fleetd #249 : withhold agentSessionId for a non-provisioned opencode cwd

OpenCodeSessionDiscovery.sessionIdForDirectory keys on the worker's cwd, which is reliable only when fleetd provisioned a unique git worktree for that member. Without one (the default no-worktree spawn), the cwd is shared with other sessions, and "most recently updated row for this directory" can pick a stranger's session — fleet_list would then hand a lead an agentSessionId that resumes someone else's conversation. Move isProvisionedWorktree from ClaudeCodeLauncher to the shared HerdrPeerLauncher base (both adapters need it now). OpenCodeLauncher.spawn now refuses a resumeSessionId spawn outright when the target cwd is not a provisioned worktree (fleetd can never verify or re-report that identity), and SessionAwareHandle.agentSessionId() withholds the id — returns null rather than guessing — for any member spawned without one, resumed or not. Corrected fleet_list/fleet_spawn's tool descriptions, which previously implied agentSessionId is always a safe resume handle.
fleetd #201 : the coverage line must name the key its caller actually means
2026-09-03 12:51:56 +07:00 · 2026-09-03 12:29:27 +07:00 · 2026-09-03 12:22:32 +07:00 · 2026-09-03 12:20:28 +07:00 · 2026-09-03 12:03:21 +07:00
12 changed files with 825 additions and 125 deletions
@@ -351,7 +351,8 @@ public final class Fleetd {
                .map(session -> exhaustedPatternsByProfile.get(session.profile()))
                .orElse(null);
        log.info("backend-exhausted classification (CB-578 stage A): {}",
-                CompletionResolver.coverage(cfg.profiles().keySet(), exhaustedPatternsByProfile.keySet()));
+                CompletionResolver.coverage("exhaustedPattern", cfg.profiles().keySet(),
+                        exhaustedPatternsByProfile.keySet()));
        // fleetd #201 Unit 5: classify a completion-fallback scrape that matches a profile's
        // configured backend-error refusal (a credential outage, a provider 5xx) as a backend error
        // rather than handing it back as a real answer. Compiled once at startup, keyed by profile
@@ -365,13 +366,14 @@ public final class Fleetd {
                errorPatternsByProfile.put(name, Pattern.compile(profile.errorPattern()));
            }
        });
-        BackendErrorPatternLookup backendErrorPatterns = target -> sessions.roster().stream()
-                .filter(session -> target.equals(session.terminalId()))
-                .findFirst()
-                .map(session -> errorPatternsByProfile.get(session.profile()))
-                .orElse(null);
+        // fleetd #248: extracted to a static factory (see backendErrorPatternLookup below) so a
+        // test can prove main() actually PASSES this into CompletionResolver, not only that the
+        // lookup itself behaves correctly — the exact gap fleetd #248 exists to close.
+        BackendErrorPatternLookup backendErrorPatterns = backendErrorPatternLookup(sessions::roster,
+                errorPatternsByProfile);
        log.info("backend-error classification (fleetd #201 Unit 5): {}",
-                CompletionResolver.coverage(cfg.profiles().keySet(), errorPatternsByProfile.keySet()));
+                CompletionResolver.coverage("errorPattern", cfg.profiles().keySet(),
+                        errorPatternsByProfile.keySet()));
        // CB-578 stage B: on a classification that actually wins, quarantine the exhausted profile's
        // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
        // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
@@ -424,59 +426,25 @@ public final class Fleetd {
        // construction-order cycle `exhaustionSinkRef` breaks above, broken the same way: a mutable
        // holder set once `pushLoop` exists, read lazily from inside the lambda built here.
        AtomicReference<ReplyPushLoop> pushLoopRef = new AtomicReference<>();
-        // Order: (1) mark the member BACKEND_ERROR; (2) resolve profile/credential through the
-        // roster — fail loud (never Optional.ifPresent, the fleetd #234 lesson applied to this new
-        // sink) and notify the lead via onBackendTargetUnmapped when it cannot be resolved; (3)
-        // record the error in BackendOutagePolicy; (4) on a NEW incident (the record() call that
-        // actually crosses the threshold), tell the lead via onBackendIncident.
-        BackendErrorSink backendErrorSink = (target, matchedLine, reason) -> {
-            sessions.onBackendError(target, reason);
-
-            String profileName = sessions.roster().stream()
-                    .filter(session -> target.equals(session.terminalId()))
-                    .findFirst()
-                    .map(MemberSession::profile)
-                    .orElse(null);
-            FleetConfig.Profile profile = profileName == null ? null : config.get().profiles().get(profileName);
-            if (profile == null) {
-                log.error("backend error on target '{}' ({}) but no profile could be resolved — the "
-                                + "target is not (yet) in the roster — no cool-off applied (fleetd #201 Unit 5)",
-                        target, reason);
-                ReplyPushLoop loop = pushLoopRef.get();
-                if (loop != null) {
-                    loop.onBackendTargetUnmapped(target, reason);
-                }
-                return;
-            }
-            String credentialId = profile.effectiveCredentialId();
-            Optional<BackendOutagePolicy.Incident> incident = outagePolicy.record(credentialId, target, reason);
-            incident.ifPresent(inc -> {
-                List<String> affectedProfiles = config.get().profiles().values().stream()
-                        .filter(p -> credentialId.equals(p.effectiveCredentialId()))
-                        .map(FleetConfig.Profile::profile)
-                        .sorted()
-                        .toList();
-                log.warn("credential '{}' cooling off for {}s after backend errors on {} distinct "
-                                + "target(s) (profile '{}'): {}", credentialId,
-                        inc.remainingCoolOffSeconds(), inc.evidenceCount(), profile.profile(), reason);
-                ReplyPushLoop loop = pushLoopRef.get();
-                if (loop != null) {
-                    loop.onBackendIncident(inc.id(), inc.targets(), credentialId, affectedProfiles,
-                            (int) inc.remainingCoolOffSeconds());
-                }
-            });
-        };
+        // fleetd #248: extracted to a static factory (see backendErrorSink below), public rather
+        // than package-private like the other two factories here, so
+        // dev.ltms.fleet.inject.BackendOutageFlowTest can exercise the REAL production sink
+        // directly instead of a hand-mirrored copy of this lambda — that copy was precisely the
+        // gap fleetd #248 exists to close (see that test's class doc for the history).
+        BackendErrorSink backendErrorSink = backendErrorSink(sessions, () -> config.get().profiles(),
+                outagePolicy, pushLoopRef::get);
        AgentControl agents = router.memberAgents();
        // Both fleetd#201 Unit 5 (backend-error patterns + sink) and fleetd#241 (the worktree/branch
        // lookup the fallback report names) land on this one call. The full constructor takes both,
        // so neither feature is dropped; nowNanos must be passed explicitly to reach it.
+        //
+        // fleetd #248: every argument built specifically for this call (backendErrorPatterns and
+        // backendErrorSink above, and the worktree/branch lookup right here) now comes from a
+        // static factory tested on its own; FleetdCompletionResolverWiringTest source-asserts that
+        // THIS call actually passes them, which is the coverage that was missing before.
        CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns,
                exhaustionSink, backendErrorPatterns, backendErrorSink, System::nanoTime,
-                target -> sessions.roster().stream()
-                        .filter(session -> target.equals(session.terminalId()))
-                        .findFirst()
-                        .map(session -> new CompletionResolver.WorktreeBranch(session.worktree(), session.branch()))
-                        .orElse(null));
+                worktreeBranchLookup(sessions::roster));
        // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
        // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
        MemberPresence presence = sessions.asPresence();
@@ -770,6 +738,123 @@ public final class Fleetd {
        return target -> presence.isPresent(target) || leads.get().containsKey(target);
    }

