#206: pin the read-only open with a test that actually fails without it

setReadOnly(true) is the whole thing keeping fleetd out of the operator's
live 841MB opencode.db, and no test failed when it was removed.

The obvious test does not work. Making the database file unwritable and
checking the read still succeeds passes either way, because SQLite silently
downgrades a read-write open of an unwritable file to read-only. I wrote that
test, watched it pass with the flag removed, and threw it away.

What works: extract a package-private openReadOnly(), then ask that connection
to INSERT and require the refusal. Watched red with the flag removed, green
with it restored.

Also switches the test's INSERT helper to a PreparedStatement -- hand-escaped
SQL in a test is a pattern that gets copied into main code.

fleetd/fleetd.example.yaml

@@ -634,17 +634,6 @@ guard:
 # to a sibling directory of the repo root.
 # worktreeRoot: /Users/me/src/.bridged-worktrees
 
-# Worktree group sharing (fleetd #185 stage 3). OPTIONAL, off by default. Names an OS group
-# that a provisioned worktree's repo is made group-writable for (git config
-# core.sharedRepository group, plus a one-time chgrp/chmod/setgid fix-up), so a member spawned
-# under a DIFFERENT OS user (see memberHerdrSocket) can write its own worktree, its
-# per-worktree git metadata, and its own commit objects — without it, every file GitWorktrees
-# creates is owned by fleetd's own uid and unwritable by another user.
-# CAUTION: this isolates credentials, not the repository — a member in the group can still
-# write the operator's git objects and refs in the shared repo. The operator running fleetd
-# must already be a member of the named group, or every provisioning spawn fails loudly.
-# worktreeGroup: fleet-workers
-
 # Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
 # the feature disabled. By default the daemon never reaps, caps, or drains sessions.
 #   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)

fleetd/pom.xml

@@ -28,6 +28,7 @@
         <testcontainers.version>1.20.4</testcontainers.version>
         <commons-compress.version>1.27.1</commons-compress.version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
+        <sqlite-jdbc.version>3.53.4.0</sqlite-jdbc.version>
     </properties>
 
     <!--
@@ -44,6 +45,12 @@
           3.0-rc5; bumping Jackson 3 to the patched 3.2.x breaks the SDK (annotation mismatch).
           Only the loopback /mcp endpoint parses this JSON, from trusted local Claude clients.
       The 11.0.23 -> 11.0.25 bump did clear jetty CVE-2024-8184 (5.9) and CVE-2024-6763.
+
+      fleetd #206: org.xerial:sqlite-jdbc 3.53.4.0 (added for OpenCodeSessionDiscovery) — the
+      only known advisory against this artifact is CVE-2023-32697 (RCE via an attacker-controlled
+      JDBC URL), fixed in 3.41.2.2; 3.53.4.0 is well past that fix and OSV.dev reports no open
+      advisory against it. Checked via the OSV.dev API (no Mend.io/JetBrains IDE MCP mount
+      available from this worktree) on 2026-08-31.
     -->
 
     <!-- Force the latest patched Jetty 11.x across all Javalin-pulled Jetty modules (no version
@@ -123,6 +130,17 @@
             <version>${amqp.version}</version>
         </dependency>
 
+        <!-- fleetd #206: opencode moved its session store from a JSON tree to SQLite
+             (opencode.db). This is the JDBC driver OpenCodeSessionDiscovery uses to read it
+             read-only. Ships bundled native libraries (linux/mac/windows, several archs), so it
+             is a heavier jar than most deps here — see the pom's dependency-security note below
+             for the size/CVE tradeoff actually measured. -->
+        <dependency>
+            <groupId>org.xerial</groupId>
+            <artifactId>sqlite-jdbc</artifactId>
+            <version>${sqlite-jdbc.version}</version>
+        </dependency>
+
         <!-- Logging -->
         <dependency>
             <groupId>org.slf4j</groupId>

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -224,7 +224,7 @@ public final class Fleetd {
             contextCap = cfg.lifecycle().contextCap();
         }
         boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup()),
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
                 System::nanoTime, contextCap, clearAfterTurn);
         liveCountRef.set(profileName -> (int) sessions.roster().stream()
                 .filter(s -> profileName.equals(s.profile()))

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -76,14 +76,6 @@ import java.util.Set;
  *                      stay on {@code broker}'s vhost). {@code null} → no lead mailbox is opened.
  *                      Config parsing + accessors only — nothing here wires it into a live
  *                      {@code LeadMailbox}; that is a separate ticket. See {@link Coordinator}.
- * @param worktreeGroup optional OS group name (fleetd #185 stage 3) that makes a provisioned
- *                      worktree's repo group-shared, so a member running as a different OS user
- *                      (see {@code memberHerdrSocket}) can write its own worktree, its per-worktree
- *                      git metadata, and its own commit objects. {@code null}/blank/empty ⇒ off,
- *                      today's behaviour unchanged (every file stays owned by fleetd's own uid).
- *                      <strong>This isolates credentials, not the repository</strong>: a member in
- *                      the group can still write the operator's git objects and refs in the shared
- *                      repo. See {@link dev.ltms.fleet.session.Worktrees#shareWithGroup}.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record FleetConfig(
@@ -106,20 +98,7 @@ public record FleetConfig(
         ConfigReload configReload,
         Integer quarantineCooldownSeconds,
         MemberCredentials memberCredentials,
-        Coordinator coordinator,
-        String worktreeGroup) {
-
-    /** Back-compat form before the {@code worktreeGroup} key was added. */
-    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
-                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
-                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
-                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
-                         ConfigReload configReload, Integer quarantineCooldownSeconds,
-                         MemberCredentials memberCredentials, Coordinator coordinator) {
-        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
-                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, null);
-    }
+        Coordinator coordinator) {
 
     /** Back-compat form before the {@code coordinator:} block was added. */
     public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
@@ -130,7 +109,7 @@ public record FleetConfig(
                          MemberCredentials memberCredentials) {
         this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, memberCredentials, null, null);
+                configReload, quarantineCooldownSeconds, memberCredentials, null);
     }
 
     /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
@@ -1346,7 +1325,7 @@ public record FleetConfig(
             "bind", "herdrSocket", "memberHerdrSocket", "profiles", "guard", "worktreeRoot",
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
             "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
-            "memberCredentials", "coordinator", "worktreeGroup");
+            "memberCredentials", "coordinator");
 
