CB-632 unit 3: point text references at fleetd.example.yaml

CB-632 unit 3: prefer fleetd.yaml, fall back to bridged.yaml; log the chosen file
CB-632 unit 3: rename the example config file to fleetd.example.yaml
2026-08-23 06:51:48 +02:00 · 2026-08-23 06:51:35 +02:00 · 2026-08-23 06:48:16 +02:00 · 2026-08-23 06:46:34 +02:00 · 2026-08-23 06:39:54 +02:00 · 2026-08-23 06:27:43 +02:00
198 changed files with 2265 additions and 1723 deletions
@@ -13,7 +13,7 @@ A design task is worked by two architects. Design alone first, then exchange and
 say plainly where you disagree. Do not concede just to agree.

 Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `bridge_ask{question}` only when a decision belongs to
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
 the lead, such as an unclear requirement or two defensible fixes. Do not ask about
 something you can decide by reading more code.

@@ -10,7 +10,7 @@ git worktree and branch. Never check out, rebase onto, or push to `main`. Confir
 the worktree root and branch before you edit. Use only paths under that root.

 Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `bridge_ask{question}` only when a decision belongs to
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
 the lead, such as an unclear requirement or two defensible fixes. Do not ask about
 something you can decide by reading more code.

@@ -12,7 +12,7 @@ Read the whole assigned scope before judging it. Review only that scope. If you
 something outside it, note it in one line and do not investigate it further. Do not
 run the build. The owner makes changes and runs checks.

-Use `bridge_ask{question}` only when a decision belongs to the lead, such as an
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
 unclear requirement or two defensible fixes. Do not ask about something you can
 decide by reading more code.

@@ -5,7 +5,7 @@ description: Implementer-role procedure for a bridged worker — verify your wor

 # Implementer worker — procedure

-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge, never commit `.mcp.json` or `wiki/`) is in **`CLAUDE.md` → Bridge communication →
 Worker** and already applies. This skill is only the *implement-and-hand-off procedure*.

@@ -85,7 +85,7 @@ host (`GITEA_HOST`) into your env for exactly this — the token can create a PR
 merge**.

 ```bash
-API="${GITEA_HOST%/}/api/v1/repos/lms/claude-bridge/pulls"
+API="${GITEA_HOST%/}/api/v1/repos/fleet/fleetd/pulls"
 BRANCH="$(git branch --show-current)"
 curl -sS -X POST "$API" \
  -H "Authorization: token ${GITEA_TOKEN}" \
@@ -103,7 +103,7 @@ fix it if the cause is yours (e.g. branch not pushed yet), and report the failur
 inventing a URL. If `GITEA_TOKEN` is unset your profile was not granted PR-create: push the branch
 and report its name so the lead opens the PR.

-## 6. Hand off — what goes in `bridge_reply`
+## 6. Hand off — what goes in `fleet_reply`

 The reply is the entire handoff; the lead cannot see your terminal.

@@ -130,7 +130,7 @@ sequenceDiagram
    I->>G: git push -u origin HEAD
    I->>G: POST /pulls (GITEA_TOKEN) — open PR to main
    G-->>I: html_url
-    I->>L: bridge_reply(PR url, branch, files, tests)
+    I->>L: fleet_reply(PR url, branch, files, tests)
    Note over L,G: the lead reviews the PR and merges on green — you never merge
 ```

@@ -53,7 +53,7 @@ Map each entry from `.mcp.json`:
  "$schema": "https://opencode.ai/config.json",
  "instructions": ["CLAUDE.md"],
  "mcp": {
-    "bridged":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
+    "fleetd":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
    "context7": { "type": "remote", "url": "https://example.dev/mcp", "enabled": true,
                  "headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" } },
    "gitea":    { "type": "local", "command": ["gitea-mcp", "-t", "stdio"], "enabled": true,
@@ -5,7 +5,7 @@ description: Reviewer-role procedure for a bridged worker — how to work a revi

 # Reviewer worker — procedure

-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies. This
 skill is only the *review procedure*: how to work the scope, and the exact shape of what you
 send back.
@@ -24,13 +24,13 @@ wrong.
  covers what it was given.
 - Do **not** edit files or run the build. You review; the owner acts.

-## 3. Reach for `bridge_ask` only for a genuine fork
+## 3. Reach for `fleet_ask` only for a genuine fork

 Ambiguous requirement, a missing acceptance criterion, "intended or a bug?", or two defensible
 fixes with different consequences — those are the lead's call, and guessing produces a
 confident-but-wrong finding. Anything you could settle by reading more code is yours to settle.

-## 4. The finding — what goes in `bridge_reply`
+## 4. The finding — what goes in `fleet_reply`

 Report the **single most important** real issue in the scope, in these four lines, under
 ~90 words:
@@ -69,8 +69,6 @@ jobs:
        env:
          RABBITMQ_DEFAULT_USER: guest
          RABBITMQ_DEFAULT_PASS: guest
-        ports:
-          - 5672:5672
    env:
      # Service containers are reachable from the job by their network alias on their internal port.
      AMQP_URI: amqp://guest:guest@rabbitmq:5672
@@ -1,3 +1,3 @@
 [submodule "wiki"]
 	path = wiki
-	url = ssh://git@git.ltms.dev:2224/lms/claude-bridge.wiki.git
+	url = ssh://git@git.ltms.dev:2224/fleet/fleetd.wiki.git
@@ -13,7 +13,7 @@ A design task is worked by two architects. Design alone first, then exchange and
 say plainly where you disagree. Do not concede just to agree.

 Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `bridge_ask{question}` only when a decision belongs to
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
 the lead, such as an unclear requirement or two defensible fixes. Do not ask about
 something you can decide by reading more code.

@@ -10,7 +10,7 @@ git worktree and branch. Never check out, rebase onto, or push to `main`. Confir
 the worktree root and branch before you edit. Use only paths under that root.

 Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `bridge_ask{question}` only when a decision belongs to
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
 the lead, such as an unclear requirement or two defensible fixes. Do not ask about
 something you can decide by reading more code.

@@ -12,7 +12,7 @@ Read the whole assigned scope before judging it. Review only that scope. If you
 something outside it, note it in one line and do not investigate it further. Do not
 run the build. The owner makes changes and runs checks.

-Use `bridge_ask{question}` only when a decision belongs to the lead, such as an
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
 unclear requirement or two defensible fixes. Do not ask about something you can
 decide by reading more code.

@@ -4,35 +4,35 @@

 > **Canonical block.** Everything down to §Layering is the portable bridge charter, copied verbatim
 > into every project that mounts the bridge MCP. Keep it byte-identical with the template in the
-> wiki ([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable
+> wiki ([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable
 > CLAUDE.md block*); improvements go to the template first, then out to each project. Anything
 > specific to *this* repo lives under §Project addendum below, never inline above it.

-If no `bridge_*` MCP tools are mounted in this session, this section does not apply — skip it.
+If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.

 `bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
 **primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
-through its `bridge_*` tools. No session addresses a peer, a broker, or the network directly.
+through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.

 ### Which role am I? — settle this before acting

 **Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.

-**Call `bridge_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
+**Call `fleet_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
 your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
 carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
 was bound to. Don't infer what you can ask.

 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
-fires: the reply charter in your system prompt (*"You are an off-subscription worker in the
+fires: the reply charter in your system prompt (*"You are a spawned member in the
 claude-bridge fleet"*) ⇒ **spawned member**; bridge tools prefixed `mcp__bridge__*` ⇒ **spawned
 member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
 `.mcp.json`, so it varies); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
 on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
-only `bridge_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+only `fleet_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
 two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
-loud and self-correcting — while a member acting as the primary ends its turn with no `bridge_reply`,
+loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
 and the sender silently receives nothing. Fail toward the recoverable error.

 ### Invariants — both roles, no exceptions
@@ -41,7 +41,7 @@ and the sender silently receives nothing. Fail toward the recoverable error.
   stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
   never move a session across that boundary.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
-   side cannot see your screen. An answer that isn't in a `bridge_*` call is silently discarded.
+   side cannot see your screen. An answer that isn't in a `fleet_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
   cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
   reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
@@ -57,10 +57,10 @@ and the sender silently receives nothing. Fail toward the recoverable error.

 **Delegate by default — that is the job.** With the bridge mounted you are an orchestrator on a
 metered subscription, and workers are cheap, parallel, and disposable. The default answer to "who
-does this?" is **a worker**, not you. Reach for `bridge_send` before you reach for `Edit`. The steps
+does this?" is **a worker**, not you. Reach for `fleet_send` before you reach for `Edit`. The steps
 below are the procedure — run them in order, every task, not only the big ones.

-0. **Know your role** — `bridge_whoami`, once per session, before anything else.
+0. **Know your role** — `fleet_whoami`, once per session, before anything else.
 1. **Split.** Write the unit list. Every unit carries: scope · the files or PR in question ·
   acceptance criteria · exactly what to report back. A unit with no acceptance criteria is not
   ready to delegate — refine it or keep it.
@@ -70,17 +70,17 @@ below are the procedure — run them in order, every task, not only the big ones
   delegate. The keep-list is closed: the conversation with the user, decomposition and planning,
   the final judgment call, verification, merges, and anything that depends on context only you
   hold. Nothing else is yours by default.
-3. **Spawn every delegated unit first** — `bridge_spawn{profile, worktree:true, ticket}`, one per
+3. **Spawn every delegated unit first** — `fleet_spawn{profile, worktree:true, ticket}`, one per
   unit, *before* sending any. Pass `profile` explicitly: profiles differ in model and cost, not in
   tier, so the default is rarely what you want.
-4. **Then send them all** — `bridge_send{sessionId, content, wait:false}`. Line 1 of every brief is
+4. **Then send them all** — `fleet_send{sessionId, content, wait:false}`. Line 1 of every brief is
   `Load the <name> skill.` naming the worker's playbook; those skills are opt-in and that line is
   what makes them reliable. Where the project ships no such skill, spell the procedure out in the
   brief instead. The brief is self-contained — the worker sees your message and the repo, nothing
   of your context, your plan, or your screen.
-5. **Collect** — `bridge_poll{ticket}` → `bridge_ack{target, msgId}`. Answer a worker's `bridge_ask`
-   with `bridge_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
-   `bridge_status`, never by reading its terminal; it also reports an open question and the `turnId`
+5. **Collect** — `fleet_poll{ticket}` → `fleet_ack{target, msgId}`. Answer a worker's `fleet_ask`
+   with `fleet_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
+   `fleet_status`, never by reading its terminal; it also reports an open question and the `turnId`
   that answers it. **A worker's ask waits ~55 seconds, and no nudge makes that longer** — so never
   brief a worker to "ask me". Decide before you delegate, or give it an explicit default.
 6. **Verify yourself.** Re-run the build and the checks. A worker cannot run your IDE tooling, any
@@ -93,11 +93,11 @@ below are the procedure — run them in order, every task, not only the big ones
   read it yourself.
 8. **Adjudicate, merge, tear down — yours alone.** Read the diff yourself: fully if it is small,
   targeted at the reported findings and the risky paths if it is large. Reviewer findings direct
-   your attention; they never substitute for it. Then merge, then `bridge_stop{paneId}`.
+   your attention; they never substitute for it. Then merge, then `fleet_stop{paneId}`.

 **Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
 silently becomes serial, and it is the most common way this layer is wasted. For the same reason,
-prefer `wait:false` + `bridge_poll` for anything non-trivial: a blocking `bridge_send` is capped by
+prefer `wait:false` + `fleet_poll` for anything non-trivial: a blocking `fleet_send` is capped by
 *your own* MCP client call timeout (~60s), well below the task's real runtime.

 **Delegating does not delegate responsibility.** Workers open PRs; you are the gate. Never delegate
@@ -105,21 +105,21 @@ the merge — and merging on a reviewer's word is delegating it by proxy.

 | Intent | Tool |
 |---|---|
-| Confirm your own role | `bridge_whoami` |
-| See backends available | `bridge_profiles` |
-| Start a member | `bridge_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
-| See the fleet | `bridge_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `bridge_status{sessionId}` |
-| Delegate (blocking) | `bridge_send{sessionId, content}` |
-| Delegate (long task) | `bridge_send{sessionId, content, wait:false}` → ticket → `bridge_poll{ticket}` |
-| Answer a member's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
-| Message a **peer lead** | `bridge_send{sessionId: <their terminal>, content}` — `bridge_list` → `leads` reports it. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `bridge_reply{content}` — the one case a lead replies |
-| Collect a held reply | `bridge_poll{target}` · then `bridge_ack{target, msgId}` |
-| Tear down a member | `bridge_stop{paneId}` |
+| Confirm your own role | `fleet_whoami` |
+| See backends available | `fleet_profiles` |
+| Start a member | `fleet_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
+| See the fleet | `fleet_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `fleet_status{sessionId}` |
+| Delegate (blocking) | `fleet_send{sessionId, content}` |
+| Delegate (long task) | `fleet_send{sessionId, content, wait:false}` → ticket → `fleet_poll{ticket}` |
+| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
+| Message a **peer lead** | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
+| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
+| Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
+| Tear down a member | `fleet_stop{paneId}` |

 ### Lead ↔ lead — coordinate, never delegate

-`bridge_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
+`fleet_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
 is a peer — an orchestrator with its own context, its own members, and its own judgment. An empty
 `members` array means no members are spawned; it says nothing about peers.

@@ -140,7 +140,7 @@ The traffic between leads is coordination and nothing else:
   against the code, and re-run the build. A peer's correction gets the same treatment — right or
   wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.

-Being messaged by a peer does not make you its worker: answer with `bridge_reply`, and push back on
+Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
 the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
 you.

@@ -148,11 +148,11 @@ you.

 1. **Load the playbook skill the lead named** before doing anything else.
 2. **Do the assigned scope only.** Note anything you spot outside it in one line; don't go hunt it.
-3. **`bridge_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
+3. **`fleet_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
   defensible fixes, "bug or intended?"). It blocks and you resume the *same* turn with the answer.
   Don't ask what you could decide yourself.
-4. **End the turn with exactly one `bridge_reply{content}`**, carrying your complete answer. This is
-   the whole handoff. No `bridge_reply` ⇒ the sender gets nothing and the exchange stalls.
+4. **End the turn with exactly one `fleet_reply{content}`**, carrying your complete answer. This is
+   the whole handoff. No `fleet_reply` ⇒ the sender gets nothing and the exchange stalls.
   Do **not** lean on the completion fallback to carry your answer for you: when you end a turn
   without replying, the bridge scrapes your pane, and it can return only the last 4000 characters.
   A clipped scrape is marked as partial, but the missing text is gone — your report reaches the
@@ -171,7 +171,7 @@ you.

 | Layer | Scope | Reaches |
 |---|---|---|
-| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `bridge_reply`* | every spawned member, at launch, every peer kind — never a lead |
+| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `fleet_reply`* | every spawned member, at launch, every peer kind — never a lead |
 | **this section** | protocol + orchestration policy | primary **and** every member that reads the repo — tracked in git, so worktrees inherit it |
 | role agent definition files | role contract and per-job procedure | a member whose launcher binds its role to the matching file in its worktree |
 | role playbook skills | per-job procedure (commit/PR recipe, finding format) | a member told to load one |
@@ -185,7 +185,7 @@ must obey belongs in the charter, not here.
 ## Project addendum — claude-bridge (not part of the canonical block)

 - **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
-  and the code behind the rules above is `mcp/BridgeMcp` (tools), `auth/Authz` (the role table),
+  and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
  `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
 - **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
  `reviewer` (scoped review → one structured finding). Name one in every delegation.
@@ -193,7 +193,7 @@ must obey belongs in the charter, not here.
  `port-to-opencode` (make an OpenCode session a participant in this workspace).
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
  (a submodule with its own remote).
- **Flows and the error model** — rendezvous, `bridge_ask`, detached delivery, turn-done fallback —
+- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, turn-done fallback —
  are diagrammed in `docs/MCP-Contract.md` **§6 only**. The rest of that page is a pre-build design
  doc whose tool names, parameter names and REST paths never caught up with the code, so do not use
  it as the tool reference (CB-609). Section 6 is kept out of this file because this file loads into
@@ -231,13 +231,13 @@ if the script is unavailable or a step fails, this is what it was protecting you
   daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
   logs this at startup — the script's `--check` is the only thing that reports it, and it checks
   whether the name resolves without ever printing the value.
-2. **Drain live members first.** `bridge_list`, then `bridge_stop` each member, and collect anything
-   you still want with `bridge_poll` before you kill anything. A restart drops in-flight tickets and
+2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
+   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
   rendezvous, and a member's report is not recoverable once its ticket is gone.
 3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
   it. The startup log names which keys it accepted and which it deferred — read those lines rather
   than assuming.
-4. **Re-check identity afterwards.** Call `bridge_whoami` and confirm it still answers `primary`. The
+4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
   lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
   demoted to worker, which refuses every orchestration call.
 5. **Prove the new jar is the one running.** Confirm a *fresh* `bridged listening` line at the end of
@@ -268,9 +268,9 @@ Before you call any work done, check the row that matches what you touched:

 | You changed… | Re-read and update… |
 |---|---|
-| a `bridge_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
+| a `fleet_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
 | `Authz` / the role table | invariant 3, and the primary-only vs worker-only claims |
-| `ConnectionIdentity` / how a caller is resolved | the `bridge_whoami` paragraph and the fallback ladder |
+| `ConnectionIdentity` / how a caller is resolved | the `fleet_whoami` paragraph and the fallback ladder |
 | `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__bridge__*`), and the layering table's top row |
 | the injector / status gating | invariant 4 |
 | worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
@@ -287,7 +287,7 @@ is a Roadmap line. A change that touches none of the three earns no entry, and t
 outcome rather than an omission.

