fleetd#219: OpenCodeLauncher config/discovery roots must not assume fleetd's own filesystem

Site 1 (config root): under memberHerdrSocket, writeConfig() now places the
ephemeral opencode.json directory under worktreeRoot and shares it read-only
with worktreeGroup, reusing EnvAllowListScrub#shareWithGroup (widened to
package-private and generalized) — the same mechanism #213 built for the
ZDOTDIR scrub, rather than a second copy. Unlike the ZDOTDIR scrub's
degrade-to-overlay fallback, a missing worktreeRoot/worktreeGroup here
REFUSES the spawn (IllegalStateException from buildLaunch): this file is the
member's only way to learn where the bridge MCP is, so writing it somewhere
unreadable would just produce an undeliverable member with no signal
pointing at the cause. memberHerdrSocket absent stays byte-identical.

Site 2 (discovery root): under memberHerdrSocket, agentSessionId() now
declares session discovery unavailable and logs one WARN per launcher
instance instead of silently scanning fleetd's own $HOME (opencode.db lives
under the MEMBER's home under this config key). Decision + reasoning for why
this is a declare-unavailable rather than a new config key is in
defaultDiscoveryRoot()'s javadoc.

Widened HerdrPeerLauncher#memberHerdrSocketConfigured/memberScrubParentDir/
memberGroup to package-private so OpenCodeLauncher reuses the exact same
config resolution rather than re-deriving it.

Same-shape finding (not fixed, out of scope): ClaudeCodeLauncher#writeCharterFile
(line ~465) writes the role-charter temp file via Files.createTempFile with no
directory argument, i.e. under java.io.tmpdir — the same site-1 shape, unfixed
for the Claude Code adapter.

fleetd/fleetd.example.yaml

@@ -117,6 +117,15 @@ herdrSocket: ~/.config/herdr/herdr.sock
 # Optional socket for member panes. Omit this to use herdrSocket for both leads and members.
 # memberHerdrSocket: /Users/member/.config/herdr/herdr.sock
 
+# fleetd #213: the login shell the member OS user (memberHerdrSocket above) actually runs. ONLY
+# read when memberHerdrSocket is set — fleetd's own $SHELL says nothing about a pane running
+# under a different OS user, and there is no channel to ask herdr for that user's shell, so this
+# must be told rather than guessed. Absent, blank, or anything not ending in "zsh" is treated the
+# same as "not zsh": the memberCredentials.policy: allow-list ZDOTDIR scrub (see worktreeGroup
+# below) is skipped in favour of the weaker CB-596 sentinel overlay — a degraded control, never a
+# refusal to spawn. When memberHerdrSocket is absent this key is never consulted at all.
+# memberLoginShell: /bin/zsh
+
 # How member sessions are spawned. Define one or more named profiles (backends) under
 # `profiles`; each key is the profile name (also the ccs profile). A profile says only WHICH
 # BACKEND — model, CLI adapter, credentials, cost. It says nothing about what a member spawned on
@@ -634,6 +643,24 @@ guard:
 # to a sibling directory of the repo root.
 # worktreeRoot: /Users/me/src/.bridged-worktrees
 
+# Worktree group sharing (fleetd #185 stage 3). OPTIONAL, off by default. Names an OS group
+# that a provisioned worktree's repo is made group-writable for (git config
+# core.sharedRepository group, plus a one-time chgrp/chmod/setgid fix-up), so a member spawned
+# under a DIFFERENT OS user (see memberHerdrSocket) can write its own worktree, its
+# per-worktree git metadata, and its own commit objects — without it, every file GitWorktrees
+# creates is owned by fleetd's own uid and unwritable by another user.
+# CAUTION: this isolates credentials, not the repository — a member in the group can still
+# write the operator's git objects and refs in the shared repo. The operator running fleetd
+# must already be a member of the named group, or every provisioning spawn fails loudly.
+#
+# fleetd #213: this is also the ONE group the memberCredentials.policy: allow-list ZDOTDIR scrub
+# reuses when memberHerdrSocket is set — deliberately not a second config key. Under
+# memberHerdrSocket, the scrub directory is generated under worktreeRoot (never java.io.tmpdir,
+# which the member OS user cannot reach) and shared read-only with this group. If worktreeGroup
+# is unset while memberHerdrSocket is set, the scrub cannot be guaranteed reachable by the member,
+# so fleetd falls back to the weaker CB-596 sentinel overlay instead (a WARN names the gap).
+# worktreeGroup: fleet-workers
+
 # Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
 # the feature disabled. By default the daemon never reaps, caps, or drains sessions.
 #   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -224,7 +224,7 @@ public final class Fleetd {
             contextCap = cfg.lifecycle().contextCap();
         }
         boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup()),
                 System::nanoTime, contextCap, clearAfterTurn);
         liveCountRef.set(profileName -> (int) sessions.roster().stream()
                 .filter(s -> profileName.equals(s.profile()))

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -76,6 +76,26 @@ import java.util.Set;
  *                      stay on {@code broker}'s vhost). {@code null} → no lead mailbox is opened.
  *                      Config parsing + accessors only — nothing here wires it into a live
  *                      {@code LeadMailbox}; that is a separate ticket. See {@link Coordinator}.
+ * @param worktreeGroup optional OS group name (fleetd #185 stage 3) that makes a provisioned
+ *                      worktree's repo group-shared, so a member running as a different OS user
+ *                      (see {@code memberHerdrSocket}) can write its own worktree, its per-worktree
+ *                      git metadata, and its own commit objects. {@code null}/blank/empty ⇒ off,
+ *                      today's behaviour unchanged (every file stays owned by fleetd's own uid).
+ *                      <strong>This isolates credentials, not the repository</strong>: a member in
+ *                      the group can still write the operator's git objects and refs in the shared
+ *                      repo. See {@link dev.ltms.fleet.session.Worktrees#shareWithGroup}.
+ * @param memberLoginShell fleetd #213: the login shell the member's OS user actually runs, ONLY
+ *                      meaningful (and only ever read) when {@code memberHerdrSocket} is
+ *                      configured — that mode spawns member panes under a different OS user than
+ *                      fleetd's own process, so fleetd's own {@code $SHELL} says nothing about what
+ *                      that pane runs. There is no channel to ask herdr for another user's shell, so
+ *                      this must be told, never guessed. {@code null}/blank (or a value not ending
+ *                      in {@code zsh}) is treated the same as "not zsh": the {@code
+ *                      memberCredentials.policy: allow-list} ZDOTDIR scrub is skipped in favour of
+ *                      the CB-596 sentinel overlay — a degraded control, never a refusal to spawn.
+ *                      When {@code memberHerdrSocket} is NOT configured this field is never
+ *                      consulted at all; fleetd keeps reading its own {@code $SHELL}, exactly as
+ *                      before this field existed.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record FleetConfig(
@@ -98,7 +118,33 @@ public record FleetConfig(
         ConfigReload configReload,
         Integer quarantineCooldownSeconds,
         MemberCredentials memberCredentials,
-        Coordinator coordinator) {
+        Coordinator coordinator,
+        String worktreeGroup,
+        String memberLoginShell) {
+
+    /** Back-compat form before the {@code memberLoginShell} key was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup, null);
+    }
+
+    /** Back-compat form before the {@code worktreeGroup} key was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, null, null);
+    }
 
     /** Back-compat form before the {@code coordinator:} block was added. */
     public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
@@ -109,7 +155,7 @@ public record FleetConfig(
                          MemberCredentials memberCredentials) {
         this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, memberCredentials, null);
+                configReload, quarantineCooldownSeconds, memberCredentials, null, null);
     }
 
     /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
@@ -1325,7 +1371,7 @@ public record FleetConfig(
             "bind", "herdrSocket", "memberHerdrSocket", "profiles", "guard", "worktreeRoot",
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
             "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
-            "memberCredentials", "coordinator");
+            "memberCredentials", "coordinator", "worktreeGroup", "memberLoginShell");
 
     /** Load and validate config from {@code path}. */
     public static FleetConfig load(Path path) {
@@ -1943,9 +1989,14 @@ public record FleetConfig(
                 : new MemberCredentials(null, List.of(), List.of());
         // coordinator is left as-is, like broker/primary above: null keeps no LeadMailbox opened,
         // and this ticket's Coordinator is config-only anyway (nothing yet reads it at startup).
+        // worktreeGroup is left as-is (fleetd #185 stage 3): null/blank is "off", and there is no
+        // sane non-null default — an OS group name is operator-specific.
+        // memberLoginShell is left as-is (fleetd #213), like worktreeGroup: null/blank is "not
+        // configured", and there is no sane non-null default — a member's login shell is
+        // operator-specific and only meaningful when memberHerdrSocket is also set.
         return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
-                quarantineCooldown, mc, coordinator);
+                quarantineCooldown, mc, coordinator, worktreeGroup, memberLoginShell);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -237,11 +237,13 @@ public final class CompletionResolver implements TurnListener {
         }
         String tail;
         String assistantBlock = null;
+        String rawScrape = null;
         int originalLength = 0;
         boolean clipped = false;
         boolean scrapeFailed = false;
         try {
-            assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
+            rawScrape = agents.read(target, SCRAPE_SOURCE);
+            assistantBlock = lastAssistantBlock(rawScrape);
             originalLength = assistantBlock.strip().length();
             clipped = originalLength > MAX_SCRAPE_CHARS;
             tail = clip(assistantBlock);
@@ -256,6 +258,20 @@ public final class CompletionResolver implements TurnListener {
         // member, so a caller (including a lead deciding whether to delegate again) can tell a lost
         // turn from a real empty answer.
         if (scrapeFailed || tail.isEmpty()) {
+            // fleetd#211: lastAssistantBlock() found nothing usable — most often a pane with no ⏺
+            // marker at all, whose boundary scan then starts at the top of the raw screen and breaks
+            // immediately on the first line of TUI chrome (╭, │, ❯, …). Before giving up as a lost
+            // turn, run the same exhaustion/backend-error classification against the RAW scrape as a
+            // fallback, ONLY here. A pane that already yielded a usable block never reaches this
+            // branch, so the narrow (trimmed) match on the normal path below is completely unchanged
+            // — zero new false positives there. Every pane this fallback examines was already headed
+            // for the empty-scrape failure, so a wrong label here is strictly less bad than silently
+            // losing an exhaustion signal: the alternative outcome is already a failure, just one that
+            // never quarantines the credential. lastAssistantBlock stays the source of the reply
+            // TEXT everywhere else; only classification ever consults the raw scrape, and only here.
+            if (rawScrape != null && classifyRawScrapeFallback(target, turn, waiter, rawScrape)) {
+                return;
+            }
             fail(target, turn, emptyScrapeReason(target, scrapeFailed));
             return;
         }
@@ -313,6 +329,43 @@ public final class CompletionResolver implements TurnListener {
         }
     }
 
+    /**
+     * fleetd#211: the raw-scrape fallback classification, run only when {@link #lastAssistantBlock}
+     * found nothing usable (see the call site in {@link #resolve}). Mirrors the two classifications
+     * the normal path already applies to the trimmed assistant block — exhaustion first, then the
+     * narrow {@link #BACKEND_ERROR} pattern — against {@code raw} instead, and reports whether one of
+     * them handled the turn (resolved the waiter or failed it) so the caller skips the empty-scrape
+     * failure. Never runs on the normal (non-empty-block) path, and never touches the reply text.
+     */
+    private boolean classifyRawScrapeFallback(String target, InFlight turn,
+                                               CompletableFuture<Rendezvous.Resolution> waiter, String raw) {
+        Pattern exhausted = exhaustedPatterns.patternFor(target);
+        String matchedLine = exhausted == null ? null : firstMatchingLine(raw, exhausted);
+        if (matchedLine != null) {
+            String reason = "backend exhausted (usage limit): " + matchedLine;
+            if (rendezvous.resolveExhausted(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("completion for {} classified BACKEND_EXHAUSTED from the raw scrape (no "
+                        + "usable assistant block; no fleet_reply): {}", target, reason);
+                // CB-578 stage B: only on the resolution that actually won the race — a late
+                // duplicate must never quarantine a credential twice for one refusal.
+                exhaustionSink.onExhausted(target, reason);
+            }
+            return true;
+        }
+        String backendError = firstMatchingLine(raw, BACKEND_ERROR);
+        if (backendError != null) {
+            // Carry the pane, not just the matched line — the same fleetd#164 rule the normal path
+            // above applies. Here it matters more, not less: the trimmed block was empty, so the raw
+            // scrape is the ONLY copy of whatever the member managed to say. Clipped to the same cap
+            // the normal path uses, since a raw screen has no boundary trimming to bound it.
+            fail(target, turn, "member " + target + " ended on a backend error: " + backendError
+                    + "\n--- pane tail ---\n" + clip(raw));
+            return true;
+        }
+        return false;
+    }
+
     /** Synchronous fail (the unit-testable core of {@link #onTurnFailed}). */
     void fail(String target, InFlight turn) {
         fail(target, turn, null);

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -951,7 +951,10 @@ public final class FleetMcp {
                     .sorted(Map.Entry.comparingByValue())
                     .map(e -> leadView(e.getKey(), e.getValue(), live.get(e.getKey()), selfTerm))
                     .toList();
-            List<MemberSession> roster = sessions.roster();
+            // fleetd #209: this is the caller-driven fleet_list read that actually reports
+            // agentSessionId (via memberCapacityView -> SessionManager.rosterView), so it uses the
+            // resolving roster; the heartbeat/health/metrics timers stay on the plain sessions.roster().
+            List<MemberSession> roster = sessions.rosterResolved();
             List<Map<String, Object>> out = roster.stream()
                     .map(s -> memberCapacityView(s, live.get(s.terminalId()), messages, capacity.clock().getAsLong()))
                     .toList();

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -278,18 +278,22 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
 
     /**
      * Add the Claude-specific session-identity flags to {@code argv} and return the peer's OWN
-     * session id — the resume handle. A resume request passes the prior id via {@code -r} and
-     * returns that id; a fresh named session mints a new UUID, passes it via {@code --session-id},
-     * and returns the mint. The bridge's logical name rides along as {@code -n} when present. When
-     * <em>no</em> identity is requested (sessionName and resumeSessionId both blank) this adds
-     * nothing and returns {@code null}, keeping the legacy no-identity launch byte-identical.
+     * session id — the resume handle. A resume passes the prior id via {@code -r} and returns
+     * that id; every other spawn mints a new UUID, passes it via {@code --session-id}, and
+     * returns the mint. The bridge's logical name rides along as {@code -n} when present.
+     *
+     * <p>fleetd #214: the mint is unconditional. A plain {@code fleet_spawn} passes neither
+     * sessionName nor resumeSessionId, yet the member must still be resumable, and this id is
+     * the only resume handle a claude-code member has — unlike opencode, nothing resolves it
+     * after the launch. Checked against the real binary (claude 2.1.252): the flag is safe on
+     * every spawn. The binary takes only a valid UUID — it refuses any other value at argument
+     * parsing ("Invalid session ID. Must be a valid UUID.") — so the {@code UUID.randomUUID()}
+     * mint is required, not incidental. The only flag interaction the binary documents is with
+     * {@code -r} (both claim the session id), and the resume branch above never combines the two.
      */
     private static String applySessionIdentity(List<String> argv, String sessionName, String resumeSessionId) {
         boolean resuming = resumeSessionId != null && !resumeSessionId.isBlank();
         boolean named = sessionName != null && !sessionName.isBlank();
-        if (!resuming && !named) {
-            return null; // no identity requested — keep the legacy launch byte-identical
-        }
         if (named) {
             argv.add("-n");
             argv.add(sessionName);
@@ -320,11 +324,19 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      *
      * <p>CB-618: Claude Code refuses to start when BOTH {@code --append-system-prompt} and
      * {@code --append-system-prompt-file} are on the command line ("Cannot use both ... Please use
-     * only one"), so the two charters can never travel on separate flags. When both are present they
-     * are concatenated into the one file, role charter first and reply charter last — last is where
-     * the reply rule must sit, because it is the rule that must survive. When only the reply charter
-     * is present it keeps its proven inline {@code --append-system-prompt} delivery, which is also
-     * the only form that reaches a member with no repo checkout.
+     * only one"), so the two charters can never travel on separate flags. They are concatenated
+     * into the one file, role charter first and reply charter last — last is where the reply rule
+     * must sit, because it is the rule that must survive.
+     *
+     * <p>fleetd #220: a lone reply charter used to ride inline on {@code --append-system-prompt},
+     * which put ~800 bytes of prose on the command line herdr types into the pane. That line is
+     * capped at {@value HerdrPeerLauncher#PANE_COMMAND_BYTE_LIMIT} bytes by the pty itself, and
+     * everything past the cap is dropped with no error from any layer. The charter alone left about
+     * 50 bytes of headroom, so adding one flag ({@code --session-id}, fleetd #214) truncated the
+     * LAST argument instead — {@code --autocompact 250000} arrived as {@code --autocompact 25},
+     * claude rejected it, and every claude-code spawn died as an unexplained readiness timeout.
+     * The charter now always travels as a file, which takes the prose off the command line for
+     * good; {@link HerdrPeerLauncher#checkPaneCommandFits} is the backstop for whatever grows next.
      */
     private List<String> argvWithFleet(FleetConfig.Profile cfg, LaunchSpec spec) {
         String roleCharter = nonBlank(spec.roleCharter());
@@ -341,16 +353,13 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
             argv.add("--mcp-config");
             argv.add(mcpConfigJson(cfg));
         }
-        // Combine the charters in order role -> reply, dropping any that are absent. When two
-        // or more survive they must ride one --append-system-prompt-file (CB-618 forbids the inline
-        // flag and the file flag together). A lone reply charter keeps its proven inline delivery.
+        // Combine the charters in order role -> reply, dropping any that are absent. They ride one
+        // --append-system-prompt-file (CB-618 forbids the inline flag and the file flag together),
+        // always — fleetd #220: charter prose on the command line overruns the pane's byte cap.
         List<String> charters = new java.util.ArrayList<>(2);
         if (roleCharter != null) charters.add(roleCharter);
         if (replyCharter != null) charters.add(replyCharter);
-        if (charters.size() == 1 && replyCharter != null && roleCharter == null) {
-            argv.add("--append-system-prompt");
-            argv.add(replyCharter);
-        } else if (!charters.isEmpty()) {
+        if (!charters.isEmpty()) {
             argv.add("--append-system-prompt-file");
             argv.add(writeCharterFile(String.join("\n\n", charters)).toString());
         }

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -7,6 +7,9 @@ import java.io.IOException;
 import java.io.UncheckedIOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.attribute.GroupPrincipal;
+import java.nio.file.attribute.PosixFileAttributeView;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.ArrayList;
@@ -116,6 +119,77 @@ public final class EnvAllowListScrub {
         }
     }
 