     /** Load and validate config from {@code path}. */
     public static FleetConfig load(Path path) {
@@ -1964,11 +1943,9 @@ public record FleetConfig(
                 : new MemberCredentials(null, List.of(), List.of());
         // coordinator is left as-is, like broker/primary above: null keeps no LeadMailbox opened,
         // and this ticket's Coordinator is config-only anyway (nothing yet reads it at startup).
-        // worktreeGroup is left as-is (fleetd #185 stage 3): null/blank is "off", and there is no
-        // sane non-null default — an OS group name is operator-specific.
         return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
-                quarantineCooldown, mc, coordinator, worktreeGroup);
+                quarantineCooldown, mc, coordinator);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeSessionDiscovery.java

@@ -1,58 +1,87 @@
 package dev.ltms.fleet.member;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.sqlite.SQLiteConfig;
 
-import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.stream.Stream;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 /**
  * Resolves the opencode session id for a fleetd worker from opencode's on-disk storage — the
  * only place this adapter touches opencode's private layout, and deliberately the <em>only</em>
  * class that does.
  *
- * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not a
- * stable contract: opencode writes one JSON file per session under
- * {@code <storageRoot>/session/<projectID>/<ses_*.json>}, and each record carries a
- * {@code "version"} field (e.g. {@code "1.1.31"}), so the exact directory shape, file naming, and
- * field names can move between opencode releases. opencode also ships a headless HTTP server that
- * may supersede file scanning entirely. Everything this adapter knows about that private storage —
- * its shape, naming, and field names — lives here, so a layout change, or a switch to the HTTP
- * server, changes exactly one class and nothing in {@link OpenCodeLauncher}.
+ * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not
+ * a stable contract: opencode persists its session state in a SQLite database at
+ * {@code <storageRoot>/opencode.db} (a {@code session} table, one row per session, keyed by id and
+ * carrying a {@code directory} column). That schema can move between opencode releases exactly
+ * like the JSON-file layout it replaced did (opencode migrated off a one-JSON-file-per-session
+ * tree under {@code <storageRoot>/storage/session/<projectID>/ses_*.json} in January 2026 — that
+ * tree is now a frozen migration artefact nothing writes, which is why this class no longer reads
+ * it). opencode also ships a headless HTTP server that may supersede both of these entirely.
+ * Everything this adapter knows about that private storage — its shape and column names — lives
+ * here, so a layout change, or a switch to the HTTP server, changes exactly one class and nothing
+ * in {@link OpenCodeLauncher}.
  *
  * <p>The determinism that makes this useful is structural, not a guess: every fleetd worker runs
- * in its own unique git worktree, so the record's {@code directory} (its project root) equals the
+ * in its own unique git worktree, so the row's {@code directory} (its project root) equals the
  * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
  * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
  * the CLI listing does not even show the directory.
  *
- * <p>All reads are best-effort and never throw: a missing or unreadable storage root, a record that
- * fails to parse, or a directory with no record yet all yield {@code null}, and the caller (the
- * session handle) treats that as "identity not resolved yet" and retries later.
+ * <p>All reads are best-effort and never throw: a missing or unreadable database, a query that
+ * fails, or a directory with no row yet all yield {@code null}, and the caller (the session
+ * handle) treats that as "identity not resolved yet" and retries later. The database is opened
+ * read-only and never written to: opencode itself may be running and writing it concurrently (WAL
+ * mode), and this class must never disturb that.
  */
 final class OpenCodeSessionDiscovery {
 
+    private static final Logger log = LoggerFactory.getLogger(OpenCodeSessionDiscovery.class);
+
     private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
-    private final ObjectMapper json;
+    private final Path databasePath;
+    private final AtomicBoolean warnedMissingDatabase = new AtomicBoolean(false);
 
     OpenCodeSessionDiscovery(Path storageRoot) {
         this.storageRoot = storageRoot;
-        this.json = new ObjectMapper();
+        this.databasePath = storageRoot.resolve("opencode.db");
     }
 