 Then **propagate**: the block in this file and the template in the wiki
-([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
+([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
 block*) must stay byte-identical, and other projects carrying the block need the same edit. Verify
 rather than trust:

@@ -9,23 +9,23 @@ Sibling of [`crush-bridge`](https://git.ltms.dev/systems/vms) (which drives a he
 process*, so it inherits `CLAUDE.md`, hooks, skills, and MCP — just pointed at a
 cheaper/local model.

-## Leading approach — herdr-centric message server (`bridged`)
+## Leading approach — herdr-centric message server (`fleetd`)

-A small always-on message server, **`bridged`**, controls
+A small always-on message server, **`fleetd`**, controls
 [herdr](https://herdr.dev) (an agent multiplexer) over its Unix-socket API and exposes a
 clean 2-way messaging API as an **MCP server that both the primary and the workers mount** —
 one unified Claude setup and the **sole communication gateway** (REST/SSE stays for non-Claude
-clients; any broker is `bridged`-internal, below the gateway).
-herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `bridged` owns
+clients; any broker is `fleetd`-internal, below the gateway).
+herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `fleetd` owns
 policy (subscription boundary, session lifecycle, status-gated delivery) and the client
 contract. A Claude member launches with `ANTHROPIC_BASE_URL` pointed at the gateway,
 `https://llm.ltms.dev/anthropic`, plus a bearer token; the lead stays env-clean and calls
-`bridged`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.
+`fleetd`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.

 ```mermaid
 flowchart LR
    OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["bridged — standalone daemon (not a claude process)"]
+    subgraph BD["fleetd — standalone daemon (not a claude process)"]
        SRV["SERVER face<br/>MCP · REST/SSE · policy"]
        CLI["CLIENT face<br/>status-gated injector · herdr socket"]
        SRV --> CLI
@@ -34,8 +34,8 @@ flowchart LR
    W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
    M["llm.ltms.dev<br/>(the one gateway)"]

-    OPUS -->|"MCP bridge_send (blocks)"| SRV
-    W -.->|"MCP bridge_reply"| SRV
+    OPUS -->|"MCP fleet_send (blocks)"| SRV
+    W -.->|"MCP fleet_reply"| SRV
    CLI -->|"Unix socket<br/>send_text · events.subscribe"| HERDR
    HERDR -->|"drives PTY"| W
    W -->|"inference"| M
@@ -47,24 +47,27 @@ flowchart LR
 ```

 - **Subscription boundary:** the *primary* never sets `ANTHROPIC_BASE_URL` (stays on
-  Pro/Max). Only the *secondary* process is off-subscription — and `bridged` itself is a
+  Pro/Max). Only the *secondary* process is off-subscription — and `fleetd` itself is a
  plain daemon (no Anthropic quota), so it may poll/subscribe freely.
- **One gateway (unified MCP setup):** `bridged` is the **sole communication path** for every
+- **One gateway (unified MCP setup):** `fleetd` is the **sole communication path** for every
  Claude session. Primary and workers each mount it as an MCP server (one `claude mcp add`
-  line, same on both) and talk over MCP tools — `bridge_send` / `bridge_reply` /
-  `bridge_status` (with `bridge_ask` planned for the blocked-worker path). **No Claude session
-  ever addresses a broker, a peer, or the network
-  directly**; any queue is `bridged`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
-  mounting the bridge is subscription-safe by construction.
- **How the primary consumes a reply:** a single **blocking MCP call** (`bridge_send`);
-  `bridged` holds it open until the worker calls `bridge_reply` or its turn hits
+   line, same on both) and talk over MCP tools — `fleet_send` / `fleet_reply` /
+   `fleet_status` (with `fleet_ask` planned for the blocked-worker path). **No Claude session
+   ever addresses a broker, a peer, or the network
+   directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
+   mounting the bridge is subscription-safe by construction.
+   **Tool naming:** the tools were renamed from `bridge_*` to `fleet_*` (CB-622). The daemon
+   still answers the old `bridge_*` names for one release, but they are deprecated — use the
+   `fleet_*` names.
+- **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
+  `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
  `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so
  no quota burn. SSE is an optional side-channel for humans/dashboards watching status.
- **Worker → primary** rides `bridged`'s **MCP rendezvous** — the reply resolves the primary's
-  blocking call (or, for detached work, `bridged` **injects the primary's idle pane** when it's
+- **Worker → primary** rides `fleetd`'s **MCP rendezvous** — the reply resolves the primary's
+  blocking call (or, for detached work, `fleetd` **injects the primary's idle pane** when it's
  ready), so *no keystroke-into-primary and no broker are involved, even single-host*. The one
  exception: a split-host primary that isn't a herdr pane wakes via its own `Stop`-hook, which
-  polls **`bridged`** (never a broker). See the wiki for the two topologies.
+  polls **`fleetd`** (never a broker). See the wiki for the two topologies.
 - **Different model per process** sidesteps Claude Code's lack of per-subagent provider
  routing — the worker isn't a subagent, it's its own configured process.
 - **AgentAPI** ([`coder/agentapi`](https://github.com/coder/agentapi)) is retained only as a
@@ -73,11 +76,11 @@ flowchart LR

 ## Docs

-Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/lms/claude-bridge/wiki)**,
+Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/fleet/fleetd/wiki)**,
 vendored here as a submodule under [`wiki/`](./wiki):

 ```bash
-git clone --recurse-submodules ssh://git@git.ltms.dev:2224/lms/claude-bridge.git
+git clone --recurse-submodules ssh://git@git.ltms.dev:2224/fleet/fleetd.git
 # or, after a plain clone:
 git submodule update --init
 ```
@@ -87,7 +90,7 @@ Gitea wiki.

 ## Status

-🟢 **Implemented & dogfooded** — the herdr-centric **`bridged`** message server is built and in
+🟢 **Implemented & dogfooded** — the herdr-centric **`fleetd`** message server is built and in
 real use: an Opus primary delegates tasks to off-subscription workers that reply through the
 bridge (code reviews delegated this way have produced committed bug fixes). Selected as the
 primary approach 2026-07-11, superseding the AgentAPI plan (2026-07-08); AgentAPI retained as a
@@ -98,9 +101,9 @@ tests run separately via `mvn test -Pcontract`):

 - **Core gateway** — herdr socket client (contract-tested vs live 0.7.0); guard-checked worker
  spawn with `ANTHROPIC_BASE_URL` injected only into the worker's env; status-gated injector;
-  blocking `bridge_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
- **MCP tools** — `bridge_send` / `bridge_reply` / `bridge_status` (messaging) and `bridge_spawn`
-  / `bridge_list` / `bridge_stop` / `bridge_profiles` / `bridge_poll` (fleet). Caller identity is
+  blocking `fleet_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
+- **MCP tools** — `fleet_send` / `fleet_reply` / `fleet_status` (messaging) and `fleet_spawn`
+  / `fleet_list` / `fleet_stop` / `fleet_profiles` / `fleet_poll` (fleet). Caller identity is
  connection-based (loopback peer PID → herdr pane), so the same mount serves primary and workers.
 - **Delivery reliability** — completion fallback (a confirmed `working→idle` turn resolves a
  send); async fire-and-poll (beats the caller's MCP call timeout for long tasks); and failure
@@ -108,7 +111,7 @@ tests run separately via `mvn test -Pcontract`):
 - **Fleet** — multiple worker profiles, each with an independent base_url guard check; workers
  inherit the primary's working directory (never `$HOME`); a readiness gate holds delivery until
  a worker's Claude has connected the bridge MCP (no paste lost into its boot window).
- **Blocked-worker path** — `bridge_ask` reverse rendezvous: a worker pauses its delegated turn to
+- **Blocked-worker path** — `fleet_ask` reverse rendezvous: a worker pauses its delegated turn to
  ask the primary and resumes the *same* turn with the answer (CB-205).
 - **Session lifecycle** — session manager with spawn/reuse/recycle, `idle_ttl` reaper, `context_cap`,
  and graceful drain on shutdown (CB-301/CB-303); per-worker git worktrees on their own branch with
@@ -2,7 +2,7 @@
 target/
 dependency-reduced-pom.xml

-# Local runtime config (copy from bridged.example.yaml)
+# Local runtime config (copy from fleetd.example.yaml)
 bridged.yaml

 # CB-505 audit trail + daemon stdout/stderr — runtime records, never source
@@ -5,10 +5,10 @@

 ## Why this exists

-Stage 2 gave a worker→primary reply a **durable place to wait** when no `bridge_send` is
+Stage 2 gave a worker→primary reply a **durable place to wait** when no `fleet_send` is
 open: it lands in `agent.<target>.inbox` on the broker and survives a daemon bounce. But
 delivery is still **pull** — the primary only sees the reply if it happens to call
-`bridge_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
+`fleet_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
 the primary works on something else.