+    /**
+     * fleetd #213: as {@link #generate(Path, Set)}, plus share the generated directory with
+     * {@code group} — the member OS user's group (the operator's existing {@code worktreeGroup:}
+     * name, reused rather than inventing a second one) — so a member running under a different OS
+     * user than fleetd's own process can still read what it needs from a directory placed outside
+     * {@code java.io.tmpdir}. {@code group} null/blank ⇒ identical to {@link #generate(Path, Set)};
+     * this is the single-daemon (no {@code memberHerdrSocket}) shape, where the pane is fleetd's own
+     * uid and no group sharing is needed.
+     *
+     * @throws UncheckedIOException also when {@code group} does not resolve on this host, or a
+     *                              group-ownership/permission call is refused — the same "fail
+     *                              loudly rather than start unprotected" contract as above: a scrub
+     *                              the configured member user cannot even read is not a working
+     *                              control.
+     */
+    public static Path generate(Path parentDir, Set<String> allowedNames, String group) {
+        Path dir = generate(parentDir, allowedNames);
+        if (group != null && !group.isBlank()) {
+            shareWithGroup(dir, group);
+        }
+        return dir;
+    }
+
+    /**
+     * chgrp/chmod-equivalent over a freshly generated directory and the flat files already written
+     * into it: owner keeps full access, {@code group} gets traverse+read on the directory ({@code
+     * rwxr-x---}, so a member process — a login shell reading it via {@code ZDOTDIR}, or another
+     * process simply opening a file under it — running under that group can find and read the
+     * files) and read-only on each file ({@code rw-r-----}) — deliberately no group WRITE anywhere,
+     * since a member never needs to add or change what fleetd generated. (For the ZDOTDIR scrub
+     * specifically, this also means the scrub script's own report write inside the pane fails
+     * closed rather than open — see {@code scrub.zsh}'s trailing {@code 2>/dev/null} — which {@link
+     * dev.ltms.fleet.member.HerdrPeerLauncher#releaseZdotdir} already treats as "cannot be
+     * confirmed to have run" rather than success.)
+     *
+     * <p>Package-private and named generically on purpose: fleetd #213 built this for the ZDOTDIR
+     * scrub directory, and fleetd #219 reuses it verbatim for {@link
+     * dev.ltms.fleet.member.OpenCodeLauncher}'s ephemeral {@code opencode.json} directory — both are
+     * "a fleetd-generated directory of flat files that a different-uid member process must read but
+     * never write," so the sharing mechanism is shared rather than copied a second time.
+     */
+    static void shareWithGroup(Path dir, String group) {
+        try {
+            GroupPrincipal principal = dir.getFileSystem().getUserPrincipalLookupService()
+                    .lookupPrincipalByGroupName(group);
+            setGroupAndPermissions(dir, principal, "rwxr-x---");
+            try (Stream<Path> entries = Files.list(dir)) {
+                for (Path file : entries.toList()) {
+                    setGroupAndPermissions(file, principal, "rw-r-----");
+                }
+            }
+        } catch (IOException e) {
+            throw new UncheckedIOException("cannot share generated directory " + dir + " with group '"
+                    + group + "' — the group must exist, and the fleetd operator ("
+                    + System.getProperty("user.name") + ") must be a member of it", e);
+        } catch (UnsupportedOperationException e) {
+            throw new UncheckedIOException("cannot share generated directory " + dir + " with group '"
+                    + group + "' — this filesystem does not support POSIX group ownership",
+                    new IOException(e));
+        }
+    }
+
+    private static void setGroupAndPermissions(Path path, GroupPrincipal group, String perms) throws IOException {
+        PosixFileAttributeView view = Files.getFileAttributeView(path, PosixFileAttributeView.class);
+        if (view == null) {
+            throw new IOException("POSIX file attributes are not supported for " + path);
+        }
+        view.setGroup(group);
+        Files.setPosixFilePermissions(path, PosixFilePermissions.fromString(perms));
+    }
+
     /** One operator-sourcing startup file: source the {@code $HOME} counterpart, change nothing else. */
     private static String homeSourcingFile(String name) {
         return """

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -112,6 +112,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * daemon's own process is started the same way (a login shell sourcing the same secret store —
      * see CB-592's investigation of {@code secrets.sh}), so on a single-host deployment its env
      * mirrors what the pane's login shell is about to export.
+     *
+     * <p>fleetd #185 stage 2: that mirroring assumption holds only while the member pane runs under
+     * the SAME OS user as the daemon. When {@code memberHerdrSocket:} is configured, member panes
+     * run on a second herdr owned by a different user — different {@code $HOME}, different {@code
+     * secrets.sh}, different environment entirely — so this field's data no longer describes what a
+     * member pane inherits. See {@link #logCredentialGap} for how that mode is handled.
      */
     private final Supplier<Set<String>> hostEnvNames;
 
@@ -676,6 +682,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         // Protocol 19 resolves the executable from the agent kind (== namePrefix here), so
         // argv[0] — the configured executable — is dropped and only the extra args are passed.
         List<String> args = argv.isEmpty() ? argv : argv.subList(1, argv.size());
+        checkPaneCommandFits(cfg, argv);
         HerdrException last = null;
         for (int attempt = 0; attempt < NAME_RETRIES; attempt++) {
             long seq = nameSeq.incrementAndGet();
@@ -691,6 +698,59 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         throw last;
     }
 
+    /**
+     * fleetd #220: herdr does not exec the launch command — it TYPES it into the pane as one line,
+     * and a pty line buffer holds only {@value #PANE_COMMAND_BYTE_LIMIT} bytes (BSD/macOS {@code
+     * MAX_CANON}). Everything past that byte is dropped. Nothing reports it: herdr answers "agent
+     * started", the backend exits on the mangled argument it was handed, the pane closes, and the
+     * only symptom is {@link #waitUntilInjectableOrThrow} timing out 20 seconds later with no
+     * reason. That is exactly how #214 broke every claude-code spawn — one 50-byte flag pushed a
+     * 978-byte command to 1028, and the tail that got cut was {@code --autocompact 250000}.
+     *
+     * <p>So measure it here and refuse, loudly and immediately, rather than spawn something that
+     * cannot work. The estimate is deliberately conservative: fleetd cannot see herdr's quoting, so
+     * every argument is charged its own bytes plus a separator and a quote pair. An over-estimate
+     * costs a clear error at a length that was already unsafe; an under-estimate would let the
+     * silent truncation back in.
+     *
+     * @throws PeerUnreachableException when the command cannot fit — the same failure the spawn
+     *                                  would have hit anyway, named at the point it is still
+     *                                  explainable
+     */
+    private void checkPaneCommandFits(FleetConfig.Profile cfg, List<String> argv) {
+        int bytes = 0;
+        String longest = null;
+        int longestBytes = 0;
+        for (String arg : argv) {
+            int argBytes = arg == null ? 0 : arg.getBytes(java.nio.charset.StandardCharsets.UTF_8).length;
+            bytes += argBytes + QUOTING_OVERHEAD_PER_ARG;
+            if (argBytes > longestBytes) {
+                longestBytes = argBytes;
+                longest = arg;
+            }
+        }
+        if (bytes <= PANE_COMMAND_BYTE_LIMIT) {
+            return;
+        }
+        String culprit = longest == null ? "<none>"
+                : longest.substring(0, Math.min(longest.length(), 60)) + (longest.length() > 60 ? "…" : "");
+        throw new PeerUnreachableException(
+                "launch command for profile " + cfg.profile() + " is about " + bytes + " bytes, over the "
+                        + PANE_COMMAND_BYTE_LIMIT + "-byte limit of the pane line herdr types it into. "
+                        + "The pty would drop the tail silently and the backend would exit on a mangled "
+                        + "argument. Longest argument is " + longestBytes + " bytes: " + culprit
+                        + " — move it off the command line (a file flag) or shorten it.");
+    }
+
+    /**
+     * The pty line buffer herdr types a launch command into: BSD/macOS {@code MAX_CANON}. Not a
+     * fleetd choice and not configurable — see {@link #checkPaneCommandFits}.
+     */
+    static final int PANE_COMMAND_BYTE_LIMIT = 1024;
+
+    /** Per-argument allowance for the separating space and a shell quote pair fleetd cannot see. */
+    private static final int QUOTING_OVERHEAD_PER_ARG = 3;
+
     /** Start the agent into {@code paneId}, waiting out the seed shell's boot with the sleeper. */
     private Agent startAwaitingShellPrompt(String name, List<String> args, String paneId) {
         HerdrException busy = null;
@@ -854,20 +914,51 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      */
     private void waitUntilInjectableOrThrow(String paneId) {
         long deadline = nowMillis.getAsLong() + spawnReadyTimeoutMs;
+        Object lastStatus = null;
         while (nowMillis.getAsLong() < deadline) {
-            if (agents.status(paneId).injectable()) {
+            var status = agents.status(paneId);
+            lastStatus = status;
+            if (status.injectable()) {
                 log.debug("peer pane={} reached injectable state", paneId);
                 return;
             }
             sleeper.run();
         }
-        log.warn("peer pane={} did not become injectable within {}ms — closing", paneId, spawnReadyTimeoutMs);
+        // fleetd #220: read the pane BEFORE stop() closes it. Without this the gate says only that
+        // it timed out, which is true of every cause — a backend that never launched, a binary that
+        // rejected an argument and exited, a trust prompt, a login shell that hung. The pane holds
+        // the one copy of that answer and it is destroyed a line later.
+        log.warn("peer pane={} did not become injectable within {}ms (last status {}) — closing. "
+                        + "Pane tail:\n{}",
+                paneId, spawnReadyTimeoutMs, lastStatus, readPaneQuietly(paneId));
         stop(paneId);
         throw new PeerUnreachableException(
                 "worker pane " + paneId + " did not reach injectable state within "
                         + spawnReadyTimeoutMs + "ms");
     }
 
+    /**
+     * fleetd #220: the pane's recent output, clipped, for the readiness-gate timeout log — or a
+     * short note when it cannot be read. Best-effort by construction: this runs on a path that is
+     * already failing, so it must never replace the real error with one of its own.
+     */
+    private String readPaneQuietly(String paneId) {
+        try {
+            String pane = agents.read(paneId, "recent");
+            if (pane == null || pane.isBlank()) {
+                return "<pane read returned nothing>";
+            }
+            return pane.length() <= SPAWN_FAILURE_PANE_CHARS
+                    ? pane
+                    : pane.substring(pane.length() - SPAWN_FAILURE_PANE_CHARS);
+        } catch (RuntimeException e) {
+            return "<pane could not be read: " + e.getMessage() + ">";
+        }
+    }
+
+    /** How much of a failed spawn's pane the timeout log carries. */
+    private static final int SPAWN_FAILURE_PANE_CHARS = 4000;
+
     /**
      * A concrete {@link PeerHandle} wrapping herdr agent coordinates, the profile that spawned it,
      * the session identity the launch resolved (CB-547a): the bridge's logical name and the peer's
@@ -1071,6 +1162,29 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * name. It stays a one-off decision because it is a live handle to the operator's ssh-agent, not
      * a value — a member holding it can sign with every key the agent holds, so letting it ride in
      * on the generic {@code allow:} list would hand that out for an unrelated reason.
+     *
+     * <p>fleetd #213: which shell decides the zsh gate, and where the generated directory lives,
+     * both depend on whether {@code memberHerdrSocket:} is configured — see {@link
+     * #memberHerdrSocketConfigured()}'s javadoc for why fleetd's own {@code $SHELL} and {@code
+     * java.io.tmpdir} describe the wrong process once member panes run under a different OS user.
+     * <ul>
+     *   <li>{@code memberHerdrSocket} ABSENT (today's only mode): byte-identical to before this
+     *       fix — fleetd's own {@code $SHELL} decides zsh, and the directory is generated under
+     *       {@code java.io.tmpdir}.</li>
+     *   <li>{@code memberHerdrSocket} PRESENT: the configured {@code memberLoginShell:} decides
+     *       zsh instead — fleetd's own {@code $SHELL} is never consulted, since it names a
+     *       different user's shell, not the member's. Absent/non-zsh falls back exactly like the
+     *       non-zsh case below. When it IS zsh, the directory still cannot go under {@code
+     *       java.io.tmpdir} (mode 0700, unreadable by another uid — the exact gap fleetd #213
+     *       exists to close), so it is generated under {@code worktreeRoot} instead and shared
+     *       read-only with {@code worktreeGroup} — the same group {@link
+     *       dev.ltms.fleet.session.Worktrees#shareWithGroup} already uses, reused rather than
+     *       inventing a second group key. Either one missing means the scrub cannot be guaranteed
+     *       reachable by the member, which is the same "cannot guarantee the scrub runs" case as a
+     *       non-zsh shell, so it gets the identical fallback.</li>
+     * </ul>
+     * In every branch: never refuse to spawn. A degraded credential control must not become an
+     * outage for an opt-in feature.
      */
     private Path applyEnvironmentAllowListPolicy(FleetConfig.Profile cfg, Launch launch) {
         FleetConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
@@ -1078,8 +1192,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             return null;
         }
         Set<String> allowed = derivedAllowedNames(creds, launch);
-        String loginShell = resolveEnv("SHELL");
-        boolean zsh = loginShell != null && (loginShell.endsWith("/zsh") || loginShell.equals("zsh"));
+        boolean memberHerdrSocket = memberHerdrSocketConfigured();
+        // fleetd #213 defect 1: under memberHerdrSocket the member pane runs as a DIFFERENT OS
+        // user, so fleetd's own $SHELL says nothing about what that pane runs — resolveEnv("SHELL")
+        // must not even be called on this path, only the explicit memberLoginShell: config can
+        // answer it. With memberHerdrSocket absent, nothing here changes: fleetd's own $SHELL is
+        // still the input, exactly as before this fix.
+        String loginShell = memberHerdrSocket ? configuredMemberLoginShell() : resolveEnv("SHELL");
+        boolean zsh = isZshShell(loginShell);
         if (!zsh) {
             // A non-zsh login shell ignores ZDOTDIR entirely: NO scrub would run, so pretending
             // otherwise would be worse than saying so. Warn loudly and fall back to the CB-596
@@ -1093,13 +1213,35 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             logCredentialGap(creds, null);
             return null;
         }
+        Path parentDir;
+        String group = null;
+        if (memberHerdrSocket) {
+            // fleetd #213 defect 2: java.io.tmpdir is fleetd's own per-user temp dir (mode 0700 on
+            // macOS) — a member running as a different uid cannot even traverse it, let alone read
+            // the generated files. worktreeRoot is the only configured location a different-uid
+            // member can be given access to, and only WITH worktreeGroup to grant that access —
+            // absent either, the scrub cannot be guaranteed reachable, so this falls back exactly
+            // like the non-zsh case above rather than generating a directory nothing can read.
+            parentDir = memberScrubParentDir();
+            group = memberGroup();
+            if (parentDir == null || group == null) {
+                warnCannotShareScrubDirectory();
+                overlayBlockedCredentials(launch.env(), creds);
+                logCredentialGap(creds, null);
+                return null;
+            }
+        } else {
+            parentDir = Path.of(System.getProperty("java.io.tmpdir"));
+        }
         // Only reached when the scrub is actually about to run — the count below describes that
         // scrub, so it must not be logged before this gate (see the non-zsh branch above). Same
         // reasoning gates logCredentialGap's wording: passing the derived `allowed` set (non-null)
         // here, and ONLY here, is what tells it the scrub will really blank an unkept name — #192.
         logAllowListCoverage(allowed);
         logCredentialGap(creds, allowed);
-        Path dir = EnvAllowListScrub.generate(Path.of(System.getProperty("java.io.tmpdir")), allowed);
+        Path dir = memberHerdrSocket
+                ? EnvAllowListScrub.generate(parentDir, allowed, group)
+                : EnvAllowListScrub.generate(parentDir, allowed);
         launch.env().put("ZDOTDIR", dir.toAbsolutePath().toString());
         log.info("memberCredentials policy=allow-list: profile={} generated ZDOTDIR {} — derived "
                         + "allow-list holds {} name(s); the pane reports allowed N of M at release",
@@ -1107,6 +1249,63 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         return dir;
     }
 
+    /** True when {@code shell} is a zsh login shell path or bare name — the ZDOTDIR gate. */
+    private static boolean isZshShell(String shell) {
+        return shell != null && (shell.endsWith("/zsh") || shell.equals("zsh"));
+    }
+
+    /**
+     * fleetd #213: the configured {@code memberLoginShell:}, or {@code null} when unconfigured.
+     * Called ONLY from the {@code memberHerdrSocket}-configured branch of {@link
+     * #applyEnvironmentAllowListPolicy} — fleetd's own {@code $SHELL} is never read on that path.
+     * {@link #config} being {@code null} (an older test call site, or a launcher that never
+     * threaded the full config through) is treated the same as "not configured".
+     */
+    private String configuredMemberLoginShell() {
+        FleetConfig cfg = config == null ? null : config.get();
+        return cfg == null ? null : cfg.memberLoginShell();
+    }
+
+    /**
+     * fleetd #213: {@code worktreeRoot}, as the ZDOTDIR scrub's parent directory under {@code
+     * memberHerdrSocket}, or {@code null} when unconfigured — the same "cannot guarantee the scrub
+     * runs" gap as {@link #memberGroup()} being unset (see {@link
+     * #applyEnvironmentAllowListPolicy}). Deliberately no sibling-of-repo-root default here, unlike
+     * {@code GitWorktrees}' own {@code worktreeRoot} resolution: that default is a convenience for
+     * provisioning a worktree that will exist regardless, whereas an unconfigured value here means
+     * fleetd has no operator-endorsed location to put a credential-bearing directory a different OS
+     * user must reach, so falling back to the overlay is the honest answer, not a guess.
+     *
+     * <p>Package-private (fleetd #219) so {@link OpenCodeLauncher} can reuse the exact same
+     * "different OS user, put it under worktreeRoot instead of java.io.tmpdir" resolution for its
+     * own ephemeral {@code opencode.json} directory, rather than re-reading {@code config} a second
+     * time with a second copy of this null/blank handling.
+     */
+    Path memberScrubParentDir() {
+        FleetConfig cfg = config == null ? null : config.get();
+        if (cfg == null || cfg.worktreeRoot() == null || cfg.worktreeRoot().isBlank()) {
+            return null;
+        }
+        return Path.of(cfg.worktreeRoot());
+    }
+
+    /**
+     * fleetd #213: the configured {@code worktreeGroup:}, or {@code null} when unset/blank. Reuses
+     * the group {@link dev.ltms.fleet.session.Worktrees#shareWithGroup} already establishes for
+     * provisioned worktrees, rather than a second group key — see {@link
+     * #applyEnvironmentAllowListPolicy}.
+     *
+     * <p>Package-private (fleetd #219) — reused by {@link OpenCodeLauncher} alongside {@link
+     * #memberScrubParentDir()}; see that method's javadoc.
+     */
+    String memberGroup() {
+        FleetConfig cfg = config == null ? null : config.get();
+        if (cfg == null || cfg.worktreeGroup() == null || cfg.worktreeGroup().isBlank()) {
+            return null;
+        }
+        return cfg.worktreeGroup();
+    }
+
     /**
      * The full kept-name set for this spawn: the profile-derived names, unioned with {@code
      * memberCredentials.allow:} (CB-633 follow-up — previously ignored by this whole policy), the
@@ -1164,6 +1363,30 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         }
     }
 
+    /** Guards {@link #warnCannotShareScrubDirectory} to one WARN per launcher instance. */
+    private final AtomicBoolean cannotShareScrubDirWarned = new AtomicBoolean();
+
+    /**
+     * fleetd #213: {@code memberHerdrSocket} is configured and the member login shell IS zsh, but
+     * {@code worktreeRoot} and/or {@code worktreeGroup} is missing, so the generated ZDOTDIR cannot
+     * be placed anywhere the member's OS user can reach — {@code java.io.tmpdir} is fleetd's own
+     * 0700 temp dir, unreadable by another uid, which is the exact gap this ticket exists to close.
+     * Say so once per launcher instance, instead of either generating a directory nothing can read
+     * (protection theatre) or refusing to spawn (turning a degraded credential control into an
+     * outage for an opt-in feature).
+     */
+    private void warnCannotShareScrubDirectory() {
+        if (cannotShareScrubDirWarned.compareAndSet(false, true)) {
+            log.warn("memberCredentials policy=allow-list: memberHerdrSocket is configured and the "
+                    + "member login shell is zsh, but worktreeRoot and/or worktreeGroup is not "
+                    + "configured — the generated ZDOTDIR cannot be placed where the member's OS "
+                    + "user can read it (java.io.tmpdir is fleetd's own, unreadable by another uid), "
+                    + "so the scrub cannot be guaranteed to run. Falling back to the CB-596 sentinel "
+                    + "overlay. Configure both worktreeRoot and worktreeGroup to enable the "
+                    + "allow-list scrub under memberHerdrSocket.");
+        }
+    }
+
     /**
      * CB-633 teardown half: read the pane's scrub report (the denominator report the generated
      * scrub wrote) and delete the directory. Called from {@link #stop}, which is the one funnel
@@ -1230,6 +1453,71 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      */
     private final AtomicBoolean allowListGapLogged = new AtomicBoolean();
 