+    /**
+     * fleetd #248: package-private factory for the member worktree/branch lookup {@link
+     * CompletionResolver} uses to name a fallback report's worktree and branch (fleetd#241).
+     *
+     * <p>Before this ticket the lookup was an anonymous lambda built inline inside {@code main}'s
+     * {@code CompletionResolver} constructor call — provably untested wiring, the whole reason
+     * fleetd #248 exists: dropping that one argument (passing {@code _ -> null} instead) compiled
+     * clean and left every test green. Extracted here, {@code main} now calls this factory instead
+     * of building the lambda inline, and a source assertion on that call site
+     * ({@code FleetdCompletionResolverWiringTest}) proves the argument is still actually passed.
+     *
+     * <p>Takes the roster as a plain {@link Supplier} — not a {@link SessionManager} — so this is
+     * directly testable with a hand-built session list; no real {@code SessionManager} (launcher,
+     * worktrees, …) needs constructing. Follows the same {@code static} factory pattern as
+     * {@link #deliverableTo} above.
+     *
+     * @param roster the live member roster, normally {@code sessions::roster}
+     */
+    static Function<String, CompletionResolver.WorktreeBranch> worktreeBranchLookup(
+            Supplier<List<MemberSession>> roster) {
+        return target -> roster.get().stream()
+                .filter(session -> target.equals(session.terminalId()))
+                .findFirst()
+                .map(session -> new CompletionResolver.WorktreeBranch(session.worktree(), session.branch()))
+                .orElse(null);
+    }
+
+    /**
+     * fleetd #248 / fleetd#201 Unit 5: package-private factory for the per-target backend-error
+     * pattern lookup {@link CompletionResolver} classifies a pane scrape against. Closes over the
+     * live roster (to resolve a target to a profile) and {@code errorPatternsByProfile} (each
+     * profile's configured {@code errorPattern}, already compiled by the caller — the same map also
+     * feeds the coverage log next to where this is called) — nothing else, so it is directly
+     * testable. See {@link #worktreeBranchLookup} above for why this ticket exists and why the
+     * factory takes a roster {@link Supplier} rather than a {@link SessionManager}.
+     *
+     * @param roster                 the live member roster, normally {@code sessions::roster}
+     * @param errorPatternsByProfile every profile that has an {@code errorPattern} configured,
+     *                               keyed by profile name
+     */
+    static BackendErrorPatternLookup backendErrorPatternLookup(Supplier<List<MemberSession>> roster,
+            Map<String, Pattern> errorPatternsByProfile) {
+        return target -> roster.get().stream()
+                .filter(session -> target.equals(session.terminalId()))
+                .findFirst()
+                .map(session -> errorPatternsByProfile.get(session.profile()))
+                .orElse(null);
+    }
+
+    /**
+     * fleetd #248 / fleetd#201 Unit 5: factory for the production {@link BackendErrorSink} — the
+     * collaborator {@link CompletionResolver} notifies when a pane-scrape classification actually
+     * resolves a waiter as a backend error. Order: (1) mark the member BACKEND_ERROR; (2) resolve
+     * profile/credential through the roster — fail loud (never {@code Optional.ifPresent}, the
+     * fleetd #234 lesson applied to this sink) and notify the lead via {@code
+     * onBackendTargetUnmapped} when it cannot be resolved; (3) record the error in {@code
+     * outagePolicy}; (4) on a NEW incident (the {@code record()} call that actually crosses the
+     * threshold), tell the lead via {@code onBackendIncident}.
+     *
+     * <p>{@code public}, unlike {@link #worktreeBranchLookup} and {@link #backendErrorPatternLookup}
+     * above: {@code dev.ltms.fleet.inject.BackendOutageFlowTest} exercises this exact object as the
+     * real, wired production path, replacing what its own class doc used to call out as a
+     * hand-mirrored copy of this lambda ("mirrors {@code Fleetd.main}'s {@code backendErrorSink}
+     * lambda line-for-line") — that copy proved only itself, never that {@code main} still wires the
+     * real thing. That was precisely the gap fleetd #248 exists to close.
+     *
+     * @param sessions the session registry; both read (roster) and written (onBackendError)
+     * @param profiles the live profile map, normally {@code () -> config.get().profiles()} in
+     *                 {@code main}, or a fixed test map via {@code () -> profiles}
+     * @param pushLoop the lead-nudge loop, read lazily: {@code main} builds this sink before the
+     *                 real {@link ReplyPushLoop} exists (a genuine construction-order cycle, broken
+     *                 the same way {@code exhaustionSinkRef} is a few lines above it), so a
+     *                 {@link Supplier} reads whatever {@code main} has filled in by the time a real
+     *                 backend error fires
+     */
+    public static BackendErrorSink backendErrorSink(SessionManager sessions,
+            Supplier<Map<String, FleetConfig.Profile>> profiles, BackendOutagePolicy outagePolicy,
+            Supplier<ReplyPushLoop> pushLoop) {
+        return (target, matchedLine, reason) -> {
+            sessions.onBackendError(target, reason);
+
+            String profileName = sessions.roster().stream()
+                    .filter(session -> target.equals(session.terminalId()))
+                    .findFirst()
+                    .map(MemberSession::profile)
+                    .orElse(null);
+            FleetConfig.Profile profile = profileName == null ? null : profiles.get().get(profileName);
+            if (profile == null) {
+                log.error("backend error on target '{}' ({}) but no profile could be resolved — the "
+                                + "target is not (yet) in the roster — no cool-off applied (fleetd #201 Unit 5)",
+                        target, reason);
+                ReplyPushLoop loop = pushLoop.get();
+                if (loop != null) {
+                    loop.onBackendTargetUnmapped(target, reason);
+                }
+                return;
+            }
+            String credentialId = profile.effectiveCredentialId();
+            Optional<BackendOutagePolicy.Incident> incident = outagePolicy.record(credentialId, target, reason);
+            incident.ifPresent(inc -> {
+                List<String> affectedProfiles = profiles.get().values().stream()
+                        .filter(p -> credentialId.equals(p.effectiveCredentialId()))
+                        .map(FleetConfig.Profile::profile)
+                        .sorted()
+                        .toList();
+                log.warn("credential '{}' cooling off for {}s after backend errors on {} distinct "
+                                + "target(s) (profile '{}'): {}", credentialId,
+                        inc.remainingCoolOffSeconds(), inc.evidenceCount(), profile.profile(), reason);
+                ReplyPushLoop loop = pushLoop.get();
+                if (loop != null) {
+                    loop.onBackendIncident(inc.id(), inc.targets(), credentialId, affectedProfiles,
+                            (int) inc.remainingCoolOffSeconds());
+                }
+            });
+        };
+    }
+
    /** Injection seam for {@link #selectReplyInbox}: production binds {@link AmqpReplyInbox#open}. */
    @FunctionalInterface
    interface AmqpOpener {
@@ -620,9 +620,9 @@ public final class CompletionResolver implements TurnListener {
     * @param allProfiles        every configured profile name
     * @param configuredProfiles the subset of {@code allProfiles} that carry an exhausted pattern
     */
-    public static String coverage(Set<String> allProfiles, Set<String> configuredProfiles) {
+    public static String coverage(String patternKey, Set<String> allProfiles, Set<String> configuredProfiles) {
        if (configuredProfiles.isEmpty()) {
-            return "off (no profile has an exhaustedPattern configured; profiles: " + sorted(allProfiles) + ")";
+            return "off (no profile has an " + patternKey + " configured; profiles: " + sorted(allProfiles) + ")";
        }
        Set<String> unconfigured = new TreeSet<>(allProfiles);
        unconfigured.removeAll(configuredProfiles);
@@ -1253,7 +1253,11 @@ public final class FleetMcp {
                        + "worktree:<ticket-slug> to provision an isolated git worktree. Pass resumeSessionId "
                        + "to relaunch onto a prior conversation instead of starting cold — this requires an "
                        + "explicit profile whose backend supports it (fleet_list shows agentSessionId for "
-                        + "resumable members), and is refused otherwise rather than silently starting fresh. "
+                        + "resumable members; it is absent for a member fleetd cannot reliably re-identify, "
+                        + "e.g. an opencode member spawned without a worktree), and is refused otherwise "
+                        + "rather than silently starting fresh. For an opencode profile, resumeSessionId "
+                        + "itself also requires worktree:true/<slug> on THIS spawn — without one fleetd can "
+                        + "never re-verify which conversation it actually resumed (fleetd #249). "
                        + "sessionName gives the member a display name in its own UI when the backend supports "
                        + "one. Returns the member's sessionId (use with fleet_send) and paneId (use with "
                        + "fleet_stop).",
@@ -1264,7 +1268,7 @@ public final class FleetMcp {
                        "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
                        "ticket", stringProp("Ticket slug when worktree:true"),
                        "sessionName", stringProp("Logical display name for the member's own session, when its backend supports one"),
-                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it")),
+                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it, and (for opencode) a worktree on this spawn too")),
                        List.of()));
    }

