#185 stage 2: stop the credential-gap detector reporting on the wrong environment

When memberHerdrSocket: is configured, member panes run under a different OS
user than fleetd's own process, so hostEnvNames (fleetd's own environment)
no longer describes what a member pane inherits. logCredentialGap now checks
for that config key and, when set, logs a single WARN saying the gap is
UNKNOWN (not clean) and names the key, instead of printing the "inherits
them UNBLOCKED" / "the scrub blanks them" conclusions as fact. Behaviour is
byte-identical when memberHerdrSocket is absent (the default and only mode
this host runs).

fleetd/fleetd.example.yaml

@@ -634,6 +634,17 @@ guard:
 # to a sibling directory of the repo root.
 # worktreeRoot: /Users/me/src/.bridged-worktrees
 
+# Worktree group sharing (fleetd #185 stage 3). OPTIONAL, off by default. Names an OS group
+# that a provisioned worktree's repo is made group-writable for (git config
+# core.sharedRepository group, plus a one-time chgrp/chmod/setgid fix-up), so a member spawned
+# under a DIFFERENT OS user (see memberHerdrSocket) can write its own worktree, its
+# per-worktree git metadata, and its own commit objects — without it, every file GitWorktrees
+# creates is owned by fleetd's own uid and unwritable by another user.
+# CAUTION: this isolates credentials, not the repository — a member in the group can still
+# write the operator's git objects and refs in the shared repo. The operator running fleetd
+# must already be a member of the named group, or every provisioning spawn fails loudly.
+# worktreeGroup: fleet-workers
+
 # Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
 # the feature disabled. By default the daemon never reaps, caps, or drains sessions.
 #   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -224,7 +224,7 @@ public final class Fleetd {
             contextCap = cfg.lifecycle().contextCap();
         }
         boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup()),
                 System::nanoTime, contextCap, clearAfterTurn);
         liveCountRef.set(profileName -> (int) sessions.roster().stream()
                 .filter(s -> profileName.equals(s.profile()))

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -76,6 +76,14 @@ import java.util.Set;
  *                      stay on {@code broker}'s vhost). {@code null} → no lead mailbox is opened.
  *                      Config parsing + accessors only — nothing here wires it into a live
  *                      {@code LeadMailbox}; that is a separate ticket. See {@link Coordinator}.
+ * @param worktreeGroup optional OS group name (fleetd #185 stage 3) that makes a provisioned
+ *                      worktree's repo group-shared, so a member running as a different OS user
+ *                      (see {@code memberHerdrSocket}) can write its own worktree, its per-worktree
+ *                      git metadata, and its own commit objects. {@code null}/blank/empty ⇒ off,
+ *                      today's behaviour unchanged (every file stays owned by fleetd's own uid).
+ *                      <strong>This isolates credentials, not the repository</strong>: a member in
+ *                      the group can still write the operator's git objects and refs in the shared
+ *                      repo. See {@link dev.ltms.fleet.session.Worktrees#shareWithGroup}.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record FleetConfig(
@@ -98,7 +106,20 @@ public record FleetConfig(
         ConfigReload configReload,
         Integer quarantineCooldownSeconds,
         MemberCredentials memberCredentials,
-        Coordinator coordinator) {
+        Coordinator coordinator,
+        String worktreeGroup) {
+
+    /** Back-compat form before the {@code worktreeGroup} key was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, null);
+    }
 
     /** Back-compat form before the {@code coordinator:} block was added. */
     public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
@@ -109,7 +130,7 @@ public record FleetConfig(
                          MemberCredentials memberCredentials) {
         this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, memberCredentials, null);
+                configReload, quarantineCooldownSeconds, memberCredentials, null, null);
     }
 
     /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
@@ -1325,7 +1346,7 @@ public record FleetConfig(
             "bind", "herdrSocket", "memberHerdrSocket", "profiles", "guard", "worktreeRoot",
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
             "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
-            "memberCredentials", "coordinator");
+            "memberCredentials", "coordinator", "worktreeGroup");
 
     /** Load and validate config from {@code path}. */
     public static FleetConfig load(Path path) {
@@ -1943,9 +1964,11 @@ public record FleetConfig(
                 : new MemberCredentials(null, List.of(), List.of());
         // coordinator is left as-is, like broker/primary above: null keeps no LeadMailbox opened,
         // and this ticket's Coordinator is config-only anyway (nothing yet reads it at startup).
+        // worktreeGroup is left as-is (fleetd #185 stage 3): null/blank is "off", and there is no
+        // sane non-null default — an OS group name is operator-specific.
         return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
-                quarantineCooldown, mc, coordinator);
+                quarantineCooldown, mc, coordinator, worktreeGroup);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -112,6 +112,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * daemon's own process is started the same way (a login shell sourcing the same secret store —
      * see CB-592's investigation of {@code secrets.sh}), so on a single-host deployment its env
      * mirrors what the pane's login shell is about to export.
+     *
+     * <p>fleetd #185 stage 2: that mirroring assumption holds only while the member pane runs under
+     * the SAME OS user as the daemon. When {@code memberHerdrSocket:} is configured, member panes
+     * run on a second herdr owned by a different user — different {@code $HOME}, different {@code
+     * secrets.sh}, different environment entirely — so this field's data no longer describes what a
+     * member pane inherits. See {@link #logCredentialGap} for how that mode is handled.
      */
     private final Supplier<Set<String>> hostEnvNames;
 