+    /**
+     * fleetd #185 stage 2: guards {@link #warnUnknownMemberEnvironment} to one WARN per launcher
+     * instance, not one per spawn — the same one-per-instance shape as {@link #unprotectedGapLogged}
+     * and {@link #allowListGapLogged}, kept as its own flag for the same reason those two are split:
+     * this mode is orthogonal to which of the other two branches would otherwise have fired.
+     */
+    private final AtomicBoolean unknownMemberEnvironmentWarned = new AtomicBoolean();
+
+    /**
+     * fleetd #185 stage 2: whether {@code memberHerdrSocket:} is configured, i.e. member panes run
+     * on a second herdr owned by a different OS user than the daemon's own process. Re-read from the
+     * live config on every call (same hot-reload shape as {@link #memberCredentials}), never cached,
+     * so a config reload takes effect on the next spawn without a restart.
+     *
+     * <p>{@link #config} is {@code null} on any call site that never threaded the full config
+     * through (every production {@code HerdrPeerLauncher} does; a handful of older tests do not) —
+     * treated the same as "not configured", which is the correct, permissive default: it is exactly
+     * today's single-daemon behaviour.
+     *
+     * <p>Package-private (fleetd #219) — {@link OpenCodeLauncher} reuses this same gate to decide
+     * where its own ephemeral {@code opencode.json} directory (site 1) and its opencode session
+     * discovery (site 2) may run, rather than re-deriving "is this a multi-uid fleet" a second way.
+     */
+    boolean memberHerdrSocketConfigured() {
+        if (config == null) {
+            return false;
+        }
+        FleetConfig cfg = config.get();
+        return cfg != null && cfg.memberHerdrSocket() != null && !cfg.memberHerdrSocket().isBlank();
+    }
+
+    /**
+     * fleetd #185 stage 2: the single replacement WARN for {@link #logCredentialGap}'s usual
+     * conclusions when {@code memberHerdrSocket:} is configured. {@link #hostEnvNames} (and
+     * everything derived from it — {@code known}/{@code allow} coverage, the allow-list scrub's
+     * derived set) describes the DAEMON's own environment; under this config key member panes run as
+     * a different OS user with a different environment entirely, so neither "every member pane
+     * inherits them UNBLOCKED" nor "the scrub blanks them" is evidence-backed here — both would be
+     * reporting on the wrong process. Logged once, names the config key, and states the honest
+     * conclusion: the gap for member panes is UNKNOWN, not clean, so {@code memberCredentials} cannot
+     * be verified from this daemon. The one count it does report is scoped explicitly to fleetd's own
+     * environment, never presented as if it said anything about the member's — see {@link
+     * #logCredentialGap}'s javadoc for why this branch exists.
+     */
+    private void warnUnknownMemberEnvironment(FleetConfig.MemberCredentials creds) {
+        if (!unknownMemberEnvironmentWarned.compareAndSet(false, true)) {
+            return;
+        }
+        Set<String> covered = new HashSet<>(creds.known());
+        covered.addAll(creds.allow());
+        Set<String> hostNames = hostEnvNames.get();
+        long gapInFleetdsOwnEnv = hostNames.stream()
+                .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
+                .filter(name -> !covered.contains(name))
+                .count();
+        log.warn("memberCredentials gap: memberHerdrSocket is configured, so member panes run under "
+                        + "a different OS user than fleetd's own process, with a different environment "
+                        + "entirely — fleetd has no channel to read that user's environment. {} of the "
+                        + "{} names in fleetd's OWN environment are credential-shaped and not on "
+                        + "known:/allow:, but that count describes fleetd's process, not the member "
+                        + "herdr's. The credential gap for member panes is UNKNOWN, not clean, and "
+                        + "memberCredentials cannot be verified from here.",
+                gapInFleetdsOwnEnv, hostNames.size());
+    }
+
     /**
      * CB-596 criterion 4: a credential-shaped host env var name on neither {@code known} nor
      * {@code allow} is not silently allowed — it is reported. {@link #hostEnvNames} enumerates the
@@ -1258,8 +1546,22 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * (same severity, and same guard, as the deny-by-default case — a name genuinely reaching a
      * member unprotected is equally serious whichever path put it there), and the names it says are
      * blanked keep the INFO.
+     *
+     * <p>fleetd #185 stage 2: everything above assumes the member pane runs under the same OS user
+     * as the daemon, so {@link #hostEnvNames} mirrors what the pane inherits — see that field's
+     * javadoc. When {@code memberHerdrSocket:} is configured that assumption is false: the member
+     * pane runs on a second herdr owned by a <em>different</em> user, and neither conclusion below
+     * ("inherits them UNBLOCKED" / "the scrub blanks them") is backed by evidence about that user's
+     * environment. So this method checks that first and, when configured, reports the honest
+     * "unknown, not clean" conclusion instead — see {@link #warnUnknownMemberEnvironment}. When
+     * {@code memberHerdrSocket:} is absent (the default, and the only mode this host runs) this
+     * branch is never taken and every line below is unchanged.
      */
     private void logCredentialGap(FleetConfig.MemberCredentials creds, Set<String> effectiveAllowed) {
+        if (memberHerdrSocketConfigured()) {
+            warnUnknownMemberEnvironment(creds);
+            return;
+        }
         Set<String> covered = new HashSet<>(creds.known());
         covered.addAll(creds.allow());
         List<String> gap = hostEnvNames.get().stream()

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -20,6 +20,8 @@ import java.util.EnumSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.BooleanSupplier;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
 import java.util.function.Supplier;
@@ -215,7 +217,43 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         return Path.of(System.getProperty("java.io.tmpdir"));
     }
 
-    /** The default opencode storage root: {@code ~/.local/share/opencode} (the XDG data dir). */
+    /**
+     * The default opencode storage root: {@code ~/.local/share/opencode} (the XDG data dir) —
+     * always FLEETD's OWN {@code user.home}, whichever OS user runs the daemon.
+     *
+     * <p><b>fleetd #219 site 2 — a decision, not a patch.</b> Under {@code memberHerdrSocket:} the
+     * member pane runs as a <em>different</em> OS user, and opencode writes {@code opencode.db}
+     * under <em>that</em> user's {@code $HOME}, not fleetd's. Scanning fleetd's own {@code
+     * user.home} is therefore looking in the wrong place — a wrong-LOCATION failure, not a
+     * wrong-PERMISSION one like site 1, and it fails quietly: {@link
+     * SessionAwareHandle#agentSessionId()} would keep returning {@code null} forever, which reads
+     * as "opencode does not support resume" rather than "fleetd looked in the wrong home." fleetd
+     * #209 is the reason that silence is unacceptable.
+     *
+     * <p>Three ways to close the gap were weighed:
+     * <ol>
+     *   <li><b>Make the member's home configurable.</b> Correct in principle, but this ticket's
+     *       scope is the two existing call sites, not a new config key — {@code memberHerdrSocket}
+     *       already carries the second herdr's socket path, not its user's home, and inventing a
+     *       parallel key here without also wiring it through discovery's actual callers is a
+     *       half-shipped feature (the exact shape CB-596/CB-611 warn against).</li>
+     *   <li><b>Derive it</b> (e.g. from {@code worktreeRoot}'s owner, or {@code getent passwd}).
+     *       Rejected: nothing in this codebase resolves a Unix username to a home directory today,
+     *       and guessing wrong would silently point discovery at a THIRD wrong location — worse
+     *       than the current gap, because it would look like it should work.</li>
+     *   <li><b>Declare discovery unavailable</b> under {@code memberHerdrSocket}, and say so once,
+     *       loudly, instead of scanning a directory that structurally cannot hold the answer.</li>
+     * </ol>
+     *
+     * <p>Option 3 is taken — the one this ticket says to default to when unsure. {@link
+     * OpenCodeLauncher#spawn} routes {@link SessionAwareHandle#agentSessionId()} through {@link
+     * HerdrPeerLauncher#memberHerdrSocketConfigured()} before ever calling {@link
+     * OpenCodeSessionDiscovery#sessionIdForDirectory}, so under {@code memberHerdrSocket} the
+     * database at this root is never even opened, and one WARN per launcher instance names the gap
+     * instead of the {@code null} return reading as "unsupported." Capability advertising is
+     * unaffected: {@link #capabilities()} always includes {@code SESSION_RESUME}, since {@code
+     * memberHerdrSocket} absent (today's only live mode) is unchanged by this decision.
+     */
     private static Path defaultDiscoveryRoot() {
         return Path.of(System.getProperty("user.home"), ".local", "share", "opencode");
     }
@@ -331,7 +369,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      */
     private Path writeConfig(FleetConfig.Profile cfg, String charterText, String cwd) {
         try {
-            Path dir = Files.createTempDirectory(configRoot, "fleetd-opencode-");
+            Path dir = Files.createTempDirectory(configParentDir(), "fleetd-opencode-");
             dir.toFile().deleteOnExit();
 
             ObjectNode root = JSON.createObjectNode();
@@ -402,6 +440,14 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             // carries operator-supplied values (URL, model id, api key), so escaping must be real.
             Files.writeString(cfgFile, JSON.writerWithDefaultPrettyPrinter().writeValueAsString(root));
             cfgFile.toFile().deleteOnExit();
+            if (memberHerdrSocketConfigured()) {
+                // fleetd #219: the same "different OS user" gap fleetd #213 closed for the ZDOTDIR
+                // scrub — share read-only with worktreeGroup rather than leaving the directory under
+                // fleetd's own 0700 java.io.tmpdir, where the member's OS user could not even
+                // traverse it. memberGroup() cannot be null here: configParentDir() above already
+                // refused this spawn if either worktreeRoot or worktreeGroup was missing.
+                EnvAllowListScrub.shareWithGroup(dir, memberGroup());
+            }
             return cfgFile;
         } catch (IOException e) {
             throw new UncheckedIOException(
@@ -409,6 +455,57 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         }
     }
 
+    /**
+     * fleetd #219 site 1: where {@link #writeConfig} creates its per-spawn directory.
+     *
+     * <ul>
+     *   <li>{@code memberHerdrSocket} ABSENT (today's only mode): byte-identical to before this
+     *       fix — always {@link #configRoot} (defaults to {@code java.io.tmpdir}, fleetd's own
+     *       process).</li>
+     *   <li>{@code memberHerdrSocket} PRESENT: {@code java.io.tmpdir} is fleetd's own per-user temp
+     *       dir (mode {@code 0700} on macOS) — the member pane runs as a DIFFERENT OS user under
+     *       this config key and cannot even traverse it, so the directory holding {@code
+     *       opencode.json} (which tells the member where the bridge MCP is) and the member charter
+     *       would be unreadable to the very process it is written for. The directory instead goes
+     *       under {@code worktreeRoot}, shared read-only with {@code worktreeGroup} via {@link
+     *       EnvAllowListScrub#shareWithGroup} — the SAME mechanism fleetd #213 built for the ZDOTDIR
+     *       scrub, reused here rather than duplicated (see {@link
+     *       HerdrPeerLauncher#memberScrubParentDir()}).</li>
+     * </ul>
+     *
+     * <p><b>Unlike the ZDOTDIR scrub, a missing {@code worktreeRoot}/{@code worktreeGroup} here
+     * REFUSES the spawn instead of degrading.</b> The ZDOTDIR scrub is a credential CONTROL: a
+     * degraded control (CB-596's sentinel overlay) is still worth having. This config file is not a
+     * control — it is the ONLY way the member learns where the bridge MCP lives. Writing it
+     * somewhere the member cannot read would not degrade anything; it would spawn a member that
+     * occupies a pane and never becomes deliverable, since {@code fleet_send} waits ~60s on the
+     * readiness gate and then fails with nothing pointing at a temp directory as the cause. Refusing
+     * up front, with a message that names the missing config key, is the honest failure — an
+     * undeliverable member is not a working spawn either way, so nothing is lost by refusing loudly
+     * instead of failing silently later.
+     *
+     * @throws IllegalStateException when {@code memberHerdrSocket} is configured but {@code
+     *                                worktreeRoot} and/or {@code worktreeGroup} is not
+     */
+    private Path configParentDir() {
+        if (!memberHerdrSocketConfigured()) {
+            return configRoot;
+        }
+        Path root = memberScrubParentDir();
+        String group = memberGroup();
+        if (root == null || group == null) {
+            throw new IllegalStateException("memberHerdrSocket is configured, so opencode's config "
+                    + "directory (opencode.json + member charter) must be placed where the member's "
+                    + "OS user can read it — worktreeRoot, shared via worktreeGroup — but "
+                    + (root == null ? "worktreeRoot" : "worktreeGroup") + " is not configured. "
+                    + "Refusing to spawn rather than write a config the member cannot read: that "
+                    + "member would occupy a pane and never become deliverable, with nothing "
+                    + "pointing at the real cause. Configure both worktreeRoot and worktreeGroup to "
+                    + "enable opencode member spawns under memberHerdrSocket.");
+        }
+        return root;
+    }
+
     /**
      * Declare a custom OpenAI-compatible provider so the worker talks to a pinned endpoint (a local
      * vLLM, say) instead of opencode's default gateway (CB-508).
@@ -517,11 +614,16 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         return afterScheme.contains("/") ? trimmed : trimmed + "/v1";
     }
 
+    /** One WARN per launcher instance for the fleetd #219 site-2 discovery-unavailable gap. */
+    private final AtomicBoolean discoveryUnavailableWarned =
+            new AtomicBoolean();
+
     /** Add lazy on-disk session discovery to the base handle. */
     @Override
     public PeerHandle spawn(SpawnRequest req) {
         PeerHandle inner = super.spawn(req);
-        return new SessionAwareHandle(inner, discovery, effectiveCwd(req));
+        return new SessionAwareHandle(inner, discovery, effectiveCwd(req),
+                this::memberHerdrSocketConfigured, discoveryUnavailableWarned);
     }
 
     /**
@@ -536,11 +638,17 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         private final PeerHandle delegate;
         private final OpenCodeSessionDiscovery discovery;
         private final String cwd;
+        private final BooleanSupplier discoveryUnavailable;
+        private final AtomicBoolean discoveryUnavailableWarned;
 
-        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd) {
+        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd,
+                            BooleanSupplier discoveryUnavailable,
+                            AtomicBoolean discoveryUnavailableWarned) {
             this.delegate = delegate;
             this.discovery = discovery;
             this.cwd = cwd;
+            this.discoveryUnavailable = discoveryUnavailable;
+            this.discoveryUnavailableWarned = discoveryUnavailableWarned;
         }
 
         @Override
@@ -565,6 +673,22 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
 
         @Override
         public String agentSessionId() {
+            // fleetd #219 site 2: under memberHerdrSocket the member pane runs as a different OS
+            // user, so opencode.db lives under THAT user's $HOME, not the one discoveryRoot was
+            // built from (see OpenCodeLauncher#defaultDiscoveryRoot's javadoc for the full
+            // reasoning). Scanning fleetd's own $HOME under that config would only ever find "no
+            // row" and read as "resume unsupported" — declare it unavailable instead, once, loudly.
+            if (discoveryUnavailable.getAsBoolean()) {
+                if (discoveryUnavailableWarned.compareAndSet(false, true)) {
+                    log.warn("opencode session discovery unavailable: memberHerdrSocket is "
+                            + "configured, so opencode's on-disk session database lives under the "
+                            + "MEMBER's own $HOME, not fleetd's ({}) — agentSessionId will stay null "
+                            + "for every opencode member under this config, and SESSION_RESUME "
+                            + "cannot be honored (fleetd #209/#219).",
+                            System.getProperty("user.home"));
+                }
+                return null;
+            }
             // Lazy + retried, never a spawn-time blocker: opencode writes the session record only
             // when the session is first persisted, so null here is the correct interim answer and
             // the caller re-calls later (each call re-scans, picking up a record that has since

fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -9,6 +9,7 @@ import dev.ltms.fleet.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
 import java.util.concurrent.CompletableFuture;
@@ -167,6 +168,12 @@ public final class MessageService {
     private static final class Task {
         private final String ticket;
         private final String target;
+        /**
+         * When this task was created (#137 fix): the tiebreaker for which of several open tasks on
+         * one target gets a recovered reply in {@link #abandon} — the oldest, since it is the one
+         * that has been waiting longest.
+         */
+        private final long createdNanos;
         private final CompletableFuture<Reply> future = new CompletableFuture<>();
         /**
          * When {@link #future} resolved, or {@code null} while it is still pending — the clock
@@ -184,6 +191,7 @@ public final class MessageService {
         private Task(String ticket, String target, LongSupplier nowNanos) {
             this.ticket = ticket;
             this.target = target;
+            this.createdNanos = nowNanos.getAsLong();
             future.whenComplete((reply, ex) -> completedNanos = nowNanos.getAsLong());
         }
     }
@@ -375,6 +383,19 @@ public final class MessageService {
      * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
      * are interactive and must never be queued.
      *
+     * <p><strong>Ambiguous match also falls to the inbox.</strong> {@link #askAnsweredAsyncTasks}
+     * cannot actually return more than one entry today (see its own javadoc for why — in short,
+     * {@link #hasAsyncQuestion} keeps a target BUSY, so no second task can reach this state, for as
+     * long as an earlier one's {@code turnId} is still stamped). That is an emergent guarantee from
+     * two other facts, not one this method enforces, so this branch stays in as defence in depth
+     * rather than being removed as dead code: if it ever weakens, returning whichever candidate a
+     * {@code ConcurrentHashMap} iteration reaches first would let a genuine reply complete the
+     * <em>wrong</em> ticket — silently handing the lead something that reads like a correct answer to
+     * a delegation the worker never touched, which is worse than a failure because the lead acts on
+     * it. When more than one candidate exists, guessing is not safe: fall back to the inbox exactly
+     * as the zero-candidate case does, and let {@link #abandon} apply the eventual recovery
+     * deterministically instead.
+     *
      * @return always {@code true} — the reply resolved a live send, completed a parked ticket, or
      *         was queued
      */
@@ -392,13 +413,21 @@ public final class MessageService {
         // FAILED with a misleading "session released before it replied" reason, even though the reply
         // had, in fact, arrived. Completing the matching ticket directly here means fleet_poll{ticket}
         // sees the real reply instead.
-        Task orphan = askAnsweredAsyncTask(session);
-        if (orphan != null && orphan.future.complete(new Reply(Outcome.REPLIED, content))) {
-            if (orphan.turnId != null) {
-                asyncTasksByTurn.remove(orphan.turnId, orphan);
+        List<Task> candidates = askAnsweredAsyncTasks(session);
+        if (candidates.size() == 1) {
+            Task orphan = candidates.get(0);
+            if (orphan.future.complete(new Reply(Outcome.REPLIED, content))) {
+                if (orphan.turnId != null) {
+                    asyncTasksByTurn.remove(orphan.turnId, orphan);
+                }
+                count(FleetMetrics.REPLIES, "path", "async-recovered");
+                return true;                   // the ticket itself took it — no inbox stranding at all
             }
-            count(FleetMetrics.REPLIES, "path", "async-recovered");
-            return true;                       // the ticket itself took it — no inbox stranding at all
+        } else if (candidates.size() > 1) {
+            List<String> tickets = candidates.stream().map(t -> t.ticket).toList();
+            log.warn("reply from {} matches {} open async tickets {} — cannot tell which one it "
+                    + "answers, queuing to the inbox instead of guessing", session, candidates.size(),
+                    tickets);
         }
         inbox.publish(session, UUID.randomUUID().toString(), content);
         // CB-640: record the stranding itself (not just the reply text) so fleet health can see a
@@ -414,21 +443,38 @@ public final class MessageService {
     }
 