 This layer makes delivery **active**: the bridge *pushes* a nudge to the primary the moment
@@ -26,11 +26,11 @@ pointed at the primary's pane instead.

 ```mermaid
 flowchart LR
-    W["worker"] -->|"bridge_reply (no open send)"| MS["MessageService.reply"]
+    W["worker"] -->|"fleet_reply (no open send)"| MS["MessageService.reply"]
    MS -->|"inbox.publish"| INBOX[("agent.&lt;target&gt;.inbox<br/>(durable, LavinMQ)")]
    MS -->|"notify"| LOOP["ReplyPushLoop"]
    LOOP -->|"status-gated inject"| PANE["primary's herdr pane"]
-    PANE -->|"primary drains"| DRAIN["bridge_poll(target)<br/>= peek + ack"]
+    PANE -->|"primary drains"| DRAIN["fleet_poll(target)<br/>= peek + ack"]
    DRAIN -->|"inbox now empty"| LOOP
    LOOP -.->|"still non-empty →<br/>re-inject on backoff"| PANE
    classDef store fill:#2c5282,stroke:#1a365d,color:#ffffff;
@@ -51,13 +51,13 @@ the caller runs in a herdr pane on this host. Today it's discarded for the prima
 (`presence.markPresent` is a no-op on it).

 **Plan:** a single-slot `PrimaryRegistry` (thread-safe) holding the primary's `terminal_id`.
-Populate it from the **orchestration-side** MCP tools — `bridge_send`, `bridge_spawn`,
-`bridge_poll`, `bridge_list`, `bridge_status`, `bridge_profiles` — capturing
+Populate it from the **orchestration-side** MCP tools — `fleet_send`, `fleet_spawn`,
+`fleet_poll`, `fleet_list`, `fleet_status`, `fleet_profiles` — capturing
 `callerTerminal(exchange)` when it is (a) non-null and (b) **not** a registered worker
 session in `SessionManager`. That caller is, by construction, the primary. Worker-side tools
-(`bridge_reply`, `bridge_ask`) never set it.
+(`fleet_reply`, `fleet_ask`) never set it.

- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `BridgedConfig`
+- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `FleetConfig`
  (nested record, same shape as `Broker`). Lets an operator pin it, or supply it when
  derivation can't (see degrade case).
 - **Degrade:** if the primary is off-host or in a non-herdr terminal, `terminalForPid`
@@ -71,13 +71,13 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
 (`MessageService.reply` → the `inbox.publish` branch, `MessageService.java:192`).

 - **Inject a nudge, not the payload.** The injected turn tells the primary *to drain*
-  (e.g. "Worker `<target>` returned a reply — run `bridge_poll(target=<target>)` to collect
+  (e.g. "Worker `<target>` returned a reply — run `fleet_poll(target=<target>)` to collect
  it"), it does **not** carry the reply text. Rationale: replies can be large/multiline and
  terminal injection would mangle them; the drain response is the clean transport. Keeps the
  push idempotent — re-nudging is harmless.
 - **Ack = drain.** The primary draining (`drainReplies` = peek + ack) is the acknowledgement.
  The loop's **stop condition is `inbox.peek(target).isEmpty()`** — the reply is gone from the
-  inbox because it was acked. No new `bridge_ack` tool needed for v1 (see Increment 3).
+  inbox because it was acked. No new `fleet_ack` tool needed for v1 (see Increment 3).
 - **Status-gated injection (mechanism (b), chosen).** A dedicated lightweight scheduled loop,
  **not** the worker `Injector`. It injects via `AgentControl.send(primaryTerminal, nudge)`
  (the same herdr `agent.send` = `pane send-text` + submit that delivers to workers) only when
@@ -93,10 +93,10 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
  the reply remains in the durable inbox and the next natural poll (or a later worker reply's
  nudge) still surfaces it. Bounded so the bridge never spams the primary.

-### Increment 3 — optional per-`msgId` `bridge_ack` tool (deferred)
+### Increment 3 — optional per-`msgId` `fleet_ack` tool (deferred)

 Drain-as-ack is coarse: it clears *all* pending replies for a target at once. If finer
-control is ever needed (ack one reply, leave others held), add a `bridge_ack(msgId)` tool
+control is ever needed (ack one reply, leave others held), add a `fleet_ack(msgId)` tool
 mapping to `inbox.ack(target, msgId)` — the port already supports per-`msgId` ack. Not built
 in v1; the stop-on-empty loop is sufficient.

@@ -106,7 +106,7 @@ in v1; the stop-on-empty loop is sufficient.
   resolved terminal is non-null **and not a registered worker session**, seen on an
   orchestration-side tool. This never mislabels a worker (workers are in `SessionManager`)
   and needs no new env var or argument (identity stays connection-derived, per the existing
-   `BridgeMcp` invariant).
+   `FleetMcp` invariant).

 2. **Readiness-gate mismatch → dedicated loop.** The existing `Injector` gates delivery on
   `ready.test(target)` = `WorkerPresence` (the *worker's* MCP connected). The primary is not
@@ -132,7 +132,7 @@ boundary**. The bridge is signalling the primary that it has mail — not drivin
  non-null terminal AND not a registered session" predicate; the loop's stop-on-empty and
  bounded-reminder logic with an injected clock + a fake injector (no real herdr).
 - **Live dogfood (primary-side):** with the daemon on the broker jar + a real worker,
-  delegate a task, let the worker reply after the `bridge_send` window closes, and observe the
+  delegate a task, let the worker reply after the `fleet_send` window closes, and observe the
  bridge inject a drain nudge into *this* primary pane; confirm draining stops the reminders;
  confirm an unreachable primary (registry empty) degrades to pull with no loss.

@@ -35,7 +35,7 @@ bind:
 # a caller whose connection maps to this pane resolves as the primary (no credential needed —
 # the pane mapping is as unforgeable as a worker's), and reply nudges are pushed to it.
 # REQUIRED when the primary runs inside a herdr pane — without it the pane match reads the
-# primary as a worker and refuses spawn/send/stop. Get the id from bridge_whoami; re-pin if
+# primary as a worker and refuses spawn/send/stop. Get the id from fleet_whoami; re-pin if
 # the primary moves panes.
 # primary:
 #   terminal: term_0123456789abcd
@@ -49,12 +49,12 @@ bind:
 #
 #   tab → the ONLY field identity depends on (CB-579); the exact label of the tab hosting the lead.
 #         Label the tab yourself, or let bridged label one it launches — see `fleet.leaders:` below.
-#   kind/model → descriptive; they document what runs in the pane and are echoed by bridge_whoami
+#   kind/model → descriptive; they document what runs in the pane and are echoed by fleet_whoami
 #
 # A lead's tab must already carry its label (or be launched by bridged, which labels it) — there is
 # no terminal id to paste in and nothing to re-pin when the session restarts: the tab survives, so
 # the same label resolves the same lead again on the next scan.
-# `bridge_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
+# `fleet_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
 # IS a primary for authorization, so nothing that keys on the role breaks.
 #
 # KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
@@ -69,7 +69,7 @@ bind:
 # never a capability: what a pane may do is decided by the role the daemon resolves for it.

 # CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
-# idle (no open bridge_send driving it) past the quiet period. The fleet is one lead + architects +
+# idle (no open fleet_send driving it) past the quiet period. The fleet is one lead + architects +
 # workers, so a lead that stalls is a single point of failure; the ReplyPushLoop only nudges when a
 # reply lands, and this timer catches the gap where nothing lands and the lead just sits idle.
 #
@@ -99,7 +99,7 @@ bind:
 #                      them changes nothing right now, and no minimum is enforced on either, because
 #                      nothing reads them to enforce one. They exist so a later build can start
 #                      honouring them without another config-shape change.
-#   notifications.mode → "webhook" flips what bridge_list REPORTS (healthCoverage: "full" instead
+#   notifications.mode → "webhook" flips what fleet_list REPORTS (healthCoverage: "full" instead
 #                      of "detection-only") — it does NOT make bridged send any webhook call; no
 #                      delivery mechanism is implemented yet. Any other value, or omitting the
 #                      block, reports "detection-only".
@@ -152,7 +152,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
 #                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
 #   exhaustedPattern → regex matched against a completion-fallback scrape (CB-578 stage A) to
-#                      classify a turn that ended with no bridge_reply as the backend having
+#                      classify a turn that ended with no fleet_reply as the backend having
 #                      refused on a subscription usage limit, rather than a real answer. Opt-in —
 #                      omit and this profile's completion fallback behaves exactly as before.
 #                      Every backend words its refusal differently, so this is config, never a
@@ -179,7 +179,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
 #                      only to override that or add more (JAVA_HOME, …). Since the default is the
 #                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
-#                      lines in deploy/dev.ltms.bridged.plist and deploy/bridged.service.
+#                      lines in deploy/dev.ltms.fleet.plist and deploy/bridged.service.
 #
 #                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
 #                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
@@ -200,12 +200,12 @@ profiles:
    # weight: relative selection weight for automatic placement (weighted, round-robin, and
    # fixed's fallback walk). Absent defaults to 1.0. An explicit 0 or negative value means
    # "never auto-select this profile" (CB-554) — it stays reachable via an explicit
-    # `bridge_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
+    # `fleet_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
    # selection skips it.
    weight: 0.5
    # maxLoad: max live workers on this profile. Omit for unlimited. An explicit 0 (CB-585) caps
    # the profile at zero live members — it is excluded from automatic placement and an explicit
-    # `bridge_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
+    # `fleet_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
    # is named directly. Negative is refused at config load — there is no sane meaning for it.
    maxLoad: 2
    # subscription: true
@@ -224,7 +224,7 @@ profiles:
    #   subscription path no guard would vet the URL, so allowing both would be a way around the
    #   guard rather than a configuration.
    #
-    #   GOTCHA 1 — it is invisible to the startup secret check. `Bridged.reportRequiredSecrets`
+    #   GOTCHA 1 — it is invisible to the startup secret check. `Fleetd.reportRequiredSecrets`
    #   skips subscription profiles on purpose (they need no token), so a boot log that reports
    #   every secret as fine says nothing about these profiles.
    #
@@ -259,8 +259,8 @@ profiles:
  # The bridge MCP + reply charter mount via a generated OPENCODE_CONFIG file, and the model is a
  # `provider/model` selector. Placement, tabs, cwd, and the readiness gate are shared with Claude.
  #
-  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → bridge_send →
-  # structured bridge_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
+  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → fleet_send →
+  # structured fleet_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
  # and need NO credentials — check `opencode models` for the current free list, since the names
  # change. That also makes the worker off-subscription by construction.
  #   opencode-free:
@@ -342,7 +342,7 @@ placement: weighted
 #               / credentialId. Those are hot because the placement policy (and, for credentialId,
 #               the CB-578 stage B quarantine check) reads them through a supplier — being config is
 #               not by itself enough to make a key hot.
-#               EXCEPT `fleet.leaders`: Bridged.main reads it once at startup to build the lead tab
+#               EXCEPT `fleet.leaders`: Fleetd.main reads it once at startup to build the lead tab
 #               scanner and launcher, and neither is rebuilt on reload. A changed/added/removed
 #               `fleet.leaders` entry is silently accepted — the reload reports "config reloaded"
 #               with nothing in the deferred list — but has NO effect until you restart. Treat it
@@ -447,7 +447,7 @@ fleet:
  #                                  # MUST NOT be a member workspace — those are excluded from the
  #                                  # scan, so a lead placed in one is never found again.
  #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
-  #     kind: claude                 # descriptive; reported by bridge_whoami
+  #     kind: claude                 # descriptive; reported by fleet_whoami
  #   gpt-sol-5.6:
  #     tab: "lead: gpt-sol-5.6"
  #     kind: opencode
@@ -600,7 +600,7 @@ guard:
 #   uri: amqp://guest:guest@127.0.0.1:5672
 #   prefetch: 32

-# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open bridge_send,
+# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open fleet_send,
 # the ReplyPushLoop injects a *drain nudge* (never the payload) into the primary's own herdr
 # pane — status-gated (only when injectable, never mid-turn) and bounded. Ack = drain: the loop
 # stops as soon as the primary's inbox is empty.
@@ -615,7 +615,7 @@ guard:
 #                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
 #                    self-locking: the learned terminal is populated by the very orchestration
 #                    calls being refused, so only this pinned value can break the cycle. Read the
-#                    id off bridge_whoami (it reports the current terminal even while
+#                    id off fleet_whoami (it reports the current terminal even while
 #                    misclassified) and re-pin whenever the primary moves panes.
 #   pushReminders  → max nudges before giving up (default 5)
 #   pushBackoffMs  → delay between nudges in ms (default 15000)
@@ -5,17 +5,17 @@
    <modelVersion>4.0.0</modelVersion>

    <groupId>dev.ltms</groupId>
-    <artifactId>bridged</artifactId>
+    <artifactId>fleetd</artifactId>
    <version>1.0.0</version>
    <packaging>jar</packaging>

-    <name>bridged</name>
-    <description>claude-bridge message server: sole gateway between primary/worker Claude sessions and herdr</description>
+    <name>fleetd</name>
+    <description>fleet message server: sole gateway between a lead session, its members, and herdr</description>

    <properties>
        <maven.compiler.release>25</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <mainClass>dev.ltms.bridged.Bridged</mainClass>
+        <mainClass>dev.ltms.fleet.Fleetd</mainClass>

        <jackson.version>2.19.0</jackson.version>
        <javalin.version>6.7.0</javalin.version>
@@ -161,6 +161,9 @@
    </dependencies>

    <build>
+        <!-- CB-632: stays 'bridged' until the cutover renames the module dir and the launchd
+         plist together. The installed plist names bridged/target/bridged.jar and
+         KeepAlive is armed, so renaming the jar alone strands a restart. -->
        <finalName>bridged</finalName>
        <plugins>
            <plugin>
@@ -1,56 +1,57 @@
-package dev.ltms.bridged;
+package dev.ltms.fleet;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.config.ConfigRef;
-import dev.ltms.bridged.config.ConfigWatcher;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.LeadTabScanner;
-import dev.ltms.bridged.lead.LeadLauncher;
-import dev.ltms.bridged.herdr.PaneLocator;
-import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.ExhaustedPatternLookup;
-import dev.ltms.bridged.inject.ExhaustionSink;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.inject.StatusPoller;
-import dev.ltms.bridged.inject.TurnListener;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.auth.MemberRegistry;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.mcp.BridgeMcp;
-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.health.FleetHealthMonitor;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.mcp.LsofPeerPidLookup;
-import dev.ltms.bridged.mcp.LsofProcessCwdLookup;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.msg.LeadHeartbeatLoop;
-import dev.ltms.bridged.msg.ReplyPushLoop;
-import dev.ltms.bridged.rest.BridgedApp;
-import dev.ltms.bridged.session.GitWorktrees;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.session.SessionReaper;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.member.CompositePeerLauncher;
-import dev.ltms.bridged.member.HerdrPeerLauncher;
-import dev.ltms.bridged.member.OpenCodeLauncher;
-import dev.ltms.bridged.placement.BackendQuarantine;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.ConfigWatcher;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.lead.LeadLauncher;
+import dev.ltms.fleet.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.UnixSocketHerdrClient;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.CompletionResolver;
+import dev.ltms.fleet.inject.ExhaustedPatternLookup;
+import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.StatusPoller;
+import dev.ltms.fleet.inject.TurnListener;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.health.FleetHealthMonitor;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.mcp.LsofPeerPidLookup;
+import dev.ltms.fleet.mcp.LsofProcessCwdLookup;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.msg.LeadHeartbeatLoop;
+import dev.ltms.fleet.msg.ReplyPushLoop;
+import dev.ltms.fleet.rest.FleetApp;
+import dev.ltms.fleet.session.GitWorktrees;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.session.SessionReaper;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.member.HerdrPeerLauncher;
+import dev.ltms.fleet.member.OpenCodeLauncher;
+import dev.ltms.fleet.placement.BackendQuarantine;
 import io.javalin.Javalin;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -72,17 +73,33 @@ import java.util.stream.Collectors;
 * starts listening. Before anything else it asserts its own environment is clean —
 * {@code bridged} is not a Claude process and must never carry a base_url.
 */
-public final class Bridged {
+public final class Fleetd {

-    private static final Logger log = LoggerFactory.getLogger(Bridged.class);
+    private static final Logger log = LoggerFactory.getLogger(Fleetd.class);

    /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
    private static final long HERDR_WAIT_SECONDS = 30;
    private static final long HERDR_WAIT_POLL_MILLIS = 500;

+    /**
+     * CB-632: prefer {@code fleetd.yaml} in {@code dir}; fall back to {@code bridged.yaml} when
+     * the new name is not there. The operator's live file is still named {@code bridged.yaml},
+     * so the old name keeps working until that file moves.
+     */
+    static Path chooseDefaultConfigFile(Path dir) {
+        Path fleetd = dir.resolve("fleetd.yaml");
+        if (Files.exists(fleetd)) {
+            return fleetd;
+        }
+        return dir.resolve("bridged.yaml");
+    }
+
    static void main(String[] args) {
-        Path configPath = Path.of(args.length > 0 ? args[0] : "bridged.yaml");
-        BridgedConfig cfg = BridgedConfig.load(configPath);
+        Path configPath = args.length > 0 ? Path.of(args[0]) : chooseDefaultConfigFile(Path.of(""));
+        // CB-632: the config file is being renamed bridged.yaml -> fleetd.yaml. Name the file we
+        // actually loaded, whichever of the two names it carries.
+        log.info("Using configuration file {}", configPath);
+        FleetConfig cfg = FleetConfig.load(configPath);
        // CB-594: report which secret env vars the config actually needs, by name, before anything
        // else can fail on a silently-empty one. A daemon started without a login shell (launchd)
        // boots fine either way — this is the only thing that says so out loud.
@@ -127,8 +144,8 @@ public final class Bridged {
        // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
        // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
        // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
-        Map<String, BridgedConfig.Profile> claudeProfiles = new LinkedHashMap<>();
-        Map<String, BridgedConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> claudeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
        cfg.profiles().forEach((name, w) -> {
            if (w.isOpenCode()) {
                opencodeProfiles.put(name, w);
@@ -157,7 +174,7 @@ public final class Bridged {
        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
        // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
        // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
-        // The cooldown is deferred (see BridgedConfig#quarantineCooldownSeconds): it is read once
+        // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
        // here, at startup, and a config reload only changes it for a daemon restart.
        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
@@ -227,7 +244,7 @@ public final class Bridged {
        var leaders = cfg.fleet().leaders();
        if (!leaders.isEmpty()) {
            Set<String> memberSpaces = cfg.profiles().values().stream()
-                    .map(BridgedConfig.Profile::workspace)
+                    .map(FleetConfig.Profile::workspace)
                    .filter(Objects::nonNull)
                    .collect(Collectors.toSet());
            Map<String, String> tabToName = new LinkedHashMap<>();
@@ -332,7 +349,7 @@ public final class Bridged {
            }

