fleetd #241 : bound the echo match so a real report is never swallowed

Round 1 used plain bidirectional containment. The direction that catches the real bug -- the pane holds the brief plus a status bar, so the scrape contains the brief -- also fires when a member restates the whole brief and then writes a genuine report under it. That threw the report away and told the lead nothing was produced, which is worse than the bug being fixed: it destroys a delivery instead of merely obscuring one. The safe direction (the scrape is a fragment of the brief) stays unbounded, because a fragment of the brief is by definition not a report. The dangerous direction now requires the scrape to add at most MAX_ECHO_EXCESS_CHARS beyond the brief, which is the amount of TUI chrome a real echo carries. Work by the cb241 worker, committed by the lead: its backend stopped answering after the fix was written, so two turns ended with no commit and no reply. Verified by the lead: 1169 tests, 0 failures; removing the bound turns pinsTheMaximumTuiChromeExcess and completionFallbackKeepsARealReportThatRestatesTheWholeBrief red with 0 compile errors.
fleetd #241 : suppress echoed fallback briefs
2026-09-03 11:39:11 +07:00 · 2026-09-03 11:10:48 +07:00 · 2026-09-03 10:53:51 +07:00 · 2026-09-03 10:52:01 +07:00 · 2026-09-03 10:49:25 +07:00 · 2026-09-03 10:49:10 +07:00
44 changed files with 6986 additions and 229 deletions
@@ -0,0 +1,531 @@
+# CB-201 and CB-227 refinement
+
+Date: 2026-09-03
+
+## Decision
+
+#201 and #227 are one delivery program, but they are not one implementation unit.
+
+#201 has a real seam: `CompletionResolver` can publish a typed backend-error event only after its
+waiter resolution wins. #227 can consume that event without knowing any pane text. The classifier
+must land before the final #227 wiring. However, the policy engine, roster state, and lead nudge can
+be built in parallel with the classifier.
+
+I propose five units. Units 1 to 4 own separate files and can run in parallel. Unit 5 owns all
+composition files and lands after them. It also depends on the #234 defect 2 fix named in the task.
+
+```mermaid
+flowchart LR
+    U1["Unit 1: typed backend-error classification"] --> U5["Unit 5: wire policy, spawn gate, and fleet views"]
+    U2["Unit 2: credential outage policy"] --> U5
+    U3["Unit 3: lead outage nudge"] --> U5
+    U4["Unit 4: durable member outcome"] --> U5
+    D234["#234 defect 2: fail-loud target resolution"] --> U5
+```
+
+*Figure 1. Four file-disjoint foundations feed one composition unit.*
+
+This split keeps `Fleetd.java` under one owner. It also keeps every other production file under one
+unit in this plan.
+
+## Evidence checked in the current branch
+
+I read both issue pages in full. Each page reports zero comments.
+
+| Evidence | What the code says now |
+|---|---|
+| `inject/CompletionResolver.java:229-237` | A turn below two seconds fails before normal scrape classification. A matching fast backend error is therefore only a generic failure today. |
+| `inject/CompletionResolver.java:260-276` and `:332-367` | #211 already added raw-screen classification when `lastAssistantBlock` is empty. The “dead-code question” in #201 is stale on this branch. |
+| `inject/CompletionResolver.java:288-317` | Exhaustion wins before the hard-coded `API Error:` match. A backend error then goes through generic `fail(...)`. |
+| `inject/CompletionResolver.java:311-316` | The code admits that the pattern is a heuristic. A member report which quotes an API error may match it. |
+| `inject/CompletionResolver.java:449-467` | Startup coverage exists only for `exhaustedPattern`. |
+| `inject/ExhaustedPatternLookup.java:13-25` | The current lookup and explicit `none()` value are a good shape for the new classifier seam. |
+| `Fleetd.java:196-207` | One `BackendQuarantine` is shared by placement and the exhaustion sink. Its cooldown comes from `quarantineCooldownSeconds`. |
+| `Fleetd.java:322-363` | Pattern compilation, target-to-profile lookup, and the live `ExhaustionSink` are composed in `Fleetd.main`. The sink on this branch still ends in `.ifPresent(...)`. This plan assumes #234 replaces that silent path. |