@@ -1230,6 +1236,67 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      */
     private final AtomicBoolean allowListGapLogged = new AtomicBoolean();
 
+    /**
+     * fleetd #185 stage 2: guards {@link #warnUnknownMemberEnvironment} to one WARN per launcher
+     * instance, not one per spawn — the same one-per-instance shape as {@link #unprotectedGapLogged}
+     * and {@link #allowListGapLogged}, kept as its own flag for the same reason those two are split:
+     * this mode is orthogonal to which of the other two branches would otherwise have fired.
+     */
+    private final AtomicBoolean unknownMemberEnvironmentWarned = new AtomicBoolean();
+
+    /**
+     * fleetd #185 stage 2: whether {@code memberHerdrSocket:} is configured, i.e. member panes run
+     * on a second herdr owned by a different OS user than the daemon's own process. Re-read from the
+     * live config on every call (same hot-reload shape as {@link #memberCredentials}), never cached,
+     * so a config reload takes effect on the next spawn without a restart.
+     *
+     * <p>{@link #config} is {@code null} on any call site that never threaded the full config
+     * through (every production {@code HerdrPeerLauncher} does; a handful of older tests do not) —
+     * treated the same as "not configured", which is the correct, permissive default: it is exactly
+     * today's single-daemon behaviour.
+     */
+    private boolean memberHerdrSocketConfigured() {
+        if (config == null) {
+            return false;
+        }
+        FleetConfig cfg = config.get();
+        return cfg != null && cfg.memberHerdrSocket() != null && !cfg.memberHerdrSocket().isBlank();
+    }
+
+    /**
+     * fleetd #185 stage 2: the single replacement WARN for {@link #logCredentialGap}'s usual
+     * conclusions when {@code memberHerdrSocket:} is configured. {@link #hostEnvNames} (and
+     * everything derived from it — {@code known}/{@code allow} coverage, the allow-list scrub's
+     * derived set) describes the DAEMON's own environment; under this config key member panes run as
+     * a different OS user with a different environment entirely, so neither "every member pane
+     * inherits them UNBLOCKED" nor "the scrub blanks them" is evidence-backed here — both would be
+     * reporting on the wrong process. Logged once, names the config key, and states the honest
+     * conclusion: the gap for member panes is UNKNOWN, not clean, so {@code memberCredentials} cannot
+     * be verified from this daemon. The one count it does report is scoped explicitly to fleetd's own
+     * environment, never presented as if it said anything about the member's — see {@link
+     * #logCredentialGap}'s javadoc for why this branch exists.
+     */
+    private void warnUnknownMemberEnvironment(FleetConfig.MemberCredentials creds) {
+        if (!unknownMemberEnvironmentWarned.compareAndSet(false, true)) {
+            return;
+        }
+        Set<String> covered = new HashSet<>(creds.known());
+        covered.addAll(creds.allow());
+        Set<String> hostNames = hostEnvNames.get();
+        long gapInFleetdsOwnEnv = hostNames.stream()
+                .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
+                .filter(name -> !covered.contains(name))
+                .count();
+        log.warn("memberCredentials gap: memberHerdrSocket is configured, so member panes run under "
+                        + "a different OS user than fleetd's own process, with a different environment "
+                        + "entirely — fleetd has no channel to read that user's environment. {} of the "
+                        + "{} names in fleetd's OWN environment are credential-shaped and not on "
+                        + "known:/allow:, but that count describes fleetd's process, not the member "
+                        + "herdr's. The credential gap for member panes is UNKNOWN, not clean, and "
+                        + "memberCredentials cannot be verified from here.",
+                gapInFleetdsOwnEnv, hostNames.size());
+    }
+
     /**
      * CB-596 criterion 4: a credential-shaped host env var name on neither {@code known} nor
      * {@code allow} is not silently allowed — it is reported. {@link #hostEnvNames} enumerates the
@@ -1258,8 +1325,22 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * (same severity, and same guard, as the deny-by-default case — a name genuinely reaching a
      * member unprotected is equally serious whichever path put it there), and the names it says are
      * blanked keep the INFO.
+     *
+     * <p>fleetd #185 stage 2: everything above assumes the member pane runs under the same OS user
+     * as the daemon, so {@link #hostEnvNames} mirrors what the pane inherits — see that field's
+     * javadoc. When {@code memberHerdrSocket:} is configured that assumption is false: the member
+     * pane runs on a second herdr owned by a <em>different</em> user, and neither conclusion below
+     * ("inherits them UNBLOCKED" / "the scrub blanks them") is backed by evidence about that user's
+     * environment. So this method checks that first and, when configured, reports the honest
+     * "unknown, not clean" conclusion instead — see {@link #warnUnknownMemberEnvironment}. When
+     * {@code memberHerdrSocket:} is absent (the default, and the only mode this host runs) this
+     * branch is never taken and every line below is unchanged.
      */
     private void logCredentialGap(FleetConfig.MemberCredentials creds, Set<String> effectiveAllowed) {
+        if (memberHerdrSocketConfigured()) {
+            warnUnknownMemberEnvironment(creds);
+            return;
+        }
         Set<String> covered = new HashSet<>(creds.known());
         covered.addAll(creds.allow());
         List<String> gap = hostEnvNames.get().stream()