@@ -1285,9 +1289,14 @@ public final class FleetMcp {
                        + "discover a peer lead without being told its address. 'members' are the "
                        + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
                        + "reviewer), profile (the backend it runs on), state, optional "
-                        + "worktree/branch/owner/agentSessionId (the id to pass as fleet_spawn's "
-                        + "resumeSessionId to relaunch onto that same conversation, when the backend "
-                        + "supports it), and live herdr status. An empty 'members' "
+                        + "worktree/branch/owner/agentSessionId, and live herdr status. agentSessionId, "
+                        + "when present, is the id to pass as fleet_spawn's resumeSessionId to relaunch "
+                        + "onto that same conversation. It is ABSENT — not a guess — for a member fleetd "
+                        + "cannot reliably re-identify: some backends (e.g. opencode) resolve it from the "
+                        + "member's working directory, which only uniquely identifies a member when it "
+                        + "was spawned into its own fleetd-provisioned worktree (worktree:true/<slug>); a "
+                        + "member spawned without one shares its directory with others and never reports "
+                        + "an id, however long it runs (fleetd #249). An empty 'members' "
                        + "means no members are spawned; it says nothing about peers. When capacity "
                        + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
                        + "a quarantined profile's credential (see fleet_profiles), whatever its "
@@ -505,7 +505,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * peer that starts without the seed still starts; it just may hit the dialog fleetd #149
     * describes.
     *
-     * <p><b>Gated to a provisioned worktree</b> ({@link #isProvisionedWorktree}) — see that
+     * <p><b>Gated to a provisioned worktree</b> ({@link HerdrPeerLauncher#isProvisionedWorktree}) — see that
     * method's javadoc for the incident that made this gate mandatory, not optional: this must
     * never run against a real checkout or an un-configured fallback cwd, only the exact
     * always-fresh-directory population fleetd #149 describes.
@@ -516,7 +516,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * sibling-temp-file + {@code ATOMIC_MOVE}, never a truncate-in-place) so a crash mid-write or a
     * concurrent reader never observes a half-written file, and through {@link #TRUST_JSON_LOCK} so
     * two concurrent spawns' entries both survive instead of the second write silently discarding
-     * the first. Both exist because of a real incident: see {@link #isProvisionedWorktree}'s javadoc
+     * the first. Both exist because of a real incident: see {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc
     * and {@link #writeAtomically}'s javadoc.
     *
     * @param configDir the profile's {@code CLAUDE_CONFIG_DIR} ({@code cfg.configDir()}), or
@@ -578,7 +578,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * <p><b>fleetd #149 incident.</b> The original implementation used
     * {@code Files.writeString(target, content)} directly, which truncates {@code target} in place
     * before writing the replacement bytes. Combined with an ungated {@code cwd} (see
-     * {@link #isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
+     * {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
     * against the operator's real {@code ~/.claude.json} and left it at 178 bytes. The gate closes
     * <em>which file</em> this can ever target; this closes <em>how</em> the target is written, so
     * that even a legitimate write against a real, live, concurrently-read {@code .claude.json}
@@ -628,32 +628,6 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
        }
    }

-    /**
-     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
-     * {@link #writeIdeOverlay} already gates on: a {@code .git} that is a <strong>regular
-     * file</strong> holding a {@code gitdir:} pointer, as opposed to a real checkout's {@code .git}
-     * <strong>directory</strong>. {@code null}/blank never qualifies.
-     *
-     * <p>Shared by every write that must land only in a worktree fleetd itself created for a
-     * member — never in a real checkout, an arbitrary configured directory, or (see the incident
-     * below) the daemon's own fallback cwd.
-     *
-     * <p><b>fleetd #149 incident.</b> {@link #seedTrustDialog} originally ran unconditionally on
-     * any non-blank {@code cwd}. Most of this launcher's OWN tests spawn a profile with no
-     * {@code cwd} configured, so the base class's {@code resolveCwd} falls through to the real
-     * {@code user.dir} — and with no {@code configDir} either (also the common case in this
-     * file's fixtures), the seed's target falls through the same way to the real
-     * {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's actual
-     * config file (it shrank from ~72 KB to a single seeded entry) the first time a mutation
-     * happened to make the write non-additive. Gating both cwd-targeted writes on "this is a
-     * worktree fleetd provisioned" — exactly the population fleetd #149 describes
-     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
-     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
-     */
-    private static boolean isProvisionedWorktree(String cwd) {
-        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
-    }
-
    /** {@code s}, or {@code null} when {@code s} is null/blank — the charter-presence test used above. */
    private static String nonBlank(String s) {
        return (s == null || s.isBlank()) ? null : s;
@@ -358,6 +358,42 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        return Files.isRegularFile(candidate) ? candidate : null;
    }

+    /**
+     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
+     * {@code ClaudeCodeLauncher#writeIdeOverlay} already gates on: a {@code .git} that is a
+     * <strong>regular file</strong> holding a {@code gitdir:} pointer, as opposed to a real
+     * checkout's {@code .git} <strong>directory</strong>. {@code null}/blank never qualifies.
+     *
+     * <p>Shared by every write (and, since fleetd #249, every identity read) that must land only
+     * in a worktree fleetd itself created for a member — never in a real checkout, an arbitrary
+     * configured directory, or (see the incident below) the daemon's own fallback cwd. Package-
+     * private (not {@code protected}) on purpose: {@link ClaudeCodeLauncher} and
+     * {@link OpenCodeLauncher} both call it, and same-package visibility is enough — no subclass
+     * outside this package needs it.
+     *
+     * <p><b>fleetd #149 incident.</b> {@code ClaudeCodeLauncher#seedTrustDialog} originally ran
+     * unconditionally on any non-blank {@code cwd}. Most of that launcher's OWN tests spawn a
+     * profile with no {@code cwd} configured, so the base class's {@code resolveCwd} falls
+     * through to the real {@code user.dir} — and with no {@code configDir} either (also the
+     * common case in that file's fixtures), the seed's target falls through the same way to the
+     * real {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's
+     * actual config file (it shrank from ~72 KB to a single seeded entry) the first time a
+     * mutation happened to make the write non-additive. Gating both cwd-targeted writes on "this
+     * is a worktree fleetd provisioned" — exactly the population fleetd #149 describes
+     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
+     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
+     *
+     * <p><b>fleetd #249.</b> The same reasoning extends to a READ: {@code
+     * OpenCodeSessionDiscovery#sessionIdForDirectory} keys on {@code directory}, a heuristic that
+     * is only reliable when the directory is unique to this member — i.e., exactly the population
+     * this gate identifies. {@link OpenCodeLauncher} uses it to withhold {@code agentSessionId()}
+     * (report absence rather than a guess) and to refuse a {@code resumeSessionId} spawn that
+     * cannot be resolved reliably going forward.
+     */
+    static boolean isProvisionedWorktree(String cwd) {
+        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
+    }
+
    // --- profile surface -----------------------------------------------------------------------

    /** The configured peer profile names (what {@code spawn(profile)} accepts). */
@@ -672,13 +672,29 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    /** Add lazy on-disk session discovery to the base handle. */
    @Override
    public PeerHandle spawn(SpawnRequest req) {
+        String cwd = effectiveCwd(req);
+        // fleetd #249: refuse rather than silently resume into unverifiable territory. opencode's
+        // `-s <id>` flag itself resumes precisely — the resolved id is what fails, not the resume —
+        // but resolvedSessionId() below can never confirm (or later re-report) this handle's own
+        // identity without a fleetd-provisioned worktree (isProvisionedWorktree(cwd)), because the
+        // directory is shared and sessionIdForDirectory's "most recently updated row" heuristic can
+        // pick a sibling's session. Refusing here, before anything spawns, beats letting the member
+        // start and only then discovering fleetd can never again verify who it actually is.
+        if (req.resumeSessionId() != null && !req.resumeSessionId().isBlank()
+                && !isProvisionedWorktree(cwd)) {
+            throw new IllegalArgumentException("resumeSessionId requires a fleetd-provisioned "
+                    + "worktree for an opencode profile — without one, this member's cwd is shared "
+                    + "with other sessions, so fleetd can never reliably confirm (now or later) which "
+                    + "conversation it is actually running (fleetd #249). Pass fleet_spawn{worktree:"
+                    + "<ticket-slug>} to resume this member.");
+        }
        PeerHandle inner = super.spawn(req);
        // fleetd #175: the same profile config buildLaunch resolved for this spawn (requireProfile
        // is deterministic on req.profileName(), so re-resolving here costs a map lookup, not a
        // second decision) — SessionAwareHandle needs cfg.model() to know what THIS session should
        // be running.
        FleetConfig.Profile cfg = requireProfile(req.profileName());
-        return new SessionAwareHandle(inner, discovery, effectiveCwd(req), cfg,
+        return new SessionAwareHandle(inner, discovery, cwd, cfg,
                this::memberHerdrSocketConfigured, discoveryUnavailableWarned, exhaustionSink);
    }