            @Override
-            public void onDelivered(String target, dev.ltms.bridged.msg.TurnToken token) {
+            public void onDelivered(String target, dev.ltms.fleet.msg.TurnToken token) {
                completion.onDelivered(target, token);
                sessions.onDelivered(target, token);
            }
@@ -389,7 +406,7 @@ public final class Bridged {
        // CB-502: the registry is built before the service and the push loop so send/reply outcomes
        // are counted at their single funnel rather than at each of the two caller-facing surfaces.
        // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
-        Metrics metrics = BridgedMetrics.create(sessions, replyInbox);
+        Metrics metrics = FleetMetrics.create(sessions, replyInbox);
        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
                pushScheduler, maxReminders, backoffMs, metrics);
        // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
@@ -480,18 +497,18 @@ public final class Bridged {
            log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
        }

-        BridgeMcp mcp = new BridgeMcp(messages, workers, sessions, identity, presence,
-                primaryRegistry, callers, metrics, new BridgeMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
+        FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
+                primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
                profile -> {
                    var configured = config.get().profiles().get(profile);
                    return configured == null ? null : configured.maxLoad();
                }, () -> config.get().profiles().keySet(), System::nanoTime),
-                new BridgeMcp.HealthCoverageSource(() -> {
+                new FleetMcp.HealthCoverageSource(() -> {
                    var health = config.get().health();
                    return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
                            health != null && health.notifications() != null && health.notifications().configured());
                }),
-                new BridgeMcp.QuarantineSource(profile -> {
+                new FleetMcp.QuarantineSource(profile -> {
                    var configured = config.get().profiles().get(profile);
                    return configured == null ? null : configured.effectiveCredentialId();
                }, quarantine));
@@ -530,7 +547,7 @@ public final class Bridged {
            herdr.close();
        }));

-        Javalin app = new BridgedApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
+        Javalin app = new FleetApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
                callers, metrics).build();
        app.start(cfg.bind().host(), cfg.bind().port());
        log.info("bridged listening on {}:{}, herdr socket {}",
@@ -546,7 +563,7 @@ public final class Bridged {
     * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
     * (or labelled its tab) only once it was up, so there is no boot window to guard.
     *
-     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code BridgeMcp} marks presence
+     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code FleetMcp} marks presence
     * for every spawned member (worker and architect), deliberately, since that map doubles as the
     * member roster's availability signal and a lead counted there would show up as an available
     * member. So without the second disjunct a lead is permanently un-deliverable: every
@@ -563,19 +580,19 @@ public final class Bridged {
    /**
     * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
     * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
-     * {@link BridgedConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
+     * {@link FleetConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
     * where set (opt-in). Derived from the config, not hard-coded, so a new profile is covered for
     * free. A var required by more than one profile is one entry naming every profile that needs
     * it. Deliberately excludes {@code auth.tokenEnv}: that one is already enforced loudly, by a
     * startup throw in {@code main()} — about 370 lines <em>below</em> this method's call site
-     * ({@link #reportRequiredSecrets(BridgedConfig)}), not a few lines above it. That throw only
+     * ({@link #reportRequiredSecrets(FleetConfig)}), not a few lines above it. That throw only
     * fires when {@code auth.mode: token} is configured; under the default loopback-trust mode it
     * never runs, and {@code auth.tokenEnv} is simply not required.
     *
     * <p>Package-private and pure (no I/O, no logging) so the derivation is unit-testable without
-     * capturing log output; {@link #reportRequiredSecrets(BridgedConfig)} is the logging caller.
+     * capturing log output; {@link #reportRequiredSecrets(FleetConfig)} is the logging caller.
     */
-    static Map<String, List<String>> requiredSecretEnvVars(BridgedConfig cfg) {
+    static Map<String, List<String>> requiredSecretEnvVars(FleetConfig cfg) {
        Map<String, List<String>> requiredBy = new LinkedHashMap<>();
        cfg.profiles().forEach((name, profile) -> {
            if (!profile.isSubscription()) {
@@ -599,7 +616,7 @@ public final class Bridged {
     * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
     * what is wrong is strictly more useful than one that will not boot at all.
     */
-    private static void reportRequiredSecrets(BridgedConfig cfg) {
+    private static void reportRequiredSecrets(FleetConfig cfg) {
        Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
        if (requiredBy.isEmpty()) {
            log.info("startup secrets: no profile references a token env var — nothing to check");
@@ -622,7 +639,7 @@ public final class Bridged {

    /**
     * CB-596: {@code known:} empty (block absent entirely, or present but empty) means {@link
-     * BridgedConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
+     * FleetConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
     * operator's whole secret store, unblocked, exactly the defect this ticket fixes. Unlike a
     * missing token ({@link #reportRequiredSecrets}), there is no name to point at: the point is
     * that the block itself is missing. Warn once at startup and say what to add; never refuse to
@@ -632,8 +649,8 @@ public final class Bridged {
     * <p>Package-private so the test can capture the log directly, the same way {@link
     * #requiredSecretEnvVars} is exposed for {@link #reportRequiredSecrets}'s own test.
     */
-    static void reportMemberCredentialsGap(BridgedConfig cfg) {
-        BridgedConfig.MemberCredentials creds = cfg.memberCredentials();
+    static void reportMemberCredentialsGap(FleetConfig cfg) {
+        FleetConfig.MemberCredentials creds = cfg.memberCredentials();
        if (creds != null && !creds.known().isEmpty()) {
            log.info("memberCredentials: {} known name(s), {} allowed — blocking {} on every spawn",
                    creds.known().size(), creds.allow().size(), creds.blockedSet().size());
@@ -642,7 +659,7 @@ public final class Bridged {
        log.warn("memberCredentials: absent or empty — the daemon will start anyway, and every "
                + "member pane inherits the operator's WHOLE secret store, unblocked (CB-592's "
                + "protection is lost). Add a memberCredentials: block (policy/allow/known) to "
-                + "bridged.yaml — see bridged.example.yaml — and restart.");
+                + "bridged.yaml — see fleetd.example.yaml — and restart.");
    }

    /**
@@ -678,6 +695,6 @@ public final class Bridged {
        }
    }

-    private Bridged() {
+    private Fleetd() {
    }
 }
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,9 +1,9 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

 /**
 * The authorization table (CB-505), stated once and enforced on both entry paths.
 *
- * <p>Most of these rules are already true de facto — {@code BridgeMcp} derives a worker's identity
+ * <p>Most of these rules are already true de facto — {@code FleetMcp} derives a worker's identity
 * from the connection rather than reading it from an argument, so a worker has never been able to
 * reply <em>as</em> another worker over MCP. What was missing is that the REST surface trusted the
 * session id in the URL path, and neither surface checked role at all. This class makes the
@@ -1,7 +1,7 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.peer.MemberRole;

 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -12,7 +12,7 @@ import java.util.function.Supplier;
 /**
 * Resolves every caller to a {@link Principal}, for both entry paths into the core (CB-501).
 *
- * <p>There are two of them and they are not layered the way the docs suggest: {@code BridgeMcp}
+ * <p>There are two of them and they are not layered the way the docs suggest: {@code FleetMcp}
 * calls the service layer directly and is mounted as a raw servlet (so it never passes through a
 * Javalin filter), while the REST routes historically resolved no identity at all. Both now
 * delegate here, so the authorization rules are stated once instead of drifting apart.
@@ -59,7 +59,7 @@ public final class CallerResolver {
     * <p>Like {@link #leadTerminals}, a supplier rather than a fixed map, so a binding injected
     * after startup — when the later spawn lifecycle establishes a live architect session, or an
     * operator pins one — takes effect without a restart. Consulted per resolve; today's wiring
-     * in {@code Bridged} reads a constant from config, which is the degenerate live case.
+     * in {@code Fleetd} reads a constant from config, which is the degenerate live case.
     */
    private final Supplier<Map<String, String>> architectTerminals;
    private final Function<String, MemberRole> memberSlotRoles;
@@ -235,7 +235,7 @@ public final class CallerResolver {

        // loopback-trust: same-host callers that are not workers are the primary. A non-loopback
        // caller is anonymous even here — and startup refuses that combination anyway
-        // (BridgedConfig.validateAuthExposure), so this is defence in depth, not the control.
+        // (FleetConfig.validateAuthExposure), so this is defence in depth, not the control.
        return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
    }

@@ -1,6 +1,6 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.peer.MemberRole;

 /** Optional session lifecycle hook for live member-slot bindings. */
 public interface MemberLifecycle {
@@ -1,7 +1,7 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.peer.MemberRole;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -59,7 +59,7 @@ public final class MemberRegistry implements MemberLifecycle {
    private final Map<String, String> terminalToSlot = new HashMap<>();

    /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
-    public MemberRegistry(BridgedConfig.Fleet fleet) {
+    public MemberRegistry(FleetConfig.Fleet fleet) {
        Map<String, Entry> flat = new LinkedHashMap<>();
        if (fleet != null) {
            for (MemberRole role : MemberRole.values()) {
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

 /**
 * A resolved caller: its {@link Role}, and — for a worker — the herdr {@code terminal_id} that
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;

 /**
 * What a caller is allowed to be on the bus (CB-501).
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -16,7 +16,7 @@ import java.util.function.Supplier;
 /**
 * The daemon's live configuration, re-readable without a restart (CB-559).
 *
- * <p>Consumers hold this, not a {@link BridgedConfig}, and read through {@link #get()} at the point
+ * <p>Consumers hold this, not a {@link FleetConfig}, and read through {@link #get()} at the point
 * of use. A component that captures {@code ref.get()} into a field at construction has opted out of
 * reload — which is sometimes right (see <em>deferred</em> below), but it must then be a deliberate
 * choice rather than an accident of where the field was initialised.
@@ -31,7 +31,7 @@ import java.util.function.Supplier;
 *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those
 *       three are read through a supplier on {@code CompositePeerLauncher}, which is what makes
 *       them hot — not the fact that they are config. <strong>This does NOT include
- *       {@code fleet.leaders}</strong>: {@code Bridged.main} reads {@code cfg.fleet().leaders()}
+ *       {@code fleet.leaders}</strong>: {@code Fleetd.main} reads {@code cfg.fleet().leaders()}
 *       once at startup to build the {@code LeadTabScanner} and the {@code LeadLauncher}, and
 *       neither is reconstructed on reload — so a lead added, removed, or re-{@code tab}'d under
 *       {@code fleet.leaders} needs a restart, the same as any deferred key below.</li>
@@ -42,7 +42,7 @@ import java.util.function.Supplier;
 *       {@code guard:}, {@code worktreeRoot:}, adding or removing a profile (a new backend needs its own launcher,
 *       which is constructed once), <em>and an existing profile's launch settings</em> —
 *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
- *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Bridged.main}'s
+ *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
 *       pattern map at startup), and the rest. {@code credentialId} (CB-578 stage B) is NOT on
 *       this list — it is read live off the config supplier at every quarantine check and
 *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
@@ -65,7 +65,7 @@ import java.util.function.Supplier;
 * running. A config file being edited is normally read once mid-save; degrading a working daemon
 * because it caught a half-written file would be a bad trade.
 */
-public final class ConfigRef implements Supplier<BridgedConfig> {
+public final class ConfigRef implements Supplier<FleetConfig> {

    private static final Logger log = LoggerFactory.getLogger(ConfigRef.class);

@@ -74,21 +74,21 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
            Set.of("bind", "herdrSocket", "broker", "auth");

    private final Path path;
-    private final AtomicReference<BridgedConfig> current;
+    private final AtomicReference<FleetConfig> current;

-    public ConfigRef(Path path, BridgedConfig initial) {
+    public ConfigRef(Path path, FleetConfig initial) {
        this.path = path;
        this.current = new AtomicReference<>(Objects.requireNonNull(initial, "initial config"));
    }

    /** A fixed reference that never reloads — for tests and for wiring built from a config in code. */
-    public static ConfigRef fixed(BridgedConfig cfg) {
+    public static ConfigRef fixed(FleetConfig cfg) {
        return new ConfigRef(null, cfg);
    }

    /** The live configuration. Read this per use; do not cache it in a field. */
    @Override
-    public BridgedConfig get() {
+    public FleetConfig get() {
        return current.get();
    }

@@ -149,10 +149,10 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
        if (path == null) {
            return Outcome.failed("this config was built in code and has no file to reload from");
        }
-        BridgedConfig old = current.get();
-        BridgedConfig fresh;
+        FleetConfig old = current.get();
+        FleetConfig fresh;
        try {
-            fresh = BridgedConfig.load(path);
+            fresh = FleetConfig.load(path);
            // The same gate startup runs. A config that would have refused to boot must not be able
            // to slip in through a reload — that is how a daemon ends up in a state it could never
            // have started in, which is the hardest kind to debug.
@@ -182,7 +182,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
    }

    /** Cold keys whose value differs between the running config and the candidate. */
-    private static List<String> changedColdKeys(BridgedConfig old, BridgedConfig fresh) {
+    private static List<String> changedColdKeys(FleetConfig old, FleetConfig fresh) {
        List<String> changed = new ArrayList<>();
        if (!Objects.equals(old.bind(), fresh.bind())) {
            changed.add("bind");
@@ -202,7 +202,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
    }

    /** Changed keys that were accepted but whose effect waits for a restart. */
-    private static List<String> changedDeferredKeys(BridgedConfig old, BridgedConfig fresh) {
+    private static List<String> changedDeferredKeys(FleetConfig old, FleetConfig fresh) {
        List<String> changed = new ArrayList<>();
        if (!Objects.equals(old.lifecycle(), fresh.lifecycle())) {
            changed.add("lifecycle");
@@ -226,9 +226,9 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
        if (!Objects.equals(old.quarantineCooldownSeconds(), fresh.quarantineCooldownSeconds())) {
            changed.add("quarantineCooldownSeconds");
        }
-        Map<String, BridgedConfig.Profile> before =
+        Map<String, FleetConfig.Profile> before =
                old.profiles() == null ? Map.of() : old.profiles();
-        Map<String, BridgedConfig.Profile> after =
+        Map<String, FleetConfig.Profile> after =
                fresh.profiles() == null ? Map.of() : fresh.profiles();
        // Adding or removing a profile is deferred: a new backend needs its own launcher, and
        // launchers are built once at startup.
@@ -247,7 +247,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
        // a reload can produce, because the operator has no reason to doubt it.
        List<String> relaunch = new ArrayList<>();
        before.forEach((name, was) -> {
-            BridgedConfig.Profile now = after.get(name);
+            FleetConfig.Profile now = after.get(name);
            if (now != null && !sameLaunchSettings(was, now)) {
                relaunch.add(name);
            }
@@ -266,7 +266,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
     * {@code CompositePeerLauncher}/the CB-578 stage B exhaustion sink) and really do take effect on
     * the next spawn.
     */
-    private static boolean sameLaunchSettings(BridgedConfig.Profile a, BridgedConfig.Profile b) {
+    private static boolean sameLaunchSettings(FleetConfig.Profile a, FleetConfig.Profile b) {
        return Objects.equals(a.baseUrl(), b.baseUrl())
                && Objects.equals(a.model(), b.model())
                && Objects.equals(a.configDir(), b.configDir())
@@ -283,7 +283,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
                && Objects.equals(a.kind(), b.kind())
                && Objects.equals(a.env(), b.env())
                && Objects.equals(a.subscription(), b.subscription())
-                // CB-578 stage B: exhaustedPattern is compiled once into Bridged.main's pattern map
+                // CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map
                // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
                // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
                && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern());
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,13 +1,13 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;

 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonToken;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.placement.PlacementPolicies;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.placement.PlacementPolicies;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -26,7 +26,7 @@ import java.util.Set;

 /**
 * {@code bridged} configuration, loaded from a YAML file (see
- * {@code bridged.example.yaml}). Unknown keys are ignored so config can grow ahead
+ * {@code fleetd.example.yaml}). Unknown keys are ignored so config can grow ahead
 * of the code — but an unknown <em>top-level</em> key is logged as a WARN at load (CB-530), because
 * silently dropping a whole block is indistinguishable from honouring it.
 *
@@ -71,7 +71,7 @@ import java.util.Set;
 *                      omitted) blocks nothing — see {@link MemberCredentials}.
 */
@JsonIgnoreProperties(ignoreUnknown = true)
-public record BridgedConfig(
+public record FleetConfig(
        Bind bind,
        String herdrSocket,
        Map<String, Profile> profiles,
@@ -92,7 +92,7 @@ public record BridgedConfig(
        MemberCredentials memberCredentials) {

    /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
@@ -106,7 +106,7 @@ public record BridgedConfig(
    public static final int DEFAULT_QUARANTINE_COOLDOWN_SECONDS = 1800;

    /** Back-compat 14-arg form — no {@code configReload:} block, so file watching stays off. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                         LeadHeartbeat leadHeartbeat, String placement, Auth auth) {
@@ -115,7 +115,7 @@ public record BridgedConfig(
    }

    /** Back-compat form before the optional {@code health:} block was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                         LeadHeartbeat leadHeartbeat, String placement, Auth auth, ConfigReload configReload) {
@@ -124,7 +124,7 @@ public record BridgedConfig(
    }

    /** Back-compat form before the CB-578 stage B {@code quarantineCooldownSeconds} field was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
@@ -147,7 +147,7 @@ public record BridgedConfig(
     * {@code WeightedRoundRobinPolicy}), so losing it makes equal-weight placement
     * non-reproducible across restarts. Unmodifiable-wrap instead of copy-and-scramble.
     */
-    public BridgedConfig {
+    public FleetConfig {
        if (profiles != null && !profiles.isEmpty()) {
            Map<String, Profile> normalized = new LinkedHashMap<>();
            profiles.forEach((name, p) -> normalized.put(name,
@@ -242,7 +242,7 @@ public record BridgedConfig(