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -23,6 +23,7 @@ import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Consumer;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 /**
@@ -88,24 +89,64 @@ public final class GitWorktrees implements Worktrees {
     );
 
     private final String configuredRoot;
+    /** OS group name for {@link #shareWithGroup} (fleetd #185 stage 3); {@code null} ⇒ feature off. */
+    private final String group;
     private final Consumer<String> afterWorktreeAdded;
+    /** How {@link #shareWithGroup}'s processes (git config / chgrp / chmod / find) actually run.
+     *  Defaults to the real {@link #exec(String...)}. Package-private test seam so a unit test can
+     *  prove "no group configured ⇒ zero processes spawned" and inspect exactly what a configured
+     *  group runs, without a real second OS user or OS group on this host. */
+    private final Function<String[], String> shareGroupRunner;
     private final SecureRandom random = new SecureRandom();
     private final AtomicLong seq = new AtomicLong();
 
     /** Default constructor: worktree root is derived per-repo as {@code <repoRoot>/../.bridged-worktrees}. */
     public GitWorktrees() {
-        this(null);
+        this(null, (String) null);
     }
 
-    /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
+    /**
+     * @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of
+     *                       the repo root. No {@code worktreeGroup} configured — {@link #shareWithGroup}
+     *                       is a no-op.
+     */
     public GitWorktrees(String configuredRoot) {
-        this(configuredRoot, _ -> {});
+        this(configuredRoot, (String) null);
+    }
+
+    /**
+     * @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of
+     *                       the repo root.
+     * @param group          optional OS group name (fleetd #185 stage 3, {@code worktreeGroup:} in
+     *                       config); null/blank ⇒ {@link #shareWithGroup} is a no-op.
+     */
+    public GitWorktrees(String configuredRoot, String group) {
+        this(configuredRoot, group, _ -> {});
     }
 
     /** Test seam for changing a real worktree between its creation and its security check. */
     GitWorktrees(String configuredRoot, Consumer<String> afterWorktreeAdded) {
+        this(configuredRoot, null, afterWorktreeAdded);
+    }
+
+    /** Test seam combining a configurable {@code group} with {@link #afterWorktreeAdded}. */
+    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded) {
+        this(configuredRoot, group, afterWorktreeAdded, null);
+    }
+
+    /**
+     * Full test seam: also overrides how {@link #shareWithGroup}'s processes run (fleetd #185
+     * stage 3), so a unit test can prove "no group configured ⇒ no process spawned" and inspect
+     * exactly what commands a configured group runs, without a real second OS user/group.
+     *
+     * @param shareGroupRunner {@code null} ⇒ the real {@link #exec(String...)}.
+     */
+    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
+                 Function<String[], String> shareGroupRunner) {
         this.configuredRoot = configuredRoot;
+        this.group = (group == null || group.isBlank()) ? null : group;
         this.afterWorktreeAdded = afterWorktreeAdded == null ? _ -> {} : afterWorktreeAdded;
+        this.shareGroupRunner = shareGroupRunner != null ? shareGroupRunner : this::exec;
     }
 