@@ -718,6 +734,17 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         * the directory right now."
         */
        private final AtomicReference<String> resolvedSessionId = new AtomicReference<>();
+        /**
+         * fleetd #249: whether {@link #cwd} is a fleetd-provisioned git worktree
+         * ({@link HerdrPeerLauncher#isProvisionedWorktree}), computed once at spawn time since
+         * {@code cwd} never changes for this handle. When {@code false} the directory is shared
+         * with other sessions (the default no-worktree spawn inherits the lead's own cwd), so
+         * {@link OpenCodeSessionDiscovery#sessionIdForDirectory}'s "most recently updated row for
+         * this directory" heuristic can and does pick another session's row — see that class's
+         * javadoc. {@link #agentSessionId()} refuses to guess in that case: it reports absent
+         * rather than a possibly-foreign id.
+         */
+        private final boolean worktreeProvisioned;

        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd,
                            FleetConfig.Profile cfg,
@@ -731,6 +758,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            this.discoveryUnavailable = discoveryUnavailable;
            this.discoveryUnavailableWarned = discoveryUnavailableWarned;
            this.exhaustionSink = exhaustionSink;
+            this.worktreeProvisioned = isProvisionedWorktree(cwd);
        }

        @Override
@@ -760,6 +788,9 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            // built from (see OpenCodeLauncher#defaultDiscoveryRoot's javadoc for the full
            // reasoning). Scanning fleetd's own $HOME under that config would only ever find "no
            // row" and read as "resume unsupported" — declare it unavailable instead, once, loudly.
+            // Checked before the fleetd #249 worktree gate below: this OS-user mismatch makes
+            // discovery unusable regardless of whether cwd happens to be a provisioned worktree, so
+            // it earns the one-time WARN either way.
            if (discoveryUnavailable.getAsBoolean()) {
                if (discoveryUnavailableWarned.compareAndSet(false, true)) {
                    log.warn("opencode session discovery unavailable: memberHerdrSocket is "
@@ -771,6 +802,16 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                }
                return null;
            }
+            // fleetd #249: cwd is shared with other sessions unless fleetd itself provisioned this
+            // worktree, and sessionIdForDirectory's directory-keyed heuristic cannot tell this
+            // member's row apart from a sibling's in that case (measured: a three-day-old row from
+            // a different profile). Refuse to guess — absent is the honest answer, and it is what
+            // this codebase already returns elsewhere for absent evidence (fleetd #175's UNKNOWN).
+            // No WARN here: unlike discoveryUnavailable above, this is the ordinary, expected shape
+            // of the large majority of spawns (no worktree requested), not a configuration gap.
+            if (!worktreeProvisioned) {
+                return null;
+            }
            // fleetd #234: once resolved, stay resolved. Re-deriving from `directory` on every call
            // would let this handle's identity drift to a sibling session that later shares the
            // same cwd and writes a newer row — see resolvedSessionId's javadoc.
@@ -0,0 +1,59 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.inject.BackendErrorPatternLookup;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.session.MemberSession;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Pattern;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * fleetd #248 / fleetd#201 Unit 5: {@link Fleetd#backendErrorPatternLookup} is the factory that
+ * replaced the local lambda {@code Fleetd.main} used to build {@code backendErrorPatterns} — one
+ * of the two arguments {@code CompletionResolver} lost cleanly (0 compile errors, every test still
+ * green) when this ticket's measurement dropped it alongside {@code backendErrorSink}. This class
+ * proves the factory's own behaviour; {@code FleetdCompletionResolverWiringTest} proves {@code
+ * main} still passes its result into {@code CompletionResolver}.
+ */
+class FleetdBackendErrorPatternLookupTest {
+
+    private static MemberSession session(String terminal, String profile) {
+        return new MemberSession("pane-" + terminal, terminal, profile, MemberRole.DEV,
+                "/cwd", null, 0L, 0L, 0, MemberSession.State.READY, null, null);
+    }
+
+    @Test
+    @DisplayName("a target on a profile with a configured pattern resolves to that pattern")
+    void configuredProfileResolves() {
+        Map<String, Pattern> byProfile = Map.of("terra", Pattern.compile("(?i)503"));
+        BackendErrorPatternLookup lookup =
+                Fleetd.backendErrorPatternLookup(() -> List.of(session("term1", "terra")), byProfile);
+
+        assertEquals("(?i)503", lookup.patternFor("term1").pattern());
+    }
+
+    @Test
+    @DisplayName("a target on a profile with no configured pattern resolves to null")
+    void unconfiguredProfileResolvesToNull() {
+        Map<String, Pattern> byProfile = Map.of("terra", Pattern.compile("x"));
+        BackendErrorPatternLookup lookup =
+                Fleetd.backendErrorPatternLookup(() -> List.of(session("term1", "sol")), byProfile);
+
+        assertNull(lookup.patternFor("term1"));
+    }
+
+    @Test
+    @DisplayName("an unknown target resolves to null")
+    void unknownTargetResolvesToNull() {
+        BackendErrorPatternLookup lookup =
+                Fleetd.backendErrorPatternLookup(List::of, Map.of("terra", Pattern.compile("x")));
+
+        assertNull(lookup.patternFor("term_stranger"));
+    }
+}
@@ -0,0 +1,229 @@
+package dev.ltms.fleet;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.BackendErrorSink;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.ReplyPushLoop;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.BackendOutagePolicy;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementPolicies;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #248 / fleetd#201 Unit 5: {@link Fleetd#backendErrorSink} is the factory that replaced
+ * the local lambda {@code Fleetd.main} used to build {@code backendErrorSink} — the other half of
+ * the pair this ticket's measurement dropped cleanly (0 compile errors, every test still green).
+ *
+ * <p>Before this ticket, the closest thing to coverage was {@code
+ * dev.ltms.fleet.inject.BackendOutageFlowTest}, whose own class doc said it "mirrors {@code
+ * Fleetd.main}'s {@code backendErrorSink} lambda line-for-line" — a hand-copy that proves itself,
+ * never that {@code main} still wires the real thing. This class exercises the actual production
+ * factory instead. {@code FleetdCompletionResolverWiringTest} proves {@code main} still passes its
+ * result into {@code CompletionResolver}.
+ */
+class FleetdBackendErrorSinkTest {
+
+    private final List<ScheduledExecutorService> schedulers = new ArrayList<>();
+
+    @AfterEach
+    void tearDown() {
+        schedulers.forEach(ScheduledExecutorService::shutdownNow);
+    }
+
+    private static FleetConfig.Profile stubWorker(String profile, String credentialId) {
+        return new FleetConfig.Profile(profile, "http://gx00.gw:8000", "coder",
+                null, "FLEETD_WORKER_TOKEN", List.of("claude"), "tab", "fleetd-workers",
+                "w #{n}", null, null, null, null, null, null, null, null, null,
+                null, null, credentialId, null);
+    }
+
+    private static Map<String, FleetConfig.Profile> orderedProfiles() {
+        Map<String, FleetConfig.Profile> m = new LinkedHashMap<>();
+        m.put("terra", stubWorker("terra", "shared-openai"));
+        m.put("sol", stubWorker("sol", "shared-openai"));
+        return m;
+    }
+
+    /** Minimal recording {@code HerdrClient} for the LEAD pane — mirrors ReplyPushLoopTest's own. */
+    private static final class RecordingLeadClient implements HerdrClient {
+        private static final ObjectMapper MAPPER = new ObjectMapper();
+        private final List<Object> prompts = new CopyOnWriteArrayList<>();
+        volatile CountDownLatch sendLatch = new CountDownLatch(1);
+
+        @Override
+        public JsonNode call(String method, Object params) {
+            if ("agent.get".equals(method)) {
+                return MAPPER.createObjectNode().set("agent", MAPPER.createObjectNode()
+                        .put("terminal_id", "term_primary").put("agent_status", "idle"));
+            }
+            if ("agent.prompt".equals(method)) {
+                prompts.add(params);
+                sendLatch.countDown();
+            }
+            return MAPPER.createObjectNode();
+        }
+
+        @Override
+        public void close() {
+        }
+
+        int sendCount() {
+            return prompts.size();
+        }
+    }
+
+    /** A {@link PeerLauncher} that never actually spawns — enough to construct a bare {@link SessionManager}. */
+    private static final class NeverSpawnsLauncher implements PeerLauncher {
+        @Override
+        public Set<Capability> capabilities() {
+            return Set.of();
+        }
+
+        @Override
+        public Set<Capability> capabilitiesFor(String profileName) {
+            return Set.of();
+        }
+
+        @Override
+        public PeerHandle spawn(SpawnRequest req) {
+            throw new UnsupportedOperationException("not reachable — this test never acquires a session");
+        }
+
+        @Override
+        public Set<String> profiles() {
+            return Set.of();
+        }
+
+        @Override
+        public String defaultProfile() {
+            return null;
+        }
+
+        @Override
+        public String effectiveCwd(SpawnRequest req) {
+            throw new UnsupportedOperationException("not reachable — this test never acquires a session");
+        }
+
+        @Override
+        public List<String> parityOverlay(String profileName) {
+            return List.of();
+        }
+
+        @Override
+        public List<?> list() {
+            return List.of();
+        }
+
+        @Override
+        public int reapOrphanWorkers() {
+            return 0;
+        }
+
+        @Override
+        public void stop(String id) {
+        }
+
+        @Override
+        public boolean clearContext(String id) {
+            return false;
+        }
+    }
+
+    @Test
+    @DisplayName("a target with no resolvable profile logs and returns without recording an incident (never throws)")
+    void unresolvableProfileDoesNotRecordOrThrow() {
+        SessionManager sessions = new SessionManager(new NeverSpawnsLauncher());
+        BackendOutagePolicy outagePolicy = new BackendOutagePolicy(() -> 0L);
+        RecordingLeadClient leadClient = new RecordingLeadClient();
+        InMemoryReplyInbox inbox = new InMemoryReplyInbox();
+        PrimaryRegistry registry = new PrimaryRegistry(null);
+        ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
