-1244`).
+- The page needs the missing separate member-herdr-daemon feature listed below.
+
+### `12-Claude-to-OpenCode.md` — REVISE
+
+- Quote: `same bridge mount` (line 5) and `a bridge-spawned worker` (line 94).
+  Rename the product path to `fleet`. The daemon exposes the MCP server as `fleet`
+  (`FleetMcp.java:313-315`), and profiles select OpenCode with `kind: opencode`
+  (`FleetConfig.java:332-335`).
+- Quote: the sample mount name is `fleetd` (line 67). The server name is `fleet`;
+  update the sample to avoid teaching a second product name.
+
+### `13-User-Guide.md` — REVISE
+
+- Quote: `The bridge is the only channel` (line 63). The invariant is correct, but
+  the product term needs the `fleet` rename. The daemon's MCP server name is
+  `fleet` (`FleetMcp.java:313-315`).
+- Quote: it describes one herdr socket (lines 72-85). It needs the optional
+  `memberHerdrSocket` setup and two-daemon health meaning. The config key is in
+  `FleetConfig.java:34-37`, and `/healthz` checks both daemons when configured at
+  `FleetApp.java:210-245`.
+
+## MISSING
+
+`11-Features.md` has a body section for **routing members through a separate herdr daemon**
+(`## memberHerdrSocket`, line 2174), but **no row in the index table** at the top of the page
+(lines 20-95). That table is how the page is meant to be read, so a capability absent from it is
+effectively undiscoverable. Lead note: this is my own omission — I added the section on 2026-08-31
+and did not add the matching row. Fixed in the wiki at `68e32c6`'s successor.
+
+The original audit stated the feature had no entry at all. That was wrong: the section exists. The
+gap is the index row. Recorded here rather than silently corrected, because the difference matters —
+"undocumented" and "documented but unindexed" are different jobs.
+
+Evidence for the feature itself: `FleetConfig.java:34-37` and `FleetApp.java:103-115`, `210-245`,
+and `247-263`.
+
+## Audit method and coverage
+
+I checked all 15 pages. I checked concrete tool, route, config, class, file, and
+product-name claims claim-by-claim on 11 pages: Home, Sidebar, 1, 2, 4, 5, 6, 7, 9,
+11, and 13. I skimmed the remaining four long historical or research pages (3, 8, 10,
+12), then checked their concrete claims that affect the verdict. This is an audit of
+the supplied snapshot, not a wiki rewrite.

e2e/README.md

@@ -2,11 +2,11 @@
 
 A standard, repeatable **live** end-to-end test of the two-way channel: it drives a real
 multi-turn conversation between a primary and an off-subscription worker **through the
-running `bridged` daemon**, captures the full transcript, and grades the channel.
+running `fleetd` daemon**, captures the full transcript, and grades the channel.
 
 This is the committed form of the ad-hoc channel test that discovered the CB-115 gaps
 (herdr `unknown` misclassification wedging delivery, dirty completion scrapes, and workers
-never calling `bridge_reply` in conversation). Run it after any change to the injector,
+never calling `fleet_reply` in conversation). Run it after any change to the injector,
 status handling, completion/failure paths, or the worker reply charter.
 
 ## What it exercises
@@ -20,7 +20,7 @@ construction** — it only calls the bridge's loopback REST face.
 ```mermaid
 sequenceDiagram
     participant T as conversation_test.py
-    participant B as bridged (REST)
+    participant B as fleetd (REST)
     participant W as worker (off-sub)
     T->>B: POST /workers  (spawn)
     T->>B: GET /sessions/{id}/status  (await ready)
@@ -28,7 +28,7 @@ sequenceDiagram
         T->>B: POST /sessions/{id}/message {wait:false}
         B-->>T: ticket
         B->>W: inject prompt (status-gated)
-        W-->>B: bridge_reply
+        W-->>B: fleet_reply
         T->>B: GET /tasks/{ticket}  (poll)
         B-->>T: done + reply
     end
@@ -37,7 +37,7 @@ sequenceDiagram
 
 ## Prerequisites
 
-- `bridged` is running (default REST on `http://127.0.0.1:8765`) with at least one worker
+- `fleetd` is running (default REST on `http://127.0.0.1:8765`) with at least one worker
   profile configured and its backend reachable.
 - herdr is up (the daemon needs it).
 - Python 3 (standard library only — no pip installs).
@@ -68,7 +68,7 @@ Per-turn grade:
 
 | Grade      | Meaning                                                              |
 |------------|---------------------------------------------------------------------|
-| `OK`       | delivered and resolved by an explicit `bridge_reply` (`source=reply`) |
+| `OK`       | delivered and resolved by an explicit `fleet_reply` (`source=reply`) |
 | `DEGRADED` | delivered and answered, but resolved via completion-scrape fallback |
 | `EMPTY`    | turn completed but the reply was empty                              |
 | `FAILED`   | the worker's turn ended in failure (`phase=failed`)                 |

e2e/conversation_sustained_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Sustained back-and-forth bridge test — ONE primary, ONE worker, many dependent turns
-over a fixed wall-clock window (default 5 minutes), through the running `bridged` daemon.