     *                       instead, naming the profile and the key. Live means any session the
     *                       registry still owns (acquired and not yet released), in any state.
     * @param kind           which peer launcher spawns this profile: {@code "claude-code"} (default —
-     *                       the {@link dev.ltms.bridged.member.ClaudeCodeLauncher}) or {@code "opencode"}.
+     *                       the {@link dev.ltms.fleet.member.ClaudeCodeLauncher}) or {@code "opencode"}.
     *                       The {@code CompositePeerLauncher} routes {@code spawn}/reap by this value, so
     *                       each adapter drives only its own kind. Normalised to lower-case; blank ⇒ the
     *                       default. It selects the adapter, not the transport — placement, tabs, cwd, and
@@ -291,7 +291,7 @@ public record BridgedConfig(
                         String exhaustedPattern,
                         String credentialId) {

-        /** Peer kind spawned by {@link dev.ltms.bridged.member.ClaudeCodeLauncher} (the default). */
+        /** Peer kind spawned by {@link dev.ltms.fleet.member.ClaudeCodeLauncher} (the default). */
        public static final String KIND_CLAUDE_CODE = "claude-code";
        /** Peer kind spawned by the opencode adapter (CB-402). */
        public static final String KIND_OPENCODE = "opencode";
@@ -472,7 +472,7 @@ public record BridgedConfig(
         * {@code ANTHROPIC_AUTH_TOKEN} is injected from {@code tokenEnv}. An {@code env:} entry for
         * either is a bypass vector — it is what the subscription path would otherwise let survive
         * unguarded — so it is rejected at config load (see
-         * {@link BridgedConfig#validateSubscriptionProfiles()}).
+         * {@link FleetConfig#validateSubscriptionProfiles()}).
         */
        public boolean envCarriesAnthropicBinding() {
            return env != null
@@ -893,7 +893,7 @@ public record BridgedConfig(
     *
     * <p>Member identity never depends on this block: a loopback peer PID that maps to a herdr
     * pane is unforgeable and is always honoured (see
-     * {@link dev.ltms.bridged.mcp.ConnectionIdentity}). This only decides what happens for
+     * {@link dev.ltms.fleet.mcp.ConnectionIdentity}). This only decides what happens for
     * <em>everyone else</em>.
     *
     * @param mode     {@code "loopback-trust"} (default) — any loopback caller that is not a known
@@ -1028,7 +1028,7 @@ public record BridgedConfig(
        return defaultProfileFor(MemberRole.DEV);
    }

-    private static final Logger log = LoggerFactory.getLogger(BridgedConfig.class);
+    private static final Logger log = LoggerFactory.getLogger(FleetConfig.class);

    private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());

@@ -1037,7 +1037,7 @@ public record BridgedConfig(
     * {@link #warnUnknownTopLevelKeys}. Keep in step with the record components.
     *
     * <p>Package-private (not {@code private}) so a test can assert every key here is documented in
-     * {@code bridged.example.yaml} — the only committed description of the config schema, since
+     * {@code fleetd.example.yaml} — the only committed description of the config schema, since
     * {@code bridged.yaml} itself is gitignored.
     */
    static final Set<String> KNOWN_TOP_LEVEL_KEYS = Set.of(
@@ -1047,7 +1047,7 @@ public record BridgedConfig(
            "memberCredentials");

    /** Load and validate config from {@code path}. */
-    public static BridgedConfig load(Path path) {
+    public static FleetConfig load(Path path) {
        try {
            String yaml = Files.readString(path);
            rejectRenamedTopLevelKeys(yaml);
@@ -1059,7 +1059,7 @@ public record BridgedConfig(
            rejectUnknownAuthMode(yaml);
            rejectUnknownPlacement(yaml);
            rejectUnknownMemberCredentialsPolicy(yaml);
-            BridgedConfig cfg = YAML.readValue(yaml, BridgedConfig.class);
+            FleetConfig cfg = YAML.readValue(yaml, FleetConfig.class);
            // CB-606: validated here, eagerly, using PlacementPolicies.fromName as the single source
            // of truth — not lazily at first spawn (see CompositePeerLauncher's placementPolicy
            // Supplier), where a bad name would still start a daemon that looks healthy.
@@ -1366,7 +1366,7 @@ public record BridgedConfig(
     *
     * <p>{@link Profile}'s compact constructor only lower-cases {@code kind} and compares it against
     * {@code KIND_OPENCODE} — anything else, including a typo like {@code opencod}, silently falls
-     * into the claude-code bucket ({@link dev.ltms.bridged.member.CompositePeerLauncher} routes by
+     * into the claude-code bucket ({@link dev.ltms.fleet.member.CompositePeerLauncher} routes by
     * exact adapter claim, not by membership in a known set). With {@code argv:} also unset, the argv
     * default special-cases only the exact string {@code "claude-code"}, so the launch command falls
     * back to {@code List.of(kind)} — the daemon then tries to run a program literally named after the
@@ -1570,7 +1570,7 @@ public record BridgedConfig(
    }

    /** Fill in nested defaults so callers never see nulls for structural fields. */
-    public BridgedConfig withDefaults() {
+    public FleetConfig withDefaults() {
        Bind b = bind != null ? bind : new Bind(null, 0);
        Guard g = guard != null ? guard : new Guard(List.of());
        Lifecycle l = lifecycle != null ? lifecycle : new Lifecycle(null, null, null, false);
@@ -1601,10 +1601,10 @@ public record BridgedConfig(
        // guard/lifecycle, an absent block is not a safe "feature off" default here, it is a gap. It
        // is deliberately not pre-populated with a Java-side name list (that would just reintroduce
        // the hardcoded-list defect this record replaces); the block must be configured in
-        // bridged.yaml to protect anything. See bridged.example.yaml's memberCredentials: comment.
+        // bridged.yaml to protect anything. See fleetd.example.yaml's memberCredentials: comment.
        MemberCredentials mc = memberCredentials != null ? memberCredentials
                : new MemberCredentials(null, List.of(), List.of());
-        return new BridgedConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
+        return new FleetConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
                quarantineCooldown, mc);
    }
@@ -1639,8 +1639,8 @@ public record BridgedConfig(
     * <p>The scan reads a tab label and concludes "a lead lives here". bridged also <em>writes</em>
     * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
     * a member template matches and the daemon starts labelling its own members as leads, promoting
-     * the entire fleet to {@link dev.ltms.bridged.auth.Role#PRIMARY} with no message and no diff.
-     * The member-space exclusion in {@link dev.ltms.bridged.herdr.LeadTabScanner} already blocks the
+     * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
+     * The member-space exclusion in {@link dev.ltms.fleet.herdr.LeadTabScanner} already blocks the
     * realistic path, but defence that depends on one workspace label holding is not defence enough
     * for a privilege boundary.
     *
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;

 /** Thrown when the subscription boundary would be violated. Never swallow this. */
 public class GuardException extends RuntimeException {
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;

 import java.net.URI;
 import java.net.URISyntaxException;
@@ -1,7 +1,7 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;

 /**
 * Pure classifier. Collection and repair are deliberately outside this package.
@@ -1,10 +1,10 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.session.MemberSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -44,7 +44,7 @@ public final class FleetHealthMonitor {
     *                   invoked once when a member transitions into a terminal health state. Required —
     *                   there is deliberately no defaulting overload; a caller that does not want the
     *                   fail-tickets-on-terminal-health behavior must pass an explicit inert value (see
-     *                   {@code TestTurnTokens.inert} / {@code BridgeMcp.CapacitySource.none()} for the pattern).
+     *                   {@code TestTurnTokens.inert} / {@code FleetMcp.CapacitySource.none()} for the pattern).
     */
    public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
                              ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

 /** Classification plus the private fact that the next pure decision needs. */
 public record HealthDecision(HealthState state, HealthPrior prior) { }
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

 /** Private cross-tick observation. It is deliberately not a reported health value. */
 public record HealthPrior(boolean busyButDone) {
@@ -1,7 +1,7 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;

 /** Read-only facts from one fleet collection tick. */
 public record HealthSnapshot(MemberSession.State sessionState, AgentStatus liveStatus,
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

 /** Health classifications reported for a member. */
 public enum HealthState {
@@ -1,6 +1,6 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

-import dev.ltms.bridged.msg.Rendezvous;
+import dev.ltms.fleet.msg.Rendezvous;

 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;

 import java.util.ArrayList;
 import java.util.HashMap;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 /**
 * A herdr agent's lifecycle state, as reported by {@code agent_status}. Drives the
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 /**
 * Raised when a herdr call fails: transport error, or an {@code error} envelope
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
@@ -14,7 +14,7 @@ import java.util.function.Supplier;

 /**
 * Discovers which panes host a lead by scanning herdr for tabs the operator labelled by convention
- * (CB-531), and hands {@link dev.ltms.bridged.auth.CallerResolver} the resulting
+ * (CB-531), and hands {@link dev.ltms.fleet.auth.CallerResolver} the resulting
 * {@code terminal_id → lead name} map.
 *
 * <p><strong>Why scan at all.</strong> A lead is never spawned — a human opens a tab and starts an
@@ -49,7 +49,7 @@ import java.util.function.Supplier;
 * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
 * that bridged never renames a lead tab, so the label was always the human's own writing and there
 * was no round-trip from the daemon's rename back into its next decision.
- * {@code dev.ltms.bridged.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
+ * {@code dev.ltms.fleet.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
 * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
 * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
 * real: a label left behind by a session that has since died would read as a live lead forever.
@@ -58,7 +58,7 @@ import java.util.function.Supplier;
 * ever make a decision that <em>removes</em> something based on this map, add the same check.
 * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
 * happens to start with the same prefix would promote the whole fleet — and that is refused at
- * startup by {@code BridgedConfig.validateLeadTabPrefixes} rather than documented here.
+ * startup by {@code FleetConfig.validateLeadTabPrefixes} rather than documented here.
 *
 * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
 * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -289,7 +289,7 @@ public final class CompletionResolver implements TurnListener {

    /**
     * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
-     * the way {@link dev.ltms.bridged.health.FleetHealthMonitor#coverage} is — so an operator can
+     * the way {@link dev.ltms.fleet.health.FleetHealthMonitor#coverage} is — so an operator can
     * see whether the classification is on, and for which profiles, without reading every
     * profile's config by hand.
     *
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

 import java.util.regex.Pattern;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

 /**
 * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
@@ -8,7 +8,7 @@ package dev.ltms.bridged.inject;
 *
 * <p>{@link CompletionResolver} knows only {@code target} (a herdr terminal id); it has no notion of
 * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
- * the sink's job — see {@code Bridged.main}'s wiring, which resolves target → session → profile →
+ * the sink's job — see {@code Fleetd.main}'s wiring, which resolves target → session → profile →
 * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
 */
@FunctionalInterface
@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -81,7 +81,7 @@ public final class Injector {

    /**
     * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
-     * {@link #onStatus} at. {@code Bridged} passes this to every {@link StatusPoller} it constructs,
+     * {@link #onStatus} at. {@code Fleetd} passes this to every {@link StatusPoller} it constructs,
     * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
     * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
     * that claims a grace duration.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

 import java.util.concurrent.ConcurrentHashMap;
 import java.util.Set;
@@ -1,8 +1,8 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -1,6 +1,6 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;

-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.msg.TurnToken;

 /**
 * Notified when a worker's delegated turn is observed to complete — a confirmed
@@ -1,12 +1,12 @@
-package dev.ltms.bridged.lead;
+package dev.ltms.fleet.lead;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.Tab;
+import dev.ltms.fleet.herdr.Workspace;
+import dev.ltms.fleet.herdr.WorkspaceControl;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -54,14 +54,14 @@ public final class LeadLauncher {

    private final AgentControl agents;
    private final WorkspaceControl spaces;
-    private final BridgedConfig cfg;
+    private final FleetConfig cfg;

    /**
     * @param agents herdr agent control (start, list)
     * @param spaces workspace / tab control (ensure, create, label, list)
     * @param cfg    the loaded config — {@code fleet.leaders}, {@code profiles} and each lead's tab
     */
-    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, BridgedConfig cfg) {
+    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, FleetConfig cfg) {
        this.agents = agents;
        this.spaces = spaces;
        this.cfg = cfg;
@@ -75,7 +75,7 @@ public final class LeadLauncher {
     * the remaining leads are still attempted.
     */
    public int ensureLeads() {
-        Map<String, BridgedConfig.Leader> leaders = cfg.fleet().leaders();
+        Map<String, FleetConfig.Leader> leaders = cfg.fleet().leaders();
        if (leaders.isEmpty()) {
            return 0;
        }
@@ -91,9 +91,9 @@ public final class LeadLauncher {
        }

        int started = 0;
-        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
+        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
            String name = e.getKey();
-            BridgedConfig.Leader lead = e.getValue();
+            FleetConfig.Leader lead = e.getValue();
            int running = live.getOrDefault(name, 0);
            int wanted = lead.instances();

@@ -110,7 +110,7 @@ public final class LeadLauncher {
                continue;
            }

-            BridgedConfig.Profile profile = cfg.profiles().get(lead.profile());
+            FleetConfig.Profile profile = cfg.profiles().get(lead.profile());
            if (profile == null) {
                log.warn("lead '{}' names profile '{}', which is not configured — not launching",
                        name, lead.profile());
@@ -138,9 +138,9 @@ public final class LeadLauncher {
     * already carries {@link Agent#tabId()} directly, so a hand-opened lead is found the same way an
     * auto-launched one is — by labelling its tab to match.
     */
-    private Map<String, Integer> liveLeads(Map<String, BridgedConfig.Leader> leaders) {
+    private Map<String, Integer> liveLeads(Map<String, FleetConfig.Leader> leaders) {
        Set<String> memberSpaces = cfg.profiles().values().stream()
-                .map(BridgedConfig.Profile::workspace)
+                .map(FleetConfig.Profile::workspace)
                .filter(w -> w != null && !w.isBlank())
                .collect(Collectors.toSet());

@@ -174,12 +174,12 @@ public final class LeadLauncher {
     * <p>Matched exactly (case-insensitively) against each lead's configured {@code tab}, so an
     * operator's {@code "lead: something-else"} tab is not mistaken for a configured lead.
     */
-    private String leadNameOf(String label, Map<String, BridgedConfig.Leader> leaders) {
+    private String leadNameOf(String label, Map<String, FleetConfig.Leader> leaders) {
        if (label == null) {
            return null;
        }
        String l = label.strip();
-        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
+        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
            String tab = e.getValue().tabLabel();
            if (tab != null && l.equalsIgnoreCase(tab.strip())) {
                return e.getKey();
@@ -189,7 +189,7 @@ public final class LeadLauncher {
    }

    /** Start one lead. Returns false (having logged) rather than throwing on any failure. */
-    private boolean launch(String name, BridgedConfig.Leader lead, BridgedConfig.Profile profile) {
+    private boolean launch(String name, FleetConfig.Leader lead, FleetConfig.Profile profile) {
        String label = lead.tabLabel();
        String cwd = (lead.cwd() == null || lead.cwd().isBlank())
                ? System.getProperty("user.dir") : lead.cwd();
@@ -236,7 +236,7 @@ public final class LeadLauncher {
     * The herdr agent kind for this profile — the same value the matching member adapter passes, so
     * herdr resolves the same executable for a lead as it does for a member on that backend.
     */
-    private static String herdrKind(BridgedConfig.Profile profile) {
+    private static String herdrKind(FleetConfig.Profile profile) {
        return profile.isOpenCode() ? "opencode" : "claude";
    }

@@ -248,7 +248,7 @@ public final class LeadLauncher {
     * any other primary. This is the single most important difference from the member launchers;
     * do not "unify" it back.
     */
-    private List<String> leadArgv(BridgedConfig.Profile profile) {
+    private List<String> leadArgv(FleetConfig.Profile profile) {
        List<String> argv = new ArrayList<>(profile.argv());
        if (profile.hasMcp()) {
            argv.add("--mcp-config");
@@ -274,7 +274,7 @@ public final class LeadLauncher {
     * definition, so there is no configuration under which pointing it elsewhere is correct, and a
     * profile that carries them (a member profile reused as a lead's backend) must not leak them in.
     */
-    private Map<String, String> leadEnv(BridgedConfig.Profile profile) {
+    private Map<String, String> leadEnv(FleetConfig.Profile profile) {
        Map<String, String> out = new LinkedHashMap<>();
        if (profile.env() != null) {
            out.putAll(profile.env());
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.logging;
+package dev.ltms.fleet.logging;

 import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.Logger;
@@ -1,6 +1,6 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

-import dev.ltms.bridged.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.PaneLocator;

 /**
 * Resolves <em>who is calling</em> an MCP tool from the connection alone — the anti-spoofing
@@ -1,26 +1,26 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

-import dev.ltms.bridged.auth.AuditLog;
-import dev.ltms.bridged.auth.Authz;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.Principal;
-import dev.ltms.bridged.auth.Role;
-import dev.ltms.bridged.guard.GuardException;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.placement.BackendQuarantine;
-import dev.ltms.bridged.placement.PlacementException;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.fleet.auth.AuditLog;
+import dev.ltms.fleet.auth.Authz;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.auth.Role;
+import dev.ltms.fleet.guard.GuardException;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementException;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.WorktreeRequest;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerLauncher;
 import io.modelcontextprotocol.common.McpTransportContext;
 import io.modelcontextprotocol.json.McpJsonMapper;
 import io.modelcontextprotocol.json.jackson3.JacksonMcpJsonMapperSupplier;
@@ -61,9 +61,9 @@ import org.slf4j.LoggerFactory;
 * {@link McpSchema.CallToolResult}, so it is unit-testable without standing up the HTTP transport;
 * the SDK owns the wire protocol. Mount {@link #servlet()} at {@code /mcp} on the daemon's Jetty.
 */
-public final class BridgeMcp {
+public final class FleetMcp {

-    private static final Logger log = LoggerFactory.getLogger(BridgeMcp.class);
+    private static final Logger log = LoggerFactory.getLogger(FleetMcp.class);

    private static final long DEFAULT_TIMEOUT_MS = 25_000;
    private static final long MAX_TIMEOUT_MS = 120_000;
@@ -127,7 +127,7 @@ public final class BridgeMcp {
     * @param quarantine CB-578 stage B facts for {@code fleet_profiles}; required — pass
     *                   {@link QuarantineSource#none()} for a caller that does not want the feature
     */