+        schedulers.add(scheduler);
+        ReplyPushLoop pushLoop = new ReplyPushLoop(registry, new AgentControl(leadClient), inbox, scheduler, 3, 50);
+
+        BackendErrorSink sink = Fleetd.backendErrorSink(sessions, Map::of, outagePolicy, () -> pushLoop);
+        sink.onBackendError("term_unmapped", "matched line", "503 Service Unavailable");
+
+        assertTrue(outagePolicy.remainingCoolOffSeconds("shared-openai").isEmpty(),
+                "no credential is ever resolvable here, so nothing must be recorded");
+    }
+
+    @Test
+    @DisplayName("two distinct targets classified through the real factory start an incident and cool the credential")
+    void twoDistinctTargetsStartAnIncident() throws Exception {
+        FakeHerdr herdr = new FakeHerdr()
+                .readText("⏺ 503 Service Unavailable: upstream credential rejected\n❯ ");
+        Map<String, FleetConfig.Profile> profiles = orderedProfiles();
+        AtomicLong clockNanos = new AtomicLong(0L);
+        BackendOutagePolicy outagePolicy = new BackendOutagePolicy(clockNanos::get);
+        ClaudeCodeLauncher adapter = new ClaudeCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), new SubscriptionGuard(Set.of("gx00.gw")),
+                profiles, "terra", _ -> "tok");
+        CompositePeerLauncher workers = new CompositePeerLauncher(List.of(adapter), "terra", profiles,
+                PlacementPolicies.weighted(), _ -> 0, null, BackendQuarantine.none(), outagePolicy);
+        SessionManager sessions = new SessionManager(workers);
+        MemberSession s1 = sessions.acquire("terra", null, null, null);
+        MemberSession s2 = sessions.acquire("terra", null, null, null);
+
+        PrimaryRegistry registry = new PrimaryRegistry(null);
+        registry.recordDelegation(s1.terminalId(), "term_primary");
+        registry.recordDelegation(s2.terminalId(), "term_primary");
+        InMemoryReplyInbox inbox = new InMemoryReplyInbox();
+        inbox.own(s1.terminalId());
+        inbox.own(s2.terminalId());
+        RecordingLeadClient leadClient = new RecordingLeadClient();
+        ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor();
+        schedulers.add(scheduler);
+        ReplyPushLoop pushLoop = new ReplyPushLoop(registry, new AgentControl(leadClient), inbox, scheduler, 3, 50);
+        AtomicReference<ReplyPushLoop> pushLoopRef = new AtomicReference<>(pushLoop);
+
+        // The exact object under test: Fleetd's real production factory, not a hand copy.
+        BackendErrorSink sink = Fleetd.backendErrorSink(sessions, () -> profiles, outagePolicy, pushLoopRef::get);
+
+        sink.onBackendError(s1.terminalId(), "matched line", "503 Service Unavailable");
+        assertTrue(outagePolicy.remainingCoolOffSeconds("shared-openai").isEmpty(),
+                "one distinct target must not start a cool-off");
+
+        sink.onBackendError(s2.terminalId(), "matched line", "503 Service Unavailable");
+
+        assertTrue(leadClient.sendLatch.await(3, TimeUnit.SECONDS),
+                "the second distinct target must cross the threshold and nudge the lead");
+        var remaining = outagePolicy.remainingCoolOffSeconds("shared-openai");
+        assertTrue(remaining.isPresent(), "two distinct targets must start a cool-off");
+        assertEquals(1, leadClient.sendCount());
+    }
+}
@@ -0,0 +1,89 @@
+package dev.ltms.fleet;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #248: this is the test that was actually missing. {@code Fleetd.main} builds its {@code
+ * CompletionResolver} from an 8-argument constructor, and the ticket's own measurement proved two
+ * ways to silently unwire it — both compiled with 0 errors and left every existing test green:
+ *
+ * <ul>
+ *   <li>replacing the worktree/branch argument (the 8th) with {@code _ -> null} — drops
+ *       fleetd#241's fallback-report location entirely;</li>
+ *   <li>replacing {@code backendErrorPatterns, backendErrorSink} (5th/6th) with {@code
+ *       BackendErrorPatternLookup.legacy(), BackendErrorSink.none()} — drops fleetd#201 Unit 5's
+ *       backend-error classification and cool-off entirely.</li>
+ * </ul>
+ *
+ * <p>Neither mutation could be caught by any test that constructs its own {@code
+ * CompletionResolver} (every test before this one did exactly that) or by a test of {@link
+ * Fleetd#worktreeBranchLookup}, {@link Fleetd#backendErrorPatternLookup}, or {@link
+ * Fleetd#backendErrorSink} in isolation (see {@code FleetdWorktreeBranchLookupTest}, {@code
+ * FleetdBackendErrorPatternLookupTest}, {@code FleetdBackendErrorSinkTest}) — those prove the
+ * factories work, never that {@code main} still calls them. This class is a plain source-text
+ * assertion on {@code Fleetd.java} — crude, but honest about what it checks, and it turns red the
+ * instant the wiring is dropped, mirroring the same fallback shape {@link
+ * FleetdFleetAppConstructionTest} already uses for a different constructor argument.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a {@code
+ * CompletionResolver} and never runs {@code main}.
+ */
+class FleetdCompletionResolverWiringTest {
+
+    private static String fleetdSource() throws Exception {
+        return Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] CompletionResolver's construction call still names backendErrorPatterns and backendErrorSink")
+    void backendErrorArgumentsAreStillNamedAtTheCallSite() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains(
+                        "exhaustionSink, backendErrorPatterns, backendErrorSink, System::nanoTime,"),
+                "CompletionResolver's construction call must still pass backendErrorPatterns and "
+                        + "backendErrorSink as its 5th/6th arguments. Replacing them with "
+                        + "BackendErrorPatternLookup.legacy()/BackendErrorSink.none() (fleetd #248's measured "
+                        + "mutation) compiles with 0 errors and leaves every behavioural test green — this "
+                        + "source check is what must go red instead.");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] CompletionResolver's construction call still passes worktreeBranchLookup(sessions::roster)")
+    void worktreeBranchLookupIsStillPassedAtTheCallSite() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains("worktreeBranchLookup(sessions::roster)"),
+                "CompletionResolver's construction call must still pass worktreeBranchLookup(sessions::roster) "
+                        + "as its 8th (last) argument. Replacing it with the inert `_ -> null` (fleetd #248's "
+                        + "other measured mutation) compiles with 0 errors and leaves every behavioural test "
+                        + "green — this source check is what must go red instead.");
+        assertFalse(source.contains("System::nanoTime,\n                _ -> null"),
+                "the worktree/branch argument must never regress to the inert `_ -> null` literal");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] backendErrorPatterns is assigned from the extracted backendErrorPatternLookup(...) factory")
+    void backendErrorPatternsComesFromTheFactory() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains(
+                        "BackendErrorPatternLookup backendErrorPatterns = backendErrorPatternLookup(sessions::roster,"),
+                "backendErrorPatterns must be assigned from Fleetd.backendErrorPatternLookup(...), not an "
+                        + "inline lambda that a source check on the CompletionResolver call alone cannot see "
+                        + "through");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] backendErrorSink is assigned from the extracted backendErrorSink(...) factory")
+    void backendErrorSinkComesFromTheFactory() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains(
+                        "BackendErrorSink backendErrorSink = backendErrorSink(sessions, () -> config.get().profiles(),"),
+                "backendErrorSink must be assigned from Fleetd.backendErrorSink(...), not an inline lambda "
+                        + "that a source check on the CompletionResolver call alone cannot see through");
+    }
+}
@@ -0,0 +1,64 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.inject.CompletionResolver;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.session.MemberSession;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * fleetd #248: {@link Fleetd#worktreeBranchLookup} is the factory that replaced the anonymous
+ * lambda {@code Fleetd.main} used to build inline, as the 8th (last) argument to {@code
+ * CompletionResolver}'s constructor. Before this ticket that argument was untestable wiring:
+ * replacing it with {@code _ -> null} compiled clean and every existing test stayed green, because
+ * every existing test builds its own {@code CompletionResolver} directly rather than going through
+ * {@code main}. This class proves the factory's own behaviour; {@code
+ * FleetdCompletionResolverWiringTest} proves {@code main} still passes it in.
+ */
+class FleetdWorktreeBranchLookupTest {
+
+    private static MemberSession session(String terminal, String worktree, String branch) {
+        return new MemberSession("pane-" + terminal, terminal, "terra", MemberRole.DEV,
+                "/cwd", null, 0L, 0L, 0, MemberSession.State.READY, worktree, branch);
+    }
+
+    @Test
+    @DisplayName("a known target resolves to its session's worktree and branch")
+    void knownTargetResolves() {
+        Function<String, CompletionResolver.WorktreeBranch> lookup =
+                Fleetd.worktreeBranchLookup(() -> List.of(session("term1", "/wt/worker_x", "worker/x")));
+
+        CompletionResolver.WorktreeBranch resolved = lookup.apply("term1");
+
+        assertEquals("/wt/worker_x", resolved.worktree());
+        assertEquals("worker/x", resolved.branch());
+    }
+
+    @Test
+    @DisplayName("an unknown target resolves to null, not a thrown exception")
+    void unknownTargetResolvesToNull() {
+        Function<String, CompletionResolver.WorktreeBranch> lookup =
+                Fleetd.worktreeBranchLookup(() -> List.of(session("term1", "/wt/worker_x", "worker/x")));
+
+        assertNull(lookup.apply("term_stranger"));
+    }
+
+    @Test
+    @DisplayName("the roster is read through the supplier on every call, not snapshotted")
+    void rosterIsReadThroughOnEveryCall() {
+        List<MemberSession> roster = new ArrayList<>();
+        Function<String, CompletionResolver.WorktreeBranch> lookup = Fleetd.worktreeBranchLookup(() -> roster);
+
+        assertNull(lookup.apply("term_late"));
+        roster.add(session("term_late", "/wt/late", "worker/late"));
+
+        assertEquals("/wt/late", lookup.apply("term_late").worktree());
+    }
+}
@@ -768,19 +768,37 @@ class CompletionResolverTest {
    @Test
    void coverageIsOffWhenNoProfileHasAPatternConfigured() {
        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",
-                CompletionResolver.coverage(Set.of("terra"), Set.of()));
+                CompletionResolver.coverage("exhaustedPattern", Set.of("terra"), Set.of()));
    }