+| `placement/BackendQuarantine.java:60-87` | A repeated exhaustion restarts one long quarantine. The store is credential-keyed and uses an injected monotonic clock. |
+| `member/CompositePeerLauncher.java:260-317` | Explicit and policy-selected spawns have separate gates. Both paths must learn about outage cool-off. |
+| `member/CompositePeerLauncher.java:347-379` | Exhaustion refusal already checks a credential for explicit spawns and filters policy candidates. Its error text says “exhausted”. |
+| `placement/PlacementContext.java:10-22` and `PlacementPolicyUtil.java:14-83` | Automatic placement has only one transient exclusion set named `quarantined`. Reusing it would make outage errors say “backend exhausted”. |
+| `mcp/FleetMcp.java:913-1025` | `fleet_list` sets `free: 0` and adds `credentialId` plus `quarantinedForSeconds` when quarantine is active. |
+| `session/MemberSession.java:51-59` | The roster has `DONE` and generic `FAILED`, but no backend-error state or stored reason. |
+| `session/SessionManager.java:695-773` | A normal boundary moves `BUSY` to `DONE`. A failure moves any non-released session to `FAILED`. The async completion resolver can race the `DONE` update. |
+| `session/SessionManager.java:648-687` | `rosterView` reports the session state, but it reports no terminal reason. |
+| `msg/MessageService.java:922-940` | CB-588 already nudges for every terminal async ticket, including failures. Current code would report failed tickets, but it would not report one correlated outage. |
+| `msg/ReplyPushLoop.java:20-48` | Replies, terminal tickets, and questions share one per-lead schedule. This prevents two push sources from injecting competing turns. |
+| `msg/ReplyPushLoop.java:305-395` | Each push entry point resolves the owning lead through `PrimaryRegistry`. Missing ownership is logged and the durable or pending item remains the backstop. |
+| `msg/ReplyPushLoop.java:496-547` | One tick builds one combined nudge. Pending items have separate reminder counts. |
+| `health/FleetHealthMonitor.java:91-143` | Health is a slow periodic observer of members and message-layer facts. It does not receive completion classifications. |
+| `health/FleetHealthMonitor.java:206-208` | `healthCoverage` means health enabled plus webhook configured. It does not describe lead-pane alerts. |
+| `Fleetd.java:465-486` | Health stays `detection-only` without the webhook notification setting. |
+
+I also read the related unit tests for `CompletionResolver`, `ReplyPushLoop`, `BackendQuarantine`,
+`CompositePeerLauncher`, `PlacementPolicyUtil`, `SessionManager`, `MessageService`, and `FleetMcp`.
+
+I did not inspect the in-progress #234 branch. I only used the two measured facts in the task. No
+peer architect was named, so I did not exchange a design with one.
+
+## Required behaviour
+
+The policy should use these first values:
+
+- Threshold: **2** classified backend errors.
+- Window: **60 seconds**, measured from the first error to the second.
+- Cool-off: **60 seconds**, starting when the threshold is reached.
+- Correlation key: `credentialId`, never profile name and never error text.
+- Incident rule: one active incident per credential. Errors during its cool-off do not extend it and
+  do not create more lead notices.
+- Rearm rule: after cool-off ends, two fresh errors are needed for another incident.
+
+Two errors are the smallest threshold which protects the honest one-turn failure. A 60-second window
+fits the measured two-member outage. A 60-second cool-off blocks immediate repeat spawns without
+turning a short backend fault into the default 1,800-second exhaustion quarantine.
+
+A single classified error still fails its send and marks its member `backend_error`. It does not
+cool a credential and does not send an outage notice. This is what “a single error changes nothing”
+must mean at the credential level. It cannot mean that the failed member still looks successful.