+over a fixed wall-clock window (default 5 minutes), through the running `fleetd` daemon.
 
 Where conversation_test.py proves a handful of turns work and issue_hunt_test.py proves
 fan-out isolation, this proves the channel stays healthy under a *sustained, stateful*
@@ -24,7 +24,7 @@ Usage:
     --turn-timeout  per-turn max wait, seconds    (default 150)
     --keep-worker   do not stop the worker at the end
 
-Exit code: 0 if every turn in the window resolved via a clean bridge_reply with no channel
+Exit code: 0 if every turn in the window resolved via a clean fleet_reply with no channel
 break; 1 otherwise. A live per-turn log streams to stdout so the run can be watched.
 """
 import argparse
@@ -47,12 +47,12 @@ STEPS = [7, 3, 11, 5, 9, 4, 13, 6, 8, 2]
 RULES = (
     "Let's play a running-total game across several messages. The total starts at 0. "
     "In each message I'll tell you to add a number; keep the running total yourself and "
-    "reply via bridge_reply with ONLY the current total as a plain integer — no words, no "
+    "reply via fleet_reply with ONLY the current total as a plain integer — no words, no "
     "punctuation, just the number. Do not restate the arithmetic. First move: add {step}."
 )
-NEXT = ("Add {step}. Reply via bridge_reply with only the new running total.")
+NEXT = ("Add {step}. Reply via fleet_reply with only the new running total.")
 REANCHOR = ("Let's re-sync — the running total is {total}. Now add {step}. Reply via "
-            "bridge_reply with only the new running total.")
+            "fleet_reply with only the new running total.")
 
 
 def parse_int(reply):
@@ -142,15 +142,15 @@ def main():
     print("=" * 72)
     print(f"SUSTAINED CONVERSATION SUMMARY — 1 primary <-> 1 worker over {dur}s (~{dur/60:.1f} min)")
     print(f"  turns:            {turns}")
-    print(f"  clean bridge_reply exchanges: {oks + drifts}/{turns}   (channel breaks: {breaks})")
+    print(f"  clean fleet_reply exchanges: {oks + drifts}/{turns}   (channel breaks: {breaks})")
     print(f"  arithmetic correct (continuity held): {oks}/{turns}   (drifts: {drifts})")
     print(f"  latency:          avg {avg}s over {turns} turns")
     ok = breaks == 0 and turns >= 2
     if ok and drifts == 0:
-        print("  RESULT: PASS — every turn resolved via bridge_reply and the worker held the "
+        print("  RESULT: PASS — every turn resolved via fleet_reply and the worker held the "
               "running total across the whole window.")
     elif ok:
-        print(f"  RESULT: PASS (channel) — every turn resolved via bridge_reply for the full "
+        print(f"  RESULT: PASS (channel) — every turn resolved via fleet_reply for the full "
               f"window; {drifts} arithmetic drift(s) (worker recovered after re-anchor).")
     else:
         print("  RESULT: FAIL — the channel broke on at least one turn (see CHANNEL BREAK above).")

e2e/conversation_test.py

@@ -1,10 +1,10 @@
 #!/usr/bin/env python3
 """Standard bridge conversation test — a multi-turn primary↔worker exchange through
-the running `bridged` daemon, fully captured, with automatic gap analysis.
+the running `fleetd` daemon, fully captured, with automatic gap analysis.
 
 This is the repeatable form of the ad-hoc channel test that surfaced the CB-115 gaps
 (herdr `unknown` misclassification, dirty completion scrape, workers not calling
-bridge_reply). It drives a real off-subscription worker over the live gateway exactly
+fleet_reply). It drives a real off-subscription worker over the live gateway exactly
 as a primary Opus session would (async fire-and-poll), records every turn, and grades
 the channel.
 
@@ -130,9 +130,9 @@ def grade(rec):
     phase, source, reply = rec["phase"], rec["source"], rec["reply"]
     has_reply = bool(reply and reply.strip())
     if phase == "done" and source == "reply" and has_reply:
-        return "OK", "clean explicit bridge_reply"
+        return "OK", "clean explicit fleet_reply"
     if phase == "done" and has_reply:
-        return "DEGRADED", f"resolved via {source} (worker did not call bridge_reply)"
+        return "DEGRADED", f"resolved via {source} (worker did not call fleet_reply)"
     if phase == "done" and not has_reply:
         return "EMPTY", "turn completed but reply was empty"
     if phase == "failed":
@@ -206,7 +206,7 @@ def main():
     ok = all(g in ("OK", "DEGRADED") for g in grades)
     reply_clean = all(g == "OK" for g in grades)
     if reply_clean:
-        print("  RESULT: PASS — every turn delivered and got a clean bridge_reply.")