    @Test
    void coverageIsFullWhenEveryProfileHasAPatternConfigured() {
        assertEquals("full (all profiles configured: [gx10, terra])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra", "gx10")));
+                CompletionResolver.coverage("exhaustedPattern", Set.of("terra", "gx10"), Set.of("terra", "gx10")));
    }

    @Test
    void coverageIsPartialAndNamesWhichProfilesAreConfigured() {
        assertEquals("partial (configured: [terra]; not configured: [gx10])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra")));
+                CompletionResolver.coverage("exhaustedPattern", Set.of("terra", "gx10"), Set.of("terra")));
+    }
+
+    /**
+     * Found live on 2026-09-03, reading a real boot log rather than a test. {@code coverage} is
+     * shared by two call sites — CB-578's {@code exhaustedPattern} line and fleetd#201 Unit 5's
+     * {@code errorPattern} line — but its "off" branch hard-coded the word {@code exhaustedPattern}.
+     * So a daemon with no {@code errorPattern} anywhere printed "no profile has an exhaustedPattern
+     * configured" directly beneath a line reporting that two profiles DO have one. Both lines were
+     * individually defensible and together they were nonsense, and the message sent an operator to
+     * set the wrong key.
+     *
+     * <p>Every earlier test here passed the exhaustion case only, so none of them could see it. This
+     * one pins that the message names the key the caller actually meant.
+     */
+    @Test
+    void coverageNamesTheConfigKeyItsCallerMeansRatherThanAlwaysSayingExhaustedPattern() {
+        assertEquals("off (no profile has an errorPattern configured; profiles: [gx10, terra])",
+                CompletionResolver.coverage("errorPattern", Set.of("terra", "gx10"), Set.of()));
    }

    // --- fleetd#201 Unit 1: target-keyed backend-error pattern + typed sink ----------------------
@@ -323,11 +323,39 @@ class OpenCodeLauncherTest {

    // --- CB-547: resume + post-hoc session discovery --------------------------------------------

+    /**
+     * Give {@code dir} the exact signature {@link HerdrPeerLauncher#isProvisionedWorktree} checks
+     * for: a {@code .git} REGULAR FILE, never a directory. Content is never parsed by that gate, so
+     * any {@code gitdir:} pointer is fine. Mirrors {@code ClaudeCodeLauncherTest}'s helper of the
+     * same shape (fleetd #249).
+     */
+    private static void markAsProvisionedWorktree(Path dir) throws IOException {
+        Files.writeString(dir.resolve(".git"), "gitdir: /tmp/not-a-real-gitdir");
+    }
+
+    /**
+     * A fresh subdirectory of {@code configRoot}, marked as a provisioned worktree (fleetd #249),
+     * for tests that predate this gate and stood in a bare {@code "/work/dir"} string as their
+     * member's cwd — a directory that never existed on disk and, post-#249, would never pass
+     * {@link HerdrPeerLauncher#isProvisionedWorktree} either. Those tests are about the model
+     * mismatch / late-resolve machinery (fleetd #175/#234/#209), not about the worktree gate
+     * itself, so they need a cwd the gate accepts without changing what each test demonstrates.
+     */
+    private static String provisionedWorkDir(Path configRoot) throws IOException {
+        Path dir = Files.createDirectories(configRoot.resolve("work-dir"));
+        markAsProvisionedWorktree(dir);
+        return dir.toString();
+    }
+
    @Test
-    void aResumeSpawnPassesTheSessionIdAsDashS(@TempDir Path root) {
+    void aResumeSpawnIntoAProvisionedWorktreePassesTheSessionIdAsDashS(@TempDir Path root,
+                                                                        @TempDir Path worktree)
+            throws Exception {
+        markAsProvisionedWorktree(worktree);
        FakeHerdr herdr = new FakeHerdr();
        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null))
-                .spawn(new SpawnRequest(null, null, null, null, "ses_41b79fc90ffeI9E8uZv6VprUn2"));
+                .spawn(new SpawnRequest(null, worktree.toString(), null, null,
+                        "ses_41b79fc90ffeI9E8uZv6VprUn2"));