     @Override
@@ -607,6 +648,126 @@ public final class GitWorktrees implements Worktrees {
         return deleted;
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * <p>fleetd #185 stage 3. No-op — no process spawned, nothing logged — when {@link #group} is
+     * null/blank. Otherwise:
+     * <ol>
+     *   <li>{@code git -C repoRoot config core.sharedRepository group} so every future write by
+     *       either uid stays group-writable;</li>
+     *   <li>a one-time {@code chgrp}/{@code chmod g+rwX} fix-up over the worktree directory and,
+     *       under the repo's <em>common</em> git directory, {@code objects}, {@code refs},
+     *       {@code logs}, {@code worktrees} and {@code packed-refs} — with setgid
+     *       ({@code chmod g+s}) applied only to the directories among them, so files created later
+     *       inherit the group;</li>
+     *   <li>one INFO line naming the group and the paths touched.</li>
+     * </ol>
+     *
+     * <p><b>Every path is skipped when it does not exist.</b> {@code .git/logs} is absent in a repo
+     * with {@code core.logAllRefUpdates=false} or one that has had no ref update yet, and
+     * {@code packed-refs} is absent until refs are packed. Passing a missing path to {@code chgrp}
+     * exits non-zero, which would fail <em>every</em> provisioning spawn with a message blaming a
+     * group that is in fact fine.
+     *
+     * <p><b>The git directory is resolved, not assumed.</b> {@code <repoRoot>/.git} is a
+     * <em>file</em>, not a directory, when the checkout is itself a linked worktree — the very
+     * thing this class creates for every member. {@code git rev-parse --git-common-dir} gives the
+     * real shared store, and it may answer relatively, so it is resolved against {@code repoRoot}.
+     *
+     * <p><b>The fix-up re-runs on every spawn, by design.</b> {@code core.sharedRepository=group}
+     * governs only what git writes <em>after</em> it is set; the walk is what covers everything
+     * already on disk. It is not redundant work to optimise away — dropping it silently leaves
+     * pre-existing objects unreadable to the member. It costs three walks of the object store per
+     * spawn (about 3000 files in this repo, well under a second, but it grows with the repo).
+     *
+     * <p>This only fixes up file ownership/permissions on the operator's shared repo so a
+     * different-uid member can write to it — it isolates credentials, not the repository. A member
+     * in the group can still write the operator's git objects and refs.
+     *
+     * <p>Fails loudly: a missing group, or a {@code chgrp}/{@code chmod} refused because the
+     * operator is not a member of it, becomes a {@link WorktreeException} naming the group — never
+     * a silent skip that leaves a member unable to work with nothing in the log to explain why.
+     */
+    @Override
+    public void shareWithGroup(String repoRoot, String worktreePath) {
+        if (group == null) {
+            return;
+        }
+        List<String> touched = new ArrayList<>();
+        try {
+            shareGroupRunner.apply(new String[]{"git", "-C", repoRoot, "config", "core.sharedRepository", "group"});
+            String commonDir = gitCommonDir(repoRoot);
+            shareGroupPathIfPresent(worktreePath, true, touched);
+            for (String name : List.of("objects", "refs", "logs", "worktrees")) {
+                shareGroupPathIfPresent(commonDir + "/" + name, true, touched);
+            }
+            shareGroupPathIfPresent(commonDir + "/packed-refs", false, touched);
+        } catch (WorktreeException e) {
+            throw new WorktreeException("cannot share worktree with group '" + group + "': "
+                    + e.getMessage() + " — the group must exist, and the fleetd operator ("
+                    + System.getProperty("user.name") + ") must be a member of it", e);
+        }
+        log.info("worktreeGroup={} shared repoRoot={} worktreePath={} paths={}",
+                group, repoRoot, worktreePath, touched);
+    }
+
+    /**
+     * The repo's <em>common</em> git directory as an absolute path — where {@code objects},
+     * {@code refs} and {@code worktrees} actually live. {@code git rev-parse --git-common-dir}
+     * answers relative to {@code repoRoot} in the ordinary case ({@code .git}) and absolutely for a
+     * linked worktree, so the answer is resolved against {@code repoRoot} either way. Never
+     * hardcode {@code repoRoot + "/.git"}: that is a FILE when the checkout is itself a linked
+     * worktree.
+     */
+    private String gitCommonDir(String repoRoot) {
+        String answer = shareGroupRunner.apply(
+                new String[]{"git", "-C", repoRoot, "rev-parse", "--git-common-dir"});
+        String trimmed = answer == null ? "" : answer.trim();
+        if (trimmed.isEmpty()) {
+            trimmed = ".git";
+        }
+        return Path.of(repoRoot).resolve(trimmed).normalize().toString();
+    }
+
+    /**
+     * {@link #shareGroupPath} when {@code path} exists, recording it in {@code touched}; otherwise
+     * nothing at all. A missing path is normal, not an error — see {@link #shareWithGroup}'s
+     * javadoc for which ones are routinely absent and why passing them to {@code chgrp} would fail
+     * every spawn.
+     */
+    private void shareGroupPathIfPresent(String path, boolean recursive, List<String> touched) {
+        if (!Files.exists(Path.of(path))) {
+            return;
+        }
+        shareGroupPath(path, recursive);
+        touched.add(path);
+    }
+
+    /**
+     * {@code chgrp}/{@code chmod g+rwX} {@code path} to {@link #group}. When {@code recursive},
+     * also walks the directories under {@code path} (including {@code path} itself, when it is a
+     * directory) and sets setgid on each — directories only, per the javadoc on
+     * {@link #shareWithGroup}.
+     */
+    private void shareGroupPath(String path, boolean recursive) {
+        List<String> chgrp = new ArrayList<>(List.of("chgrp"));
+        if (recursive) chgrp.add("-R");
+        chgrp.add(group);
+        chgrp.add(path);
+        shareGroupRunner.apply(chgrp.toArray(new String[0]));
+
+        List<String> chmod = new ArrayList<>(List.of("chmod"));
+        if (recursive) chmod.add("-R");
+        chmod.add("g+rwX");
+        chmod.add(path);
+        shareGroupRunner.apply(chmod.toArray(new String[0]));
+
+        if (recursive) {
+            shareGroupRunner.apply(new String[]{"find", path, "-type", "d", "-exec", "chmod", "g+s", "{}", "+"});
+        }
+    }
+
     /**
      * Every {@code refs/wip/*} ref (see {@link WipRef}). The committer date is read as a unix
      * count of seconds and converted to millis. {@code %00} (NUL) separates the fields because a

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -472,6 +472,10 @@ public final class SessionManager implements TurnListener {
         try {
             path = worktrees.add(repoRoot, branch, wt.baseRef());
             worktrees.overlayParity(repoRoot, path, launcher.parityOverlay(preResolvedProfile));
+            // fleetd #185 stage 3: MUST run after overlayParity, not folded into add() — overlayParity
+            // copies more files into the worktree after add() returns, so sharing the group any earlier
+            // leaves those overlay files operator-owned and read-only for a different-uid member.
+            worktrees.shareWithGroup(repoRoot, path);
             handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd, sessionName, resumeSessionId, memberRole));
         } catch (RuntimeException e) {
             log.warn("spawn failed for profile={} role={} branch={} path={}: {}",