     /**
-     * The still-open async task on {@code target} whose {@code fleet_ask} was already answered — its
-     * {@link Task#turnId} is stamped but its {@link Task#question} was cleared by {@link #answer} —
-     * yet whose future is not resolved yet (#137). {@code null} if no such task exists, including the
+     * Every still-open async task on {@code target} whose {@code fleet_ask} was already answered —
+     * its {@link Task#turnId} is stamped but its {@link Task#question} was cleared by {@link #answer}
+     * — yet whose future is not resolved yet (#137). Empty if no such task exists, including the
      * common case where {@code target}'s worker never used {@code fleet_ask} at all (a task that was
      * never asked has {@code turnId == null}, so it can never match here and only ever completes
      * through the ordinary rendezvous fast path in {@link #reply}).
+     *
+     * <p><strong>Returns at most one entry today — verified, not assumed.</strong> {@link #send}
+     * refuses to open a waiter on {@code target} while {@link #hasAsyncQuestion} is true, and that
+     * check matches ANY task whose {@code turnId} is still stamped in {@code asyncTasksByTurn} —
+     * not only while its question is still open. {@link #answer} deliberately leaves that stamp in
+     * place ({@code clearAsyncQuestion(turnId, false)}) until the resumed turn's own future actually
+     * resolves, at which point {@link #finishAsyncTask} both removes the stamp AND completes that
+     * task's future in the same call. So a second task can never reach "{@code turnId} stamped, future
+     * still open" — the exact pair this method matches on — while a first one already holds it: by
+     * the time the stamp is gone, so is the eligibility. This is an emergent property of those two
+     * facts holding together, not something this method (or its callers) enforces on its own — flip
+     * {@code forgetTurn} to {@code true} in that one {@link #answer} call and it silently stops being
+     * true, with nothing left to fail loudly. The callers below still handle "more than one" as
+     * defence in depth against exactly that, not because they exercise it today: {@link #reply}
+     * treats it as unresolvable and falls back to the inbox; {@link #abandon} would pick the oldest
+     * deterministically (its own {@code matching} list has no such guarantee — see its javadoc).
      */
-    private Task askAnsweredAsyncTask(String target) {
+    private List<Task> askAnsweredAsyncTasks(String target) {
+        List<Task> candidates = new ArrayList<>();
         for (Task task : tasks.values()) {
             if (target.equals(task.target) && task.question == null && task.turnId != null
                     && !task.future.isDone()) {
-                return task;
+                candidates.add(task);
             }
         }
-        return null;
+        return candidates;
     }
 
     /** Record a counter sample when a registry is wired; a no-op in unit tests. */
@@ -473,16 +519,63 @@ public final class MessageService {
      * outcome is counted, so a torn-down delegation stops being invisible to {@code /metrics}.
      *
      * <p><strong>#137 defence in depth.</strong> {@link #reply} already hands a worker's real
-     * {@code fleet_reply} straight to the async ticket it belongs to whenever one is still parked
-     * waiting for it (see {@link #askAnsweredAsyncTask}), so by the time a session is released its
-     * tasks are normally already resolved — this loop's {@code complete} calls are then harmless
-     * no-ops (a {@link CompletableFuture} can only resolve once). But should some other path someday
-     * strand a reply in the inbox without completing its ticket, checking
+     * {@code fleet_reply} straight to the async ticket it belongs to whenever exactly one is still
+     * parked waiting for it (see {@link #askAnsweredAsyncTasks}), so by the time a session is
+     * released its tasks are normally already resolved — this loop's {@code complete} calls are then
+     * harmless no-ops (a {@link CompletableFuture} can only resolve once). But should some other path
+     * someday strand a reply in the inbox without completing its ticket, checking
      * {@link #hasStrandedReply(String)} here — before ever writing a failure — means a torn-down
      * session whose worker in fact replied is still reported {@code REPLIED} with that reply's own
      * text, never the misleading "the worker session was released before it replied" (which also
      * means the snapshot/worktree recovery hint that follows it never prints once a reply exists).
      *
+     * <p><strong>At most one task gets the recovered reply — and here, unlike {@link #reply}'s
+     * {@link #askAnsweredAsyncTasks}, {@code matching.size() >= 2} alone is reachable today.</strong>
+     * This method's {@code matching} filter has no {@code turnId != null} requirement, so it matches
+     * any plain (never-asked) open task too — and {@link #sendAsync} does not limit a target to one
+     * of those: a second {@code fleet_send{wait:false}} at a target that is still busy returns its own
+     * ticket immediately and simply parks its {@link #send} behind the target's session lock for up
+     * to {@link #ASYNC_TIMEOUT_MS}, exactly as {@code abandonFailsEveryPendingAsyncTicketForTheReleasedTarget}
+     * already proves. Before this fix, the loop below drained the strand once and then reused that
+     * same {@code Reply} for <em>every</em> task it walked past — so two open tasks really did both
+     * complete {@code REPLIED} with the same text (see the pre-fix loop in commit 97f6c33's parent).
+     * A stranded reply is one worker answer, so it can settle at most one open task on this target —
+     * never every open task, and never a guess. When more than one task is still open here, the
+     * recovered reply goes to the <em>oldest</em> (lowest {@link Task#createdNanos}) — it has been
+     * waiting longest, so it is the one most likely to be what the reply actually answers. Every
+     * other open task keeps the ordinary {@code WORKER_FAILED} path it would take without a stranded
+     * reply at all.
+     *
+     * <p><strong>{@code matching.size() >= 2} together with {@code hadStrandedReply} is a different
+     * question, and today it is defence in depth rather than a path this codebase's public API can
+     * drive.</strong> This class has exactly two sites that ever acquire a target's entry in
+     * {@code sessionLocks} — {@link #send} and {@link #answer} — and both open a {@link Rendezvous}
+     * waiter for that same target as the very first thing they do after acquiring the lock, then hold
+     * lock and waiter together for the rest of their critical section ({@link #send} also clears
+     * {@link #strandedReplies} right there, the instant it opens its waiter — before it ever enqueues
+     * delivery). So "the session lock is held" and "a live waiter is open for it" are the same fact
+     * throughout this class, and {@link #reply}'s fast path always resolves a currently-open waiter
+     * directly rather than stranding. The two facts this method wants therefore cannot be produced
+     * side by side: while the lock is held, a real reply resolves the open waiter directly and never
+     * reaches {@link #strandedReplies}; the instant the lock is free, any parked matching task's own
+     * {@link #send} that is scheduled next wins it and, by opening its waiter, clears the strand again
+     * before this method ever runs. There is no way to hold that lock open-but-unaccepted from outside
+     * {@link #send}/{@link #answer} to freeze a window in between. Constructing both facts at once
+     * through {@code sendAsync}/{@code reply}/{@code ask}/{@code answer} would need a race against
+     * virtual-thread scheduling, not a deterministic sequence — so the oldest-wins code below stays as
+     * defence in depth against a regression to that mechanism (e.g. clearing {@link #strandedReplies}
+     * on a narrower condition than "any acceptance"), not because today's test suite exercises the
+     * conjunction. {@code matching.size() >= 2} alone, without a strand, is exactly what
+     * {@code abandonFailsEveryPendingAsyncTicketForTheReleasedTarget} already covers.
+     *
+     * <p><strong>Do not "fix" that gap with a test that reaches past this class.</strong> A test can
+     * build both facts by calling {@link Rendezvous#close} itself on the waiter an accepted
+     * {@link #send} is still blocked on: the send keeps the lock, no waiter is registered any more, a
+     * second parked task stays open, and the next {@link #reply} then strands. That was checked, and
+     * such a test does go red against the pre-fix loop. But it only goes red because it broke the
+     * lock-and-waiter invariant above from outside — no caller of this class ever does that — so it
+     * pins a state production cannot reach, and would read to the next person as if it could.
+     *
      * @return true if a live waiter or an async task was failed (never true for one recovered as a
      *         reply — see the note above)
      */
@@ -494,21 +587,39 @@ public final class MessageService {
         CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
         boolean failed = waiter != null && !waiter.isDone() && rendezvous.resolveFailure(waiter, reason);
         boolean asyncFailed = false;
-        Reply recovered = null; // lazily drained at most once, only if a task actually needs it
+
+        List<Task> matching = new ArrayList<>();
         for (Task task : tasks.values()) {
-            if (!target.equals(task.target) || task.question != null || task.future.isDone()) {
-                continue;
+            if (target.equals(task.target) && task.question == null && !task.future.isDone()) {
+                matching.add(task);
             }
-            if (hadStrandedReply && recovered == null) {
-                recovered = recoverStrandedReply(target);
+        }
+        Task recoveryTask = null;
+        if (hadStrandedReply && !matching.isEmpty()) {
+            recoveryTask = matching.get(0);
+            for (Task candidate : matching) {
+                if (candidate.createdNanos < recoveryTask.createdNanos) {
+                    recoveryTask = candidate;
+                }
             }
-            Reply outcome = recovered != null ? recovered : new Reply(Outcome.WORKER_FAILED, reason);
+        }
+        Reply recovered = recoveryTask != null ? recoverStrandedReply(target) : null;
+        for (Task task : matching) {
+            boolean isRecovery = task == recoveryTask && recovered != null;
+            Reply outcome = isRecovery ? recovered : new Reply(Outcome.WORKER_FAILED, reason);
             if (task.future.complete(outcome)) {
                 if (outcome.outcome() == Outcome.WORKER_FAILED) {
                     asyncFailed = true;
                 } else if (task.turnId != null) {
                     asyncTasksByTurn.remove(task.turnId, task);
                 }
+            } else if (isRecovery) {
+                // The recovered reply was already drained out of the inbox, but this task resolved
+                // through another path (e.g. a concurrent reply() or a second abandon() racing this
+                // one) between us choosing it and completing it here. Put the reply back rather than
+                // lose it silently — it may still belong to some other still-open task, or the next
+                // caller that drains this target's inbox.
+                inbox.publish(target, UUID.randomUUID().toString(), recovered.text());
             }
         }
         if (failed) {
@@ -523,6 +634,10 @@ public final class MessageService {
      * stranding fact raced away, e.g. a lead's own {@code fleet_poll} on the raw session already
      * drained it first). When more than one message is queued, only the newest is the worker's actual
      * final answer ({@link #drainReplies} returns them oldest-first).
+     *
+     * <p>This does drain (removes the messages from the inbox) before the caller knows whether the
+     * task it is recovering for will actually accept them — {@link #abandon} is the one that puts a
+     * reply back if its {@code complete} call turns out to lose the race.
      */
     private Reply recoverStrandedReply(String target) {
         var messages = drainReplies(target);

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -315,10 +315,18 @@ public final class FleetApp {
                 .map(Agent.class::cast)
                 .filter(a -> a.terminalId() != null)
                 .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
-        List<Map<String, Object>> out = sessions.roster().stream()
+        // fleetd #209: this REST roster reports agentSessionId via SessionManager.rosterView, so it
+        // uses the resolving roster read (caller-driven, not a timer) rather than the plain one.
+        List<Map<String, Object>> out = sessions.rosterResolved().stream()
                 .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
                 .toList();
         Map<String, Object> body = new LinkedHashMap<>();
+        // fleetd #199: the endpoint became /members in the CB-634 rename but the body key stayed
+        // "workers", so a caller that read "members" saw an empty fleet and reported no members at
+        // all. "members" is the canonical key; "workers" stays as a deprecated alias so an existing
+        // REST consumer keeps working — the out-of-band path a lead falls back to when its MCP mount
+        // drops reads this endpoint. Drop the alias once nothing reads it.
+        body.put("members", out);
         body.put("workers", out);
         // CB-586: operator visibility for the refs/wip snapshot store without shelling into the
         // repo — how many snapshot refs exist and roughly what they cost. Present only once a

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -23,6 +23,7 @@ import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Consumer;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /**
@@ -88,24 +89,64 @@ public final class GitWorktrees implements Worktrees {
     );
 
     private final String configuredRoot;
+    /** OS group name for {@link #shareWithGroup} (fleetd #185 stage 3); {@code null} ⇒ feature off. */
+    private final String group;
     private final Consumer<String> afterWorktreeAdded;
+    /** How {@link #shareWithGroup}'s processes (git config / chgrp / chmod / find) actually run.
+     *  Defaults to the real {@link #exec(String...)}. Package-private test seam so a unit test can
+     *  prove "no group configured ⇒ zero processes spawned" and inspect exactly what a configured
+     *  group runs, without a real second OS user or OS group on this host. */
+    private final Function<String[], String> shareGroupRunner;
     private final SecureRandom random = new SecureRandom();
     private final AtomicLong seq = new AtomicLong();
 
     /** Default constructor: worktree root is derived per-repo as {@code <repoRoot>/../.bridged-worktrees}. */
     public GitWorktrees() {
-        this(null);
+        this(null, (String) null);
     }
 
-    /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
+    /**
+     * @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of
+     *                       the repo root. No {@code worktreeGroup} configured — {@link #shareWithGroup}
+     *                       is a no-op.
+     */
     public GitWorktrees(String configuredRoot) {
-        this(configuredRoot, _ -> {});
+        this(configuredRoot, (String) null);
+    }
+
+    /**
+     * @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of
+     *                       the repo root.
+     * @param group          optional OS group name (fleetd #185 stage 3, {@code worktreeGroup:} in
+     *                       config); null/blank ⇒ {@link #shareWithGroup} is a no-op.
+     */
+    public GitWorktrees(String configuredRoot, String group) {
+        this(configuredRoot, group, _ -> {});
     }
 
     /** Test seam for changing a real worktree between its creation and its security check. */
     GitWorktrees(String configuredRoot, Consumer<String> afterWorktreeAdded) {
+        this(configuredRoot, null, afterWorktreeAdded);
+    }
+
+    /** Test seam combining a configurable {@code group} with {@link #afterWorktreeAdded}. */
+    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded) {
+        this(configuredRoot, group, afterWorktreeAdded, null);
+    }
+
+    /**
+     * Full test seam: also overrides how {@link #shareWithGroup}'s processes run (fleetd #185
+     * stage 3), so a unit test can prove "no group configured ⇒ no process spawned" and inspect
+     * exactly what commands a configured group runs, without a real second OS user/group.
+     *
+     * @param shareGroupRunner {@code null} ⇒ the real {@link #exec(String...)}.
+     */
+    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
+                 Function<String[], String> shareGroupRunner) {
         this.configuredRoot = configuredRoot;
+        this.group = (group == null || group.isBlank()) ? null : group;
         this.afterWorktreeAdded = afterWorktreeAdded == null ? _ -> {} : afterWorktreeAdded;
+        this.shareGroupRunner = shareGroupRunner != null ? shareGroupRunner : this::exec;
     }
 
     @Override
@@ -607,6 +648,126 @@ public final class GitWorktrees implements Worktrees {
         return deleted;
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * <p>fleetd #185 stage 3. No-op — no process spawned, nothing logged — when {@link #group} is
+     * null/blank. Otherwise:
+     * <ol>
+     *   <li>{@code git -C repoRoot config core.sharedRepository group} so every future write by
+     *       either uid stays group-writable;</li>
+     *   <li>a one-time {@code chgrp}/{@code chmod g+rwX} fix-up over the worktree directory and,
+     *       under the repo's <em>common</em> git directory, {@code objects}, {@code refs},
+     *       {@code logs}, {@code worktrees} and {@code packed-refs} — with setgid
+     *       ({@code chmod g+s}) applied only to the directories among them, so files created later
+     *       inherit the group;</li>
+     *   <li>one INFO line naming the group and the paths touched.</li>
+     * </ol>
+     *
+     * <p><b>Every path is skipped when it does not exist.</b> {@code .git/logs} is absent in a repo
+     * with {@code core.logAllRefUpdates=false} or one that has had no ref update yet, and
+     * {@code packed-refs} is absent until refs are packed. Passing a missing path to {@code chgrp}
+     * exits non-zero, which would fail <em>every</em> provisioning spawn with a message blaming a
+     * group that is in fact fine.
+     *
+     * <p><b>The git directory is resolved, not assumed.</b> {@code <repoRoot>/.git} is a
+     * <em>file</em>, not a directory, when the checkout is itself a linked worktree — the very
+     * thing this class creates for every member. {@code git rev-parse --git-common-dir} gives the
+     * real shared store, and it may answer relatively, so it is resolved against {@code repoRoot}.
+     *
+     * <p><b>The fix-up re-runs on every spawn, by design.</b> {@code core.sharedRepository=group}
+     * governs only what git writes <em>after</em> it is set; the walk is what covers everything
+     * already on disk. It is not redundant work to optimise away — dropping it silently leaves
+     * pre-existing objects unreadable to the member. It costs three walks of the object store per
+     * spawn (about 3000 files in this repo, well under a second, but it grows with the repo).
+     *
+     * <p>This only fixes up file ownership/permissions on the operator's shared repo so a
+     * different-uid member can write to it — it isolates credentials, not the repository. A member
+     * in the group can still write the operator's git objects and refs.
+     *
+     * <p>Fails loudly: a missing group, or a {@code chgrp}/{@code chmod} refused because the
+     * operator is not a member of it, becomes a {@link WorktreeException} naming the group — never
+     * a silent skip that leaves a member unable to work with nothing in the log to explain why.
+     */
+    @Override
+    public void shareWithGroup(String repoRoot, String worktreePath) {
+        if (group == null) {
+            return;
+        }
+        List<String> touched = new ArrayList<>();
+        try {
+            shareGroupRunner.apply(new String[]{"git", "-C", repoRoot, "config", "core.sharedRepository", "group"});
+            String commonDir = gitCommonDir(repoRoot);
+            shareGroupPathIfPresent(worktreePath, true, touched);
+            for (String name : List.of("objects", "refs", "logs", "worktrees")) {
+                shareGroupPathIfPresent(commonDir + "/" + name, true, touched);
+            }
+            shareGroupPathIfPresent(commonDir + "/packed-refs", false, touched);
+        } catch (WorktreeException e) {
+            throw new WorktreeException("cannot share worktree with group '" + group + "': "
+                    + e.getMessage() + " — the group must exist, and the fleetd operator ("
+                    + System.getProperty("user.name") + ") must be a member of it", e);
+        }
+        log.info("worktreeGroup={} shared repoRoot={} worktreePath={} paths={}",
+                group, repoRoot, worktreePath, touched);
+    }
+
+    /**
+     * The repo's <em>common</em> git directory as an absolute path — where {@code objects},
+     * {@code refs} and {@code worktrees} actually live. {@code git rev-parse --git-common-dir}
+     * answers relative to {@code repoRoot} in the ordinary case ({@code .git}) and absolutely for a
+     * linked worktree, so the answer is resolved against {@code repoRoot} either way. Never
+     * hardcode {@code repoRoot + "/.git"}: that is a FILE when the checkout is itself a linked
+     * worktree.
+     */
+    private String gitCommonDir(String repoRoot) {
+        String answer = shareGroupRunner.apply(
+                new String[]{"git", "-C", repoRoot, "rev-parse", "--git-common-dir"});
+        String trimmed = answer == null ? "" : answer.trim();
+        if (trimmed.isEmpty()) {
+            trimmed = ".git";
+        }
+        return Path.of(repoRoot).resolve(trimmed).normalize().toString();
+    }
+
+    /**
+     * {@link #shareGroupPath} when {@code path} exists, recording it in {@code touched}; otherwise
+     * nothing at all. A missing path is normal, not an error — see {@link #shareWithGroup}'s
+     * javadoc for which ones are routinely absent and why passing them to {@code chgrp} would fail
+     * every spawn.
+     */
+    private void shareGroupPathIfPresent(String path, boolean recursive, List<String> touched) {
+        if (!Files.exists(Path.of(path))) {
+            return;
+        }
+        shareGroupPath(path, recursive);
+        touched.add(path);
+    }
+
+    /**
+     * {@code chgrp}/{@code chmod g+rwX} {@code path} to {@link #group}. When {@code recursive},
+     * also walks the directories under {@code path} (including {@code path} itself, when it is a
+     * directory) and sets setgid on each — directories only, per the javadoc on
+     * {@link #shareWithGroup}.
+     */
+    private void shareGroupPath(String path, boolean recursive) {
+        List<String> chgrp = new ArrayList<>(List.of("chgrp"));
+        if (recursive) chgrp.add("-R");
+        chgrp.add(group);
+        chgrp.add(path);
+        shareGroupRunner.apply(chgrp.toArray(new String[0]));
+
+        List<String> chmod = new ArrayList<>(List.of("chmod"));
+        if (recursive) chmod.add("-R");
+        chmod.add("g+rwX");
+        chmod.add(path);
+        shareGroupRunner.apply(chmod.toArray(new String[0]));
+
+        if (recursive) {
+            shareGroupRunner.apply(new String[]{"find", path, "-type", "d", "-exec", "chmod", "g+s", "{}", "+"});
+        }
+    }
+
     /**
      * Every {@code refs/wip/*} ref (see {@link WipRef}). The committer date is read as a unix
      * count of seconds and converted to millis. {@code %00} (NUL) separates the fields because a

fleetd/src/main/java/dev/ltms/fleet/session/MemberSession.java

@@ -89,4 +89,15 @@ public record MemberSession(
         return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
                 nowNanos, turnCount + 1, state, worktree, branch, charterReceipt, agentSessionId);
     }
+
+    /**
+     * Return a copy with {@code agentSessionId} resolved to a non-null value (fleetd #209). Some
+     * adapters (opencode) cannot answer {@link dev.ltms.fleet.peer.PeerHandle#agentSessionId()} at
+     * spawn time — the peer has not persisted its session record yet — so the id is discovered on
+     * a later poll and swapped into the otherwise-immutable session via this wither.
+     */
+    public MemberSession withAgentSessionId(String agentSessionId) {
+        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
+                lastActivityAtNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId);
+    }
 }