        List<String> args = startArgs(herdr);
        int s = args.indexOf("-s");
@@ -336,6 +364,27 @@ class OpenCodeLauncherTest {
                "the resume target id follows -s");
    }

+    /**
+     * fleetd #249 acceptance criterion 3: without a fleetd-provisioned worktree, the member's cwd
+     * is shared with other sessions, so fleetd can never reliably confirm (now or later via {@link
+     * OpenCodeSessionDiscovery}) which conversation it is actually running. Refuse the spawn itself
+     * rather than silently launching opencode's {@code -s <id>} into unverifiable territory.
+     */
+    @Test
+    void aResumeSpawnWithoutAProvisionedWorktreeIsRefused(@TempDir Path root) {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = service(herdr, root,
+                opencodeCfg("google/gemini-2.5-pro", null, null));
+
+        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
+                launcher.spawn(new SpawnRequest(null, null, null, null,
+                        "ses_41b79fc90ffeI9E8uZv6VprUn2")));
+
+        assertTrue(e.getMessage().contains("worktree"), e.getMessage());
+        assertFalse(herdr.called("agent.start"),
+                "the refusal must happen before anything spawns — no pane, no process");
+    }
+
    @Test
    void aFreshSpawnCarriesNoSessionFlag(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
@@ -348,25 +397,59 @@ class OpenCodeLauncherTest {

    @Test
    void theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears(@TempDir Path root,
-                                                                          @TempDir Path discRoot)
+                                                                          @TempDir Path discRoot,
+                                                                          @TempDir Path worktree)
            throws Exception {
+        markAsProvisionedWorktree(worktree);
        FakeHerdr herdr = new FakeHerdr();
        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);

-        PeerHandle handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, worktree.toString(), null));

        // opencode writes the record only when the session is first persisted — the instant the
        // pane is ready it does not exist, so agentSessionId() is null (never a spawn failure).
        assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
        // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
        // session id matches its own worktree, not another's.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", "/work/dir", 1000L);
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", worktree.toString(), 1000L);
        assertEquals("ses_resolved", handle.agentSessionId(),
                "agentSessionId() re-scans and picks up a record that has since been written");
    }

+    /**
+     * fleetd #249 acceptance criterion 1, exercised through the real caller path (the handle
+     * {@code fleet_list} actually reads), not {@link OpenCodeSessionDiscovery} directly. Without a
+     * fleetd-provisioned worktree the member's cwd is shared — the default no-worktree spawn
+     * inherits the lead's own long-lived cwd — so even once a matching row appears (here:
+     * simulating another profile's session that happens to share the directory) the handle must
+     * report absence rather than guess. Measured real-world case (2026-09-03): the row it would
+     * otherwise pick was three days old and belonged to a different profile.
+     */
+    @Test
+    void theHandleNeverReportsAnIdForANonProvisionedCwdEvenAfterARowAppears(@TempDir Path root,
+                                                                             @TempDir Path discRoot)
+            throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
+                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
+        // No markAsProvisionedWorktree — this cwd has no .git file, the shared-cwd shape a
+        // no-worktree spawn (or a real checkout) actually has.
+        String sharedCwd = root.resolve("shared-cwd").toString();
+
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, sharedCwd, null));
+
+        assertNull(handle.agentSessionId(), "no record yet → null, same as the provisioned case");
+        // A row for this exact directory now appears — e.g. a sibling member, or a stale session
+        // from days earlier, sharing the same unprovisioned cwd.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_someone_elses", sharedCwd, 1000L);
+        assertNull(handle.agentSessionId(),
+                "a non-provisioned cwd must NEVER report an id, even once a row for it exists — "
+                        + "the row could belong to any other session sharing this directory");
+    }
+
    @Test
    void foreignWorkerMatchesOpencodePrefixButNotClaude() {
        String nonce = "abc123";
@@ -920,6 +1003,7 @@ class OpenCodeLauncherTest {
    @Test
    void theRealSessionManagerLateResolvePathCatchesAModelMismatch(@TempDir Path configRoot,
                                                                     @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FakeHerdr herdr = new FakeHerdr();
        // xf's real shape (fleetd #175): weight:80, model "opencode/nemotron-3-ultra-free", no
        // credentialId — the profile that actually escaped the fleet's accounting.
@@ -929,7 +1013,7 @@ class OpenCodeLauncherTest {
        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, sink);

        SessionManager sessions = new SessionManager(launcher);
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        // Real late-resolve path, driven BEFORE opencode has written its session row — same shape
        // as production the instant a pane goes ready.
@@ -940,7 +1024,7 @@ class OpenCodeLauncherTest {

        // opencode writes its row late, running gpt-5.6-sol (a PAID credential) instead of the
        // withdrawn free model the profile actually asked for — the exact fleetd #175 scenario.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        // Drive the SAME real late-resolve path again: sessions.get() -> resolveAgentSessionId ->
@@ -959,12 +1043,13 @@ class OpenCodeLauncherTest {
    @Test
    void aProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                        @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -975,12 +1060,13 @@ class OpenCodeLauncherTest {
    @Test
    void aGxProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                          @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("gx/deepseek-v4-flash", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -997,12 +1083,13 @@ class OpenCodeLauncherTest {
    @Test
    void aMissingProviderIdInTheEvidenceIsUnknownNotAMismatchWhenTheIdMatches(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1018,12 +1105,13 @@ class OpenCodeLauncherTest {
    @Test
    void aMissingProviderIdInTheEvidenceStillCatchesARealIdMismatch(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1042,12 +1130,13 @@ class OpenCodeLauncherTest {
    @Test
    void aBareModelWithNoProviderPrefixMatchesOnIdAloneAndIsNotAMismatch(@TempDir Path configRoot,
                                                                          @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("deepseek-v4-flash", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1064,6 +1153,7 @@ class OpenCodeLauncherTest {
    @Test
    void aRealIdMismatchLogsAnErrorNamingBothModelsAndQuarantinesThroughTheSink(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(target + "|" + reason);
        FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
@@ -1075,8 +1165,8 @@ class OpenCodeLauncherTest {
        PeerHandle handle;
        try {
            handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                    .spawn(new SpawnRequest(null, "/work/dir", null));
-            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                    .spawn(new SpawnRequest(null, workDir, null));
+            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                    "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
            assertEquals("ses_x", handle.agentSessionId());
        } finally {
@@ -1111,11 +1201,12 @@ class OpenCodeLauncherTest {
    @Test
    void unknownOrUnparseableModelEvidenceNeverQuarantines(@TempDir Path configRoot,
                                                             @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
+                .spawn(new SpawnRequest(null, workDir, null));

        // No row yet at all.
        assertNull(handle.agentSessionId());
@@ -1137,12 +1228,13 @@ class OpenCodeLauncherTest {
    @Test
    void aProfileWithNoConfiguredModelIsNeverCheckedForAMismatch(@TempDir Path configRoot,
                                                                  @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg(null, null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"anything-at-all\",\"providerID\":\"anyone\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1166,21 +1258,22 @@ class OpenCodeLauncherTest {
    @Test
    void modelCheckReadsTheResolvedSessionsOwnRowNotWhateverIsNewestInTheSharedDirectory(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
+                .spawn(new SpawnRequest(null, workDir, null));