     /**
-     * The opencode session id whose record references {@code directory} (the worker's cwd), or
-     * {@code null} when no record matches yet. When several records share the directory — e.g.
-     * repeated spawns into the same worktree — the <em>most recently modified</em> one wins: it is
+     * A connection to {@link #databasePath} opened with SQLite's {@code SQLITE_OPEN_READONLY}
+     * flag: it never creates the file, never writes, and never touches WAL or journal mode.
+     * opencode may be running and writing this database concurrently, and this class must never
+     * disturb it.
+     *
+     * <p>Package-private so a test can hold the connection and prove it refuses a write. That is
+     * the only way to pin this property: making the file unwritable does <em>not</em> work,
+     * because SQLite silently downgrades a read-write open of an unwritable file to read-only, so
+     * such a test passes whether or not the flag is set.
+     */
+    Connection openReadOnly() throws SQLException {
+        SQLiteConfig config = new SQLiteConfig();
+        config.setReadOnly(true);
+        return config.createConnection("jdbc:sqlite:" + databasePath);
+    }
+
+    /**
+     * The opencode session id whose row references {@code directory} (the worker's cwd), or
+     * {@code null} when no row matches yet. When several rows share the directory — e.g. repeated
+     * spawns into the same worktree — the row with the highest {@code time_updated} wins: it is
      * the session the pane most likely corresponds to.
      *
-     * <p>Never throws: a missing {@code storageRoot}, an unreadable/malformed record, or a
-     * directory that has not been persisted yet all resolve to {@code null} rather than failing a
-     * spawn. A fleetd worker's session record is written lazily (when the session is first
-     * persisted), so {@code null} here is the normal answer right after the pane is ready, and the
-     * caller retries later.
+     * <p>Never throws: a missing {@code opencode.db}, a locked/unreadable database, a query
+     * failure, or a directory that has not been persisted yet all resolve to {@code null} rather
+     * than failing a spawn. A fleetd worker's session row is written lazily (when the session is
+     * first persisted), so {@code null} here is the normal answer right after the pane is ready,
+     * and the caller retries later.
      *
      * @param directory the worker's cwd, as resolved for this spawn
      * @return the matching session id, or {@code null} if none is known yet
@@ -61,62 +90,31 @@ final class OpenCodeSessionDiscovery {
         if (directory == null || directory.isBlank()) {
             return null;
         }
-        Path sessionRoot = storageRoot.resolve("session");
-        if (!Files.isDirectory(sessionRoot)) {
+        if (!Files.isRegularFile(databasePath)) {
+            if (warnedMissingDatabase.compareAndSet(false, true)) {
+                log.warn("opencode session database not found at {} — opencode's on-disk layout "
+                        + "may have moved again; session discovery will keep returning null",
+                        databasePath);
+            }
             return null;
         }
-        String best = null;
-        long bestMtime = Long.MIN_VALUE;
-        try (Stream<Path> projectDirs = Files.list(sessionRoot)) {
-            for (Path projectDir : projectDirs.filter(Files::isDirectory).toList()) {
-                try (Stream<Path> records = Files.list(projectDir)) {
-                    for (Path record : records.toList()) {
-                        String id = matchId(record, directory);
-                        if (id == null) {
-                            continue;
-                        }
-                        long mtime = lastModifiedEpochMillis(record);
-                        if (mtime > bestMtime) {
-                            bestMtime = mtime;
-                            best = id;
-                        }
-                    }
-                } catch (IOException ignored) {
-                    // one project dir unreadable — skip it; another may still match
+        String sql = "SELECT id FROM session WHERE directory = ? ORDER BY time_updated DESC LIMIT 1";
+        try (Connection connection = openReadOnly();
+             PreparedStatement statement = connection.prepareStatement(sql)) {
+            statement.setString(1, directory);
+            try (ResultSet rows = statement.executeQuery()) {
+                if (rows.next()) {
+                    return rows.getString("id");
                 }
             }
-        } catch (IOException ignored) {
-            // storage root vanished or became unreadable — "no session known yet"
+        } catch (SQLException e) {
+            // Locked, corrupt, or otherwise unreadable — never fatal to a spawn. Not the
+            // "database moved" signal (the file exists), so this stays below WARN.
+            log.debug("opencode session database unreadable at {}: {}", databasePath, e.toString());
             return null;
         }
-        return best;
-    }
-
-    /**
-     * The record's session id when it references {@code directory}, else {@code null}. A record
-     * that is not JSON, lacks {@code id}/{@code directory}, or points at a different directory is
-     * simply not our session; a malformed one is skipped, never fatal.
-     */
-    private String matchId(Path record, String directory) {
-        try {
-            JsonNode node = json.readTree(record.toFile());
-            JsonNode id = node == null ? null : node.get("id");
-            JsonNode dir = node == null ? null : node.get("directory");
-            if (id == null || dir == null || !directory.equals(dir.asText())) {
-                return null;
-            }
-            return id.asText();
-        } catch (IOException e) {
-            return null;
-        }
-    }
-
-    /** The record's last-modified epoch ms, or {@code Long.MIN_VALUE} if unreadable (never wins). */
-    private static long lastModifiedEpochMillis(Path record) {
-        try {
-            return Files.getLastModifiedTime(record).toMillis();
-        } catch (IOException e) {
-            return Long.MIN_VALUE;
-        }
+        log.debug("no opencode session row for directory (root={}, directory={})",
+                storageRoot, directory);
+        return null;
     }
 }

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -23,7 +23,6 @@ import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Consumer;
-import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /**
@@ -89,64 +88,24 @@ public final class GitWorktrees implements Worktrees {
     );
 
     private final String configuredRoot;
-    /** OS group name for {@link #shareWithGroup} (fleetd #185 stage 3); {@code null} ⇒ feature off. */
-    private final String group;
     private final Consumer<String> afterWorktreeAdded;
-    /** How {@link #shareWithGroup}'s processes (git config / chgrp / chmod / find) actually run.
-     *  Defaults to the real {@link #exec(String...)}. Package-private test seam so a unit test can
-     *  prove "no group configured ⇒ zero processes spawned" and inspect exactly what a configured
-     *  group runs, without a real second OS user or OS group on this host. */
-    private final Function<String[], String> shareGroupRunner;
     private final SecureRandom random = new SecureRandom();
     private final AtomicLong seq = new AtomicLong();
 
     /** Default constructor: worktree root is derived per-repo as {@code <repoRoot>/../.bridged-worktrees}. */
     public GitWorktrees() {
-        this(null, (String) null);
+        this(null);
     }
 
-    /**
-     * @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of
-     *                       the repo root. No {@code worktreeGroup} configured — {@link #shareWithGroup}
-     *                       is a no-op.
-     */
+    /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
     public GitWorktrees(String configuredRoot) {
-        this(configuredRoot, (String) null);
-    }
-
-    /**
-     * @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of
-     *                       the repo root.
-     * @param group          optional OS group name (fleetd #185 stage 3, {@code worktreeGroup:} in
-     *                       config); null/blank ⇒ {@link #shareWithGroup} is a no-op.
-     */
-    public GitWorktrees(String configuredRoot, String group) {
-        this(configuredRoot, group, _ -> {});
+        this(configuredRoot, _ -> {});
     }
 
     /** Test seam for changing a real worktree between its creation and its security check. */
     GitWorktrees(String configuredRoot, Consumer<String> afterWorktreeAdded) {
-        this(configuredRoot, null, afterWorktreeAdded);
-    }
-
-    /** Test seam combining a configurable {@code group} with {@link #afterWorktreeAdded}. */
-    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded) {
-        this(configuredRoot, group, afterWorktreeAdded, null);
-    }
-
-    /**
-     * Full test seam: also overrides how {@link #shareWithGroup}'s processes run (fleetd #185
-     * stage 3), so a unit test can prove "no group configured ⇒ no process spawned" and inspect
-     * exactly what commands a configured group runs, without a real second OS user/group.
-     *
-     * @param shareGroupRunner {@code null} ⇒ the real {@link #exec(String...)}.
-     */
-    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
-                 Function<String[], String> shareGroupRunner) {
         this.configuredRoot = configuredRoot;
-        this.group = (group == null || group.isBlank()) ? null : group;
         this.afterWorktreeAdded = afterWorktreeAdded == null ? _ -> {} : afterWorktreeAdded;
-        this.shareGroupRunner = shareGroupRunner != null ? shareGroupRunner : this::exec;
     }
 
     @Override
@@ -648,126 +607,6 @@ public final class GitWorktrees implements Worktrees {
         return deleted;
     }
 