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -46,6 +46,15 @@ public final class SessionManager implements TurnListener {
     private final PeerLauncher launcher;
     private final Worktrees worktrees;
     private final ConcurrentHashMap<String /*paneId*/, MemberSession> registry = new ConcurrentHashMap<>();
+    /**
+     * fleetd #209: the live {@link PeerHandle} for every registered pane, retained solely so
+     * {@link #resolveAgentSessionId} can re-poll {@link PeerHandle#agentSessionId()} after spawn.
+     * The handle used to go out of scope at the end of the spawn method, so a launcher that answers
+     * the id lazily (opencode — the on-disk session row is written after the pane is created) could
+     * never be re-asked, and {@code fleet_list}/{@code fleet_spawn resumeSessionId} never saw it.
+     * Populated on every spawn path, removed on {@link #release}.
+     */
+    private final ConcurrentHashMap<String /*paneId*/, PeerHandle> handles = new ConcurrentHashMap<>();
     private final MemberPresence presence;
     private final SecureRandom nonceRandom = new SecureRandom();
     private final AtomicLong nonceSeq = new AtomicLong();
@@ -205,6 +214,7 @@ public final class SessionManager implements TurnListener {
                     handle.charterReceipt(),
                     handle.agentSessionId());
             registry.put(handle.id(), session);
+            handles.put(handle.id(), handle);
             memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
             log.debug("acquired session id={} terminal={} profile={} owner={}",
                     handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
@@ -257,6 +267,10 @@ public final class SessionManager implements TurnListener {
      */
     private void release(String paneId, ReleaseCause cause) {
         MemberSession removed = registry.remove(paneId);
+        // fleetd #209: remove right alongside the registry entry so a released session's handle is
+        // never leaked — but keep the local reference below, so the id can still be resolved for
+        // the ReleaseDetail this teardown notifies with.
+        PeerHandle removedHandle = handles.remove(paneId);
         boolean preserveWorktree = cause == ReleaseCause.SHUTDOWN;
         String snapshotRef = null;
         if (removed != null) {
@@ -303,8 +317,11 @@ public final class SessionManager implements TurnListener {
                 // too, so a failed ticket's detail can point a lead at the same tree to re-dispatch.
                 // CB-584 (issue #65 criterion 5): carry agentSessionId alongside them, so a lead can
                 // also resume the member's conversation, not just re-dispatch onto its files.
-                notifyReleased(new ReleaseDetail(removed.terminalId(), removed.worktree(),
-                        removed.branch(), snapshotRef, removed.agentSessionId()));
+                // fleetd #209: a late-resolving adapter (opencode) may only now have an id — resolve
+                // one last time so a released member's detail carries the id it now has.
+                MemberSession resolved = resolveAgentSessionId(removed, removedHandle);
+                notifyReleased(new ReleaseDetail(resolved.terminalId(), resolved.worktree(),
+                        resolved.branch(), snapshotRef, resolved.agentSessionId()));
             }
         }
         // CB-581: the pane must always stop, even if the dirty check above threw. A session removed
@@ -472,6 +489,10 @@ public final class SessionManager implements TurnListener {
         try {
             path = worktrees.add(repoRoot, branch, wt.baseRef());
             worktrees.overlayParity(repoRoot, path, launcher.parityOverlay(preResolvedProfile));
+            // fleetd #185 stage 3: MUST run after overlayParity, not folded into add() — overlayParity
+            // copies more files into the worktree after add() returns, so sharing the group any earlier
+            // leaves those overlay files operator-owned and read-only for a different-uid member.
+            worktrees.shareWithGroup(repoRoot, path);
             handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd, sessionName, resumeSessionId, memberRole));
         } catch (RuntimeException e) {
             log.warn("spawn failed for profile={} role={} branch={} path={}: {}",
@@ -504,6 +525,7 @@ public final class SessionManager implements TurnListener {
                 handle.charterReceipt(),
                 handle.agentSessionId());
         registry.put(handle.id(), session);
+        handles.put(handle.id(), handle);
         memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
         log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
                 handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
@@ -535,16 +557,73 @@ public final class SessionManager implements TurnListener {
         return launcher.defaultProfile();
     }
 
-    /** The session for {@code paneId}, if it is still registered and not released. */
+    /**
+     * The session for {@code paneId}, if it is still registered and not released. fleetd #209:
+     * resolves a still-unknown {@code agentSessionId} against the retained handle before returning,
+     * so {@code fleet_status} sees an id a lazy-resolving adapter has since written.
+     */
     public Optional<MemberSession> get(String paneId) {
-        return Optional.ofNullable(registry.get(paneId));
+        return Optional.ofNullable(registry.get(paneId)).map(this::resolveAgentSessionId);
     }
 
-    /** Fleet-owned roster: all registered sessions (acquired minus released). */
+    /**
+     * Fleet-owned roster: all registered sessions (acquired minus released). Deliberately does
+     * <strong>not</strong> resolve {@code agentSessionId} (fleetd #209 follow-up) — this is the
+     * roster supplier on the heartbeat and health-tick timers ({@code LeadHeartbeatLoop},
+     * {@code FleetHealthMonitor} in {@code Fleetd}), on the placement/exhaustion paths, and on the
+     * metrics scrape ({@code FleetMetrics}), all called far more often than any caller actually
+     * reads {@code agentSessionId}. Resolving here would mean every tick opens a lazy-resolving
+     * adapter's (opencode's) on-disk session store once per member whose id is still unknown — and
+     * for a member whose id never appears, that cost never stops, for the life of the process. Use
+     * {@link #rosterResolved()} instead wherever the id must be current.
+     */
     public List<MemberSession> roster() {
         return List.copyOf(registry.values());
     }
 
+    /**
+     * {@link #roster()}, with each session's still-unknown {@code agentSessionId} re-resolved
+     * against its retained handle (fleetd #209) — so a caller that actually reports the id (
+     * {@code fleet_list}, the REST roster) sees one a lazy-resolving adapter (opencode) has since
+     * written, rather than the null frozen in at spawn time. Reserved for caller-driven reads, not
+     * timers: see {@link #roster()}'s javadoc for why the plain roster must stay non-resolving.
+     */
+    public List<MemberSession> rosterResolved() {
+        return registry.values().stream().map(this::resolveAgentSessionId).toList();
+    }
+
+    /**
+     * Resolve {@code session}'s {@code agentSessionId} if still unknown, re-polling the retained
+     * {@link PeerHandle} for this pane (fleetd #209). A no-op — returning {@code session} unchanged
+     * — once the id is already known, once no handle is retained for this pane (never spawned, or
+     * already released), or if the handle throws while answering. A resolved id is best-effort
+     * CAS-swapped into the registry via {@link #replace}; a lost race just means another caller
+     * already applied the same update, so the resolved value is returned either way.
+     */
+    private MemberSession resolveAgentSessionId(MemberSession session) {
+        return resolveAgentSessionId(session, handles.get(session.paneId()));
+    }
+
+    private MemberSession resolveAgentSessionId(MemberSession session, PeerHandle handle) {
+        if (session.agentSessionId() != null || handle == null) {
+            return session;
+        }
+        String resolved;
+        try {
+            resolved = handle.agentSessionId();
+        } catch (RuntimeException e) {
+            log.debug("agentSessionId lookup failed for pane={} terminal={}: {}",
+                    session.paneId(), session.terminalId(), e.toString());
+            return session;
+        }
+        if (resolved == null) {
+            return session;
+        }
+        MemberSession updated = session.withAgentSessionId(resolved);
+        replace(session, updated); // best-effort; a lost CAS just means the resolved value stands anyway
+        return updated;
+    }
+
     /**
      * CB-304 merged roster+live view. The registry is authoritative for worktree, branch,
      * profile, owner, and state; the optional live agent supplies the herdr-reported status.

fleetd/src/main/java/dev/ltms/fleet/session/Worktrees.java

@@ -98,4 +98,21 @@ public interface Worktrees {
     /** CB-586: the operator-visible census of {@code refs/wip/*} in one repository. */
     record WipRefStats(int count, long costBytes) {
     }
+
+    /**
+     * Make {@code repoRoot}'s git store and {@code worktreePath} writable by the configured group
+     * (fleetd #185 stage 3), so a member spawned as a different OS user (see
+     * {@code memberHerdrSocket}) can write its own worktree, its per-worktree git metadata, and
+     * its own commit objects. No-op when no group is configured.
+     *
+     * <p><strong>This isolates credentials, not the repository.</strong> A member in the group can
+     * still write the operator's git objects and refs in the shared repo — this only fixes file
+     * ownership/permissions so a different-uid member can work at all, it grants no narrower access
+     * than that.
+     *
+     * @param repoRoot     the repository whose git store ({@code .git/objects}, {@code refs},
+     *                     {@code logs}, {@code worktrees}, {@code packed-refs}) needs sharing
+     * @param worktreePath the linked worktree's own directory
+     */
+    void shareWithGroup(String repoRoot, String worktreePath);
 }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -1036,6 +1036,35 @@ class FleetConfigTest {
         assertEquals(LeadMailbox.DEFAULT_PREFETCH, noEnv.prefetchOrDefault());
     }
 
+    @Test
+    void absentWorktreeGroupLeavesItNull(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-worktree-group.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\n");
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertNull(cfg.worktreeGroup(), "no worktreeGroup: key → null → GitWorktrees.shareWithGroup is a no-op");
+    }
+
+    @Test
+    void worktreeGroupKeyParses(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("worktree-group.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\nworktreeGroup: fleet-workers\n");
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertEquals("fleet-workers", cfg.worktreeGroup());
+    }
+
+    @Test
+    void absentWorktreeGroupSurvivesTheBackCompatConstructorChain() {
+        // fleetd #185 stage 3: withDefaults() (and every pre-existing call site) must not silently
+        // drop a live worktreeGroup by routing through a back-compat constructor that defaults it
+        // to null.
+        FleetConfig cfg = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null, "fleet-workers");
+        assertEquals("fleet-workers", cfg.withDefaults().worktreeGroup(),
+                "withDefaults() must carry a configured worktreeGroup through unchanged");
+    }
+
     @Test
     void absentPrimaryBlockLeavesPrimaryNull(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("no-primary.yaml");

fleetd/src/test/java/dev/ltms/fleet/inject/CompletionResolverTest.java

@@ -633,6 +633,115 @@ class CompletionResolverTest {
                 "the failure carries the rest of the pane, not only the matched line: " + reason);
     }
 
+    // --- fleetd#211: raw-scrape fallback classification when there is no usable assistant block ---
+
+    @Test
+    void anExhaustionLineWithNoMarkerAndLeadingChromeIsClassifiedFromTheRawScrapeAndNotifiesTheSink() {
+        // No ⏺ anywhere, and the first visible line is TUI chrome (╭). lastAssistantBlock's boundary
+        // scan starts at the top of the raw screen and breaks immediately, so the trimmed block is "".
+        // The fix: fall back to matching the RAW scrape so this doesn't get lost as an empty scrape.
+        String block = """
+                ╭──────────────────────────────────────╮
+                The usage limit has been reached. Try again later.
+                """;
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "a raw-scrape match still resolves the blocked send");
+        assertEquals(Rendezvous.Kind.BACKEND_EXHAUSTED, waiter.getNow(null).kind(),
+                "classified from the raw scrape even though the trimmed block was empty");
+        assertEquals(1, notified.size(),
+                "the sink is the whole point of this ticket — it must be notified: " + notified);
+        assertTrue(notified.get(0).startsWith("term_a: "), "the sink is told which target exhausted");
+        assertTrue(notified.get(0).contains("The usage limit has been reached"),
+                "the sink is told the matched reason: " + notified.get(0));
+    }
+
+    @Test
+    void aBackendErrorLineWithNoMarkerAndLeadingChromeIsClassifiedFromTheRawScrape() {
+        String block = """
+                ╭──────────────────────────────────────╮
+                API Error: 400 invalid request body
+                """;
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "a raw-scrape backend-error match still resolves the blocked send");
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "classified BACKEND_ERROR from the raw scrape even though the trimmed block was empty");
+        assertTrue(waiter.getNow(null).text().contains("API Error: 400 invalid request body"),
+                "the failure carries the matched line: " + waiter.getNow(null).text());
+        assertTrue(waiter.getNow(null).text().contains("--- pane tail ---"),
+                "fleetd#164: the failure must carry the pane, not only the matched line — with an "
+                        + "empty trimmed block the raw scrape is the only copy of what the member said: "
+                        + waiter.getNow(null).text());
+        assertTrue(waiter.getNow(null).text().contains("╭"),
+                "the carried pane is the raw scrape, chrome included: " + waiter.getNow(null).text());
+    }
+
+    @Test
+    void anOrdinaryPaneWithANormalAssistantBlockIsUnaffectedByTheRawScrapeFallback() {
+        // Pin: on a pane that already yields a usable block, the fallback branch is never reached —
+        // same outcome, same text, sink not called — even though the raw screen around the marker
+        // would itself match the configured exhausted pattern.
+        String block = "The usage limit has been reached, but this is a leading TUI line above the "
+                + "marker.\n⏺ complete report\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone());
+        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
+                "unchanged: a usable assistant block never reaches the raw-scrape fallback");
+        assertEquals("complete report", waiter.getNow(null).text(), "the reply text is unaffected");
+        assertTrue(notified.isEmpty(), "the fallback never runs, so the sink is never called");
+    }
+
+    @Test
+    void aGenuinelyEmptyScrapeStillFailsAsEmptyAndNeverNotifiesTheSink() {
+        // The false-positive pin: no exhaustion or backend-error text anywhere on the pane (just
+        // chrome, no marker) — the raw-scrape fallback must not manufacture a classification, and
+        // the sink must stay untouched.
+        String block = """
+                ╭──────────────────────────────────────╮
+                │ >                                    │
+                ╰──────────────────────────────────────╯
+                """;
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "an empty scrape must still resolve the send, not hang");
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "no exhaustion or backend-error text anywhere ⇒ this stays the ordinary empty-scrape failure");
+        assertTrue(waiter.getNow(null).text().toLowerCase().contains("empty"),
+                "the failure still says the scrape was empty: " + waiter.getNow(null).text());
+        assertTrue(notified.isEmpty(), "a genuinely empty pane must never quarantine a credential");
+    }
+
     @Test
     void coverageIsOffWhenNoProfileHasAPatternConfigured() {
         assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",

fleetd/src/test/java/dev/ltms/fleet/member/ClaudeCodeLauncherTest.java

@@ -61,8 +61,75 @@ class ClaudeCodeLauncherTest {
         assertTrue(args.stream().noneMatch(a -> a.contains("\"bridge\"")),
                 "the mount is named fleet since CB-632 — a member addresses its tools as "
                         + "mcp__fleet__*, and CLAUDE.md's role-detection ladder names that prefix");
-        assertTrue(args.contains("--append-system-prompt"));
-        assertTrue(args.stream().anyMatch(a -> a.contains("fleet_reply")), "reply charter present");
+        // fleetd #220: the charter travels as a FILE, never inline — charter prose on the command
+        // line overruns the byte cap of the pane line herdr types it into.
+        assertTrue(args.contains("--append-system-prompt-file"));
+        assertFalse(args.contains("--append-system-prompt"),
+                "the inline flag would put ~800 bytes of prose on the pane command line");
+        String charterFile = args.get(args.indexOf("--append-system-prompt-file") + 1);
+        assertTrue(readFile(charterFile).contains("fleet_reply"), "reply charter present in the file");
+    }
+
+    /** Read a charter file the launcher wrote, failing the test rather than the build on an IO error. */
+    private static String readFile(String path) {
+        try {
+            return java.nio.file.Files.readString(java.nio.file.Path.of(path));
+        } catch (java.io.IOException e) {
+            throw new AssertionError("charter file " + path + " is not readable", e);
+        }
+    }
+
+    /**
+     * fleetd #220 regression. herdr TYPES the launch command into the pane, and the pty line buffer
+     * holds 1024 bytes — past that the tail is dropped with no error anywhere, so the backend exits
+     * on a mangled argument and the spawn dies as an unexplained readiness timeout. That is what
+     * happened when #214 added --session-id to a command already 978 bytes long: --autocompact
+     * 250000 arrived as --autocompact 25. This asserts the whole assembled command still fits, with
+     * the flags a real spawn carries (MCP mount, charter, model, autocompact, session id).
+     */
+    @Test
+    void theAssembledLaunchCommandFitsThePaneLineLimit() {
+        FakeHerdr herdr = new FakeHerdr();
+        // Shaped like the live sonnet profile, because the bug is a SUM: the charter alone fits,
+        // and so does every flag alone. Only model + autocompact + session id on top of the charter
+        // crossed the cap, which is why nothing caught it until a member failed to spawn.
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "sonnet", null, "claude-sonnet-5", null, null,
+                List.of("claude"), "tab", "fleetd-workers", "w #{n}", "http://127.0.0.1:8765/mcp",
+                null, null, null, null, null, null, null, null, true, null, null, null, null, null,
+                250000);
+        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of()), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null)
+                .spawn();
+
+        List<String> args = spawnedArgs(herdr);
+        int bytes = "claude".length();
+        for (String arg : args) {
+            bytes += arg.getBytes(java.nio.charset.StandardCharsets.UTF_8).length + 3;
+        }
+        assertTrue(bytes <= HerdrPeerLauncher.PANE_COMMAND_BYTE_LIMIT,
+                "the launch command must fit the pane line: " + bytes + " bytes vs limit "
+                        + HerdrPeerLauncher.PANE_COMMAND_BYTE_LIMIT + " — args " + args);
+    }
+
+    /**
+     * fleetd #220: the guard refuses a command that cannot fit, instead of letting the pty drop the
+     * tail. The refusal must name the size and the argument to blame — a spawn that fails with
+     * "did not reach injectable state" tells the operator nothing, which is the whole reason this
+     * bug took a live pane scrape to find.
+     */
+    @Test
+    void anOverlongLaunchCommandIsRefusedWithTheSizeAndTheCulprit() {
+        FakeHerdr herdr = new FakeHerdr();
+        String huge = "x".repeat(1500);
+        ClaudeCodeLauncher launcher = service(herdr, List.of("claude", huge), null);
+
+        PeerUnreachableException refused = assertThrows(PeerUnreachableException.class, launcher::spawn);
+
+        assertTrue(refused.getMessage().contains("1024"), "names the limit: " + refused.getMessage());
+        assertTrue(refused.getMessage().contains("1500"), "names the culprit's size: " + refused.getMessage());
+        assertFalse(herdr.called("agent.start"),
+                "nothing may be started — a truncated command is worse than no spawn");
     }
 