+
+```mermaid
+sequenceDiagram
+    participant R1 as Resolver for member A
+    participant R2 as Resolver for member B
+    participant P as Outage policy
+    participant S as Spawn gate
+    participant N as Lead push loop
+    participant L as Lead pane
+
+    R1->>P: backend error for credential C
+    Note over P: Count 1, no cool-off
+    R2->>P: backend error for credential C within 60s
+    P->>P: Start one 60s incident
+    P->>S: Credential C is cooling off
+    P->>N: Queue one incident notice
+    N->>L: Inject when lead is idle, blocked, or done
+    L->>S: Request another spawn on credential C
+    S-->>L: Refuse and report remaining cool-off
+```
+
+*Figure 2. The second independent classification creates the fleet-level event.*
+
+Against the 2026-09-01 case, the second failed member would start cool-off. `fleet_list` would show
+zero free capacity and both members as `backend_error`. The push loop would inject one outage notice
+even if the lead had not polled either ticket yet. The design reports the outage. It does not recover
+uncommitted work from the members.
+
+## Unit 1 — Typed backend-error classification
+
+### Scope
+
+Replace the direct hard-coded check inside `CompletionResolver` with a lookup and a sink. Keep the
+public send result as a failed send. The typed internal event is the seam #227 consumes.
+
+The lookup returns the pattern for a target. The sink receives the target, matched line, and full
+failure reason. It fires only after `Rendezvous.resolveFailure(...)` wins for that exact captured
+waiter. This copies the race rule already used by `ExhaustionSink`.
+
+The classifier must run in all three current paths:
+
+1. a normal non-empty assistant block;
+2. the #211 raw scrape fallback;
+3. a turn inside `MIN_TURN_NANOS`, before it becomes a generic too-fast failure.
+
+In every path, the order stays: stale-baseline guard, exhaustion, backend error, then generic
+failure or completion. A fast turn still fails when no configured pattern matches.
+
+Keep `(?i)\bAPI Error\s*:` as a compatibility pattern for profiles without `errorPattern` until the
+operator config is updated. Do not call this full coverage. Startup reporting in Unit 5 must name
+profiles using this weaker legacy default.
+
+### Files owned
+
+- Add `fleetd/src/main/java/dev/ltms/fleet/inject/BackendErrorPatternLookup.java`.
+- Add `fleetd/src/main/java/dev/ltms/fleet/inject/BackendErrorSink.java`.
+- Change `fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/inject/CompletionResolverTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. A target-specific error pattern matches a normal assistant block and resolves the send as failed.
+2. The same match calls `BackendErrorSink` exactly once after the waiter resolution wins.
+3. A late classification which loses to `fleet_reply` does not call the sink.
+4. An exhausted line that also matches the generic error pattern stays `BACKEND_EXHAUSTED`. It calls
+   only `ExhaustionSink`.
+5. A raw pane with leading Terminal User Interface (TUI) chrome and no assistant marker still uses
+   the #211 fallback and calls the backend-error sink.
+6. A matching error inside the two-second floor is typed and sent to the sink. A non-matching fast
+   turn stays a generic failure.
+7. An unchanged delivery baseline which contains old backend-error text is suppressed. It never
+   increments outage evidence.
+8. A non-match keeps the existing completion result and text.
+9. Constructors used by current callers keep compiling. They use the legacy default lookup and an
+   explicit inert sink until Unit 5 supplies the production objects.
+10. Unit tests pass. The developer runs the focused test first, then `mvn clean install` from
+    `fleetd/`.
+
+### Dependencies
+
+None. Unit 1 can run with Units 2, 3, and 4.
+
+Unit 5 depends on its new lookup, sink, and constructor.
+
+### What to report back
+
+- The exact classifier order in all three paths.
+- The focused test command and result.
+- The test which proves a losing waiter race does not publish an event.
+- The test which proves a fast matching failure is typed.
+- The final `mvn clean install` result.
+- Any constructor kept only for transition and where Unit 5 replaces it.
+
+## Unit 2 — Credential outage policy
+
+### Scope
+
+Build a small credential-keyed state machine. It accepts already-classified backend-error events.
+It does not read pane text, profiles, sessions, or lead state.