        // Our own session's row, correctly matching the profile's requested model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
        assertEquals("ses_ours", handle.agentSessionId(), "resolves to our own session");
        assertTrue(exhausted.isEmpty(), "matching model → no mismatch on first resolve: " + exhausted);

        // A sibling member, spawned later into the SAME shared directory (no worktree, fleetd
        // #234's default), writes a newer row running a totally different model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", "/work/dir", 9000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", workDir, 9000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_ours", handle.agentSessionId(),
@@ -1212,6 +1305,7 @@ class OpenCodeLauncherTest {
    @Test
    void aSpawnTimeModelMismatchActuallyQuarantinesTheCredentialThroughTheRealAcquirePath(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1232,14 +1326,14 @@ class OpenCodeLauncherTest {

        // The mismatching row exists BEFORE the spawn — reproducing fleetd #234's exact timing:
        // opencode's session table already carries evidence by the moment acquire() first asks.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");

        // The real production entrypoint: acquire() builds the MemberSession by calling
        // handle.agentSessionId() BEFORE registry.put() runs.
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertTrue(quarantine.isQuarantined("openai-shared"),
@@ -1258,6 +1352,7 @@ class OpenCodeLauncherTest {
    @Test
    void aRosterOnlySinkSilentlyDropsTheSpawnTimeQuarantine(@TempDir Path configRoot,
                                                              @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.SECONDS.toNanos(1800));
@@ -1270,10 +1365,10 @@ class OpenCodeLauncherTest {
        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, rosterOnlySink);
        SessionManager sessions = new SessionManager(launcher);

-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertFalse(quarantine.isQuarantined("openai-shared"),
@@ -1301,6 +1396,7 @@ class OpenCodeLauncherTest {
    @Test
    void theSpawnTimeQuarantineSurvivesTheFleetdStyleForwardingHop(@TempDir Path configRoot,
                                                                     @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1332,12 +1428,12 @@ class OpenCodeLauncherTest {
        };
        exhaustionSinkRef.set(realSink);

-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");

-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertTrue(quarantine.isQuarantined("openai-shared"),
Author	SHA1	Message	Date
Dai Ha	2afa3652bb	fleetd #249 : withhold agentSessionId for a non-provisioned opencode cwd CI / contract (pull_request) Successful in 54s Details CI / build (pull_request) Successful in 1m52s Details OpenCodeSessionDiscovery.sessionIdForDirectory keys on the worker's cwd, which is reliable only when fleetd provisioned a unique git worktree for that member. Without one (the default no-worktree spawn), the cwd is shared with other sessions, and "most recently updated row for this directory" can pick a stranger's session — fleet_list would then hand a lead an agentSessionId that resumes someone else's conversation. Move isProvisionedWorktree from ClaudeCodeLauncher to the shared HerdrPeerLauncher base (both adapters need it now). OpenCodeLauncher.spawn now refuses a resumeSessionId spawn outright when the target cwd is not a provisioned worktree (fleetd can never verify or re-report that identity), and SessionAwareHandle.agentSessionId() withholds the id — returns null rather than guessing — for any member spawned without one, resumed or not. Corrected fleet_list/fleet_spawn's tool descriptions, which previously implied agentSessionId is always a safe resume handle.	2026-09-03 12:51:56 +07:00
Dai Ha	9d37f3aa29	fleetd #201 : the coverage line must name the key its caller actually means CI / contract (push) Successful in 43s Details CI / build (push) Successful in 1m56s Details Found by reading a real boot log after the redeploy, not by a test. coverage() is shared by two call sites — CB-578's exhaustedPattern line and Unit 5's errorPattern line — but its 'off' branch hard-coded the word exhaustedPattern. So this daemon printed: backend-exhausted classification (CB-578 stage A): partial (configured: [sol, terra]; not configured: [...]) backend-error classification (fleetd #201 Unit 5): off (no profile has an exhaustedPattern configured; profiles: [...]) Two lines, one directly under the other, disagreeing about whether any profile has an exhaustedPattern. Both were individually defensible and together they were nonsense. Worse, the message sends an operator to set the wrong key: the thing that is missing is errorPattern. coverage now takes the key name. I changed the signature rather than adding an overload, so the compiler found all three existing callers instead of leaving them silently on the old path. Every earlier coverage test passed the exhaustion case only, which is why none of them could see this. The new test pins the errorPattern case. Reverting the fix turns it red with 0 compile errors. 1229 tests, 0 failures, BUILD SUCCESS. This is the second defect in two hours found only by reading the live startup log — see #115, where the noise of a false warning had been hiding a correct line saying a whole feature was off.	2026-09-03 12:29:27 +07:00
Dai Ha	eaf89abaf6	fleetd #248 : make Fleetd's CompletionResolver wiring provable CI / contract (push) Successful in 42s Details CI / build (push) Successful in 1m40s Details Before this, dropping either #241's worktree lookup or Unit 5's backend-error pair at Fleetd.main's new CompletionResolver(...) call left all 1216 tests green with 0 compile errors. Every existing test built its own CompletionResolver, so they proved the class and never the wiring. BackendOutageFlowTest was the sharpest case: it copies main's sink lambda line-for-line, so it proves the copy and cannot notice the original being deleted. The three inline arguments are now package-private static factories on Fleetd, following the deliverableTo pattern the file already had, each with its own behaviour test. backendErrorSink is public so a cross-package test can drive the real production object rather than a hand-mirrored copy. The test that was actually missing is a source-text assertion. That is the honest fallback for a composition root with no seam, and it is labelled [SOURCE TEXT] in every test name and message so it cannot be misread as a behaviour check. It is not vacuous: two tests pin that the variables are assigned from the factories, and two pin that those variables reach the call site, so renaming a variable while assigning an inert value does not slip through. Known cost, accepted: the assertions match exact source substrings, so reformatting that statement will break them. That is the price of covering a main method, and a spurious failure here is loud and obvious, which is the right direction to fail. Verified by the lead, both mutations re-run against the merged code — see the merge check. PR #251	2026-09-03 12:22:32 +07:00
Dai Ha	d895f02bc1	fleetd #248 : prove main() wires CompletionResolver's arguments, not just the class CI / contract (pull_request) Successful in 48s Details CI / build (pull_request) Failing after 1m40s Details Fleetd.main built three of CompletionResolver's 8 constructor arguments inline (a worktree/branch lookup lambda, and the backend-error pattern lookup + sink locals). Dropping any of them at the call site compiled clean and left every existing test green, because every existing test constructs its own CompletionResolver and only ever proves the class, never main's wiring. Extract each into a static factory on Fleetd (worktreeBranchLookup, backendErrorPatternLookup, backendErrorSink — the same static-factory pattern Fleetd.deliverableTo already uses), test each factory's own behaviour, and add a source-text assertion (FleetdCompletionResolverWiringTest) proving main's CompletionResolver call still passes all three. backendErrorSink is public so BackendOutageFlowTest can exercise the real production sink directly instead of the hand-mirrored copy its own class doc used to describe. No production behaviour changes — mechanical extraction only.	2026-09-03 12:20:28 +07:00
Dai Ha	43206cac2f	fleetd #148 point 2: drop .envrc from the default parity overlay CI / contract (push) Successful in 1m9s Details CI / build (push) Successful in 1m18s Details The default is now [.env], not [.env, .envrc]. .env is data, so copying it into a worker worktree can only move values. .envrc is executable shell that direnv runs on every cd, so copying it moves behaviour. Those are different risks and should not share a default. The knob is unchanged. An operator who wants .envrc copied writes parityOverlay: ['.env', '.envrc'] and owns that choice; a new test pins that escape hatch, because without it this would be a removal rather than a re-default. Decision recorded on the ticket, with the evidence it asked for first: this checkout has no .env and no .envrc, and direnv is not on PATH, so there was no live exposure. Point 1 (extend the credential scrub to direnv) is declined and the reason is on the ticket — the scrub is a one-shot .zlogin and a direnv hook runs on every cd, so no amount of work on the scrub can cover it. Not copying the executable file is the smaller change and removes the need. The worker also fixed WorktreeSessionManagerTest, which hardcoded the same default at another layer and broke the build. Outside its named scope, correctly flagged rather than done silently. Verified by the lead: 1216 tests, 0 failures, 0 compile errors. PR #250	2026-09-03 12:03:21 +07:00