fleetd/src/main/java/dev/ltms/fleet/session/Worktrees.java

@@ -98,4 +98,21 @@ public interface Worktrees {
     /** CB-586: the operator-visible census of {@code refs/wip/*} in one repository. */
     record WipRefStats(int count, long costBytes) {
     }
+
+    /**
+     * Make {@code repoRoot}'s git store and {@code worktreePath} writable by the configured group
+     * (fleetd #185 stage 3), so a member spawned as a different OS user (see
+     * {@code memberHerdrSocket}) can write its own worktree, its per-worktree git metadata, and
+     * its own commit objects. No-op when no group is configured.
+     *
+     * <p><strong>This isolates credentials, not the repository.</strong> A member in the group can
+     * still write the operator's git objects and refs in the shared repo — this only fixes file
+     * ownership/permissions so a different-uid member can work at all, it grants no narrower access
+     * than that.
+     *
+     * @param repoRoot     the repository whose git store ({@code .git/objects}, {@code refs},
+     *                     {@code logs}, {@code worktrees}, {@code packed-refs}) needs sharing
+     * @param worktreePath the linked worktree's own directory
+     */
+    void shareWithGroup(String repoRoot, String worktreePath);
 }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -1036,6 +1036,35 @@ class FleetConfigTest {
         assertEquals(LeadMailbox.DEFAULT_PREFETCH, noEnv.prefetchOrDefault());
     }
 
+    @Test
+    void absentWorktreeGroupLeavesItNull(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-worktree-group.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\n");
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertNull(cfg.worktreeGroup(), "no worktreeGroup: key → null → GitWorktrees.shareWithGroup is a no-op");
+    }
+
+    @Test
+    void worktreeGroupKeyParses(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("worktree-group.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\nworktreeGroup: fleet-workers\n");
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertEquals("fleet-workers", cfg.worktreeGroup());
+    }
+
+    @Test
+    void absentWorktreeGroupSurvivesTheBackCompatConstructorChain() {
+        // fleetd #185 stage 3: withDefaults() (and every pre-existing call site) must not silently
+        // drop a live worktreeGroup by routing through a back-compat constructor that defaults it
+        // to null.
+        FleetConfig cfg = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null, "fleet-workers");
+        assertEquals("fleet-workers", cfg.withDefaults().worktreeGroup(),
+                "withDefaults() must carry a configured worktreeGroup through unchanged");
+    }
+
     @Test
     void absentPrimaryBlockLeavesPrimaryNull(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("no-primary.yaml");

fleetd/src/test/java/dev/ltms/fleet/member/HerdrPeerLauncherAllowListWiringTest.java

@@ -257,6 +257,137 @@ class HerdrPeerLauncherAllowListWiringTest {
                         + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
     }
 
+    /**
+     * fleetd #185 stage 2 pin: with {@code memberHerdrSocket:} absent (today's only mode, and the
+     * default — this host runs no other), the gap detector's WARN/INFO conclusions read exactly as
+     * they did before this fix. Real path: {@code FLEETD_WORKER_TOKEN} (the test profile's own
+     * {@code tokenEnv}) is a name the derived allow-list keeps, so it gets the "UNBLOCKED" WARN;
+     * {@code SOME_UNKNOWN_SECRET_TOKEN} is not derived from anywhere, so it gets the "scrub blanks
+     * them" INFO. This is the exact shape #185 stage 2 must not touch on this path.
+     */
+    @Test
+    void gapConclusionsAreByteIdenticalWhenMemberHerdrSocketIsAbsent() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> config(null));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.contains("memberCredentials gap: 1 credential-shaped env var name(s) are on "
+                        + "neither known: nor allow: — the derived allow-list keeps them anyway (a "
+                        + "profile's gitTokenEnv/gitHostEnv/tokenEnv/env: names one, or this spawn "
+                        + "injects it), so every member pane inherits them UNBLOCKED — [FLEETD_WORKER_TOKEN]. "
+                        + "Add each to memberCredentials.known (or .allow if a member legitimately needs "
+                        + "it), or remove it from whatever profile setting derives it in."),
+                "expected the pre-existing UNBLOCKED WARN unchanged, got: " + messages);
+        assertTrue(messages.contains("memberCredentials gap: 1 credential-shaped env var name(s) are on "
+                        + "neither known: nor allow: — [SOME_UNKNOWN_SECRET_TOKEN]. The allow-list scrub "
+                        + "blanks them anyway (they are not on the derived allow-list), so no member pane "
+                        + "keeps them; add each to memberCredentials.known or .allow to make that explicit."),
+                "expected the pre-existing 'scrub blanks them' INFO unchanged, got: " + messages);
+    }
+
+    /**
+     * fleetd #185 stage 2: with {@code memberHerdrSocket:} configured, member panes run under a
+     * different OS user — {@link HerdrPeerLauncher#hostEnvNames} describes fleetd's own process, not
+     * that user's. Neither "inherits them UNBLOCKED" nor "scrub blanks them" is evidence-backed
+     * there, so neither may print; the single unknown-environment WARN must, naming the config key.
+     */
+    @Test
+    void gapDetectorReportsUnknownInsteadOfAConclusionWhenMemberHerdrSocketIsConfigured() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock"));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.stream().anyMatch(m -> m.contains("memberHerdrSocket")
+                        && m.contains("UNKNOWN") && m.contains("cannot be verified")),
+                "expected the unknown-member-environment WARN naming memberHerdrSocket, got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains("UNBLOCKED")),
+                "the 'inherits them UNBLOCKED' conclusion must not print once the evidence is about "
+                        + "the wrong (daemon's own) environment — got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains("scrub blanks them")),
+                "the 'scrub blanks them' conclusion must not print once the evidence is about the "
+                        + "wrong (daemon's own) environment — got: " + messages);
+    }
+
+    /**
+     * fleetd #185 stage 2: the unknown-environment WARN is a standing fact about this launcher's
+     * configuration, not per-spawn news — it must fire once per launcher instance, the same shape as
+     * every other one-time WARN in this class (e.g. {@code warnNonZsh}).
+     */
+    @Test
+    void theUnknownEnvironmentWarnFiresOnceNotOncePerSpawn() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock"));
+
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.WARN);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+
+        long count = appender.list.stream()
+                .filter(e -> e.getFormattedMessage().contains("cannot be verified from here"))
+                .count();
+        assertEquals(1, count, "the unknown-member-environment WARN must fire once per launcher "
+                + "instance, not once per spawn — got " + count + " occurrence(s) among: "
+                + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
+    }
+
+    /**
+     * Hard constraint: the gap detector must never log an env var VALUE, only its NAME. {@code
+     * SOME_UNKNOWN_SECRET_TOKEN} resolves to a distinctive canary value through the same {@code env}
+     * lookup the launcher uses elsewhere (SHELL, PATH, token resolution) — proving the value IS
+     * resolvable does not mean the detector reads it, since {@link HerdrPeerLauncher#hostEnvNames}
+     * (names only) is its data source, never {@code env.apply(name)} for those names.
+     */
+    @Test
+    void theGapDetectorNeverLogsAnEnvVarValueOnlyItsName() {
+        FakeHerdr herdr = new FakeHerdr();
+        String canary = "sekrit-value-CANARY-9f3a1b7c";
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> config(null), Map.of("SOME_UNKNOWN_SECRET_TOKEN", canary));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.stream().anyMatch(m -> m.contains("SOME_UNKNOWN_SECRET_TOKEN")),
+                "expected the credential-shaped NAME to appear in the log, got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains(canary)),
+                "the log must never contain an env var VALUE, only its NAME — got: " + messages);
+    }
+
+    /** Spawn once through the real launcher path, capturing every INFO+ line this class logs. */
+    private static List<String> spawnAndCaptureLogs(HerdrPeerLauncher launcher) {
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+        return appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList();
+    }
+
     private static String readAll(Path p) {
         try {
             return Files.readString(p);
@@ -294,9 +425,24 @@ class HerdrPeerLauncherAllowListWiringTest {
 
         WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell,
                        Supplier<Set<String>> hostEnvNames, Supplier<FleetConfig> config) {
+            this(herdr, creds, shell, hostEnvNames, config, Map.of());
+        }
+
+        /**
+         * Plus a host-env value map (name → value), resolved through the same {@code env} lookup
+         * every adapter uses for {@code SHELL}/{@code PATH}/token resolution — fleetd #185 stage 2's
+         * "the gap detector never logs a value" tests use this to prove a value that IS resolvable
+         * for a credential-shaped name never reaches the log, since the detector only ever reads
+         * {@code hostEnvNames} (names), never {@code env.apply(name)} (values), for those names.
+         */
+        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell,
+                       Supplier<Set<String>> hostEnvNames, Supplier<FleetConfig> config,
+                       Map<String, String> extraEnvValues) {
             super("test", new AgentControl(herdr), new WorkspaceControl(herdr),
                     Map.of("test", profile()), "test",
-                    name -> "SHELL".equals(name) ? shell : null,
+                    name -> "SHELL".equals(name) ? shell
+                            : (extraEnvValues != null && extraEnvValues.containsKey(name))
+                                    ? extraEnvValues.get(name) : null,
                     0, () -> 0L, () -> { }, null, creds, hostEnvNames, config);
         }
 
@@ -321,6 +467,16 @@ class HerdrPeerLauncherAllowListWiringTest {
                 null, null, null, null, null).withDefaults();
     }
 
+    /**
+     * fleetd #185 stage 2: a config with {@code memberHerdrSocket:} set — member panes run on a
+     * second herdr owned by a different OS user, so {@link HerdrPeerLauncher#hostEnvNames} no
+     * longer describes what a member pane inherits.
+     */
+    private static FleetConfig configWithMemberHerdrSocket(String memberHerdrSocket) {
+        return new FleetConfig(null, null, memberHerdrSocket, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null).withDefaults();
+    }
+
     /** The generated directory is a temp directory; make sure the test does not leave a pile. */
     @Test
     void theGeneratedDirectoryIsRemovedWhenThePaneIsStopped() {

fleetd/src/test/java/dev/ltms/fleet/session/FakeWorktrees.java

@@ -30,12 +30,19 @@ public final class FakeWorktrees implements Worktrees {
     public record PruneCall(String repoRoot, long minAgeMillis) {
     }
 
+    public record ShareCall(String repoRoot, String worktreePath) {
+    }
+
     private final List<AddCall> addCalls = new CopyOnWriteArrayList<>();
     private final List<RemoveCall> removeCalls = new CopyOnWriteArrayList<>();
     private final List<OverlayCall> overlayCalls = new CopyOnWriteArrayList<>();
     private final List<RepoRootCall> repoRootCalls = new CopyOnWriteArrayList<>();
     private final List<SnapshotCall> snapshotCalls = new CopyOnWriteArrayList<>();
     private final List<PruneCall> pruneCalls = new CopyOnWriteArrayList<>();
+    private final List<ShareCall> shareCalls = new CopyOnWriteArrayList<>();
+    /** Tags every {@code overlayParity}/{@code shareWithGroup} call in call order, so a test can
+     *  pin that sharing runs after the overlay copy (fleetd #185 stage 3). */
+    private final List<String> overlayShareOrder = new CopyOnWriteArrayList<>();
     private final Set<String> existingPaths = ConcurrentHashMap.newKeySet();
     private final Set<String> trackedPaths = ConcurrentHashMap.newKeySet();
     private final AtomicLong snapshotSeq = new AtomicLong();
@@ -136,6 +143,13 @@ public final class FakeWorktrees implements Worktrees {
         }
         overlayCalls.add(new OverlayCall(repoRoot, worktreePath, List.copyOf(overlay),
                 List.copyOf(copied), List.copyOf(skipped)));
+        overlayShareOrder.add("overlay:" + worktreePath);
+    }
+
+    @Override
+    public void shareWithGroup(String repoRoot, String worktreePath) {
+        shareCalls.add(new ShareCall(repoRoot, worktreePath));
+        overlayShareOrder.add("share:" + worktreePath);
     }
 