     // CB-634: a profile with ideMcpUrl set mounts the IDE Index MCP as a second server and pins
@@ -262,10 +329,16 @@ class ClaudeCodeLauncherTest {
 
         Map<?, ?> start = (Map<?, ?>) herdr.lastCall("agent.start").params();
         assertEquals("claude", start.get("kind"), "herdr launches the canonical executable by kind");
-        // CB-533: the shared fixture pins model "coder", so the model flag is the whole args list.
         // What this test guards is that argv[0] is NOT repeated — herdr supplies it from `kind`.
-        assertEquals(List.of("--model", "coder"), start.get("args"),
-                "the configured executable is not repeated in args");
+        // fleetd #214: a plain spawn now also carries fleetd's own minted session id.
+        List<String> args = spawnedArgs(herdr);
+        assertFalse(args.contains("claude"), "the configured executable is not repeated in args");
+        int flag = args.indexOf("--session-id");
+        assertTrue(flag >= 0, "a plain spawn mints a session id: " + args);
+        assertDoesNotThrow(() -> UUID.fromString(args.get(flag + 1)), "the minted id is a valid UUID");
+        assertEquals(List.of("--model", "coder"),
+                List.of(args.get(args.size() - 2), args.get(args.size() - 1)),
+                "the CB-533 model flag still trails the launch flags: " + args);
     }
 
     @Test
@@ -278,7 +351,15 @@ class ClaudeCodeLauncherTest {
         assertFalse(args.contains("--append-system-prompt"), "no reply charter without mcpUrl");
         // CB-533: the model flag is independent of the MCP mount — pinning the model is not part of
         // "mount the bridge", so an unmounted worker still runs the model its profile names.
-        assertEquals(List.of("--verbose", "--model", "coder"), args,
+        // fleetd #214: a plain spawn now carries fleetd's own minted session id; drop the two
+        // mint elements when checking the rest of the argv.
+        int flag = args.indexOf("--session-id");
+        assertTrue(flag >= 0, "a plain spawn mints a session id even without a bridge mount: " + args);
+        assertDoesNotThrow(() -> UUID.fromString(args.get(flag + 1)), "the minted id is a valid UUID");
+        List<String> rest = new java.util.ArrayList<>(args);
+        rest.remove(flag + 1);
+        rest.remove(flag);
+        assertEquals(List.of("--verbose", "--model", "coder"), rest,
                 "the operator's own args are preserved, in order, ahead of the model flag");
     }
 
@@ -649,7 +730,7 @@ class ClaudeCodeLauncherTest {
         assertEquals("/work/proj", cwd, "effectiveCwd via SpawnRequest must match the three-arg resolution");
     }
 
-    // --- CB-547a: durable session identity (mint / resume / no-identity legacy) -----------------
+    // --- CB-547a / fleetd #214: durable session identity (always mint / resume) -----------------
 
     @Test
     void freshSpawnMintsASessionIdAndPassesTheName() {
@@ -684,18 +765,28 @@ class ClaudeCodeLauncherTest {
     }
 
     @Test
-    void noIdentitySpawnKeepsTheLegacyArgvAndCarriesNoSessionHandle() {
+    void plainSpawnMintsASessionIdSoEveryMemberIsResumable() {
+        // fleetd #214: a plain spawn passes no sessionName and no resumeSessionId, yet the member
+        // must still be resumable — the id is minted unconditionally, and it is the ONLY resume
+        // handle a claude-code member has (unlike opencode, nothing resolves it after the launch).
+        // The binary requires a valid UUID (checked against claude 2.1.252: a non-UUID is refused
+        // at argument parsing with "Invalid session ID. Must be a valid UUID.").
         FakeHerdr herdr = new FakeHerdr();
         ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
 
         PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, null));
 
         List<String> args = spawnedArgs(herdr);
-        assertFalse(args.contains("--session-id"), "no identity → no --session-id");
-        assertFalse(args.contains("-n"), "no identity → no -n");
-        assertFalse(args.contains("-r"), "no identity → no -r");
-        assertNull(handle.agentSessionId(), "no identity → no resume handle");
-        assertNull(handle.sessionName(), "no identity → no logical name");
+        int flag = args.indexOf("--session-id");
+        assertTrue(flag >= 0 && flag + 1 < args.size(),
+                "--session-id is minted even when no identity is requested: " + args);
+        String minted = args.get(flag + 1);
+        assertDoesNotThrow(() -> UUID.fromString(minted), "--session-id is a valid UUID: " + minted);
+        assertEquals(minted, handle.agentSessionId(),
+                "the resume handle is the minted id, so every member is resumable from fleet_list");
+        assertFalse(args.contains("-n"), "no sessionName was requested → no -n");
+        assertFalse(args.contains("-r"), "no resume was requested → no -r");
+        assertNull(handle.sessionName(), "no sessionName was requested → no logical name");
     }
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/member/HerdrPeerLauncherAllowListWiringTest.java

@@ -12,20 +12,26 @@ import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.SpawnRequest;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.LoggerFactory;
 
+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.attribute.PosixFileAttributeView;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.Function;
 import java.util.function.Supplier;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;
 
 /**
  * CB-633: proves the allow-list scrub is actually WIRED INTO the spawn path — not merely that its
@@ -119,6 +125,18 @@ class HerdrPeerLauncherAllowListWiringTest {
                 FleetConfig.MemberCredentials.POLICY_ALLOW_LIST, allow, List.of(), null);
     }
 
+    /**
+     * Same as {@link #allowList()} but with an operator-configured {@code known:} list, so the
+     * fallback overlay (the non-zsh / no-memberLoginShell path) has something visible to shadow —
+     * {@link FleetConfig.MemberCredentials#blockedSet()} is {@code known - allow}, so an empty
+     * {@code known} (what {@link #allowList()} uses) blocks nothing and a fallback test would have
+     * no sentinel entry to assert on.
+     */
+    private static Supplier<FleetConfig.MemberCredentials> allowListWithKnown(List<String> known) {
+        return () -> new FleetConfig.MemberCredentials(
+                FleetConfig.MemberCredentials.POLICY_ALLOW_LIST, List.of(), known, null);
+    }
+
     /**
      * CB-633 follow-up: a name that lives ONLY in {@code memberCredentials.allow:} — no profile
      * mentions it — must survive the scrub the real spawn path generates. Calling {@code
@@ -257,6 +275,268 @@ class HerdrPeerLauncherAllowListWiringTest {
                         + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
     }
 
+    /**
+     * fleetd #185 stage 2 pin: with {@code memberHerdrSocket:} absent (today's only mode, and the
+     * default — this host runs no other), the gap detector's WARN/INFO conclusions read exactly as
+     * they did before this fix. Real path: {@code FLEETD_WORKER_TOKEN} (the test profile's own
+     * {@code tokenEnv}) is a name the derived allow-list keeps, so it gets the "UNBLOCKED" WARN;
+     * {@code SOME_UNKNOWN_SECRET_TOKEN} is not derived from anywhere, so it gets the "scrub blanks
+     * them" INFO. This is the exact shape #185 stage 2 must not touch on this path.
+     */
+    @Test
+    void gapConclusionsAreByteIdenticalWhenMemberHerdrSocketIsAbsent() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> config(null));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.contains("memberCredentials gap: 1 credential-shaped env var name(s) are on "
+                        + "neither known: nor allow: — the derived allow-list keeps them anyway (a "
+                        + "profile's gitTokenEnv/gitHostEnv/tokenEnv/env: names one, or this spawn "
+                        + "injects it), so every member pane inherits them UNBLOCKED — [FLEETD_WORKER_TOKEN]. "
+                        + "Add each to memberCredentials.known (or .allow if a member legitimately needs "
+                        + "it), or remove it from whatever profile setting derives it in."),
+                "expected the pre-existing UNBLOCKED WARN unchanged, got: " + messages);
+        assertTrue(messages.contains("memberCredentials gap: 1 credential-shaped env var name(s) are on "
+                        + "neither known: nor allow: — [SOME_UNKNOWN_SECRET_TOKEN]. The allow-list scrub "
+                        + "blanks them anyway (they are not on the derived allow-list), so no member pane "
+                        + "keeps them; add each to memberCredentials.known or .allow to make that explicit."),
+                "expected the pre-existing 'scrub blanks them' INFO unchanged, got: " + messages);
+    }
+
+    /**
+     * fleetd #185 stage 2: with {@code memberHerdrSocket:} configured, member panes run under a
+     * different OS user — {@link HerdrPeerLauncher#hostEnvNames} describes fleetd's own process, not
+     * that user's. Neither "inherits them UNBLOCKED" nor "scrub blanks them" is evidence-backed
+     * there, so neither may print; the single unknown-environment WARN must, naming the config key.
+     */
+    @Test
+    void gapDetectorReportsUnknownInsteadOfAConclusionWhenMemberHerdrSocketIsConfigured() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock"));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.stream().anyMatch(m -> m.contains("memberHerdrSocket")
+                        && m.contains("UNKNOWN") && m.contains("cannot be verified")),
+                "expected the unknown-member-environment WARN naming memberHerdrSocket, got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains("UNBLOCKED")),
+                "the 'inherits them UNBLOCKED' conclusion must not print once the evidence is about "
+                        + "the wrong (daemon's own) environment — got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains("scrub blanks them")),
+                "the 'scrub blanks them' conclusion must not print once the evidence is about the "
+                        + "wrong (daemon's own) environment — got: " + messages);
+    }
+
+    /**
+     * fleetd #185 stage 2: the unknown-environment WARN is a standing fact about this launcher's
+     * configuration, not per-spawn news — it must fire once per launcher instance, the same shape as
+     * every other one-time WARN in this class (e.g. {@code warnNonZsh}).
+     */
+    @Test
+    void theUnknownEnvironmentWarnFiresOnceNotOncePerSpawn() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock"));
+
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.WARN);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+
+        long count = appender.list.stream()
+                .filter(e -> e.getFormattedMessage().contains("cannot be verified from here"))
+                .count();
+        assertEquals(1, count, "the unknown-member-environment WARN must fire once per launcher "
+                + "instance, not once per spawn — got " + count + " occurrence(s) among: "
+                + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
+    }
+
+    /**
+     * Hard constraint: the gap detector must never log an env var VALUE, only its NAME. {@code
+     * SOME_UNKNOWN_SECRET_TOKEN} resolves to a distinctive canary value through the same {@code env}
+     * lookup the launcher uses elsewhere (SHELL, PATH, token resolution) — proving the value IS
+     * resolvable does not mean the detector reads it, since {@link HerdrPeerLauncher#hostEnvNames}
+     * (names only) is its data source, never {@code env.apply(name)} for those names.
+     */
+    @Test
+    void theGapDetectorNeverLogsAnEnvVarValueOnlyItsName() {
+        FakeHerdr herdr = new FakeHerdr();
+        String canary = "sekrit-value-CANARY-9f3a1b7c";
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> config(null), Map.of("SOME_UNKNOWN_SECRET_TOKEN", canary));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.stream().anyMatch(m -> m.contains("SOME_UNKNOWN_SECRET_TOKEN")),
+                "expected the credential-shaped NAME to appear in the log, got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains(canary)),
+                "the log must never contain an env var VALUE, only its NAME — got: " + messages);
+    }
+
+    /**
+     * fleetd #213 defect 1, acceptance criterion 1: {@code memberHerdrSocket} configured and {@code
+     * memberLoginShell} configured as non-zsh must fall back to the sentinel overlay exactly like a
+     * non-zsh {@code $SHELL} does today — and the "generated ZDOTDIR" INFO must not appear, since no
+     * scrub actually runs. The WiringLauncher's own {@code env("SHELL")} is deliberately set to
+     * {@code /bin/zsh} — the OPPOSITE of what {@code memberLoginShell} says — so a launcher that
+     * (incorrectly) fell back to fleetd's own {@code $SHELL} here would wrongly pass the gate and
+     * fail this test.
+     */
+    @Test
+    void memberHerdrSocketWithNonZshMemberLoginShellFallsBackToTheOverlay() {
+        FakeHerdr herdr = new FakeHerdr();
+        WiringLauncher launcher = new WiringLauncher(herdr, allowListWithKnown(List.of("SOME_TOKEN")),
+                "/bin/zsh", null,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock", "/bin/bash"));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertEquals("blocked-by-fleetd-cb596-see-gitea-issue-82", launcher.env.get("SOME_TOKEN"),
+                "a non-zsh memberLoginShell must fall back to the CB-596 sentinel overlay, exactly "
+                        + "like a non-zsh $SHELL does when memberHerdrSocket is absent");
+        assertFalse(launcher.env.containsKey("ZDOTDIR"),
+                "no scrub directory may be generated when the configured member login shell is not zsh");
+        assertFalse(messages.stream().anyMatch(m -> m.contains("generated ZDOTDIR")),
+                "the 'generated ZDOTDIR' INFO must not appear when the scrub never runs — got: " + messages);
+    }
+
+    /**
+     * fleetd #213 defect 1, acceptance criterion 2: {@code memberHerdrSocket} configured and NO
+     * {@code memberLoginShell} configured must fall back exactly like criterion 1 above — AND
+     * fleetd's own {@code $SHELL} must never even be consulted (not merely "not decisive"). The
+     * fixture's {@code env} function reports {@code /bin/zsh} for {@code SHELL} — a value that would
+     * WRONGLY pass the zsh gate if the fix regressed to reading it — while flagging whether it was
+     * ever asked for at all, so this test fails loudly on either kind of regression.
+     */
+    @Test
+    void memberHerdrSocketWithNoMemberLoginShellFallsBackAndNeverConsultsFleetdsOwnShell() {
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicBoolean shellQueried = new AtomicBoolean(false);
+        Function<String, String> env = name -> {
+            if ("SHELL".equals(name)) {
+                shellQueried.set(true);
+                return "/bin/zsh"; // would wrongly pass the zsh gate if this ever leaked through
+            }
+            return null;
+        };
+        WiringLauncher launcher = new WiringLauncher(herdr, allowListWithKnown(List.of("SOME_TOKEN")), env,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock", null));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertFalse(shellQueried.get(), "fleetd's own $SHELL must never be consulted once "
+                + "memberHerdrSocket is configured — only memberLoginShell: may decide the gate");
+        assertEquals("blocked-by-fleetd-cb596-see-gitea-issue-82", launcher.env.get("SOME_TOKEN"),
+                "no memberLoginShell configured must fall back to the sentinel overlay, same as a "
+                        + "configured non-zsh shell");
+        assertFalse(messages.stream().anyMatch(m -> m.contains("generated ZDOTDIR")),
+                "no scrub may run without a configured memberLoginShell — got: " + messages);
+    }
+
+    /**
+     * fleetd #213 defect 2, acceptance criterion 3: with {@code memberHerdrSocket} configured, a
+     * zsh {@code memberLoginShell}, and {@code worktreeRoot}/{@code worktreeGroup} both configured,
+     * the generated scrub directory must live under {@code worktreeRoot} — NEVER under {@code
+     * java.io.tmpdir}, which is fleetd's own 0700 temp dir and unreadable by the member's different
+     * OS user. {@code worktreeGroup} is set to the CURRENT process's own primary group so {@code
+     * EnvAllowListScrub}'s group-sharing step resolves on whatever host runs this test, rather than
+     * hardcoding a group name that may not exist here.
+     */
+    @Test
+    void memberHerdrSocketWithZshMemberLoginShellPutsTheScrubOutsideJavaIoTmpdir(@TempDir Path worktreeRoot)
+            throws IOException {
+        String group = currentUserGroup();
+        FakeHerdr herdr = new FakeHerdr();
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/bash-should-be-ignored", null,
+                () -> configWithMemberHerdrSocketRootAndGroup("/tmp/other-user-herdr.sock", "/bin/zsh",
+                        worktreeRoot.toString(), group));
+
+        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+
+        String zdotdir = launcher.env.get("ZDOTDIR");
+        assertNotNull(zdotdir, "a zsh memberLoginShell with worktreeRoot+worktreeGroup configured "
+                + "must still generate a ZDOTDIR");
+        Path dir = Path.of(zdotdir);
+        // The immediate PARENT is asserted (not merely startsWith(java.io.tmpdir)), because a
+        // JUnit @TempDir is itself carved out of the JVM's java.io.tmpdir — startsWith alone would
+        // pass by coincidence of the test fixture, not because the launcher used worktreeRoot.
+        assertEquals(worktreeRoot.toAbsolutePath().normalize(), dir.getParent(),
+                "the generated scrub directory's parent must be the configured worktreeRoot, not "
+                        + "System.getProperty(\"java.io.tmpdir\") — got parent " + dir.getParent());
+    }
+
+    /**
+     * fleetd #213, acceptance criterion 4: with {@code memberHerdrSocket} absent (today's only
+     * mode), behaviour must be byte-identical to before this fix — fleetd's own {@code $SHELL}
+     * still decides the gate (proven here, not merely assumed, by flagging the lookup), and the
+     * scrub still lands under {@code java.io.tmpdir}.
+     */
+    @Test
+    void memberHerdrSocketAbsentStillConsultsFleetdsOwnShellAndBehavesAsBefore() {
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicBoolean shellQueried = new AtomicBoolean(false);
+        Function<String, String> env = name -> {
+            if ("SHELL".equals(name)) {
+                shellQueried.set(true);
+                return "/bin/zsh";
+            }
+            return null;
+        };
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), env, null); // memberHerdrSocket absent
+
+        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+
+        assertTrue(shellQueried.get(), "with memberHerdrSocket absent, fleetd's own $SHELL must "
+                + "still decide the zsh gate, unchanged from before this fix");
+        String zdotdir = launcher.env.get("ZDOTDIR");
+        assertNotNull(zdotdir, "SHELL=/bin/zsh with memberHerdrSocket absent must still generate a "
+                + "ZDOTDIR, as before this fix");
+        Path dir = Path.of(zdotdir);
+        assertTrue(dir.startsWith(Path.of(System.getProperty("java.io.tmpdir"))),
+                "with memberHerdrSocket absent the scrub directory must still be generated under "
+                        + "java.io.tmpdir, unchanged from before this fix: " + dir);
+    }
+
+    /** The current process's own primary group — resolvable on whatever host runs this test. */
+    private static String currentUserGroup() throws IOException {
+        PosixFileAttributeView view = Files.getFileAttributeView(Path.of("."), PosixFileAttributeView.class);
+        assumeTrue(view != null, "this host's filesystem does not support POSIX group ownership");
+        return view.readAttributes().group().getName();
+    }
+
+    /** Spawn once through the real launcher path, capturing every INFO+ line this class logs. */
+    private static List<String> spawnAndCaptureLogs(HerdrPeerLauncher launcher) {
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+        return appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList();
+    }
+
     private static String readAll(Path p) {
         try {
             return Files.readString(p);
@@ -294,12 +574,40 @@ class HerdrPeerLauncherAllowListWiringTest {
 
         WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell,
                        Supplier<Set<String>> hostEnvNames, Supplier<FleetConfig> config) {
+            this(herdr, creds, shell, hostEnvNames, config, Map.of());
+        }
+
+        /**
+         * Plus a host-env value map (name → value), resolved through the same {@code env} lookup
+         * every adapter uses for {@code SHELL}/{@code PATH}/token resolution — fleetd #185 stage 2's
+         * "the gap detector never logs a value" tests use this to prove a value that IS resolvable
+         * for a credential-shaped name never reaches the log, since the detector only ever reads
+         * {@code hostEnvNames} (names), never {@code env.apply(name)} (values), for those names.
+         */
+        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell,
+                       Supplier<Set<String>> hostEnvNames, Supplier<FleetConfig> config,
+                       Map<String, String> extraEnvValues) {
             super("test", new AgentControl(herdr), new WorkspaceControl(herdr),
                     Map.of("test", profile()), "test",
-                    name -> "SHELL".equals(name) ? shell : null,
+                    name -> "SHELL".equals(name) ? shell
+                            : (extraEnvValues != null && extraEnvValues.containsKey(name))
+                                    ? extraEnvValues.get(name) : null,
                     0, () -> 0L, () -> { }, null, creds, hostEnvNames, config);
         }
 
+        /**
+         * Full control over the {@code env} lookup, bypassing the {@code shell}/{@code
+         * extraEnvValues} convenience above entirely — fleetd #213's "fleetd's own $SHELL must
+         * never be consulted" tests need to OBSERVE whether {@code SHELL} was ever looked up, which
+         * a plain value substitution cannot do.
+         */
+        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds,
+                       Function<String, String> env, Supplier<FleetConfig> config) {
+            super("test", new AgentControl(herdr), new WorkspaceControl(herdr),
+                    Map.of("test", profile()), "test",
+                    env, 0, () -> 0L, () -> { }, null, creds, null, config);
+        }
+
         @Override
         protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
             Map<String, String> launchEnv = baseEnv(cfg);
@@ -321,6 +629,82 @@ class HerdrPeerLauncherAllowListWiringTest {
                 null, null, null, null, null).withDefaults();
     }
 
+    /**
+     * fleetd #185 stage 2: a config with {@code memberHerdrSocket:} set — member panes run on a
+     * second herdr owned by a different OS user, so {@link HerdrPeerLauncher#hostEnvNames} no
+     * longer describes what a member pane inherits.
+     */
+    private static FleetConfig configWithMemberHerdrSocket(String memberHerdrSocket) {
+        return new FleetConfig(null, null, memberHerdrSocket, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null).withDefaults();
+    }
+
+    /**
+     * fleetd #213: as {@link #configWithMemberHerdrSocket(String)}, plus the {@code
+     * memberLoginShell:} the member's OS user actually runs — the config key {@link
+     * HerdrPeerLauncher#applyEnvironmentAllowListPolicy} must consult instead of fleetd's own
+     * {@code $SHELL} once {@code memberHerdrSocket} is configured.
+     */
+    private static FleetConfig configWithMemberHerdrSocket(String memberHerdrSocket, String memberLoginShell) {
+        return new FleetConfig(
+                null,               // bind
+                null,               // herdrSocket
+                memberHerdrSocket,  // memberHerdrSocket
+                Map.of(),           // profiles
+                null,               // guard
+                null,               // worktreeRoot
+                null,               // lifecycle
+                null,               // spawnReadyTimeoutMs
+                null,               // spawnReadyPollMs
+                null,               // broker
+                null,               // primary
+                null,               // fleet
+                null,               // leadHeartbeat
+                null,               // health
+                null,               // placement
+                null,               // auth
+                null,               // configReload
+                null,               // quarantineCooldownSeconds
+                null,               // memberCredentials
+                null,               // coordinator
+                null,               // worktreeGroup
+                memberLoginShell    // memberLoginShell
+        ).withDefaults();
+    }
+
+    /**
+     * fleetd #213: as above, plus {@code worktreeRoot:}/{@code worktreeGroup:} — both required for
+     * the ZDOTDIR scrub to run at all once {@code memberHerdrSocket} is configured; either missing
+     * falls back to the sentinel overlay, same as a non-zsh {@code memberLoginShell}.
+     */
+    private static FleetConfig configWithMemberHerdrSocketRootAndGroup(String memberHerdrSocket,
+            String memberLoginShell, String worktreeRoot, String worktreeGroup) {
+        return new FleetConfig(
+                null,               // bind
+                null,               // herdrSocket
+                memberHerdrSocket,  // memberHerdrSocket
+                Map.of(),           // profiles
+                null,               // guard
+                worktreeRoot,       // worktreeRoot
+                null,               // lifecycle
+                null,               // spawnReadyTimeoutMs
+                null,               // spawnReadyPollMs
+                null,               // broker
+                null,               // primary
+                null,               // fleet
+                null,               // leadHeartbeat
+                null,               // health
+                null,               // placement
+                null,               // auth
+                null,               // configReload
+                null,               // quarantineCooldownSeconds
+                null,               // memberCredentials
+                null,               // coordinator
+                worktreeGroup,      // worktreeGroup
+                memberLoginShell    // memberLoginShell
+        ).withDefaults();
+    }
+
     /** The generated directory is a temp directory; make sure the test does not leave a pile. */
     @Test
     void theGeneratedDirectoryIsRemovedWhenThePaneIsStopped() {

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeLauncherTest.java

@@ -1,5 +1,9 @@
 package dev.ltms.fleet.member;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import dev.ltms.fleet.config.FleetConfig;
@@ -14,9 +18,13 @@ import dev.ltms.fleet.peer.PeerUnreachableException;
 import dev.ltms.fleet.peer.SpawnRequest;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;
 
+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.attribute.PosixFileAttributeView;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ExecutorService;
@@ -25,6 +33,7 @@ import java.util.concurrent.Future;
 import java.util.function.Supplier;
 
 import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;
 
 /**
  * The opencode adapter's launch build: a file-based MCP mount + reply-charter instructions (no
@@ -610,4 +619,196 @@ class OpenCodeLauncherTest {
         assertTrue(json.path("mcp").path("intellij").isMissingNode(),
                 "no IDE server when ideMcpUrl is unset");
     }
+
+    // --- fleetd #219: config root + discovery root under memberHerdrSocket ------------------------
+
+    /** A config with {@code memberHerdrSocket:} set, and optionally {@code worktreeRoot:}/{@code worktreeGroup:}. */
+    private static FleetConfig configWithMemberHerdrSocket(String worktreeRoot, String worktreeGroup) {
+        return new FleetConfig(
+                null,                    // bind
+                null,                    // herdrSocket
+                "/tmp/other-user.sock",  // memberHerdrSocket
+                Map.of(),                // profiles
+                null,                    // guard
+                worktreeRoot,            // worktreeRoot
+                null,                    // lifecycle
+                null,                    // spawnReadyTimeoutMs
+                null,                    // spawnReadyPollMs
+                null,                    // broker
+                null,                    // primary
+                null,                    // fleet
+                null,                    // leadHeartbeat
+                null,                    // health
+                null,                    // placement
+                null,                    // auth
+                null,                    // configReload
+                null,                    // quarantineCooldownSeconds
+                null,                    // memberCredentials
+                null,                    // coordinator
+                worktreeGroup,           // worktreeGroup
+                null                     // memberLoginShell
+        ).withDefaults();
+    }
+
+    private static OpenCodeLauncher serviceWithConfig(FakeHerdr herdr, Path configRoot, Path discoveryRoot,
+                                                        FleetConfig.Profile cfg, Supplier<FleetConfig> config) {
+        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
+                0, System::currentTimeMillis, () -> { }, configRoot, discoveryRoot, null, null, config);
+    }
+
+    /** The current process's own primary group — resolvable on whatever host runs this test. */
+    private static String currentUserGroup() throws IOException {
+        PosixFileAttributeView view = Files.getFileAttributeView(Path.of("."), PosixFileAttributeView.class);
+        assumeTrue(view != null, "this host's filesystem does not support POSIX group ownership");
+        return view.readAttributes().group().getName();
+    }
+
+    /**
+     * fleetd #219 site 1, acceptance criterion 1: with {@code memberHerdrSocket} configured and both
+     * {@code worktreeRoot}/{@code worktreeGroup} set, the generated {@code opencode.json} directory
+     * lives under {@code worktreeRoot} — NEVER under the injected {@code configRoot} (standing in for
+     * {@code java.io.tmpdir}, fleetd's own 0700 temp dir, unreadable by the member's different OS
+     * user) — and is shared read-only with the group via the SAME mechanism (fleetd #213's {@link
+     * EnvAllowListScrub#shareWithGroup}) the ZDOTDIR scrub uses.
+     */
+    @Test
+    void memberHerdrSocketWithWorktreeRootAndGroupPutsConfigDirUnderWorktreeRootAndSharesIt(
+            @TempDir Path configRoot, @TempDir Path worktreeRoot) throws Exception {
+        String group = currentUserGroup();
+        FakeHerdr herdr = new FakeHerdr();
+        serviceWithConfig(herdr, configRoot, configRoot,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null),
+                () -> configWithMemberHerdrSocket(worktreeRoot.toString(), group)).spawn();
+
+        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
+        assertNotNull(cfgPath, "the profile still needs a config file");
+        Path cfgFile = Path.of(cfgPath);
+        Path dir = cfgFile.getParent();
+        assertEquals(worktreeRoot.toAbsolutePath().normalize(), dir.getParent(),
+                "the generated directory's parent must be worktreeRoot, not the injected configRoot "
+                        + "standing in for java.io.tmpdir — got parent " + dir.getParent());
+        assertFalse(dir.startsWith(configRoot),
+                "the generated directory must NOT be created under configRoot when memberHerdrSocket "
+                        + "is configured: " + dir);
+
+        assertEquals("rwxr-x---", PosixFilePermissions.toString(Files.getPosixFilePermissions(dir)),
+                "the directory must be group-traversable+readable, owner-only writable");
+        assertEquals("rw-r-----", PosixFilePermissions.toString(Files.getPosixFilePermissions(cfgFile)),
+                "opencode.json must be group-readable, never group-writable");
+    }
+
+    /**
+     * fleetd #219 site 1, acceptance criterion 2: with {@code memberHerdrSocket} configured but
+     * NEITHER {@code worktreeRoot} nor {@code worktreeGroup} set, the launcher must refuse the spawn
+     * rather than write a config under {@code java.io.tmpdir} the member cannot read — that member
+     * would occupy a pane and never become deliverable, with nothing pointing at the real cause.
+     */
+    @Test
+    void memberHerdrSocketWithoutWorktreeRootOrGroupRefusesTheSpawn(@TempDir Path configRoot) {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = serviceWithConfig(herdr, configRoot, configRoot,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null),
+                () -> configWithMemberHerdrSocket(null, null));
+
+        IllegalStateException ex = assertThrows(IllegalStateException.class,
+                () -> launcher.spawn(new SpawnRequest(null, null, null)),
+                "a missing worktreeRoot/worktreeGroup must refuse the spawn, not write an unreadable config");
+        assertTrue(ex.getMessage().contains("worktreeRoot"),
+                "the refusal must name the missing config key — got: " + ex.getMessage());
+        assertFalse(herdr.called("tab.create"),
+                "the spawn must be refused BEFORE any pane is created — got calls: " + herdr.calls);
+    }
+
+    /**
+     * fleetd #219 site 1, acceptance criterion 2 (the other missing half): {@code worktreeRoot} set
+     * but {@code worktreeGroup} missing must ALSO refuse — either one alone is not enough to
+     * guarantee the member's OS user can read the directory.
+     */
+    @Test
+    void memberHerdrSocketWithWorktreeRootButNoGroupRefusesTheSpawn(
+            @TempDir Path configRoot, @TempDir Path worktreeRoot) {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = serviceWithConfig(herdr, configRoot, configRoot,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null),
+                () -> configWithMemberHerdrSocket(worktreeRoot.toString(), null));
+
+        IllegalStateException ex = assertThrows(IllegalStateException.class,
+                () -> launcher.spawn(new SpawnRequest(null, null, null)));
+        assertTrue(ex.getMessage().contains("worktreeGroup"),
+                "worktreeRoot alone is not enough — got: " + ex.getMessage());
+    }
+
+    /**
+     * fleetd #219 site 1, acceptance criterion 3: with {@code memberHerdrSocket} ABSENT — even when
+     * a live, non-null {@code config} supplier is threaded through (not merely {@code config == null},
+     * which every other test in this file already exercises) — the generated directory must still
+     * land directly under the injected {@code configRoot}, byte-identical to before this fix.
+     */
+    @Test
+    void memberHerdrSocketAbsentStaysUnderConfigRootEvenWithALiveConfigSupplier(@TempDir Path configRoot)
+            throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig config = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null, null, null).withDefaults();
+        serviceWithConfig(herdr, configRoot, configRoot,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null), () -> config)
+                .spawn();
+
+        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
+        assertNotNull(cfgPath);
+        assertTrue(Path.of(cfgPath).startsWith(configRoot),
+                "with memberHerdrSocket absent, the config directory must still be created directly "
+                        + "under configRoot, unchanged from before this fix");
+    }
+
+    /**
+     * fleetd #219 site 2: under {@code memberHerdrSocket}, opencode session discovery must be
+     * declared unavailable rather than silently scanning fleetd's own {@code discoveryRoot} — which,
+     * under this config key, is NOT where the member's opencode actually writes its session
+     * database. This test proves the gate is real, not merely "no record yet": a matching record IS
+     * written to {@code discoveryRoot} (the exact fixture {@link
+     * #theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears} proves discovery would
+     * otherwise find), and {@code agentSessionId()} must still return {@code null} — proving the
+     * gate, not a coincidental absence of data, is what produced the null. One WARN is also logged,
+     * exactly once even across repeated calls.
+     */
+    @Test
+    void discoveryIsUnavailableUnderMemberHerdrSocketEvenWhenARecordExists(
+            @TempDir Path configRoot, @TempDir Path worktreeRoot, @TempDir Path discRoot) throws Exception {
+        String group = currentUserGroup();
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_should_be_hidden", "/work/dir", 1000L);
+
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
+                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, configRoot, discRoot,
+                null, null, () -> configWithMemberHerdrSocket(worktreeRoot.toString(), group));
+
+        Logger logger = (Logger) LoggerFactory.getLogger(OpenCodeLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        PeerHandle handle;
+        try {
+            handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
+            assertNull(handle.agentSessionId(),
+                    "memberHerdrSocket configured: discovery must stay unavailable even though a "
+                            + "matching record exists in discoveryRoot");
+            assertNull(handle.agentSessionId(), "the gate must hold on a second call too");
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+        List<String> warnings = appender.list.stream()
+                .filter(e -> e.getLevel() == Level.WARN)
+                .map(ILoggingEvent::getFormattedMessage)
+                .toList();
+        assertEquals(1, warnings.size(),
+                "exactly one WARN across two agentSessionId() calls — got: " + warnings);
+        assertTrue(warnings.get(0).contains("memberHerdrSocket"),
+                "the WARN must name memberHerdrSocket as the reason — got: " + warnings.get(0));
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -688,6 +688,32 @@ class MessageServiceTest {
         assertFailedTicket(third, "agent target term_a not found");
     }
 
+    // --- #137 follow-up: abandon() must not guess when more than one task is open ---------------
+    //
+    // A test combining a genuine stranded reply (hasStrandedReply(T)==true) with two simultaneously
+    // open matching tasks was attempted here and removed after investigation showed the combination
+    // is not reachable through the public API today, not merely hard to time right:
+    //
+    // This class has exactly two call sites that ever hold a target's entry in the session-lock map
+    // (send() and answer()), and both open a Rendezvous waiter for that same target as the first thing
+    // they do after acquiring the lock, holding lock and waiter together for their whole critical
+    // section. So "the lock is held" and "a live waiter is open" are the same fact throughout this
+    // class. reply()'s fast path always resolves a currently-open waiter directly instead of
+    // stranding — so a strand can only be created while NO task is accepted (lock free), and the
+    // instant the lock is next taken (by any parked matching task's own send(), the moment it is
+    // scheduled), that acceptance clears strandedReplies again (see send()'s CB-640 comment) before
+    // abandon() can ever observe both facts together. Confirmed empirically too: an earlier version of
+    // this test stranded a reply, then created an "accepted" task (awaitWaiting()) followed by a
+    // "parked" one — and the accepted task's own acceptance silently cleared the strand it was
+    // supposed to be racing against, so the parked task came back WORKER_FAILED instead of DONE, not
+    // because the fix was missing but because the test's premise could not be constructed.
+    //
+    // The reachable half — matching.size() >= 2 alone, no strand — is exactly what
+    // abandonFailsEveryPendingAsyncTicketForTheReleasedTarget already covers (all fail, none guess).
+    // The oldest-wins code in abandon() stays as defence in depth (see its own javadoc) against a
+    // regression that would make the conjunction reachable, e.g. clearing strandedReplies on a
+    // narrower condition than "any acceptance" — not because this suite exercises it today.
+
     @Test
     void abandonDoesNotFailAnAsyncTicketWaitingForAnAnswer() throws Exception {
         String ticket = messages.sendAsync(T, "task that asks");

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppTest.java

@@ -218,9 +218,17 @@ class FleetAppTest {
 
         HttpResponse<String> res = req(port, "GET", "/members");
         assertEquals(200, res.statusCode());
-        JsonNode workers = mapper.readTree(res.body()).get("workers");
-        assertEquals(1, workers.size());
-        JsonNode w = workers.get(0);
+        JsonNode body = mapper.readTree(res.body());
+        // fleetd #199: "members" is the canonical key. The endpoint is /members, so a caller that
+        // reads "members" must not see an empty fleet. "workers" is kept only as a deprecated alias
+        // and must carry the same rows — assert both, or the alias can silently drift.
+        JsonNode members = body.get("members");
+        assertNotNull(members, "GET /members must return its rows under \"members\"");
+        assertEquals(1, members.size());
+        JsonNode workers = body.get("workers");
+        assertNotNull(workers, "the deprecated \"workers\" alias is still emitted");
+        assertEquals(members, workers, "the alias must carry the same rows as \"members\"");
+        JsonNode w = members.get(0);
         assertEquals(spawned.get("terminalId").asText(), w.get("sessionId").asText());
         assertEquals(paneId, w.get("paneId").asText());
         assertEquals("ltms-local", w.get("profile").asText());

fleetd/src/test/java/dev/ltms/fleet/session/FakeWorktrees.java

@@ -30,12 +30,19 @@ public final class FakeWorktrees implements Worktrees {
     public record PruneCall(String repoRoot, long minAgeMillis) {
     }
 
+    public record ShareCall(String repoRoot, String worktreePath) {
+    }
+
     private final List<AddCall> addCalls = new CopyOnWriteArrayList<>();
     private final List<RemoveCall> removeCalls = new CopyOnWriteArrayList<>();
     private final List<OverlayCall> overlayCalls = new CopyOnWriteArrayList<>();
     private final List<RepoRootCall> repoRootCalls = new CopyOnWriteArrayList<>();
     private final List<SnapshotCall> snapshotCalls = new CopyOnWriteArrayList<>();
     private final List<PruneCall> pruneCalls = new CopyOnWriteArrayList<>();
+    private final List<ShareCall> shareCalls = new CopyOnWriteArrayList<>();
+    /** Tags every {@code overlayParity}/{@code shareWithGroup} call in call order, so a test can
+     *  pin that sharing runs after the overlay copy (fleetd #185 stage 3). */
+    private final List<String> overlayShareOrder = new CopyOnWriteArrayList<>();
     private final Set<String> existingPaths = ConcurrentHashMap.newKeySet();
     private final Set<String> trackedPaths = ConcurrentHashMap.newKeySet();
     private final AtomicLong snapshotSeq = new AtomicLong();
@@ -136,6 +143,13 @@ public final class FakeWorktrees implements Worktrees {
         }
         overlayCalls.add(new OverlayCall(repoRoot, worktreePath, List.copyOf(overlay),
                 List.copyOf(copied), List.copyOf(skipped)));
+        overlayShareOrder.add("overlay:" + worktreePath);
+    }
+
+    @Override
+    public void shareWithGroup(String repoRoot, String worktreePath) {
+        shareCalls.add(new ShareCall(repoRoot, worktreePath));
+        overlayShareOrder.add("share:" + worktreePath);
     }
 