+        print("  RESULT: PASS — every turn delivered and got a clean fleet_reply.")
     elif ok:
         print("  RESULT: PASS (with notes) — every turn delivered & replied, but some via fallback.")
     else:

e2e/fleet_ask_test.py

@@ -1,16 +1,16 @@
 #!/usr/bin/env python3
-"""Live bridge_ask test — the REVERSE rendezvous (CB-205), watched end to end.
+"""Live fleet_ask test — the REVERSE rendezvous (CB-205), watched end to end.
 
-Every other harness drives the forward path: primary `bridge_send` → worker `bridge_reply`.
+Every other harness drives the forward path: primary `fleet_send` → worker `fleet_reply`.
 This drives the one that runs the other way. A worker is told to pause its delegated turn,
-ask the primary a question via `bridge_ask`, and only finish once it has the answer — so the
+ask the primary a question via `fleet_ask`, and only finish once it has the answer — so the
 turn round-trips primary→worker→primary→worker inside a SINGLE delegation.
 
 The mechanics that only this path exercises:
 
   • a worker's mid-turn question surfacing on the primary's *own* blocked send (Outcome.QUESTION),
   • the `turnId` correlation that lets the primary answer the exact paused turn,
-  • the answer resuming that same turn and the worker's final `bridge_reply` landing on the
+  • the answer resuming that same turn and the worker's final `fleet_reply` landing on the
     re-opened forward waiter (never a stale or cross-wired one).
 
 It is two blocking REST calls, no polling:
@@ -24,7 +24,7 @@ Like the rest of the suite it talks ONLY to the bridge's REST face on loopback
 ANTHROPIC_BASE_URL and never touches herdr, so it is subscription-safe by construction.
 
 Usage:
-    python3 bridge_ask_test.py [--base URL] [--profile NAME] [--repo DIR] [--out DIR]
+    python3 fleet_ask_test.py [--base URL] [--profile NAME] [--repo DIR] [--out DIR]
                                [--send-timeout SECS] [--answer-timeout SECS] [--keep-worker]
 
     --base            bridge REST base URL              (default http://127.0.0.1:8765)
@@ -57,14 +57,14 @@ ANSWER_COLOR = "blue"
 
 # A task that CANNOT be completed without asking: the worker is not told which color to choose,
 # only that the primary will name one when asked. So a correct final reply is only reachable by
-# actually calling bridge_ask and using the answer.
+# actually calling fleet_ask and using the answer.
 TASK_PROMPT = (
     "You are a bridge worker in a quick coordination game. You do NOT know which color to pick — "
     "only the primary does. Do exactly this, in order:\n"
-    "1. Call the `bridge_ask` tool with EXACTLY this question: \"PICK A COLOR: red or blue?\"\n"
+    "1. Call the `fleet_ask` tool with EXACTLY this question: \"PICK A COLOR: red or blue?\"\n"
     "2. The primary will answer with one color word. Take that color and uppercase it.\n"
-    "3. Call `bridge_reply` with EXACTLY one line: CHOSEN=<COLOR>  (e.g. CHOSEN=GREEN if told green).\n"
-    "Do not guess a color. Do not call bridge_reply before bridge_ask has returned an answer. "
+    "3. Call `fleet_reply` with EXACTLY one line: CHOSEN=<COLOR>  (e.g. CHOSEN=GREEN if told green).\n"
+    "Do not guess a color. Do not call fleet_reply before fleet_ask has returned an answer. "
     "Do nothing else — no file reads, no other tools."
 )
 
@@ -134,7 +134,7 @@ def run(base, profile, repo, send_timeout, answer_timeout):
     rec.update(tid=tid, pane=pane, spawned=True)
     await_ready(base, tid)
 
-    # 1) Delegate the ask-forcing task. This blocks until the worker calls bridge_ask, at which
+    # 1) Delegate the ask-forcing task. This blocks until the worker calls fleet_ask, at which
     #    point our own send unblocks carrying the question and the turnId to answer on.
     print(f"[{now()}] delegating task (blocks until the worker asks; up to {send_timeout}s)…")
     t0 = time.time()
@@ -159,7 +159,7 @@ def run(base, profile, repo, send_timeout, answer_timeout):
         rec.update(phase="no_turnid", detail="question surfaced without a turnId to answer on")
         return rec
 
-    # 2) Answer on that exact turn. This blocks again until the resumed worker calls bridge_reply.