+
+Use an injected monotonic clock. A call records `credentialId`, target, and reason. It returns a new
+incident only on the threshold crossing. The incident contains a stable event id, credential id,
+the distinct affected targets, evidence count, window, and remaining cool-off.
+
+This class owns both correlation and short cool-off. Keeping them together makes threshold crossing
+and the cool-off deadline one atomic state change.
+
+### Files owned
+
+- Add `fleetd/src/main/java/dev/ltms/fleet/placement/BackendOutagePolicy.java`.
+- Add `fleetd/src/test/java/dev/ltms/fleet/placement/BackendOutagePolicyTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. One error creates no incident and no cool-off.
+2. Two errors for one credential within 60 seconds create exactly one incident and a 60-second
+   cool-off.
+3. Two errors more than 60 seconds apart do not create an incident.
+4. The exact 60-second boundary has a pinned result. Use inclusive `<= 60s` so scheduler delay does
+   not discard evidence at the boundary.
+5. Different credentials never share evidence.
+6. Different profiles which supply the same credential id do share evidence. The policy itself only
+   sees the credential id.
+7. More errors during active cool-off do not extend its deadline and do not return another incident.
+8. After expiry, old evidence is cleared. Two fresh errors are needed to create the next incident.
+9. Remaining seconds round up, matching `BackendQuarantine` reporting.
+10. Concurrent second and third errors cannot return two incidents.
+11. The focused tests and `mvn clean install` pass.
+
+### Dependencies
+
+None. Unit 2 can run with Units 1, 3, and 4.
+
+Unit 5 depends on the policy API.
+
+### What to report back
+
+- The state transition table and locking method.
+- The exact threshold, window, cool-off, and boundary rule.
+- The test which proves one incident under concurrent calls.
+- The focused test and `mvn clean install` results.
+
+## Unit 3 — Lead outage nudge
+
+### Scope
+
+Add backend incidents as a fourth pending source in `ReplyPushLoop`. Do not create another scheduler
+or call `AgentControl.send` from `Fleetd`. The existing combined per-lead schedule is the control
+which prevents competing injected turns.
+
+The entry point takes an incident id, affected worker targets, credential id, affected profile
+names, and remaining cool-off. It resolves distinct owning leads through `PrimaryRegistry`.
+
+Each `(incidentId, lead)` item is one-shot. It waits while the lead is not injectable. After one
+successful `agents.send`, remove it. A send exception keeps it pending for a bounded retry. It never
+uses the repeated reminder behaviour of an uncollected ticket.
+
+Also add a fail-loud entry point for a classified target that Unit 5 cannot map to a credential. It
+uses `PrimaryRegistry.nudgeTargetFor(target)` and says that correlation could not run. If no lead is
+known, log at `WARN`, not `DEBUG`.
+
+### Files owned
+
+- Change `fleetd/src/main/java/dev/ltms/fleet/msg/ReplyPushLoop.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/msg/ReplyPushLoopTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. One incident affecting two workers owned by one lead causes one successful pane injection.
+2. Two affected workers owned by two leads cause one successful injection per affected lead. This
+   is one notice per event per lead, not one notice per member.
+3. Repeating the same incident id is idempotent.
+4. A busy or unknown lead is not injected. The item stays pending until the lead becomes injectable
+   or its attempt cap is reached.
+5. After one successful injection, later ticks do not mention that incident again.
+6. A failed `agents.send` is retried within the existing bound. A successful retry still gives only
+   one successful send.
+7. A pending ticket and an outage incident for one lead appear in one combined nudge, not two
+   competing turns.
+8. The text names the credential, profiles, affected workers, and remaining cool-off. It tells the
+   lead to run `fleet_list`.
+9. An unmapped target produces a direct warning notice when a lead is known. If no lead is known,
+   the code logs a `WARN` naming the target and reason.
+10. `stop()` clears incident state as it clears other push state.
+11. Existing reply, ticket, and question tests stay green. The focused tests and
+    `mvn clean install` pass.