-    /**
-     * {@inheritDoc}
-     *
-     * <p>fleetd #185 stage 3. No-op — no process spawned, nothing logged — when {@link #group} is
-     * null/blank. Otherwise:
-     * <ol>
-     *   <li>{@code git -C repoRoot config core.sharedRepository group} so every future write by
-     *       either uid stays group-writable;</li>
-     *   <li>a one-time {@code chgrp}/{@code chmod g+rwX} fix-up over the worktree directory and,
-     *       under the repo's <em>common</em> git directory, {@code objects}, {@code refs},
-     *       {@code logs}, {@code worktrees} and {@code packed-refs} — with setgid
-     *       ({@code chmod g+s}) applied only to the directories among them, so files created later
-     *       inherit the group;</li>
-     *   <li>one INFO line naming the group and the paths touched.</li>
-     * </ol>
-     *
-     * <p><b>Every path is skipped when it does not exist.</b> {@code .git/logs} is absent in a repo
-     * with {@code core.logAllRefUpdates=false} or one that has had no ref update yet, and
-     * {@code packed-refs} is absent until refs are packed. Passing a missing path to {@code chgrp}
-     * exits non-zero, which would fail <em>every</em> provisioning spawn with a message blaming a
-     * group that is in fact fine.
-     *
-     * <p><b>The git directory is resolved, not assumed.</b> {@code <repoRoot>/.git} is a
-     * <em>file</em>, not a directory, when the checkout is itself a linked worktree — the very
-     * thing this class creates for every member. {@code git rev-parse --git-common-dir} gives the
-     * real shared store, and it may answer relatively, so it is resolved against {@code repoRoot}.
-     *
-     * <p><b>The fix-up re-runs on every spawn, by design.</b> {@code core.sharedRepository=group}
-     * governs only what git writes <em>after</em> it is set; the walk is what covers everything
-     * already on disk. It is not redundant work to optimise away — dropping it silently leaves
-     * pre-existing objects unreadable to the member. It costs three walks of the object store per
-     * spawn (about 3000 files in this repo, well under a second, but it grows with the repo).
-     *
-     * <p>This only fixes up file ownership/permissions on the operator's shared repo so a
-     * different-uid member can write to it — it isolates credentials, not the repository. A member
-     * in the group can still write the operator's git objects and refs.
-     *
-     * <p>Fails loudly: a missing group, or a {@code chgrp}/{@code chmod} refused because the
-     * operator is not a member of it, becomes a {@link WorktreeException} naming the group — never
-     * a silent skip that leaves a member unable to work with nothing in the log to explain why.
-     */
-    @Override
-    public void shareWithGroup(String repoRoot, String worktreePath) {
-        if (group == null) {
-            return;
-        }
-        List<String> touched = new ArrayList<>();
-        try {
-            shareGroupRunner.apply(new String[]{"git", "-C", repoRoot, "config", "core.sharedRepository", "group"});
-            String commonDir = gitCommonDir(repoRoot);
-            shareGroupPathIfPresent(worktreePath, true, touched);
-            for (String name : List.of("objects", "refs", "logs", "worktrees")) {
-                shareGroupPathIfPresent(commonDir + "/" + name, true, touched);
-            }
-            shareGroupPathIfPresent(commonDir + "/packed-refs", false, touched);
-        } catch (WorktreeException e) {
-            throw new WorktreeException("cannot share worktree with group '" + group + "': "
-                    + e.getMessage() + " — the group must exist, and the fleetd operator ("
-                    + System.getProperty("user.name") + ") must be a member of it", e);
-        }
-        log.info("worktreeGroup={} shared repoRoot={} worktreePath={} paths={}",
-                group, repoRoot, worktreePath, touched);
-    }
-
-    /**
-     * The repo's <em>common</em> git directory as an absolute path — where {@code objects},
-     * {@code refs} and {@code worktrees} actually live. {@code git rev-parse --git-common-dir}
-     * answers relative to {@code repoRoot} in the ordinary case ({@code .git}) and absolutely for a
-     * linked worktree, so the answer is resolved against {@code repoRoot} either way. Never
-     * hardcode {@code repoRoot + "/.git"}: that is a FILE when the checkout is itself a linked
-     * worktree.
-     */
-    private String gitCommonDir(String repoRoot) {
-        String answer = shareGroupRunner.apply(
-                new String[]{"git", "-C", repoRoot, "rev-parse", "--git-common-dir"});
-        String trimmed = answer == null ? "" : answer.trim();
-        if (trimmed.isEmpty()) {
-            trimmed = ".git";
-        }
-        return Path.of(repoRoot).resolve(trimmed).normalize().toString();
-    }
-
-    /**
-     * {@link #shareGroupPath} when {@code path} exists, recording it in {@code touched}; otherwise
-     * nothing at all. A missing path is normal, not an error — see {@link #shareWithGroup}'s
-     * javadoc for which ones are routinely absent and why passing them to {@code chgrp} would fail
-     * every spawn.
-     */
-    private void shareGroupPathIfPresent(String path, boolean recursive, List<String> touched) {
-        if (!Files.exists(Path.of(path))) {
-            return;
-        }
-        shareGroupPath(path, recursive);
-        touched.add(path);
-    }
-
-    /**
-     * {@code chgrp}/{@code chmod g+rwX} {@code path} to {@link #group}. When {@code recursive},
-     * also walks the directories under {@code path} (including {@code path} itself, when it is a
-     * directory) and sets setgid on each — directories only, per the javadoc on
-     * {@link #shareWithGroup}.
-     */
-    private void shareGroupPath(String path, boolean recursive) {
-        List<String> chgrp = new ArrayList<>(List.of("chgrp"));
-        if (recursive) chgrp.add("-R");
-        chgrp.add(group);
-        chgrp.add(path);
-        shareGroupRunner.apply(chgrp.toArray(new String[0]));
-
-        List<String> chmod = new ArrayList<>(List.of("chmod"));
-        if (recursive) chmod.add("-R");
-        chmod.add("g+rwX");
-        chmod.add(path);
-        shareGroupRunner.apply(chmod.toArray(new String[0]));
-
-        if (recursive) {
-            shareGroupRunner.apply(new String[]{"find", path, "-type", "d", "-exec", "chmod", "g+s", "{}", "+"});
-        }
-    }
-
     /**
      * Every {@code refs/wip/*} ref (see {@link WipRef}). The committer date is read as a unix
      * count of seconds and converted to millis. {@code %00} (NUL) separates the fields because a