     @Override
@@ -203,4 +217,17 @@ public final class FakeWorktrees implements Worktrees {
     public SnapshotCall lastSnapshot() {
         return snapshotCalls.isEmpty() ? null : snapshotCalls.getLast();
     }
+
+    public List<ShareCall> shareCalls() {
+        return List.copyOf(shareCalls);
+    }
+
+    public ShareCall lastShare() {
+        return shareCalls.isEmpty() ? null : shareCalls.getLast();
+    }
+
+    /** Call-order tags ({@code "overlay:<path>"}/{@code "share:<path>"}) — see field javadoc. */
+    public List<String> overlayShareOrder() {
+        return List.copyOf(overlayShareOrder);
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -924,4 +924,179 @@ class GitWorktreesTest {
         assertEquals(2, stats.count(), "two snapshot refs are reported");
         assertTrue(stats.costBytes() > 0, "the cost of the snapshots is a positive byte count");
     }
+
+    /**
+     * fleetd #185 stage 3: a recording {@link java.util.function.Function} test seam stands in for
+     * every process {@link GitWorktrees#shareWithGroup} would run — no real second OS user/group
+     * exists on this host, so these are unit tests against that seam, not a live-group integration
+     * test (out of scope per the ticket).
+     */
+    private static List<String> joined(String[] command) {
+        return List.of(command);
+    }
+
+    /** Remove {@code path} and anything under it. Tolerates an already-absent path. */
+    private static void deleteRecursively(Path path) throws Exception {
+        if (!Files.exists(path)) {
+            return;
+        }
+        if (Files.isDirectory(path)) {
+            try (java.util.stream.Stream<Path> children = Files.list(path)) {
+                for (Path child : children.toList()) {
+                    deleteRecursively(child);
+                }
+            }
+        }
+        Files.delete(path);
+    }
+
+    /** {@code worktreeGroup} absent ⇒ zero processes spawned and no git config written. */
+    @Test
+    void shareWithGroupIsNoopWhenNoGroupConfigured(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString(), null, _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repo.toString(), repo.resolve("some-worktree").toString());
+
+        assertTrue(recorded.isEmpty(), "no group configured must spawn no process at all: " + recorded);
+    }
+
+    /** A configured group runs {@code git config core.sharedRepository group} first, then
+     *  chgrp/chmod/setgid over every path {@link GitWorktrees#shareWithGroup} documents. */
+    @Test
+    void shareWithGroupRunsConfigThenChgrpChmodSetgidPerPath(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        Path worktree = Files.createDirectories(repo.resolve("some-worktree"));
+        String worktreePath = worktree.toString();
+        Files.createDirectories(repo.resolve(".git/worktrees"));
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            // What real git answers for an ordinary (non-linked) checkout: relative to repoRoot.
+            return List.of(cmd).contains("--git-common-dir") ? ".git\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, worktreePath);
+
+        assertEquals(List.of("git", "-C", repoRoot, "config", "core.sharedRepository", "group"), recorded.get(0),
+                "core.sharedRepository must be set first, so it keeps working after the one-time fix-up");
+        assertTrue(recorded.contains(List.of("git", "-C", repoRoot, "rev-parse", "--git-common-dir")),
+                "the git dir must be asked for, never hardcoded as <repoRoot>/.git — that is a FILE "
+                        + "when the checkout is itself a linked worktree: " + recorded);
+
+        for (String dir : List.of(worktreePath, repoRoot + "/.git/objects", repoRoot + "/.git/refs",
+                repoRoot + "/.git/logs", repoRoot + "/.git/worktrees")) {
+            assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", dir)), "missing chgrp -R for " + dir);
+            assertTrue(recorded.contains(List.of("chmod", "-R", "g+rwX", dir)), "missing chmod -R for " + dir);
+            assertTrue(recorded.contains(List.of("find", dir, "-type", "d", "-exec", "chmod", "g+s", "{}", "+")),
+                    "missing setgid find pass for " + dir);
+        }
+        // packed-refs does not exist in a freshly-init'd repo (only git gc / pack-refs creates it) —
+        // tolerated absence, so it must not appear at all: no recursive/-R treatment for a plain file.
+        String packedRefs = repoRoot + "/.git/packed-refs";
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(packedRefs)),
+                "packed-refs is absent here and must be skipped, not chgrp'd: " + recorded);
+    }
+
+    /**
+     * A path that does not exist is skipped, never handed to {@code chgrp}. {@code .git/logs} is
+     * absent whenever {@code core.logAllRefUpdates} is false or no ref has been updated yet, and
+     * {@code chgrp} on a missing path exits non-zero — which would fail EVERY provisioning spawn
+     * with a message blaming a group that is in fact fine.
+     */
+    @Test
+    void shareWithGroupSkipsPathsThatDoNotExist(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        deleteRecursively(repo.resolve(".git/logs"));
+        assertFalse(Files.exists(repo.resolve(".git/logs")), "fixture: .git/logs must be gone");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return List.of(cmd).contains("--git-common-dir") ? ".git\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, repo.resolve("no-such-worktree").toString());
+
+        String logs = repoRoot + "/.git/logs";
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(logs)),
+                "a missing .git/logs must be skipped, not chgrp'd: " + recorded);
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(repo.resolve("no-such-worktree").toString())),
+                "a missing worktree path must be skipped too: " + recorded);
+        assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", repoRoot + "/.git/objects")),
+                "paths that DO exist are still shared: " + recorded);
+    }
+
+    /**
+     * The git store is located by {@code rev-parse --git-common-dir}, not by appending
+     * {@code /.git}. When git answers with an absolute path — what it does for a linked worktree,
+     * where {@code <repoRoot>/.git} is a file — every shared path must follow that answer.
+     */
+    @Test
+    void shareWithGroupFollowsAnAbsoluteGitCommonDir(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path realGitDir = repo.resolve(".git");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return List.of(cmd).contains("--git-common-dir") ? realGitDir + "\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(tmp.resolve("some/linked/worktree").toString(),
+                repo.resolve("wt").toString());
+
+        assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", realGitDir + "/objects")),
+                "objects must be taken from the reported common dir, not <repoRoot>/.git: " + recorded);
+    }
+
+    /** {@code packed-refs}, when present, is chgrp/chmod'd but never setgid'd (it is a file, not a dir). */
+    @Test
+    void shareWithGroupIncludesPackedRefsWhenPresent(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        Path packedRefsPath = repo.resolve(".git/packed-refs");
+        Files.writeString(packedRefsPath, "");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, repo.resolve("some-worktree").toString());
+
+        String packedRefs = packedRefsPath.toString();
+        assertTrue(recorded.contains(List.of("chgrp", "devteam", packedRefs)),
+                "packed-refs must be chgrp'd non-recursively when present: " + recorded);
+        assertTrue(recorded.contains(List.of("chmod", "g+rwX", packedRefs)),
+                "packed-refs must be chmod'd non-recursively when present: " + recorded);
+        assertTrue(recorded.stream().noneMatch(c -> c.contains("find") && c.contains(packedRefs)),
+                "packed-refs (a file) must never get the recursive setgid pass: " + recorded);
+    }
+
+    /** A group that does not exist (or that the operator is not a member of) fails loudly, naming it. */
+    @Test
+    void shareWithGroupThrowsNamingTheGroupWhenChgrpFails(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString(), "cb185-nonexistent-group-zz");
+        String wt = new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-185-share", "HEAD");
+
+        WorktreeException e = assertThrows(WorktreeException.class,
+                () -> gitWorktrees.shareWithGroup(repo.toString(), wt));
+        assertTrue(e.getMessage().contains("cb185-nonexistent-group-zz"),
+                "exception must name the missing/refused group: " + e.getMessage());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -148,6 +148,10 @@ class SessionManagerTest {
             return 0;
         }
 