+    # 2) Answer on that exact turn. This blocks again until the resumed worker calls fleet_reply.
     print(f"[{now()}] answering '{ANSWER_COLOR}' on turn {rec['turnId']} (blocks until reply; up to {answer_timeout}s)…")
     t1 = time.time()
     rec["phase"] = "awaiting_reply"
@@ -188,7 +188,7 @@ def run(base, profile, repo, send_timeout, answer_timeout):
 def grade(rec):
     """PASS only if the worker asked, the turn resumed, and the reply reflects the answer."""
     if rec["phase"] == "no_question":
-        return "NO_ASK", "the worker finished/stalled without ever calling bridge_ask"
+        return "NO_ASK", "the worker finished/stalled without ever calling fleet_ask"
     if rec["phase"] in ("send_error", "answer_error", "spawn"):
         return "ERROR", rec.get("detail") or "transport error before the round-trip completed"
     if rec["phase"] == "no_turnid":
@@ -203,26 +203,26 @@ def grade(rec):
             return "OK", "asked, resumed the same turn, and the reply reflected the primary's answer"
         if reflected:
             return "DEGRADED", f"reply reflected the answer but resolved via {rec['replySource']} " \
-                               "(worker did not call bridge_reply cleanly)"
+                               "(worker did not call fleet_reply cleanly)"
         return "WRONG_ANSWER", f"the worker replied but did not reflect '{ANSWER_COLOR}' — " \
                                f"the answer may not have reached the resumed turn: {rec['reply']!r}"
     return "WEDGE", f"unexpected terminal phase {rec['phase']}: {rec.get('detail')}"
 
 
 def write_transcript(out_dir, rec, meta):
-    path = out_dir / "bridge_ask_transcript.md"
+    path = out_dir / "fleet_ask_transcript.md"
     g, note = grade(rec)
     with path.open("w") as f:
-        f.write(f"# Live bridge_ask — reverse rendezvous — {datetime.now():%Y-%m-%d %H:%M}\n\n")
+        f.write(f"# Live fleet_ask — reverse rendezvous — {datetime.now():%Y-%m-%d %H:%M}\n\n")
         f.write(f"One worker paused its delegated turn to ask the primary, then resumed with the "
                 f"answer (profile `{meta['profile']}`). Result: **`{g}`**.\n\n")
         f.write("## Round-trip\n\n")
         f.write(f"1. **primary → worker** (delegation): the ask-forcing task.\n")
-        f.write(f"2. **worker → primary** (`bridge_ask`, {rec.get('ask_latency')}s): "
+        f.write(f"2. **worker → primary** (`fleet_ask`, {rec.get('ask_latency')}s): "
                 f"{rec.get('question')!r} — surfaced on the primary's blocked send as a "
                 f"`question` with `turnId={rec.get('turnId')}`.\n")
         f.write(f"3. **primary → worker** (answer on that turn): `{ANSWER_COLOR}`.\n")
-        f.write(f"4. **worker → primary** (`bridge_reply`, {rec.get('answer_latency')}s, "
+        f.write(f"4. **worker → primary** (`fleet_reply`, {rec.get('answer_latency')}s, "
                 f"source={rec.get('replySource')}): {rec.get('reply')!r}\n\n")
         f.write(f"> **{g}:** {note}\n")
         if rec.get("detail"):
@@ -231,7 +231,7 @@ def write_transcript(out_dir, rec, meta):
 
 
 def main():
-    ap = argparse.ArgumentParser(description="Live bridge_ask reverse-rendezvous test (CB-205)")
+    ap = argparse.ArgumentParser(description="Live fleet_ask reverse-rendezvous test (CB-205)")
     ap.add_argument("--base", default="http://127.0.0.1:8765")
     ap.add_argument("--profile", default=None)
     ap.add_argument("--repo", default=str(REPO_ROOT))
@@ -241,7 +241,7 @@ def main():
     ap.add_argument("--keep-worker", action="store_true")
     args = ap.parse_args()
 
-    print(f"[{now()}] live bridge_ask: 1 primary, 1 worker "
+    print(f"[{now()}] live fleet_ask: 1 primary, 1 worker "
           f"(profile={args.profile or 'default'}, repo={args.repo})\n")
 
     rec = {"spawned": False, "pane": None}
@@ -262,7 +262,7 @@ def main():
 
     print()
     print("=" * 72)
-    print("LIVE bridge_ask SUMMARY — reverse rendezvous (CB-205)")
+    print("LIVE fleet_ask SUMMARY — reverse rendezvous (CB-205)")
     print(f"  asked:    {rec.get('question')!r}  (turnId={rec.get('turnId')}, {rec.get('ask_latency')}s)")
     print(f"  answered: {ANSWER_COLOR!r}")
     print(f"  replied:  {rec.get('reply')!r}  (source={rec.get('replySource')}, {rec.get('answer_latency')}s)")