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -472,10 +472,6 @@ public final class SessionManager implements TurnListener {
         try {
             path = worktrees.add(repoRoot, branch, wt.baseRef());
             worktrees.overlayParity(repoRoot, path, launcher.parityOverlay(preResolvedProfile));
-            // fleetd #185 stage 3: MUST run after overlayParity, not folded into add() — overlayParity
-            // copies more files into the worktree after add() returns, so sharing the group any earlier
-            // leaves those overlay files operator-owned and read-only for a different-uid member.
-            worktrees.shareWithGroup(repoRoot, path);
             handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd, sessionName, resumeSessionId, memberRole));
         } catch (RuntimeException e) {
             log.warn("spawn failed for profile={} role={} branch={} path={}: {}",

fleetd/src/main/java/dev/ltms/fleet/session/Worktrees.java

@@ -98,21 +98,4 @@ public interface Worktrees {
     /** CB-586: the operator-visible census of {@code refs/wip/*} in one repository. */
     record WipRefStats(int count, long costBytes) {
     }
-
-    /**
-     * Make {@code repoRoot}'s git store and {@code worktreePath} writable by the configured group
-     * (fleetd #185 stage 3), so a member spawned as a different OS user (see
-     * {@code memberHerdrSocket}) can write its own worktree, its per-worktree git metadata, and
-     * its own commit objects. No-op when no group is configured.
-     *
-     * <p><strong>This isolates credentials, not the repository.</strong> A member in the group can
-     * still write the operator's git objects and refs in the shared repo — this only fixes file
-     * ownership/permissions so a different-uid member can work at all, it grants no narrower access
-     * than that.
-     *
-     * @param repoRoot     the repository whose git store ({@code .git/objects}, {@code refs},
-     *                     {@code logs}, {@code worktrees}, {@code packed-refs}) needs sharing
-     * @param worktreePath the linked worktree's own directory
-     */
-    void shareWithGroup(String repoRoot, String worktreePath);
 }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -1036,35 +1036,6 @@ class FleetConfigTest {
         assertEquals(LeadMailbox.DEFAULT_PREFETCH, noEnv.prefetchOrDefault());
     }
 
-    @Test
-    void absentWorktreeGroupLeavesItNull(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-worktree-group.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\n");
-
-        FleetConfig cfg = FleetConfig.load(f);
-        assertNull(cfg.worktreeGroup(), "no worktreeGroup: key → null → GitWorktrees.shareWithGroup is a no-op");
-    }
-
-    @Test
-    void worktreeGroupKeyParses(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("worktree-group.yaml");
-        Files.writeString(f, "bind:\n  port: 8080\nworktreeGroup: fleet-workers\n");
-
-        FleetConfig cfg = FleetConfig.load(f);
-        assertEquals("fleet-workers", cfg.worktreeGroup());
-    }
-
-    @Test
-    void absentWorktreeGroupSurvivesTheBackCompatConstructorChain() {
-        // fleetd #185 stage 3: withDefaults() (and every pre-existing call site) must not silently
-        // drop a live worktreeGroup by routing through a back-compat constructor that defaults it
-        // to null.
-        FleetConfig cfg = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
-                null, null, null, null, null, null, null, null, null, null, null, "fleet-workers");
-        assertEquals("fleet-workers", cfg.withDefaults().worktreeGroup(),
-                "withDefaults() must carry a configured worktreeGroup through unchanged");
-    }
-
     @Test
     void absentPrimaryBlockLeavesPrimaryNull(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("no-primary.yaml");

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeLauncherTest.java

@@ -334,8 +334,7 @@ class OpenCodeLauncherTest {
         assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
         // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
         // session id matches its own worktree, not another's.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "p1", "ses_a.json",
-                "ses_resolved", "/work/dir", 1000L);
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", "/work/dir", 1000L);
         assertEquals("ses_resolved", handle.agentSessionId(),
                 "agentSessionId() re-scans and picks up a record that has since been written");
     }

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeSessionDiscoveryTest.java

@@ -5,68 +5,89 @@ import org.junit.jupiter.api.io.TempDir;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.PreparedStatement;
+import java.sql.SQLException;
+import java.sql.Statement;
 
 import static org.junit.jupiter.api.Assertions.*;
 
 /**
- * {@link OpenCodeSessionDiscovery} matches an opencode session record by the worker's cwd (its
- * {@code directory}) against opencode's on-disk storage. These tests populate a TEMP storage root
- * themselves — never the operator's real {@code ~/.local/share/opencode}.
+ * {@link OpenCodeSessionDiscovery} matches an opencode session row by the worker's cwd (its
+ * {@code directory}) against opencode's {@code opencode.db} SQLite database. These tests build a
+ * SYNTHETIC database themselves, in a JUnit temp directory — never the operator's real
+ * {@code ~/.local/share/opencode/opencode.db}, which a live opencode process may be writing.
  */
 class OpenCodeSessionDiscoveryTest {
 
     /**
-     * Write a session record {@code {"id":..., "directory":...}} under
-     * {@code <root>/session/<projectID>/<fileName>} and stamp it with a known last-modified time,
-     * so "most recently modified wins" is deterministic. Static so the launcher test can reuse it.
+     * Create {@code <root>/opencode.db} with a minimal {@code session} table (just the columns
+     * {@link OpenCodeSessionDiscovery} reads: {@code id}, {@code directory}, {@code time_updated})
+     * and insert one row. Static so {@link OpenCodeLauncherTest} can reuse it.
      */
-    static void writeRecord(Path root, String projectId, String fileName, String id,
-                            String directory, long lastModifiedEpochMillis) throws Exception {
-        Path dir = root.resolve("session").resolve(projectId);
-        Files.createDirectories(dir);
-        Path file = dir.resolve(fileName);
-        Files.writeString(file, "{\"id\":\"" + id + "\",\"directory\":\"" + directory
-                + "\",\"projectID\":\"" + projectId + "\",\"version\":\"1.1.31\"}");
-        Files.setLastModifiedTime(file, FileTime.fromMillis(lastModifiedEpochMillis));
+    static void writeRecord(Path root, String id, String directory, long timeUpdated) throws Exception {
+        Path db = root.resolve("opencode.db");
+        try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + db)) {
+            try (Statement statement = connection.createStatement()) {
+                statement.execute("CREATE TABLE IF NOT EXISTS session ("
+                        + "id TEXT PRIMARY KEY, directory TEXT, time_updated INTEGER)");
+            }
+            // Bound parameters, not string interpolation: the class under test uses a
+            // PreparedStatement, and a hand-escaped INSERT here is a pattern someone copies out.
+            try (PreparedStatement insert = connection.prepareStatement(
+                    "INSERT INTO session (id, directory, time_updated) VALUES (?, ?, ?)")) {
+                insert.setString(1, id);
+                insert.setString(2, directory);
+                insert.setLong(3, timeUpdated);
+                insert.executeUpdate();
+            }
+        }
     }
 