     @Override
@@ -203,4 +217,17 @@ public final class FakeWorktrees implements Worktrees {
     public SnapshotCall lastSnapshot() {
         return snapshotCalls.isEmpty() ? null : snapshotCalls.getLast();
     }
+
+    public List<ShareCall> shareCalls() {
+        return List.copyOf(shareCalls);
+    }
+
+    public ShareCall lastShare() {
+        return shareCalls.isEmpty() ? null : shareCalls.getLast();
+    }
+
+    /** Call-order tags ({@code "overlay:<path>"}/{@code "share:<path>"}) — see field javadoc. */
+    public List<String> overlayShareOrder() {
+        return List.copyOf(overlayShareOrder);
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -924,4 +924,179 @@ class GitWorktreesTest {
         assertEquals(2, stats.count(), "two snapshot refs are reported");
         assertTrue(stats.costBytes() > 0, "the cost of the snapshots is a positive byte count");
     }
+
+    /**
+     * fleetd #185 stage 3: a recording {@link java.util.function.Function} test seam stands in for
+     * every process {@link GitWorktrees#shareWithGroup} would run — no real second OS user/group
+     * exists on this host, so these are unit tests against that seam, not a live-group integration
+     * test (out of scope per the ticket).
+     */
+    private static List<String> joined(String[] command) {
+        return List.of(command);
+    }
+
+    /** Remove {@code path} and anything under it. Tolerates an already-absent path. */
+    private static void deleteRecursively(Path path) throws Exception {
+        if (!Files.exists(path)) {
+            return;
+        }
+        if (Files.isDirectory(path)) {
+            try (java.util.stream.Stream<Path> children = Files.list(path)) {
+                for (Path child : children.toList()) {
+                    deleteRecursively(child);
+                }
+            }
+        }
+        Files.delete(path);
+    }
+
+    /** {@code worktreeGroup} absent ⇒ zero processes spawned and no git config written. */
+    @Test
+    void shareWithGroupIsNoopWhenNoGroupConfigured(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString(), null, _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repo.toString(), repo.resolve("some-worktree").toString());
+
+        assertTrue(recorded.isEmpty(), "no group configured must spawn no process at all: " + recorded);
+    }
+
+    /** A configured group runs {@code git config core.sharedRepository group} first, then
+     *  chgrp/chmod/setgid over every path {@link GitWorktrees#shareWithGroup} documents. */
+    @Test
+    void shareWithGroupRunsConfigThenChgrpChmodSetgidPerPath(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        Path worktree = Files.createDirectories(repo.resolve("some-worktree"));
+        String worktreePath = worktree.toString();
+        Files.createDirectories(repo.resolve(".git/worktrees"));
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            // What real git answers for an ordinary (non-linked) checkout: relative to repoRoot.
+            return List.of(cmd).contains("--git-common-dir") ? ".git\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, worktreePath);
+
+        assertEquals(List.of("git", "-C", repoRoot, "config", "core.sharedRepository", "group"), recorded.get(0),
+                "core.sharedRepository must be set first, so it keeps working after the one-time fix-up");
+        assertTrue(recorded.contains(List.of("git", "-C", repoRoot, "rev-parse", "--git-common-dir")),
+                "the git dir must be asked for, never hardcoded as <repoRoot>/.git — that is a FILE "
+                        + "when the checkout is itself a linked worktree: " + recorded);
+
+        for (String dir : List.of(worktreePath, repoRoot + "/.git/objects", repoRoot + "/.git/refs",
+                repoRoot + "/.git/logs", repoRoot + "/.git/worktrees")) {
+            assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", dir)), "missing chgrp -R for " + dir);
+            assertTrue(recorded.contains(List.of("chmod", "-R", "g+rwX", dir)), "missing chmod -R for " + dir);
+            assertTrue(recorded.contains(List.of("find", dir, "-type", "d", "-exec", "chmod", "g+s", "{}", "+")),
+                    "missing setgid find pass for " + dir);
+        }
+        // packed-refs does not exist in a freshly-init'd repo (only git gc / pack-refs creates it) —
+        // tolerated absence, so it must not appear at all: no recursive/-R treatment for a plain file.
+        String packedRefs = repoRoot + "/.git/packed-refs";
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(packedRefs)),
+                "packed-refs is absent here and must be skipped, not chgrp'd: " + recorded);
+    }
+
+    /**
+     * A path that does not exist is skipped, never handed to {@code chgrp}. {@code .git/logs} is
+     * absent whenever {@code core.logAllRefUpdates} is false or no ref has been updated yet, and
+     * {@code chgrp} on a missing path exits non-zero — which would fail EVERY provisioning spawn
+     * with a message blaming a group that is in fact fine.
+     */
+    @Test
+    void shareWithGroupSkipsPathsThatDoNotExist(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        deleteRecursively(repo.resolve(".git/logs"));
+        assertFalse(Files.exists(repo.resolve(".git/logs")), "fixture: .git/logs must be gone");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return List.of(cmd).contains("--git-common-dir") ? ".git\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, repo.resolve("no-such-worktree").toString());
+
+        String logs = repoRoot + "/.git/logs";
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(logs)),
+                "a missing .git/logs must be skipped, not chgrp'd: " + recorded);
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(repo.resolve("no-such-worktree").toString())),
+                "a missing worktree path must be skipped too: " + recorded);
+        assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", repoRoot + "/.git/objects")),
+                "paths that DO exist are still shared: " + recorded);
+    }
+
+    /**
+     * The git store is located by {@code rev-parse --git-common-dir}, not by appending
+     * {@code /.git}. When git answers with an absolute path — what it does for a linked worktree,
+     * where {@code <repoRoot>/.git} is a file — every shared path must follow that answer.
+     */
+    @Test
+    void shareWithGroupFollowsAnAbsoluteGitCommonDir(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path realGitDir = repo.resolve(".git");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return List.of(cmd).contains("--git-common-dir") ? realGitDir + "\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(tmp.resolve("some/linked/worktree").toString(),
+                repo.resolve("wt").toString());
+
+        assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", realGitDir + "/objects")),
+                "objects must be taken from the reported common dir, not <repoRoot>/.git: " + recorded);
+    }
+
+    /** {@code packed-refs}, when present, is chgrp/chmod'd but never setgid'd (it is a file, not a dir). */
+    @Test
+    void shareWithGroupIncludesPackedRefsWhenPresent(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        Path packedRefsPath = repo.resolve(".git/packed-refs");
+        Files.writeString(packedRefsPath, "");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, repo.resolve("some-worktree").toString());
+
+        String packedRefs = packedRefsPath.toString();
+        assertTrue(recorded.contains(List.of("chgrp", "devteam", packedRefs)),
+                "packed-refs must be chgrp'd non-recursively when present: " + recorded);
+        assertTrue(recorded.contains(List.of("chmod", "g+rwX", packedRefs)),
+                "packed-refs must be chmod'd non-recursively when present: " + recorded);
+        assertTrue(recorded.stream().noneMatch(c -> c.contains("find") && c.contains(packedRefs)),
+                "packed-refs (a file) must never get the recursive setgid pass: " + recorded);
+    }
+
+    /** A group that does not exist (or that the operator is not a member of) fails loudly, naming it. */
+    @Test
+    void shareWithGroupThrowsNamingTheGroupWhenChgrpFails(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString(), "cb185-nonexistent-group-zz");
+        String wt = new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-185-share", "HEAD");
+
+        WorktreeException e = assertThrows(WorktreeException.class,
+                () -> gitWorktrees.shareWithGroup(repo.toString(), wt));
+        assertTrue(e.getMessage().contains("cb185-nonexistent-group-zz"),
+                "exception must name the missing/refused group: " + e.getMessage());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -148,6 +148,10 @@ class SessionManagerTest {
             return 0;
         }
 
+        @Override
+        public void shareWithGroup(String repoRoot, String worktreePath) {
+        }
+
         List<String> removeCalls() {
             return List.copyOf(removeCalls);
         }
@@ -883,15 +887,18 @@ class SessionManagerTest {
     }
 
     @Test
-    void acquireWithNeitherSessionFieldLeavesAgentSessionIdNull() {
+    void acquireWithNeitherSessionFieldStillMintsAnAgentSessionId() {
+        // fleetd #214: the claude-code launcher mints a session id for EVERY spawn, so a member is
+        // resumable even when the spawn asked for no session identity.
         FakeHerdr herdr = new FakeHerdr();
         SessionManager sessions = sessionManager(herdr);
 
         MemberSession s = sessions.acquire("ltms-local", null, null, null);
 
-        assertNull(s.agentSessionId(), "no identity requested — unchanged from before CB-584");
-        assertFalse(SessionManager.rosterView(s, null).containsKey("agentSessionId"),
-                "a null id is omitted from the roster, like charterSha256 for a receipt-less session");
+        assertNotNull(s.agentSessionId(),
+                "fleetd #214: a plain spawn mints a session id, so every member is resumable");
+        assertTrue(SessionManager.rosterView(s, null).containsKey("agentSessionId"),
+                "the minted id is in the roster, so fleet_list advertises every member's resume handle");
     }
 
     @Test
@@ -927,4 +934,235 @@ class SessionManagerTest {
         assertTrue(e.getMessage().contains("SESSION_RESUME"), e.getMessage());
         assertTrue(e.getMessage().contains("stub-profile"), e.getMessage());
     }
+
+    // ── fleetd #209: agentSessionId resolved lazily against the retained handle ─────────────────
+    //
+    // The opencode adapter cannot answer PeerHandle.agentSessionId() at spawn time — the on-disk
+    // session row is written only after the pane is live — so the id must be re-polled on a LATER
+    // call, against the SAME handle instance the launcher returned at spawn. SessionManager used
+    // to let that handle go out of scope at the end of the spawn method, so no caller ever re-asked
+    // it and fleet_list/fleet_status never saw the id. LazyIdHandle below reproduces exactly that
+    // shape: null on the first N calls (the spawn-time call included), a real id after.
+
+    /**
+     * A {@link PeerHandle} whose {@link #agentSessionId()} answers {@code null} for its first
+     * {@code nullCalls} invocations, then either a fixed id or a configured throw on every call
+     * after that — the shape of the opencode bug (fleetd #209): the session row is not written
+     * until after the pane is live, so early polls come back empty and a later one finds it.
+     */
+    private static final class LazyIdHandle implements PeerHandle {
+        private final String id;
+        private final String terminalId;
+        private final int nullCalls;
+        private final String resolvedId;
+        private final java.util.concurrent.atomic.AtomicInteger calls =
+                new java.util.concurrent.atomic.AtomicInteger();
+        private volatile RuntimeException throwAfter;
+
+        LazyIdHandle(String id, String terminalId, int nullCalls, String resolvedId) {
+            this.id = id;
+            this.terminalId = terminalId;
+            this.nullCalls = nullCalls;
+            this.resolvedId = resolvedId;
+        }
+
+        /** After the null calls are exhausted, throw instead of answering the resolved id. */
+        LazyIdHandle throwing(RuntimeException e) {
+            this.throwAfter = e;
+            return this;
+        }
+
+        @Override
+        public String id() {
+            return id;
+        }
+
+        @Override
+        public String terminalId() {
+            return terminalId;
+        }
+
+        @Override
+        public String agentSessionId() {
+            int n = calls.incrementAndGet();
+            if (n <= nullCalls) {
+                return null;
+            }
+            if (throwAfter != null) {
+                throw throwAfter;
+            }
+            return resolvedId;
+        }
+
+        @Override
+        public CharterReceipt charterReceipt() {
+            return null;
+        }
+
+        int callCount() {
+            return calls.get();
+        }
+    }
+
+    /** A minimal {@link PeerLauncher} that hands out pre-built {@link LazyIdHandle}s, one per spawn. */
+    private static final class LazyIdLauncher implements PeerLauncher {
+        private final java.util.Deque<LazyIdHandle> queued = new java.util.ArrayDeque<>();
+
+        LazyIdLauncher queue(LazyIdHandle handle) {
+            queued.add(handle);
+            return this;
+        }
+
+        @Override
+        public Set<Capability> capabilities() {
+            return Set.of(Capability.WORKTREE, Capability.SESSION_RESUME);
+        }
+
+        @Override
+        public Set<Capability> capabilitiesFor(String profileName) {
+            return capabilities();
+        }
+
+        @Override
+        public PeerHandle spawn(SpawnRequest req) {
+            LazyIdHandle handle = queued.poll();
+            if (handle == null) {
+                throw new IllegalStateException("no queued LazyIdHandle for this spawn");
+            }
+            return handle;
+        }
+
+        @Override
+        public Set<String> profiles() {
+            return Set.of("lazy");
+        }
+
+        @Override
+        public String defaultProfile() {
+            return "lazy";
+        }
+
+        @Override
+        public String effectiveCwd(SpawnRequest req) {
+            return "/cwd";
+        }
+
+        @Override
+        public List<String> parityOverlay(String profileName) {
+            return List.of();
+        }
+
+        @Override
+        public List<?> list() {
+            return List.of();
+        }
+
+        @Override
+        public int reapOrphanWorkers() {
+            return 0;
+        }
+
+        @Override
+        public void stop(String id) {
+        }
+
+        @Override
+        public boolean clearContext(String id) {
+            return false;
+        }
+    }
+
+    @Test
+    void plainRosterDoesNotResolveAgentSessionId() {
+        // fleetd #209 follow-up: roster() sits on the heartbeat/health-tick timers (and the metrics
+        // scrape), so it must never trigger the resolve lookup — for opencode that lookup opens an
+        // on-disk session database, and a member whose id never appears would pay that cost forever.
+        // rosterResolved() is the one to use when a caller actually reports the id.
+        LazyIdHandle handle = new LazyIdHandle("p0", "t0", 1, "oc-session-0");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        MemberSession acquired = sessions.acquire("lazy", "/cwd", "/caller", null);
+        assertEquals(1, handle.callCount(), "sanity: only the spawn-time call happened so far");
+
+        List<MemberSession> roster = sessions.roster();
+
+        assertEquals(1, roster.size());
+        assertEquals(acquired.paneId(), roster.getFirst().paneId());
+        assertNull(roster.getFirst().agentSessionId(), "the plain roster must not resolve the id");
+        assertEquals(1, handle.callCount(),
+                "roster() must never call agentSessionId() again — it sits on the heartbeat/health timers");
+    }
+
+    @Test
+    void rosterResolvedResolvesALateAgentSessionIdFromTheRetainedHandle() {
+        LazyIdHandle handle = new LazyIdHandle("p1", "t1", 1, "oc-session-1");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+
+        MemberSession acquired = sessions.acquire("lazy", "/cwd", "/caller", null);
+        assertNull(acquired.agentSessionId(),
+                "opencode has not written its session row yet at spawn time");
+
+        List<MemberSession> roster = sessions.rosterResolved();
+        assertEquals(1, roster.size());
+        assertEquals("oc-session-1", roster.getFirst().agentSessionId(),
+                "fleet_list must see the id once the adapter can answer it");
+
+        Map<String, Object> view = SessionManager.rosterView(roster.getFirst(), null);
+        assertEquals("oc-session-1", view.get("agentSessionId"),
+                "rosterView renders whatever rosterResolved() resolved");
+    }
+
+    @Test
+    void getResolvesALateAgentSessionIdFromTheRetainedHandle() {
+        LazyIdHandle handle = new LazyIdHandle("p2", "t2", 1, "oc-session-2");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        MemberSession acquired = sessions.acquire("lazy", "/cwd", "/caller", null);
+
+        MemberSession resolved = sessions.get(acquired.paneId()).orElseThrow();
+
+        assertEquals("oc-session-2", resolved.agentSessionId(),
+                "fleet_status (single-session lookup) must also see the late-resolved id");
+    }
+
+    @Test
+    void releaseCarriesALateResolvedAgentSessionIdIntoTheReleaseDetail() {
+        LazyIdHandle handle = new LazyIdHandle("p3", "t3", 1, "oc-session-3");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        MemberSession acquired = sessions.acquire("lazy", "/cwd", "/caller", null);
+        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
+        sessions.onRelease(detail -> released.add(detail.agentSessionId()));
+
+        sessions.release(acquired.paneId());
+
+        assertEquals(java.util.List.of("oc-session-3"), released,
+                "a released member's detail carries the id it has since resolved, not the null "
+                        + "frozen in at spawn time");
+    }
+
+    @Test
+    void aThrowingHandleDoesNotBreakRosterResolved() {
+        LazyIdHandle handle = new LazyIdHandle("p4", "t4", 1, "oc-session-4")
+                .throwing(new RuntimeException("sqlite locked"));
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        sessions.acquire("lazy", "/cwd", "/caller", null);
+
+        List<MemberSession> roster = assertDoesNotThrow(sessions::rosterResolved,
+                "a handle that throws resolving its id must not break the roster read");
+
+        assertEquals(1, roster.size());
+        assertNull(roster.getFirst().agentSessionId(), "the id stays unresolved when the lookup throws");
+    }
+
+    @Test
+    void aResolvedAgentSessionIdIsNotLookedUpAgain() {
+        LazyIdHandle handle = new LazyIdHandle("p5", "t5", 1, "oc-session-5");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        sessions.acquire("lazy", "/cwd", "/caller", null);
+        assertEquals(1, handle.callCount(), "sanity: only the spawn-time call happened so far");
+
+        sessions.rosterResolved();
+        assertEquals(2, handle.callCount(), "the first rosterResolved() read resolves the id");
+
+        sessions.rosterResolved();
+        assertEquals(2, handle.callCount(), "once resolved, the id must not be looked up again");
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/WorktreeSessionManagerTest.java

@@ -163,6 +163,37 @@ class WorktreeSessionManagerTest {
                 "tracked copied paths are --skip-worktree'd");
     }
 
+    /**
+     * fleetd #185 stage 3, THE TRAP: {@code overlayParity} copies more files into the worktree
+     * AFTER {@code add} returns, so {@code shareWithGroup} must run after it, not folded into
+     * {@code add()} — otherwise every overlay file lands operator-owned and unwritable for a
+     * different-uid member, with a green test suite hiding it.
+     */
+    @Test
+    void shareWithGroupRunsAfterOverlayParityNotBeforeIt() {
+        FakeHerdr herdr = new FakeHerdr();
+        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
+                .track(".envrc");
+        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
+
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-185", null));
+
+        assertEquals(1, worktrees.overlayCalls().size(), "overlayParity ran exactly once");
+        assertEquals(1, worktrees.shareCalls().size(), "shareWithGroup ran exactly once");
+        FakeWorktrees.OverlayCall overlay = worktrees.lastOverlay();
+        FakeWorktrees.ShareCall share = worktrees.lastShare();
+        assertEquals(s.worktree(), overlay.worktreePath());
+        assertEquals(s.worktree(), share.worktreePath());
+
+        List<String> order = worktrees.overlayShareOrder();
+        int overlayIndex = order.indexOf("overlay:" + s.worktree());
+        int shareIndex = order.indexOf("share:" + s.worktree());
+        assertTrue(overlayIndex >= 0 && shareIndex >= 0, "both calls must be recorded: " + order);
+        assertTrue(overlayIndex < shareIndex,
+                "shareWithGroup MUST run after overlayParity, not before/inside add(): " + order);
+    }
+
     @Test
     void releaseRemovesWorktreeButDoesNotDeleteBranch() {
         FakeHerdr herdr = new FakeHerdr();