-    public BridgeMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
+    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                      QuarantineSource quarantine) {
@@ -377,7 +377,7 @@ public final class BridgeMcp {
     * without fabricating an SDK {@code McpSyncServerExchange}.
     *
     * <p>This surface exists because the enforcement was previously unreachable from a test: no
-     * test constructs a {@code BridgeMcp}, so the whole MCP-side gate ran zero times in the suite
+     * test constructs a {@code FleetMcp}, so the whole MCP-side gate ran zero times in the suite
     * while the REST-side equivalent had ten tests. A security control nothing exercises is a
     * claim, not a control.
     *
@@ -398,7 +398,7 @@ public final class BridgeMcp {
        String reason = Authz.isUnauthenticated(caller) ? "unauthenticated" : "forbidden";
        AuditLog.denied(caller, action, target, reason);
        if (metrics != null) {
-            metrics.inc(BridgedMetrics.AUTH_FAILURES, "reason", reason);
+            metrics.inc(FleetMetrics.AUTH_FAILURES, "reason", reason);
        }
        return error(reason + ": " + caller.describe() + " may not " + action);
    }
@@ -745,7 +745,7 @@ public final class BridgeMcp {
     * CB-301-ext: {@code worktreeRequest} non-null provisions an isolated git worktree.
     * CB-584: {@code sessionName}/{@code resumeSessionId} request agent session identity — a resumed
     * conversation requires an explicit {@code profile} whose adapter declares
-     * {@link dev.ltms.bridged.peer.Capability#SESSION_RESUME}, or the spawn is refused rather than
+     * {@link dev.ltms.fleet.peer.Capability#SESSION_RESUME}, or the spawn is refused rather than
     * silently starting a cold session.
     *
     * <p>{@code role} and {@code profile} are independent: the role picks the contract, the profile
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 /**
 * Resolves the OS PID that owns a loopback TCP source port — the OS half of connection-based MCP
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.mcp;
+package dev.ltms.fleet.mcp;

 /**
 * Resolves a process's current working directory from its PID — the OS half of CB-112's
@@ -1,11 +1,11 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -53,7 +53,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * existing deployments and tests keep the legacy non-blocking spawn semantics.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env) {
        this(agents, spaces, guard, profiles, defaultProfile, env, 0,
                System::currentTimeMillis, () -> sleepUninterruptibly(300));
@@ -64,7 +64,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs, long spawnReadyPollMs) {
        this(agents, spaces, guard, profiles, defaultProfile, env,
@@ -77,10 +77,10 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<BridgedConfig.Fleet> fleet) {
+                              Supplier<FleetConfig.Fleet> fleet) {
        this(agents, spaces, guard, profiles, defaultProfile, env,
                spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
@@ -91,11 +91,11 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        this(agents, spaces, guard, profiles, defaultProfile, env,
                spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
@@ -120,7 +120,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     *                             (poll ms) is accepted for API symmetry but otherwise unused here
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper) {
@@ -134,11 +134,11 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * @param fleet live fleet config, read once for each spawn
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet) {
+                              Supplier<FleetConfig.Fleet> fleet) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
        this.guard = guard;
@@ -148,12 +148,12 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
        this.guard = guard;
@@ -165,12 +165,12 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * default (the real {@code System.getenv()} key set) via the constructor above.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet,
-                              Supplier<BridgedConfig.MemberCredentials> memberCredentials,
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials,
                              Supplier<Set<String>> hostEnvNames) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, hostEnvNames);
@@ -187,7 +187,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * applied here — see {@link #applySessionIdentity}.
     */
    @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
@@ -232,9 +232,9 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
        // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
        // id via -r and passes no --session-id (the two conflict). Both are injected before the
        // model flag so --model keeps outranking the operator's own argv.
-        // mutableArgv: argvWithBridge may hand back the profile's own (immutable) List.of when it
+        // mutableArgv: argvWithFleet may hand back the profile's own (immutable) List.of when it
        // has neither MCP nor a charter — session flags must be added into a list we own.
-        List<String> argv = mutableArgv(argvWithBridge(cfg, spec));
+        List<String> argv = mutableArgv(argvWithFleet(cfg, spec));
        String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
        return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
    }
@@ -289,7 +289,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * is present it keeps its proven inline {@code --append-system-prompt} delivery, which is also
     * the only form that reaches a member with no repo checkout.
     */
-    private List<String> argvWithBridge(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    private List<String> argvWithFleet(FleetConfig.Profile cfg, LaunchSpec spec) {
        String roleCharter = nonBlank(spec.roleCharter());
        String replyCharter = nonBlank(spec.replyCharter());
        Path agentFile = agentDefinitionFile(spec.cwd(), spec.role(), ".claude", "agents");
@@ -358,7 +358,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
     */
-    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+    private static List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
        if (cfg.model() == null || cfg.model().isBlank()) {
            return argv;
        }
@@ -411,7 +411,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {

    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
    }

    // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------
@@ -1,19 +1,19 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
-import dev.ltms.bridged.placement.BackendQuarantine;
-import dev.ltms.bridged.placement.PlacementCandidate;
-import dev.ltms.bridged.placement.PlacementContext;
-import dev.ltms.bridged.placement.PlacementException;
-import dev.ltms.bridged.placement.PlacementPolicies;
-import dev.ltms.bridged.placement.PlacementPolicy;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementCandidate;
+import dev.ltms.fleet.placement.PlacementContext;
+import dev.ltms.fleet.placement.PlacementException;
+import dev.ltms.fleet.placement.PlacementPolicies;
+import dev.ltms.fleet.placement.PlacementPolicy;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -78,7 +78,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * this way is the set of adapters ({@link #byProfile}), because a new backend needs a launcher
     * and launchers are built once; {@code ConfigRef} classifies that as deferred and says so.
     */
-    private final Supplier<Map<String, BridgedConfig.Profile>> profileConfigs;
+    private final Supplier<Map<String, FleetConfig.Profile>> profileConfigs;
    private final Supplier<PlacementPolicy> placementPolicy;

    /** CB-578 stage B: credential cooldown, checked before an explicit spawn and filtered into placement. */
@@ -89,7 +89,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * {@code null}, and an empty pool for a role, both fall back to every configured profile — the
     * pre-CB-557 behaviour.
     */
-    private final Supplier<BridgedConfig.Fleet> fleet;
+    private final Supplier<FleetConfig.Fleet> fleet;

    /**
     * Backward-compatible constructor: fixed placement, no live-counting. Use this for tests and
@@ -119,7 +119,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                 PlacementPolicy placementPolicy,
                                 Function<String, Integer> liveCount) {
        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, null, BackendQuarantine.none());
@@ -136,27 +136,27 @@ public final class CompositePeerLauncher implements PeerLauncher {
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                 PlacementPolicy placementPolicy,
                                 Function<String, Integer> liveCount,
-                                 BridgedConfig.Fleet fleet) {
+                                 FleetConfig.Fleet fleet) {
        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, fleet, BackendQuarantine.none());
    }

    /**
     * Production constructor with role pools and quarantine (CB-578 stage B). The full-featured
     * non-reloading form; {@link #CompositePeerLauncher(List, String, Supplier, Function, BackendQuarantine)}
-     * is what {@code Bridged.main} actually wires up.
+     * is what {@code Fleetd.main} actually wires up.
     *
     * @param quarantine required — pass {@link BackendQuarantine#none()} for a caller that does not
     *                   want the feature, never a defaulting overload (CB-578 stage B's own rule).
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
                                 PlacementPolicy placementPolicy,
                                 Function<String, Integer> liveCount,
-                                 BridgedConfig.Fleet fleet,
+                                 FleetConfig.Fleet fleet,
                                 BackendQuarantine quarantine) {
        // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
        // policy breaks exact-weight ties on it, so a salted iteration order would make placement
@@ -175,7 +175,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Supplier<BridgedConfig> config,
+                                 Supplier<FleetConfig> config,
                                 Function<String, Integer> liveCount,
                                 BackendQuarantine quarantine) {
        this(delegates, defaultProfile,
@@ -189,10 +189,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
    /** The all-suppliers form every other constructor funnels into. */
    private CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                  String defaultProfile,
-                                  Supplier<Map<String, BridgedConfig.Profile>> profileConfigs,
+                                  Supplier<Map<String, FleetConfig.Profile>> profileConfigs,
                                  Supplier<PlacementPolicy> placementPolicy,
                                  Function<String, Integer> liveCount,
-                                  Supplier<BridgedConfig.Fleet> fleet,
+                                  Supplier<FleetConfig.Fleet> fleet,
                                  BackendQuarantine quarantine) {
        this.fleet = fleet;
        this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
@@ -229,8 +229,8 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * <p>Read fresh on every call so a reload is visible; a caller that needs two consistent reads
     * takes one local, as {@link #poolFor} does.
     */
-    private Map<String, BridgedConfig.Profile> profiles0() {
-        Map<String, BridgedConfig.Profile> m = profileConfigs.get();
+    private Map<String, FleetConfig.Profile> profiles0() {
+        Map<String, FleetConfig.Profile> m = profileConfigs.get();
        return m == null ? Map.of() : m;
    }

@@ -254,7 +254,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
        String requestedProfile = req.profileName();
        if (requestedProfile != null && !requestedProfile.isBlank()) {
            // An explicit profile bypasses the placement policy, but not the capacity cap: maxLoad
-            // is documented as an unconditional limit on this profile (BridgedConfig.Profile), and
+            // is documented as an unconditional limit on this profile (FleetConfig.Profile), and
            // the charter makes explicit-profile spawns the normal path — so skipping the check
            // here would leave the cap dead config in real operation.
            HerdrPeerLauncher d = route(requestedProfile);
@@ -317,7 +317,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
    /**
     * Refuse an explicit-profile spawn when the profile is at its {@code maxLoad} cap.
     *
-     * <p>maxLoad is a documented, unconditional capacity limit (see {@code BridgedConfig.Profile#maxLoad}),
+     * <p>maxLoad is a documented, unconditional capacity limit (see {@code FleetConfig.Profile#maxLoad}),
     * and the charter makes explicit-profile spawns the normal path — so enforcing it only in placement
     * ({@code PlacementPolicyUtil}, package-private, hence not linked) would leave the cap dead config
     * on every call that names a profile. Same rule as placement: {@code live >= cap} is at capacity.
@@ -359,7 +359,7 @@ public final class CompositePeerLauncher implements PeerLauncher {

    /** {@code profile}'s credential group (CB-578 stage B), or the profile's own name if unconfigured. */
    private String credentialIdFor(String profile) {
-        BridgedConfig.Profile cfg = profiles0().get(profile);
+        FleetConfig.Profile cfg = profiles0().get(profile);
        return cfg == null ? profile : cfg.effectiveCredentialId();
    }

@@ -377,7 +377,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
        // until CB-585: an explicit `maxLoad: 0` now survives as 0 and is a real cap of zero, so the
        // check below refuses every spawn on that profile, and a negative value is refused at config
        // load rather than normalized away.
-        BridgedConfig.Profile cfg = profiles0().get(profile);
+        FleetConfig.Profile cfg = profiles0().get(profile);
        Integer cap = (cfg == null) ? null : cfg.maxLoad();
        if (cap == null) {
            return;
@@ -398,8 +398,8 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * a pool entry with no profile, so a survivor is a profile this particular composite does not own.
     */
    private List<String> poolFor(MemberRole role) {
-        Map<String, BridgedConfig.Profile> configured = profiles0();
-        BridgedConfig.Fleet f = fleet.get();
+        Map<String, FleetConfig.Profile> configured = profiles0();
+        FleetConfig.Fleet f = fleet.get();
        List<String> pool = (f == null) ? List.of() : f.profilesFor(role);
        List<String> known = pool.stream().filter(configured::containsKey).toList();
        return known.isEmpty() ? List.copyOf(configured.keySet()) : known;
@@ -415,7 +415,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
    private List<PlacementCandidate> candidates(MemberRole role) {
        List<PlacementCandidate> out = new ArrayList<>();
        for (String name : poolFor(role)) {
-            BridgedConfig.Profile w = profiles0().get(name);
+            FleetConfig.Profile w = profiles0().get(name);
            if (w != null) {
                out.add(new PlacementCandidate(name, null, w.weight(), w.maxLoad()));
            }
@@ -1,19 +1,19 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.Tab;
+import dev.ltms.fleet.herdr.Workspace;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.CharterReceipt;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.peer.SpawnRequest;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -49,7 +49,7 @@ import java.util.regex.Pattern;
 *   <li>{@code namePrefix} (constructor arg) — the label prefix ({@code claude}, {@code opencode})
 *       that drives both unique naming and the orphan-reap pattern, so each adapter reaps only its
 *       own kind of pane and never another's.</li>
- *   <li>{@link #buildLaunch(BridgedConfig.Profile, LaunchSpec)} — the peer-specific env map + argv, including any
+ *   <li>{@link #buildLaunch(FleetConfig.Profile, LaunchSpec)} — the peer-specific env map + argv, including any
 *       subscription/guard check, MCP mount, and instruction injection. The base never sees how the
 *       peer is configured; it only places and starts the returned {@link Launch}.</li>
 * </ul>
@@ -76,7 +76,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    private final String namePrefix;                       // label prefix: naming + reap scheme
    private final AgentControl agents;
    private final WorkspaceControl spaces;
-    private final Map<String, BridgedConfig.Profile> profiles; // profile name → spawn settings
+    private final Map<String, FleetConfig.Profile> profiles; // profile name → spawn settings
    private final String defaultProfile;                      // profile a no-arg spawn uses (nullable)

    /** Host env lookup (injectable for tests); adapters read it in {@link #buildLaunch}. */
@@ -91,14 +91,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * <p>CB-559: a supplier rather than a snapshot, so a config reload affects the next launch
     * without a restart. Existing tabs keep the label they were given.
     */
-    private final Supplier<BridgedConfig.Fleet> fleet;
+    private final Supplier<FleetConfig.Fleet> fleet;

    /**
     * CB-596: the live {@code memberCredentials:} policy, read once per spawn (same hot-reload shape
     * as {@link #fleet}). {@code null} — either the supplier itself, or what it returns — means no
     * policy is configured and {@link #applyMemberCredentialPolicy} shadows nothing.
     */
-    private final Supplier<BridgedConfig.MemberCredentials> memberCredentials;
+    private final Supplier<FleetConfig.MemberCredentials> memberCredentials;

    /**
     * Enumerates the daemon's own process environment variable NAMES ONLY, never values — the CB-596
@@ -169,7 +169,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *                            interval is baked into this hook, so the base needs no poll field
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper) {
@@ -185,11 +185,11 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *              above, so every existing call site keeps the default without an edit.
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet) {
+                                Supplier<FleetConfig.Fleet> fleet) {
        this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                nowMillis, sleeper, fleet, null);
    }
@@ -203,12 +203,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *                          existing call site keeps the pre-CB-596 default without an edit.
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet,
-                                Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                                Supplier<FleetConfig.Fleet> fleet,
+                                Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                nowMillis, sleeper, fleet, memberCredentials, null);
    }
@@ -218,12 +218,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * seam only — every production call site leaves this {@code null} and gets the real host env.
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet,
-                                Supplier<BridgedConfig.MemberCredentials> memberCredentials,
+                                Supplier<FleetConfig.Fleet> fleet,
+                                Supplier<FleetConfig.MemberCredentials> memberCredentials,
                                Supplier<Set<String>> hostEnvNames) {
        this.fleet = fleet;
        this.namePrefix = namePrefix;
@@ -246,7 +246,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * Any subscription/guard check, MCP mount, and instruction injection happen here. The env map
     * and argv are adapter-private; the base only places and starts what is returned.
     */
-    protected abstract Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec);
+    protected abstract Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec);

    /** Direct transport access for peer-specific, non-turn control operations. */
    protected final AgentControl agents() {
@@ -327,7 +327,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        if (name == null || name.isBlank()) {
            return List.of();
        }
-        BridgedConfig.Profile cfg = profiles.get(name);
+        FleetConfig.Profile cfg = profiles.get(name);
        return cfg == null ? List.of() : cfg.parityOverlay();
    }

@@ -351,18 +351,18 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    }

    /** The configured profiles, for adapter capability decisions (e.g. any git-token grant). */
-    protected Collection<BridgedConfig.Profile> profileConfigs() {
+    protected Collection<FleetConfig.Profile> profileConfigs() {
        return profiles.values();
    }

    /** Resolve {@code profileName} (null/blank → default) to its config, or throw with the options. */
-    protected BridgedConfig.Profile requireProfile(String profileName) {
+    protected FleetConfig.Profile requireProfile(String profileName) {
        String name = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
        if (name == null || name.isBlank()) {
            throw new IllegalArgumentException("no default worker profile is configured — "
                    + "pass a profile; configured: " + profiles.keySet());
        }
-        BridgedConfig.Profile cfg = profiles.get(name);
+        FleetConfig.Profile cfg = profiles.get(name);