     @Test
-    void findsTheRecordWhoseDirectoryEqualsTheCwd(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
-        writeRecord(root, "p2", "ses_b.json", "ses_bbb", "/w/b", 2000L);
+    void findsTheRowWhoseDirectoryEqualsTheCwd(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L);
+        writeRecord(root, "ses_bbb", "/w/b", 2000L);
 
         assertEquals("ses_bbb", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/b"),
-                "the record whose directory equals the cwd is the one found");
+                "the row whose directory equals the cwd is the one found");
         assertEquals("ses_aaa", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
     }
 
     @Test
     void aNonMatchingDirectoryYieldsNullRatherThanAMismatch(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
+        writeRecord(root, "ses_aaa", "/w/a", 1000L);
 
         assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/other"),
-                "no record for this cwd yet → null, not a wrong session");
+                "no row for this cwd yet → null, not a wrong session");
     }
 
     @Test
-    void prefersTheMostRecentlyModifiedRecordWhenSeveralMatch(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "old.json", "ses_old", "/w/a", 1000L);
-        writeRecord(root, "p2", "new.json", "ses_new", "/w/a", 5000L);
+    void prefersTheMostRecentlyUpdatedRowWhenSeveralMatch(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_old", "/w/a", 1000L);
+        writeRecord(root, "ses_new", "/w/a", 5000L);
 
         assertEquals("ses_new", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
-                "the freshest record for the cwd wins");
+                "the row with the highest time_updated for the cwd wins");
     }
 
     @Test
-    void aMissingOrEmptyStorageRootYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
-        // Missing: no session dir at all under the root.
+    void aMissingDatabaseYieldsNullWithoutThrowing(@TempDir Path root) {
+        // No opencode.db at all under the root.
         assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
+    }
 
-        // Present but empty: a session dir with nothing in it produces no match, not a throw.
-        Path emptyRoot = root.resolve("empty");
-        Files.createDirectories(emptyRoot.resolve("session"));
-        assertNull(new OpenCodeSessionDiscovery(emptyRoot).sessionIdForDirectory("/w/a"));
+    @Test
+    void anEmptyDatabaseYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
+        Path db = root.resolve("opencode.db");
+        try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + db);
+             Statement statement = connection.createStatement()) {
+            statement.execute("CREATE TABLE session (id TEXT PRIMARY KEY, directory TEXT, "
+                    + "time_updated INTEGER)");
+        }
+
+        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
     }
 
     @Test
@@ -76,15 +97,41 @@ class OpenCodeSessionDiscoveryTest {
         assertNull(discovery.sessionIdForDirectory("   "));
     }
 
+    /**
+     * The one line standing between fleetd and writing the operator's live {@code opencode.db} —
+     * 841MB, with a running opencode writing it — is {@code config.setReadOnly(true)} in
+     * {@link OpenCodeSessionDiscovery#openReadOnly()}. Delete it and every other test in this class
+     * still passes, so this is the test that guards it.
+     *
+     * <p>It asks the connection to write, and requires a refusal. The obvious alternative — make
+     * the database file unwritable and check the read still works — proves nothing: SQLite silently
+     * downgrades a read-write open of an unwritable file to read-only, so that test passes either
+     * way. It was tried and watched pass with the flag removed.
+     */
     @Test
-    void aMalformedRecordIsSkippedRatherThanFatal(@TempDir Path root) throws Exception {
-        // A record that fails to parse must not abort the scan of its siblings.
-        Path dir = root.resolve("session").resolve("p1");
-        Files.createDirectories(dir);
-        Files.writeString(dir.resolve("broken.json"), "{not valid json");
-        writeRecord(root, "p1", "good.json", "ses_good", "/w/a", 1000L);
+    void theDatabaseIsOpenedReadOnly(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L);
 
-        assertEquals("ses_good", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
-                "an unreadable record is skipped; a later valid one still matches");
+        try (Connection connection = new OpenCodeSessionDiscovery(root).openReadOnly();
+             Statement statement = connection.createStatement()) {
+            SQLException refused = assertThrows(SQLException.class,
+                    () -> statement.executeUpdate("INSERT INTO session (id, directory, time_updated) "
+                            + "VALUES ('ses_zzz', '/w/z', 1)"),
+                    "the connection must REFUSE a write — opencode is writing this database live");
+            assertTrue(refused.getMessage().toLowerCase().contains("readonly")
+                            || refused.getMessage().toLowerCase().contains("read-only"),
+                    "the refusal must be about read-only, not some other error: " + refused.getMessage());
+        }
+    }
+
+    @Test
+    void aCorruptDatabaseFileYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
+        // A file at opencode.db that is not a SQLite database at all — the open/query must fail
+        // safe, never fatal to a spawn.
+        Path db = root.resolve("opencode.db");
+        Files.writeString(db, "this is not a sqlite database");
+
+        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
+                "an unreadable database resolves to null, not an exception");
     }
 }

fleetd/src/test/java/dev/ltms/fleet/session/FakeWorktrees.java

@@ -30,19 +30,12 @@ public final class FakeWorktrees implements Worktrees {
     public record PruneCall(String repoRoot, long minAgeMillis) {
     }
 