+
+### Dependencies
+
+None. The API uses plain values, not the Unit 2 incident class. This lets Unit 3 run in parallel.
+
+Unit 5 adapts the Unit 2 incident into this entry point.
+
+### What to report back
+
+- The exact one-shot and retry rules.
+- The test showing one combined nudge with a failed ticket.
+- The test showing one successful send for two affected workers.
+- The focused test and `mvn clean install` results.
+
+## Unit 4 — Durable member backend-error outcome
+
+### Scope
+
+Make a classified backend failure remain visible after its ticket is collected or expires.
+
+Add `BACKEND_ERROR` to `MemberSession.State`. Add a nullable failure detail to `MemberSession` and
+render it as `failureReason` in `SessionManager.rosterView`. Add
+`SessionManager.onBackendError(target, reason)`.
+
+The transition must handle both completion orderings:
+
+- `BUSY -> BACKEND_ERROR` when classification wins before the normal completion state update;
+- `DONE -> BACKEND_ERROR` when the async resolver runs after `SessionManager.onTurnComplete`.
+
+It must use a compare-and-set retry or another atomic update. `RELEASED` must never return to the
+roster. A backend-error member is terminal and cannot accept another delivery.
+
+### Files owned
+
+- Change `fleetd/src/main/java/dev/ltms/fleet/session/MemberSession.java`.
+- Change `fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java`.
+- Change `fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java`.
+
+No other unit may edit these files.
+
+### Acceptance criteria
+
+1. `onBackendError` moves a `BUSY` member to `BACKEND_ERROR` and stores the reason.
+2. It also moves `DONE` to `BACKEND_ERROR`, covering the resolver race.
+3. A later normal `onTurnComplete` cannot change `BACKEND_ERROR` back to `DONE`.
+4. A released or unknown member is not recreated. The unknown case logs at `WARN` and returns an
+   explicit false result to its caller.
+5. `onDelivered` refuses a `BACKEND_ERROR` member, just as it refuses generic `FAILED`.
+6. `rosterView` reports `state: backend_error` and `failureReason` after the send ticket is gone.
+7. Ordinary members do not gain a blank or invented `failureReason` field.
+8. Existing constructors keep source compatibility for tests and adapters.
+9. The focused tests and `mvn clean install` pass.
+
+### Dependencies
+
+None. Unit 4 can run with Units 1, 2, and 3.
+
+Unit 5 calls the new session method from the production sink.
+
+### What to report back
+
+- The two race orderings and the tests for both.
+- The exact roster JSON shape.
+- The unknown-target result and log level.
+- The focused test and `mvn clean install` results.
+
+## Unit 5 — Production wiring, spawn gate, and fleet views
+
+### Scope
+
+Compose Units 1 to 4 in production. This is the only unit which edits `Fleetd.java`.
+
+Add per-profile `errorPattern` config beside `exhaustedPattern`. Compile both once at startup. A
+configured pattern wins over the legacy default. Report configured profiles and legacy-default
+profiles separately at startup. A bad regex must stop startup with the profile and key in the
+message.
+
+Wire one production `BackendErrorSink` with this order:
+
+1. mark the member `backend_error` with its reason;
+2. resolve the profile and its current `effectiveCredentialId()` through the fail-loud #234 seam;
+3. record the error in `BackendOutagePolicy`;
+4. on a new incident, submit one event to `ReplyPushLoop`.
+
+If target metadata cannot be resolved, do not end in `Optional.ifPresent`. Log an error and call the
+Unit 3 unmapped-target notice. The failed send still reaches its ticket through CB-588.
+
+Teach both spawn paths about a separate cool-off source. Exhaustion quarantine has priority when
+both states are active. Automatic placement needs a distinct `coolingOff` set so its refusal does
+not say “exhausted”.
+
+Extend the MCP (Model Context Protocol) views:
+
+- A cooling profile has `free: 0`, `credentialId`, and `coolingOffForSeconds` in `fleet_list`.
+- It does not have `quarantinedForSeconds` unless exhaustion quarantine is also active.
+- `fleet_profiles` has a separate `coolingOff` map, not an entry in `quarantined`.