        if (cfg == null) {
            throw new IllegalArgumentException("unknown worker profile '" + name
                    + "' — configured: " + profiles.keySet());
@@ -399,14 +399,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {

    /**
     * Spawn a peer with session identity (CB-547a). The session values, role, and charter are
-     * threaded from the {@link SpawnRequest} into {@link #buildLaunch(BridgedConfig.Profile,
+     * threaded from the {@link SpawnRequest} into {@link #buildLaunch(FleetConfig.Profile,
     * LaunchSpec)}, and the launch's resolved agent-session id is returned alongside the agent so
     * the caller can put it on the {@link PeerHandle}.
     */
    protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
                                    String sessionName, String resumeSessionId, MemberRole role) {
-        BridgedConfig.Profile cfg = requireProfile(profileName);
-        BridgedConfig.Fleet liveFleet = fleet == null ? null : fleet.get();
+        FleetConfig.Profile cfg = requireProfile(profileName);
+        FleetConfig.Fleet liveFleet = fleet == null ? null : fleet.get();
        String roleCharter = liveFleet == null ? null : liveFleet.charterFor(role);
        String replyCharter = cfg.hasMcp() ? REPLY_CHARTER : null;
        String charter = roleCharter == null ? replyCharter
@@ -507,7 +507,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * guaranteed last resort so a pathological environment with an unset {@code user.dir} still
     * honours the "never assume {@code $HOME}" contract rather than letting herdr default the pane.
     */
-    private static String resolveCwd(String requestedCwd, BridgedConfig.Profile cfg, String callerCwd) {
+    private static String resolveCwd(String requestedCwd, FleetConfig.Profile cfg, String callerCwd) {
        return firstNonBlank(requestedCwd, cfg.cwd(), callerCwd, System.getProperty("user.dir"), ".");
    }

@@ -519,8 +519,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    }

    /** Dedicated worker space → own tab (carrying cwd+env) → start the peer into the seed pane. */
-    private Agent spawnInTab(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
-                             List<String> argv, String cwd, MemberRole role, BridgedConfig.Fleet liveFleet) {
+    private Agent spawnInTab(FleetConfig.Profile cfg, Map<String, String> workerEnv,
+                             List<String> argv, String cwd, MemberRole role, FleetConfig.Fleet liveFleet) {
        Workspace space = spaces.ensureWorkspace(cfg.workspace());
        Tab.Created tab = spaces.createTab(space.workspaceId(), cwd, workerEnv);
        log.info("spawning {} profile={} space={} tab={} cwd={}",
@@ -578,7 +578,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * composed charter, if any; its argv element is replaced by its digest so the log still shows
     * which args were passed without exposing the charter prose.
     */
-    private Agent spawnAsPane(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
+    private Agent spawnAsPane(FleetConfig.Profile cfg, Map<String, String> workerEnv,
                              List<String> argv, String cwd, String charter) {
        log.info("spawning {} (pane placement) profile={} cwd={} argv={}",
                namePrefix, cfg.profile(), cwd, redactCharter(argv, charter));
@@ -620,7 +620,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * backstop for the astronomically unlikely nonce+seq clash; the name is a label only — herdr
     * detects kind and status from terminal output, not from it.
     */
-    private Started startUniquelyNamed(BridgedConfig.Profile cfg, List<String> argv, String paneId) {
+    private Started startUniquelyNamed(FleetConfig.Profile cfg, List<String> argv, String paneId) {
        // Protocol 19 resolves the executable from the agent kind (== namePrefix here), so
        // argv[0] — the configured executable — is dropped and only the extra args are passed.
        List<String> args = argv.isEmpty() ? argv : argv.subList(1, argv.size());
@@ -778,7 +778,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {

    /** Whether any configured profile places peers in their own tab (so tabs may need cleanup). */
    private boolean usesTabPlacement() {
-        return profiles.values().stream().anyMatch(BridgedConfig.Profile::tabPlacement);
+        return profiles.values().stream().anyMatch(FleetConfig.Profile::tabPlacement);
    }

    /** True when a herdr error means the target is already gone (safe to treat as done). */
@@ -844,7 +844,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * {@code GITEA_HOST}. Push over SSH is unaffected; the only incremental grant is PR-create.
     * Peer-neutral, so every herdr adapter reuses it unchanged.
     */
-    protected void applyGitToken(Map<String, String> workerEnv, BridgedConfig.Profile cfg) {
+    protected void applyGitToken(Map<String, String> workerEnv, FleetConfig.Profile cfg) {
        if (!cfg.hasGitToken()) {
            return;
        }
@@ -860,7 +860,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * herdr's own login-shell process environment (gitea issue #82, superseding CB-592's single
     * hardcoded {@code GITEA_ACCESS_TOKEN} name — see {@link #applyMemberCredentialPolicy}). herdr
     * spawns a pane from its <em>own</em> process environment and layers our map on top —
-     * {@link dev.ltms.bridged.herdr.WorkspaceControl#createTab} and {@code #splitPane} send only
+     * {@link dev.ltms.fleet.herdr.WorkspaceControl#createTab} and {@code #splitPane} send only
     * the keys we put in that map, so any key we never mention passes straight through from
     * herdr's own shell, admin credentials included.
     *
@@ -922,7 +922,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * <p>Adapter-specific variables are layered on top of this by {@code buildLaunch} and therefore
     * win. That ordering is deliberate and load-bearing: it stops a profile's {@code env:} from
     * overriding {@code ANTHROPIC_BASE_URL} and slipping past {@link
-     * dev.ltms.bridged.guard.SubscriptionGuard}, which is checked against the profile's
+     * dev.ltms.fleet.guard.SubscriptionGuard}, which is checked against the profile's
     * {@code baseUrl} and nothing else.
     *
     * <p>The CB-596 credential shadow and the CB-592 marker are put in <em>last</em>, after the
@@ -931,7 +931,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * place both are applied: every {@code buildLaunch} in every adapter calls this first, so a new
     * profile, and a peer kind not yet written, gets them for free.
     */
-    protected Map<String, String> baseEnv(BridgedConfig.Profile cfg) {
+    protected Map<String, String> baseEnv(FleetConfig.Profile cfg) {
        Map<String, String> workerEnv = new LinkedHashMap<>();
        String path = env.apply("PATH");
        if (path != null && !path.isBlank()) {
@@ -955,11 +955,11 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *
     * <p>No {@code memberCredentials} configured — the supplier is {@code null}, or it resolves to
     * one whose {@code known} list is empty — shadows nothing. This is a real, config-driven gap
-     * (see {@link BridgedConfig.MemberCredentials}'s javadoc), not a safe default: deny-by-default
+     * (see {@link FleetConfig.MemberCredentials}'s javadoc), not a safe default: deny-by-default
     * only defends names the operator has actually enumerated in {@code known}.
     */
    private void applyMemberCredentialPolicy(Map<String, String> workerEnv) {
-        BridgedConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
+        FleetConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
        if (creds == null) {
            return;
        }
@@ -984,7 +984,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * every such NAME, at WARN, at most once per launcher instance — never a value, a prefix of a
     * value, or a hash of a value, so the log itself cannot leak anything.
     */
-    private void logCredentialGap(BridgedConfig.MemberCredentials creds) {
+    private void logCredentialGap(FleetConfig.MemberCredentials creds) {
        Set<String> covered = new HashSet<>(creds.known());
        covered.addAll(creds.allow());
        List<String> gap = hostEnvNames.get().stream()
@@ -1,15 +1,15 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.SpawnRequest;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.CharterReceipt;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.SpawnRequest;

 import java.io.IOException;
 import java.io.UncheckedIOException;
@@ -33,7 +33,7 @@ import java.util.function.Supplier;
 * <p>The divergences from {@link ClaudeCodeLauncher}, all confined to {@link #buildLaunch}:
 * <ul>
 *   <li><strong>No subscription boundary.</strong> opencode carries no {@code ANTHROPIC_BASE_URL}
- *       and there is no {@link dev.ltms.bridged.guard.SubscriptionGuard} — the guard is a
+ *       and there is no {@link dev.ltms.fleet.guard.SubscriptionGuard} — the guard is a
 *       Claude-private concern, not part of the SPI. opencode reads the operator's own provider
 *       credentials from its global {@code auth.json}; the bridge injects none.</li>
 *   <li><strong>File-based MCP mount + instructions.</strong> opencode has no inline
@@ -70,7 +70,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env) {
        this(agents, spaces, profiles, defaultProfile, env, 0,
                System::currentTimeMillis, () -> sleepUninterruptibly(300),
@@ -82,7 +82,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs, long spawnReadyPollMs) {
        this(agents, spaces, profiles, defaultProfile, env,
@@ -95,10 +95,10 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                            Supplier<BridgedConfig.Fleet> fleet) {
+                            Supplier<FleetConfig.Fleet> fleet) {
        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
                defaultConfigRoot(), defaultDiscoveryRoot(), fleet);
@@ -108,11 +108,11 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * Production constructor, plus the CB-596 {@code memberCredentials} policy supplier.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                            Supplier<BridgedConfig.Fleet> fleet,
-                            Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials);
@@ -138,7 +138,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     *                            {@link OpenCodeSessionDiscovery})
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
@@ -153,12 +153,12 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * @param fleet live fleet config, read once for each spawn
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
                            Path configRoot, Path discoveryRoot,
-                            Supplier<BridgedConfig.Fleet> fleet) {
+                            Supplier<FleetConfig.Fleet> fleet) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
        this.configRoot = configRoot;
@@ -169,13 +169,13 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * Full testability constructor, plus the CB-596 {@code memberCredentials} policy supplier.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
                            Path configRoot, Path discoveryRoot,
-                            Supplier<BridgedConfig.Fleet> fleet,
-                            Supplier<BridgedConfig.MemberCredentials> memberCredentials) {
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
        this.configRoot = configRoot;
@@ -201,7 +201,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * grant; and select the model with {@code -m}.
     */
    @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
        Map<String, String> workerEnv = baseEnv(cfg);
        // A config file is needed for the bridge MCP mount, a member charter, or a pinned endpoint (CB-508).
        if (cfg.hasMcp() || spec.charter() != null || hasCustomProvider(cfg)) {
@@ -238,7 +238,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * primary's Anthropic subscription, and an opencode process has no Anthropic credential path
     * at all. Pointing it at a local vLLM cannot leak the subscription.
     */
-    private static boolean hasCustomProvider(BridgedConfig.Profile cfg) {
+    private static boolean hasCustomProvider(FleetConfig.Profile cfg) {
        return cfg.baseUrl() != null && !cfg.baseUrl().isBlank();
    }

@@ -252,7 +252,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * own git worktree on its own branch, is off-subscription, and cannot merge — the lead is the
     * gate.
     */
-    private List<String> argvWithAuto(BridgedConfig.Profile cfg) {
+    private List<String> argvWithAuto(FleetConfig.Profile cfg) {
        List<String> argv = mutableArgv(cfg.argv());
        argv.add("--auto");
        return argv;
@@ -275,7 +275,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    }

    /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
-    private List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+    private List<String> argvWithModel(List<String> argv, FleetConfig.Profile cfg) {
        if (cfg.model() != null && !cfg.model().isBlank()) {
            argv.add("-m");
            argv.add(cfg.model());
@@ -289,7 +289,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * {@code OPENCODE_CONFIG}. The dir is unique per spawn so concurrent workers never race on it;
     * it is best-effort cleaned on JVM exit (worker config is disposable — regenerated every spawn).
     */
-    private Path writeConfig(BridgedConfig.Profile cfg, String charterText) {
+    private Path writeConfig(FleetConfig.Profile cfg, String charterText) {
        try {
            Path dir = Files.createTempDirectory(configRoot, "bridged-opencode-");
            dir.toFile().deleteOnExit();
@@ -349,7 +349,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * <p>The provider id comes from the {@code provider/model} selector in {@code model:}, so one
     * field drives both the declaration and the {@code -m} flag and they cannot drift apart.
     */
-    private void addCustomProvider(ObjectNode root, BridgedConfig.Profile cfg) {
+    private void addCustomProvider(ObjectNode root, FleetConfig.Profile cfg) {
        String[] parts = splitModelSelector(cfg);
        String providerId = parts[0];
        String modelId = parts[1];
@@ -362,7 +362,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
        options.put("baseURL", openAiBaseUrl(cfg.baseUrl()));
        // vLLM and friends usually ignore the key, but the AI SDK still requires a non-empty one.
        String token = resolveEnv(cfg.tokenEnv());
-        options.put("apiKey", (token == null || token.isBlank()) ? "bridged-local-noauth" : token);
+        options.put("apiKey", (token == null || token.isBlank()) ? "fleetd-local-noauth" : token);

        provider.putObject("models").putObject(modelId).put("name", modelId);
    }
@@ -372,7 +372,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * needs both, so a bare model name is rejected loudly rather than silently falling back to the
     * default gateway — a worker quietly talking to the wrong endpoint is the failure this avoids.
     */
-    private static String[] splitModelSelector(BridgedConfig.Profile cfg) {
+    private static String[] splitModelSelector(FleetConfig.Profile cfg) {
        String model = cfg.model();
        int slash = model == null ? -1 : model.indexOf('/');
        if (model == null || model.isBlank() || slash <= 0 || slash == model.length() - 1) {
@@ -496,7 +496,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {

    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+        return profileConfigs().stream().anyMatch(FleetConfig.Profile::hasGitToken);
    }

    // --- CB-117 reap predicate (opencode prefix), kept for direct unit testing -----------------
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.fleet.member;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -1,8 +1,8 @@
-package dev.ltms.bridged.metrics;
+package dev.ltms.fleet.metrics;

-import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.session.MemberSession;

 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -18,7 +18,7 @@ import java.util.Map;
 * {@code bridged_push_nudges_total{outcome="exhausted"}}, which means the primary stopped draining
 * its inbox and CB-307's active push gave up.
 */
-public final class BridgedMetrics {
+public final class FleetMetrics {

    /** Counter: delegated sends by terminal outcome. */
    public static final String SENDS = "bridged_sends_total";
@@ -39,7 +39,7 @@ public final class BridgedMetrics {
    /** Gauge: undrained replies held per target. */
    public static final String INBOX_DEPTH = "bridged_inbox_depth";

-    private BridgedMetrics() {
+    private FleetMetrics() {
    }

    /**
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.metrics;
+package dev.ltms.fleet.metrics;

 import java.util.Map;
 import java.util.NavigableMap;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import com.rabbitmq.client.AMQP;
 import com.rabbitmq.client.Channel;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import java.util.LinkedHashMap;
 import java.util.List;
@@ -1,11 +1,11 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.session.MemberSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -99,7 +99,7 @@ public final class LeadHeartbeatLoop {
    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
    private void countNudge(String outcome) {
        if (metrics != null) {
-            metrics.inc(BridgedMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
+            metrics.inc(FleetMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
        }
    }

@@ -1,10 +1,10 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -284,13 +284,13 @@ public final class MessageService {
     */
    public boolean reply(String session, String content) {
        if (rendezvous.resolve(session, content)) {
-            count(BridgedMetrics.REPLIES, "path", "rendezvous");
+            count(FleetMetrics.REPLIES, "path", "rendezvous");
            return true;                       // a live send took it — unchanged fast path
        }
        inbox.publish(session, UUID.randomUUID().toString(), content);
        // A rising inbox share is the signal CB-307 exists to make visible: the worker finished but
        // nobody was waiting, so delivery now depends on the push loop and a drain.
-        count(BridgedMetrics.REPLIES, "path", "inbox");
+        count(FleetMetrics.REPLIES, "path", "inbox");
        if (pushLoop != null) {
            pushLoop.onReplyQueued(session);
        }
@@ -308,7 +308,7 @@ public final class MessageService {
    private Reply recorded(Reply r) {
        String label = sendOutcomeLabel(r.outcome());
        if (label != null) {
-            count(BridgedMetrics.SENDS, "outcome", label);
+            count(FleetMetrics.SENDS, "outcome", label);
        }
        return r;
    }
@@ -512,7 +512,7 @@ public final class MessageService {
            // CB-582: the question just became visible via fleet_poll (Phase.ASKING) for an async
            // (wait:false) delegation — nudge the lead's own pane the same way a terminal ticket does
            // (CB-588), since the lead's normal poll cadence is minutes away and the reverse-rendezvous
-            // window (~55s, see BridgeMcp/BridgedApp) is far shorter. A blocking (wait:true) send has
+            // window (~55s, see FleetMcp/FleetApp) is far shorter. A blocking (wait:true) send has
            // no Task and gets the question directly in its own reply, so task == null there — nothing
            // to nudge.
            if (task != null && pushLoop != null) {
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import java.util.List;

@@ -1,10 +1,10 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -118,7 +118,7 @@ public final class ReplyPushLoop {
    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
    private void countNudge(String outcome) {
        if (metrics != null) {
-            metrics.inc(BridgedMetrics.PUSH_NUDGES, "outcome", outcome);
+            metrics.inc(FleetMetrics.PUSH_NUDGES, "outcome", outcome);
        }
    }

@@ -364,7 +364,7 @@ public final class ReplyPushLoop {
    /**
     * Called when an async ticket's worker pauses mid-turn in {@code fleet_ask} (CB-582): the
     * question is now visible via {@code fleet_poll} (Phase.ASKING), but the reverse-rendezvous
-     * window it opened with (~55s default, see {@code BridgeMcp}/{@code BridgedApp}) is far shorter
+     * window it opened with (~55s default, see {@code FleetMcp}/{@code FleetApp}) is far shorter
     * than a lead's normal minutes-long poll cadence — exactly the gap this closes. Resolves the
     * delegating lead the same way {@link #onTicketTerminal} does and coalesces onto the same
     * per-lead schedule (CB-590).
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;

 import java.util.concurrent.CompletableFuture;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 /**
 * Declared capabilities of a {@link PeerLauncher}. The protocol is the union across all
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 import java.util.Locale;

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 /**
 * An opaque handle returned by {@link PeerLauncher#spawn(SpawnRequest)}. The core routes on
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 import java.util.List;
 import java.util.Set;
@@ -13,7 +13,7 @@ import java.util.Set;
 * and naming conventions are all adapter-private — the core sees only the returned
 * {@link PeerHandle} whose {@code id()} is the registry/routing key.
 *