-    public record ShareCall(String repoRoot, String worktreePath) {
-    }
-
     private final List<AddCall> addCalls = new CopyOnWriteArrayList<>();
     private final List<RemoveCall> removeCalls = new CopyOnWriteArrayList<>();
     private final List<OverlayCall> overlayCalls = new CopyOnWriteArrayList<>();
     private final List<RepoRootCall> repoRootCalls = new CopyOnWriteArrayList<>();
     private final List<SnapshotCall> snapshotCalls = new CopyOnWriteArrayList<>();
     private final List<PruneCall> pruneCalls = new CopyOnWriteArrayList<>();
-    private final List<ShareCall> shareCalls = new CopyOnWriteArrayList<>();
-    /** Tags every {@code overlayParity}/{@code shareWithGroup} call in call order, so a test can
-     *  pin that sharing runs after the overlay copy (fleetd #185 stage 3). */
-    private final List<String> overlayShareOrder = new CopyOnWriteArrayList<>();
     private final Set<String> existingPaths = ConcurrentHashMap.newKeySet();
     private final Set<String> trackedPaths = ConcurrentHashMap.newKeySet();
     private final AtomicLong snapshotSeq = new AtomicLong();
@@ -143,13 +136,6 @@ public final class FakeWorktrees implements Worktrees {
         }
         overlayCalls.add(new OverlayCall(repoRoot, worktreePath, List.copyOf(overlay),
                 List.copyOf(copied), List.copyOf(skipped)));
-        overlayShareOrder.add("overlay:" + worktreePath);
-    }
-
-    @Override
-    public void shareWithGroup(String repoRoot, String worktreePath) {
-        shareCalls.add(new ShareCall(repoRoot, worktreePath));
-        overlayShareOrder.add("share:" + worktreePath);
     }
 
     @Override
@@ -217,17 +203,4 @@ public final class FakeWorktrees implements Worktrees {
     public SnapshotCall lastSnapshot() {
         return snapshotCalls.isEmpty() ? null : snapshotCalls.getLast();
     }
-
-    public List<ShareCall> shareCalls() {
-        return List.copyOf(shareCalls);
-    }
-
-    public ShareCall lastShare() {
-        return shareCalls.isEmpty() ? null : shareCalls.getLast();
-    }
-
-    /** Call-order tags ({@code "overlay:<path>"}/{@code "share:<path>"}) — see field javadoc. */
-    public List<String> overlayShareOrder() {
-        return List.copyOf(overlayShareOrder);
-    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -924,179 +924,4 @@ class GitWorktreesTest {
         assertEquals(2, stats.count(), "two snapshot refs are reported");
         assertTrue(stats.costBytes() > 0, "the cost of the snapshots is a positive byte count");
     }
-
-    /**
-     * fleetd #185 stage 3: a recording {@link java.util.function.Function} test seam stands in for
-     * every process {@link GitWorktrees#shareWithGroup} would run — no real second OS user/group
-     * exists on this host, so these are unit tests against that seam, not a live-group integration
-     * test (out of scope per the ticket).
-     */
-    private static List<String> joined(String[] command) {
-        return List.of(command);
-    }
-
-    /** Remove {@code path} and anything under it. Tolerates an already-absent path. */
-    private static void deleteRecursively(Path path) throws Exception {
-        if (!Files.exists(path)) {
-            return;
-        }
-        if (Files.isDirectory(path)) {
-            try (java.util.stream.Stream<Path> children = Files.list(path)) {
-                for (Path child : children.toList()) {
-                    deleteRecursively(child);
-                }
-            }
-        }
-        Files.delete(path);
-    }
-
-    /** {@code worktreeGroup} absent ⇒ zero processes spawned and no git config written. */
-    @Test
-    void shareWithGroupIsNoopWhenNoGroupConfigured(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        List<List<String>> recorded = new java.util.ArrayList<>();
-        java.util.function.Function<String[], String> recordingRunner = cmd -> {
-            recorded.add(joined(cmd));
-            return "";
-        };
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString(), null, _ -> {}, recordingRunner);
-
-        gitWorktrees.shareWithGroup(repo.toString(), repo.resolve("some-worktree").toString());
-
-        assertTrue(recorded.isEmpty(), "no group configured must spawn no process at all: " + recorded);
-    }
-
-    /** A configured group runs {@code git config core.sharedRepository group} first, then
-     *  chgrp/chmod/setgid over every path {@link GitWorktrees#shareWithGroup} documents. */
-    @Test
-    void shareWithGroupRunsConfigThenChgrpChmodSetgidPerPath(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String repoRoot = repo.toString();
-        Path worktree = Files.createDirectories(repo.resolve("some-worktree"));
-        String worktreePath = worktree.toString();
-        Files.createDirectories(repo.resolve(".git/worktrees"));
-        List<List<String>> recorded = new java.util.ArrayList<>();
-        java.util.function.Function<String[], String> recordingRunner = cmd -> {
-            recorded.add(joined(cmd));
-            // What real git answers for an ordinary (non-linked) checkout: relative to repoRoot.
-            return List.of(cmd).contains("--git-common-dir") ? ".git\n" : "";
-        };
-        GitWorktrees gitWorktrees =
-                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
-
-        gitWorktrees.shareWithGroup(repoRoot, worktreePath);
-
-        assertEquals(List.of("git", "-C", repoRoot, "config", "core.sharedRepository", "group"), recorded.get(0),
-                "core.sharedRepository must be set first, so it keeps working after the one-time fix-up");
-        assertTrue(recorded.contains(List.of("git", "-C", repoRoot, "rev-parse", "--git-common-dir")),
-                "the git dir must be asked for, never hardcoded as <repoRoot>/.git — that is a FILE "
-                        + "when the checkout is itself a linked worktree: " + recorded);
-
-        for (String dir : List.of(worktreePath, repoRoot + "/.git/objects", repoRoot + "/.git/refs",
-                repoRoot + "/.git/logs", repoRoot + "/.git/worktrees")) {
-            assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", dir)), "missing chgrp -R for " + dir);
-            assertTrue(recorded.contains(List.of("chmod", "-R", "g+rwX", dir)), "missing chmod -R for " + dir);
-            assertTrue(recorded.contains(List.of("find", dir, "-type", "d", "-exec", "chmod", "g+s", "{}", "+")),
-                    "missing setgid find pass for " + dir);
-        }
-        // packed-refs does not exist in a freshly-init'd repo (only git gc / pack-refs creates it) —
-        // tolerated absence, so it must not appear at all: no recursive/-R treatment for a plain file.
-        String packedRefs = repoRoot + "/.git/packed-refs";
-        assertTrue(recorded.stream().noneMatch(c -> c.contains(packedRefs)),
-                "packed-refs is absent here and must be skipped, not chgrp'd: " + recorded);
-    }
-
-    /**
-     * A path that does not exist is skipped, never handed to {@code chgrp}. {@code .git/logs} is
-     * absent whenever {@code core.logAllRefUpdates} is false or no ref has been updated yet, and
-     * {@code chgrp} on a missing path exits non-zero — which would fail EVERY provisioning spawn
-     * with a message blaming a group that is in fact fine.
-     */
-    @Test
-    void shareWithGroupSkipsPathsThatDoNotExist(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String repoRoot = repo.toString();
-        deleteRecursively(repo.resolve(".git/logs"));
-        assertFalse(Files.exists(repo.resolve(".git/logs")), "fixture: .git/logs must be gone");
-        List<List<String>> recorded = new java.util.ArrayList<>();
-        java.util.function.Function<String[], String> recordingRunner = cmd -> {
-            recorded.add(joined(cmd));
-            return List.of(cmd).contains("--git-common-dir") ? ".git\n" : "";
-        };
-        GitWorktrees gitWorktrees =
-                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
-
-        gitWorktrees.shareWithGroup(repoRoot, repo.resolve("no-such-worktree").toString());
-
-        String logs = repoRoot + "/.git/logs";
-        assertTrue(recorded.stream().noneMatch(c -> c.contains(logs)),
-                "a missing .git/logs must be skipped, not chgrp'd: " + recorded);
-        assertTrue(recorded.stream().noneMatch(c -> c.contains(repo.resolve("no-such-worktree").toString())),
-                "a missing worktree path must be skipped too: " + recorded);
-        assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", repoRoot + "/.git/objects")),
-                "paths that DO exist are still shared: " + recorded);
-    }
-
-    /**
-     * The git store is located by {@code rev-parse --git-common-dir}, not by appending
-     * {@code /.git}. When git answers with an absolute path — what it does for a linked worktree,
-     * where {@code <repoRoot>/.git} is a file — every shared path must follow that answer.
-     */
-    @Test
-    void shareWithGroupFollowsAnAbsoluteGitCommonDir(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        Path realGitDir = repo.resolve(".git");
-        List<List<String>> recorded = new java.util.ArrayList<>();
-        java.util.function.Function<String[], String> recordingRunner = cmd -> {
-            recorded.add(joined(cmd));
-            return List.of(cmd).contains("--git-common-dir") ? realGitDir + "\n" : "";
-        };
-        GitWorktrees gitWorktrees =
-                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
-
-        gitWorktrees.shareWithGroup(tmp.resolve("some/linked/worktree").toString(),
-                repo.resolve("wt").toString());
-
-        assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", realGitDir + "/objects")),
-                "objects must be taken from the reported common dir, not <repoRoot>/.git: " + recorded);
-    }
-
-    /** {@code packed-refs}, when present, is chgrp/chmod'd but never setgid'd (it is a file, not a dir). */
-    @Test
-    void shareWithGroupIncludesPackedRefsWhenPresent(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String repoRoot = repo.toString();
-        Path packedRefsPath = repo.resolve(".git/packed-refs");
-        Files.writeString(packedRefsPath, "");
-        List<List<String>> recorded = new java.util.ArrayList<>();
-        java.util.function.Function<String[], String> recordingRunner = cmd -> {
-            recorded.add(joined(cmd));
-            return "";
-        };
-        GitWorktrees gitWorktrees =
-                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
-
-        gitWorktrees.shareWithGroup(repoRoot, repo.resolve("some-worktree").toString());
-
-        String packedRefs = packedRefsPath.toString();
-        assertTrue(recorded.contains(List.of("chgrp", "devteam", packedRefs)),
-                "packed-refs must be chgrp'd non-recursively when present: " + recorded);
-        assertTrue(recorded.contains(List.of("chmod", "g+rwX", packedRefs)),
-                "packed-refs must be chmod'd non-recursively when present: " + recorded);
-        assertTrue(recorded.stream().noneMatch(c -> c.contains("find") && c.contains(packedRefs)),
-                "packed-refs (a file) must never get the recursive setgid pass: " + recorded);
-    }
-
-    /** A group that does not exist (or that the operator is not a member of) fails loudly, naming it. */
-    @Test
-    void shareWithGroupThrowsNamingTheGroupWhenChgrpFails(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString(), "cb185-nonexistent-group-zz");
-        String wt = new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-185-share", "HEAD");
-
-        WorktreeException e = assertThrows(WorktreeException.class,
-                () -> gitWorktrees.shareWithGroup(repo.toString(), wt));
-        assertTrue(e.getMessage().contains("cb185-nonexistent-group-zz"),
-                "exception must name the missing/refused group: " + e.getMessage());
-    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -148,10 +148,6 @@ class SessionManagerTest {
             return 0;
         }
 