+        @Override
+        public void shareWithGroup(String repoRoot, String worktreePath) {
+        }
+
         List<String> removeCalls() {
             return List.copyOf(removeCalls);
         }

fleetd/src/test/java/dev/ltms/fleet/session/WorktreeSessionManagerTest.java

@@ -163,6 +163,37 @@ class WorktreeSessionManagerTest {
                 "tracked copied paths are --skip-worktree'd");
     }
 
+    /**
+     * fleetd #185 stage 3, THE TRAP: {@code overlayParity} copies more files into the worktree
+     * AFTER {@code add} returns, so {@code shareWithGroup} must run after it, not folded into
+     * {@code add()} — otherwise every overlay file lands operator-owned and unwritable for a
+     * different-uid member, with a green test suite hiding it.
+     */
+    @Test
+    void shareWithGroupRunsAfterOverlayParityNotBeforeIt() {
+        FakeHerdr herdr = new FakeHerdr();
+        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
+                .track(".envrc");
+        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
+
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-185", null));
+
+        assertEquals(1, worktrees.overlayCalls().size(), "overlayParity ran exactly once");
+        assertEquals(1, worktrees.shareCalls().size(), "shareWithGroup ran exactly once");
+        FakeWorktrees.OverlayCall overlay = worktrees.lastOverlay();
+        FakeWorktrees.ShareCall share = worktrees.lastShare();
+        assertEquals(s.worktree(), overlay.worktreePath());
+        assertEquals(s.worktree(), share.worktreePath());
+
+        List<String> order = worktrees.overlayShareOrder();
+        int overlayIndex = order.indexOf("overlay:" + s.worktree());
+        int shareIndex = order.indexOf("share:" + s.worktree());
+        assertTrue(overlayIndex >= 0 && shareIndex >= 0, "both calls must be recorded: " + order);
+        assertTrue(overlayIndex < shareIndex,
+                "shareWithGroup MUST run after overlayParity, not before/inside add(): " + order);
+    }
+
     @Test
     void releaseRemovesWorktreeButDoesNotDeleteBranch() {
         FakeHerdr herdr = new FakeHerdr();