+- A direct spawn refusal says the credential is cooling off after repeated backend errors and gives
+  the remaining seconds.
+
+Do not change `FleetHealthMonitor.coverage`. It still describes the periodic health webhook path.
+Lead-pane outage delivery is a separate capability.
+
+### Files owned
+
+- `fleetd/src/main/java/dev/ltms/fleet/Fleetd.java`
+- `fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java`
+- `fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java`
+- `fleetd/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java`
+- `fleetd/src/main/java/dev/ltms/fleet/placement/PlacementContext.java`
+- `fleetd/src/main/java/dev/ltms/fleet/placement/PlacementPolicyUtil.java`
+- `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java`
+- `fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/member/CompositePeerLauncherTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/placement/PlacementPolicyTest.java`
+- `fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java`
+- Add `fleetd/src/test/java/dev/ltms/fleet/BackendOutageFlowTest.java`.
+- `fleetd/fleetd.example.yaml`
+- `CLAUDE.md`
+
+No earlier unit edits these files.
+
+The lead, not a worker, must update `wiki/7-Use-Cases.md`, `wiki/9-Implementation.md`, and
+`wiki/11-Features.md`. Project rules forbid workers from committing `wiki/`. The portable block in
+`CLAUDE.md` and `wiki/7-Use-Cases.md` must remain byte-identical.
+
+### Acceptance criteria
+
+1. `errorPattern` binds per profile. Blank uses the legacy default and is reported as degraded
+   coverage. A config reload which changes it is reported as deferred because patterns are compiled
+   at startup.
+2. A malformed `errorPattern` stops startup and names `profiles.<name>.errorPattern`.
+3. The real production sink never silently drops an unknown target. A test captures its error log
+   and the fallback notice call.
+4. One real backend-error classification through `CompletionResolver` marks only its member. It does
+   not cool the credential and does not send an outage notice.
+5. Two real classifications for one credential within 60 seconds start one incident.
+6. The integration test then calls the real explicit-profile spawn gate. It is refused before any
+   adapter spawn call, with “cooling off” and remaining seconds in the message.
+7. The same test calls an automatic placement path. A cooling candidate is skipped. If every
+   candidate is cooling, the error names cool-off rather than exhaustion.
+8. Profiles sharing the credential are all blocked. A profile on another credential stays usable.
+9. `fleet_list` from the same fixture shows both members as `backend_error`, preserves each failure
+   reason, and reports `free: 0`, the credential, and `coolingOffForSeconds`.
+10. `fleet_profiles` reports cool-off separately from quarantine.
+11. The real `ReplyPushLoop` receives one incident and makes one successful lead-pane send. Existing
+    failed-ticket notice content may share that same combined send.
+12. Exhaustion still wins when a line matches both patterns. A simultaneous exhaustion quarantine
+    also wins in spawn errors and fleet views.
+13. After the 60-second cool-off, spawn is allowed again. A new incident needs two fresh errors.
+14. `healthCoverage` has the same value before and after this change for the same health config.
+15. `fleetd.example.yaml` explains `errorPattern`, the legacy fallback, 2/60/60 policy, and the
+    difference between cool-off and exhaustion quarantine.
+16. `CLAUDE.md` tells leads how `fleet_profiles` and `fleet_list` report cool-off. The lead later
+    applies the matching wiki updates and runs the documented byte-sync check.
+17. The developer records the new end-to-end test failing before implementation, then passing. The
+    focused suites and `mvn clean install` pass.
+
+### Dependencies
+
+Unit 5 starts only after Units 1 to 4 are merged or rebased into its branch. It also starts after the
+#234 defect 2 fix lands, because both areas touch the same target-resolution control path.
+
+### What to report back
+
+- The exact commits used for Units 1 to 4 and #234.
+- The startup coverage line with one configured and one legacy-default profile.
+- The red test output before the implementation and its green result after.
+- The explicit and automatic spawn refusal text.
+- Sample `fleet_list` and `fleet_profiles` JSON for cool-off and exhaustion.