-        @Override
-        public void shareWithGroup(String repoRoot, String worktreePath) {
-        }
-
         List<String> removeCalls() {
             return List.copyOf(removeCalls);
         }

fleetd/src/test/java/dev/ltms/fleet/session/WorktreeSessionManagerTest.java

@@ -163,37 +163,6 @@ class WorktreeSessionManagerTest {
                 "tracked copied paths are --skip-worktree'd");
     }
 
-    /**
-     * fleetd #185 stage 3, THE TRAP: {@code overlayParity} copies more files into the worktree
-     * AFTER {@code add} returns, so {@code shareWithGroup} must run after it, not folded into
-     * {@code add()} — otherwise every overlay file lands operator-owned and unwritable for a
-     * different-uid member, with a green test suite hiding it.
-     */
-    @Test
-    void shareWithGroupRunsAfterOverlayParityNotBeforeIt() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
-                .track(".envrc");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-185", null));
-
-        assertEquals(1, worktrees.overlayCalls().size(), "overlayParity ran exactly once");
-        assertEquals(1, worktrees.shareCalls().size(), "shareWithGroup ran exactly once");
-        FakeWorktrees.OverlayCall overlay = worktrees.lastOverlay();
-        FakeWorktrees.ShareCall share = worktrees.lastShare();
-        assertEquals(s.worktree(), overlay.worktreePath());
-        assertEquals(s.worktree(), share.worktreePath());
-
-        List<String> order = worktrees.overlayShareOrder();
-        int overlayIndex = order.indexOf("overlay:" + s.worktree());
-        int shareIndex = order.indexOf("share:" + s.worktree());
-        assertTrue(overlayIndex >= 0 && shareIndex >= 0, "both calls must be recorded: " + order);
-        assertTrue(overlayIndex < shareIndex,
-                "shareWithGroup MUST run after overlayParity, not before/inside add(): " + order);
-    }
-
     @Test
     void releaseRemovesWorktreeButDoesNotDeleteBranch() {
         FakeHerdr herdr = new FakeHerdr();