- * <p>The interface is a superset of what {@code SessionManager} and {@code Bridged.main} call
+ * <p>The interface is a superset of what {@code SessionManager} and {@code Fleetd.main} call
 * on the concrete launcher today.
 */
 public interface PeerLauncher {
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 /**
 * Thrown when a {@link PeerLauncher} starts a peer process but the peer
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.peer;
+package dev.ltms.fleet.peer;

 /**
 * What a caller asks for when spawning a peer.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -8,7 +8,7 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.LongSupplier;

 /**
- * Where a credential (not a profile — see {@code BridgedConfig.Profile#effectiveCredentialId()})
+ * Where a credential (not a profile — see {@code FleetConfig.Profile#effectiveCredentialId()})
 * sits out a cooldown after a {@code BACKEND_EXHAUSTED} classification (CB-578 stage B), so a fresh
 * spawn does not walk straight back onto the account that just refused on a usage limit.
 *
@@ -16,7 +16,7 @@ import java.util.function.LongSupplier;
 * models on the same OpenAI account) share one quarantine — {@link #quarantine} one credential id
 * and every profile whose {@code effectiveCredentialId()} equals it is quarantined too, without this
 * class knowing anything about profiles at all. That mapping is the caller's job (see
- * {@code CompositePeerLauncher} and {@code dev.ltms.bridged.inject.ExhaustionSink}).
+ * {@code CompositePeerLauncher} and {@code dev.ltms.fleet.inject.ExhaustionSink}).
 *
 * <p>The clock is injected ({@link LongSupplier}, conventionally {@code System::nanoTime} like
 * {@code FleetHealthMonitor}), never read inline, so a quarantine's expiry is testable without a
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * Backward-compatible placement: an unqualified spawn always resolves to the configured default
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * A profile (and, in CB-308, a host) that can be chosen by a {@link PlacementPolicy}.
@@ -21,7 +21,7 @@ public record PlacementCandidate(String profile, String host, float weight, Inte
    /**
     * True when this candidate carries an explicit {@code weight <= 0} (CB-554) and must be
     * skipped by every automatic policy — the same way a quarantined or unreachable candidate is
-     * skipped. {@code BridgedConfig.Profile}'s compact constructor already normalises "absent" to
+     * skipped. {@code FleetConfig.Profile}'s compact constructor already normalises "absent" to
     * {@code 1.0} and "negative" to {@code 0.0}, so this is a plain threshold check here; it does
     * not need to distinguish "explicit 0" from "absent" itself.
     *
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.List;
 import java.util.Set;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * Thrown when a {@link PlacementPolicy} has no candidate available. Kept as a distinct type so
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * Factory for the built-in placement policies.
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 /**
 * How {@code bridged} chooses a worker profile when a spawn names none. Implementations are
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.ArrayList;
 import java.util.List;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.List;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.placement;
+package dev.ltms.fleet.placement;

 import java.util.List;
 import java.util.Map;
@@ -1,25 +1,25 @@
-package dev.ltms.bridged.rest;
+package dev.ltms.fleet.rest;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import dev.ltms.bridged.auth.AuditLog;
-import dev.ltms.bridged.auth.Authz;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.Principal;
-import dev.ltms.bridged.guard.GuardException;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.placement.PlacementException;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.fleet.auth.AuditLog;
+import dev.ltms.fleet.auth.Authz;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.guard.GuardException;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.peer.PeerUnreachableException;
+import dev.ltms.fleet.placement.PlacementException;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.WorktreeRequest;
+import dev.ltms.fleet.peer.PeerLauncher;
 import io.javalin.Javalin;
 import io.javalin.http.Context;
 import jakarta.servlet.http.HttpServlet;
@@ -41,7 +41,7 @@ import java.util.stream.Collectors;
 * <p>Built from injected collaborators so tests supply fakes and run on an ephemeral
 * port; {@code main} supplies the real Unix-socket client and worker service.
 */
-public final class BridgedApp {
+public final class FleetApp {

    /** Default blocking window for a message; kept under typical HTTP idle timeouts. */
    private static final long DEFAULT_MESSAGE_TIMEOUT_MS = 25_000;
@@ -68,7 +68,7 @@ public final class BridgedApp {
     * behaved before CB-501. Retained so existing acceptance tests keep exercising handler
     * behaviour without each needing an auth fixture.
     */
-    public BridgedApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
+    public FleetApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
                      MessageService messages, MemberPresence presence,
                      HttpServlet mcpServlet) {
        this(herdr, workers, sessions, messages, presence, mcpServlet, null, null);
@@ -80,7 +80,7 @@ public final class BridgedApp {
     * @param metrics registry to instrument and expose at {@code GET /metrics}; {@code null} omits
     *                the endpoint
     */
-    public BridgedApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
+    public FleetApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
                      MessageService messages, MemberPresence presence,
                      HttpServlet mcpServlet, CallerResolver auth, Metrics metrics) {
        this.herdr = herdr;
@@ -104,7 +104,7 @@ public final class BridgedApp {
            }
        });
        // CB-501: resolve identity once per request, before any handler. /mcp does NOT pass through
-        // here — it is a raw servlet on Jetty's context handler — so BridgeMcp enforces separately
+        // here — it is a raw servlet on Jetty's context handler — so FleetMcp enforces separately
        // against the same CallerResolver. Any check that lives in only one place is not a control.
        if (auth != null) {
            app.before(ctx -> ctx.attribute(CALLER,
@@ -219,7 +219,7 @@ public final class BridgedApp {
            return;
        }
        ctx.status(200).json(Map.of("agents",
-                workers.list().stream().map(Agent.class::cast).map(BridgedApp::view).toList()));
+                workers.list().stream().map(Agent.class::cast).map(FleetApp::view).toList()));
    }

    /** CB-304: bridge-owned roster merged with live herdr status by paneId. */
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Dai Ha	6e7fc12f89	CB-632 unit 3: point text references at fleetd.example.yaml CI / contract (pull_request) Successful in 1m17s Details CI / build (pull_request) Successful in 1m36s Details	2026-08-23 06:51:48 +02:00
Dai Ha	50df14a50f	CB-632 unit 3: prefer fleetd.yaml, fall back to bridged.yaml; log the chosen file	2026-08-23 06:51:35 +02:00
Dai Ha	ccd882f2fc	CB-632 unit 3: rename the example config file to fleetd.example.yaml	2026-08-23 06:48:16 +02:00
Dai Ha	ecc590f344	CB-632 unit 5: rename the daemon and classes in the docs prose Part of #145 (CB-632). Documentation only, plus one internal literal. Unit 1 renamed the package and classes, which left every doc describing classes that no longer exist. This fixes the prose across README.md, docs/ and bridged/docs/ -- 18 files. Renamed: dev.ltms.bridged -> dev.ltms.fleet, the five class names, and "bridged" where it names the daemon as a product rather than a path. Also renamed two literals, because a doc that disagrees with the code is worse than one that is out of date: - bridged-local-noauth -> fleetd-local-noauth. A placeholder apiKey OpenCodeLauncher sends when a profile resolves no token, to a local endpoint that does not check it. No test asserts the old string. - the vnd.ltms.bridged.* media type in the M4 design doc. It appears in no Java file, so nothing implements it yet. Deliberately NOT renamed, because each is still literally true today and changes only at the cutover: - paths: bridged/, bridged.yaml, bridged.example.yaml, bridged.jar, .bridged-worktrees, deploy/dev.ltms.bridged.plist, scripts/redeploy-bridged.sh, bridged-launchd-wrapper.sh - bridged_* metric names -- renaming these after the monitoring is wired would break dashboard continuity, so they move before it is - bridge_* MCP tool names, which answer alongside fleet_* on purpose - BRIDGED_* environment variables, read by a file outside this repo Method note: perl, not sed. BSD sed has no \b and no lookaround, and a word-boundary expression there fails silently. The prose replace uses (?<![\w./-])bridged(?![\w./-]) so it cannot touch a path or an identifier, then every remaining hit was read by hand. Verified: mvn clean install green, 51 classes, 878 tests, 0 failures.	2026-08-23 06:46:34 +02:00
Dai Ha	3b7cdf9365	CB-632: the addendum named a class unit 1 renamed mcp/BridgeMcp is now mcp/FleetMcp. This line is in the project addendum, not the canonical block, so the wiki template is untouched -- the sync check still returns True. Part of #145.	2026-08-23 06:39:54 +02:00
Dai Ha	9b50dd69d8	CB-632 unit 1: rename the Java package and classes to fleet Part of #145 (CB-632), under epic #125. The product is called fleet and the daemon is called fleetd, but the code still said bridge everywhere. This renames the Java half: package dev.ltms.bridged -> dev.ltms.fleet Bridged -> Fleetd (the main class) BridgedConfig -> FleetConfig BridgeMcp -> FleetMcp BridgedApp -> FleetApp BridgedMetrics -> FleetMetrics The package root is dev.ltms.fleet, not dev.ltms.fleetd. The trailing d means daemon, which names a process, not a namespace. What this commit deliberately does NOT change: - The module directory stays bridged/, and <finalName> stays bridged. The installed launchd plist names bridged/target/bridged.jar and its KeepAlive is armed, so renaming the jar on its own strands a restart. Both change at the cutover, together with the plist, in one step. - The bridge_* MCP tool aliases. CB-622 shipped both names on purpose. One test names a local variable viaBridge because it holds the result of the deprecated call; the rename collided with it and the compiler caught it. That variable is back. - BRIDGED_* env var names, and bridged.yaml. Both are operator contracts and need a read-both shim, which is a later unit. Two things a plain search-and-replace would have missed: - logback.xml and logback-test.xml name the package twice, once as a turboFilter class= attribute. The compiler never checks those. - BSD sed does not support \b. The word-boundary expression matched nothing and said nothing, while the other ten in the same command worked. Checked the leftovers instead of trusting the exit code. Verified: mvn clean install green, 51 test classes, 878 tests, 0 failures -- the same count as before the rename.	2026-08-23 06:27:43 +02:00
ltms	08f1a79800	Merge #143 : scripts/rename-checkout.sh (CB-624) CI / contract (push) Successful in 1m13s Details CI / build (push) Successful in 1m22s Details Adds the rename script for CB-624 (#128), with a read-only --check mode. Two workers ran this ticket in parallel and were kept apart on purpose: one wrote the script, one inventoried the same rename read-only without seeing it. The inventory found three surfaces the script had missed, all verified on the live machine before being acted on: ~/.claude.json's projects key (trust state, enabledMcpjsonServers, allowedTools, lastSessionId), ~/.config/herdr/session.json, and the JetBrains recentProjects.xml / trusted-paths.xml pair in 2026.1 and 2026.2. All three are report-only by decision, not by oversight, and the reason is written into the script header: ~/.claude.json is global config written by live sessions, herdr/session.json is live process state, and IntelliJ rewrites its own files when the project is reopened. While adding them the author found a trap worth recording: JetBrains stores $USER_HOME$/LTMS/claude-bridge, not the absolute path, so a plain absolute-path grep reports 0 hits on files full of them. The script now counts both forms and says which form matched. Every apply-mode branch is unexecuted. Running it moves the directory this system runs from and stops the daemon the workers talk through, so the script is well-reasoned, not proven. Its first real run is its test. Verified before merge: CI run 215 green on both jobs, bash -n passes. shellcheck is not installed on this machine, so it never ran.	2026-08-23 06:09:18 +02:00
Dai Ha	51bdec22e7	CB-624: report three more rename surfaces as report-only CI / contract (pull_request) Successful in 55s Details CI / build (pull_request) Successful in 1m14s Details --check gains section 6 counting ~/.claude.json (the projects entry keyed by the old absolute path), ~/.config/herdr/session.json, and JetBrains recentProjects.xml / trusted-paths.xml across every IntelliJIdea* version. Apply mode's closing summary lists the same three with manual follow-ups. None of the three is rewritten automatically, on purpose: ~/.claude.json is global live Claude Code config, herdr session.json is live process state, and JetBrains rewrites its own files when the project is reopened at the new path. Header comment states the reason for each so it does not read as an oversight. JetBrains stores these paths as its $USER_HOME$ macro rather than a literal absolute path, so the counter matches both forms and says which form the hits used.	2026-08-23 06:07:16 +02:00
Dai Ha	d43f670285	CB-624: add scripts/rename-checkout.sh to rename the checkout safely CI / contract (pull_request) Successful in 46s Details CI / build (pull_request) Successful in 1m32s Details Renames ~/LTMS/claude-bridge -> ~/LTMS/fleetd as one auditable command, modeled on redeploy-bridged.sh. --check reports every surface holding the old absolute path (checkout files, launchd plist, Claude Code project state, worktree .git pointers, running daemon). Apply mode stops the daemon first (launchctl-aware), moves the checkout and the Claude Code project-state slug dir derived from both paths, repairs worktree gitdir pointers, rewrites bridged.yaml and the installed plist if they exist, restarts, and verifies /healthz plus a fresh 'bridged listening' line anchored to a pre-stop marker.	2026-08-23 05:55:04 +02:00
ltms	c135583402	Merge #139 : drop the unused rabbitmq host port mapping CI / contract (push) Successful in 53s Details CI / build (push) Successful in 1m19s Details The contract job reaches the broker by network alias (AMQP_URI=amqp://guest:guest@rabbitmq:5672), so the host mapping 5672:5672 was never used. It only bound a port on the runner host, which made two concurrent runs collide and the service container fail to start. Seen on 2026-08-22: run 209 (PR) contract=success and run 210 (the merge of that same code) contract=failure with every step, including checkout, marked cancelled. Both started at 22:08. Re-running 210 alone on the identical commit passed. PR #139's own run 212 is green on both jobs with the mapping gone, which proves the alias path still works. Also the worker-PR proof for CB-623 (#127): opened by the agent account against fleet/fleetd after the org transfer.	2026-08-23 05:41:26 +02:00
Dai Ha	8d2893b67e	CB-ci: drop host port mapping for rabbitmq service in contract job CI / contract (pull_request) Successful in 43s Details CI / build (pull_request) Successful in 1m33s Details	2026-08-23 05:35:58 +02:00
Dai Ha	555715ced9	CB-623: point every path at fleet/fleetd after the org transfer CI / contract (push) Successful in 44s Details CI / build (push) Successful in 1m29s Details The repo moved lms/claude-bridge -> fleet/claude-bridge -> fleet/fleetd. Gitea redirects hold, so most of this is not urgent, but one line was a real break: the implementer skill posts a worker's PR to a hardcoded repo path, so every worker PR would have gone to the old address. .claude/skills/implementer/SKILL.md the worker PR endpoint (functional) .gitmodules wiki submodule URL CLAUDE.md + wiki/7-Use-Cases.md the canonical block, kept byte-identical README.md clone command and wiki link deploy/bridged.service Documentation= plugin/.claude-plugin/plugin.json homepage + repository docs/*.md issue and wiki links The wiki is not a separate repo. /repos/lms/claude-bridge.wiki returns 404 and lms owned no .wiki entity, so the wiki moved with the repo; both the old and the new wiki SSH URLs resolve to the same sha. Ticket step 4 assumed a second transfer that does not exist.	2026-08-23 05:22:04 +02:00
ltms	446a9d395c	Merge CB-622: canonical block to fleet_*, charter quote fixed CI / contract (push) Successful in 49s Details CI / build (push) Successful in 1m22s Details	2026-08-22 22:08:44 +02:00
Dai Ha	8311f2db7f	CB-622: update the canonical block to fleet_, and fix the broken charter quote CI / contract (pull_request) Successful in 43s Details CI / build (pull_request) Successful in 1m28s Details The eleven tool names become fleet_ throughout the portable block. The fallback ladder keeps mcp__bridge__* unchanged and that is deliberate: both launchers still mount the server as "bridge", so a spawned member really does see that prefix. Renaming the mount is a separate surface CB-622 did not touch. Separately, a pre-existing defect: the ladder quoted the reply charter as "You are an off-subscription worker in the claude-bridge fleet", while REPLY_CHARTER says "You are a spawned member in the claude-bridge fleet". A member matching that quote found nothing, so the ladder's first rung could never fire. Now quoted verbatim. wiki/7-Use-Cases.md is advanced to the matching template commit; the sync check prints in sync: True.	2026-08-22 22:08:12 +02:00
ltms	f4570ff274	Merge CB-622 lead follow-up CI / contract (push) Successful in 42s Details CI / build (push) Successful in 1m1s Details	2026-08-22 21:59:46 +02:00
Dai Ha	3aea4e1ec6	CB-622 lead follow-up: the three changes no worker could make CI / contract (pull_request) Successful in 1m10s Details CI / build (pull_request) Successful in 1m30s Details 1. opencode.json — mount key bridged -> fleetd. Unit C could not do this: the file is neutralized by the worktree overlay, so every worker sees a stub and correctly reported it held no mount key. Tracked as CB-628. 2. e2e/bridge_ask_transcript.md keeps its name. It is a dated record of a run on 2026-07-16 that really did call bridge_ask, and its first line says so. The harness now writes fleet_ask_transcript.md for new runs; its header already says 'Live fleet_ask', so the two now agree. 3. docs/MCP-Contract.md line 20 — the historical banner describes section 6, and section 6 now says fleet_ask.	2026-08-22 21:59:23 +02:00
ltms	516366b796	Merge CB-622 Unit B: rename bridge_* to fleet_* in the Markdown docs CI / build (push) Successful in 1m0s Details CI / contract (push) Successful in 40s Details Lead-verified: 27 .md files, 165 occurrences, no wiki/, no CLAUDE.md. The docs/MCP-Contract.md boundary held exactly — every hunk falls in 223-286, inside section 6 (210-293). The transcript rename is reverted by the lead in a follow-up: that file is a dated record of a run that really did call bridge_ask.	2026-08-22 21:58:16 +02:00
ltms	d82d0157cb	Merge CB-622 Unit C: rename bridge_* to fleet_* in scripts, e2e and config CI / build (push) Successful in 1m0s Details CI / contract (push) Successful in 1m5s Details Lead-verified: 9 files, +68/-68, nothing under wiki/, root .mcp.json untouched. The worker's opencode.json finding was correct about its worktree and led to CB-628 (#134); the tracked file is fixed separately by the lead.	2026-08-22 21:58:09 +02:00
ltms	1deb0c90d4	Merge CB-622 Unit A: dual-register the MCP tools as fleet_* and bridge_* CI / contract (push) Successful in 37s Details CI / build (push) Successful in 1m30s Details Lead-verified: both names reach the same handler instance; warn-once uses a per-name Set, not a numeric sentinel; Authz keys on an action enum so the deprecated names keep their authorization. 878 tests green in a local integration with #132, #133 and the lead's opencode.json fix. Live MCP verification is still outstanding and is the lead's step after redeploy.	2026-08-22 21:58:03 +02:00
Dai Ha	76e4b577a0	CB-622: rename bridge_* tool names to fleet_* in Markdown docs CI / build (pull_request) Successful in 1m6s Details CI / contract (pull_request) Successful in 1m6s Details Rename the eleven MCP tool names (bridge_ack/ask/list/poll/profiles/reply/ send/spawn/status/stop/whoami) to their fleet_* names across the Markdown documentation. fleet_* is written as the normal name; one deprecation note in README.md says bridge_* still works for one release. docs/MCP-Contract.md is renamed only inside section 6 (lines 210-293): sections 1-5 and 7-11 are stale pre-build design text (CB-609) and are deliberately left with old names so dead text does not look maintained. Also renames e2e/bridge_ask_transcript.md to e2e/fleet_ask_transcript.md to match its content. CLAUDE.md, wiki/, plugin/skills/setup/SKILL.md and .claude/skills/port-to-opencode/SKILL.md are owned by other units and are untouched.	2026-08-22 21:52:24 +02:00
Dai Ha	03473a286b	CB-622: rename bridge_* tools to fleet_* in scripts, e2e tests and config; mount name bridged -> fleetd CI / build (pull_request) Successful in 58s Details CI / contract (pull_request) Successful in 1m9s Details	2026-08-22 21:49:15 +02:00