+- The number and text of lead-pane sends in the real-path test.
+- The focused test commands and final `mvn clean install` result.
+- The exact `CLAUDE.md` change and the wiki edits the lead must apply.
+
+## File ownership summary
+
+| Area | Unit | Shared edit risk |
+|---|---:|---|
+| Completion classification | 1 | Only Unit 1 edits `CompletionResolver` and its test. |
+| Correlation and cool-off state | 2 | New files only. |
+| Lead push scheduling | 3 | Only Unit 3 edits `ReplyPushLoop` and its test. |
+| Member terminal state | 4 | Only Unit 4 edits `MemberSession`, `SessionManager`, and their test. |
+| Main composition, config, placement, MCP views, shipped prompt | 5 | Only Unit 5 edits `Fleetd`, `FleetConfig`, `CompositePeerLauncher`, placement context, `FleetMcp`, and `CLAUDE.md`. |
+| Wiki propagation | Lead after Unit 5 | Workers do not commit the wiki submodule. |
+
+## What I would not build
+
+1. **Do not reuse `BackendQuarantine` for outages.** Its repeat call restarts a long credential
+   quarantine. Its fields and errors say “exhausted”. That is wrong for a short outage.
+2. **Do not merge the exhaustion and generic error patterns.** Exhaustion must win because it has a
+   different policy and duration.
+3. **Do not group by error string.** One outage can produce different text. The shared operational
+   limit is the credential.
+4. **Do not mark a profile unusable until config changes.** The current classifier cannot safely
+   tell a permanent malformed request from a transient service fault. A permanent state would need
+   a stronger error taxonomy first.
+5. **Do not quarantine on the first generic backend error.** That would turn one bad request or one
+   false pattern match into a fleet-wide capacity loss.
+6. **Do not add this to `FleetHealthMonitor`.** The monitor samples slow member health. The exact
+   backend event already exists at completion resolution, and moving it to polling would lose type
+   and time.
+7. **Do not add another direct lead injector.** `ReplyPushLoop` already owns status gating,
+   per-lead coalescing, retry bounds, and heartbeat stand-down.
+8. **Do not change `healthCoverage` to `full`.** That field still means a webhook notification sink
+   exists for periodic health. A backend outage nudge does not make every health event visible.
+9. **Do not persist incident history across daemon restart in this work.** Existing exhaustion
+   quarantine is also in memory. A 60-second state does not justify a new durable store.
+10. **Do not build work recovery.** The PR-body survival story proves why checkpoint-first work is
+    useful, but these tickets are about detection, capacity, and signalling.
+11. **Do not remove the legacy `API Error:` fallback in the first release.** Doing so would turn an
+    unedited config back into a false successful completion. Report it as degraded coverage instead.
+12. **Do not reorder or add the old `visibleTurn` fallback from #201.** #211 already implemented the
+    narrow raw-scrape fallback at `CompletionResolver.classifyRawScrapeFallback`.
+
+## Riskiest assumption and cheapest experiment
+
+The riskiest assumption is that a configured error regex means “the backend failed this turn”. The
+current code and test already show the counterexample: a worker may quote `API Error:` while writing
+a valid report. Two such false matches on one credential would now remove capacity for 60 seconds.
+
+The cheapest experiment is a replay corpus before Unit 5 ships:
+
+1. Save the full pane text from the measured 2026-09-01 outage.
+2. Produce one safe failure per backend with a disposable invalid endpoint or request.
+3. Save one valid member report which quotes each error line.
+4. Replay all samples through the real `CompletionResolver` test fixture.
+5. Require outage samples to match and quoted-report samples not to match after assistant-block
+   extraction and baseline checks.
+
+This costs no outage deployment and no real sleep. If quoted reports still match, narrow the profile
+patterns before enabling correlation. Do not raise the threshold to hide a bad classifier.
+
+## Sequencing with three developers
+
+First wave:
+
+1. Developer A: Unit 1, typed classification.
+2. Developer B: Unit 2, credential outage policy.
+3. Developer C: Unit 3, lead outage nudge.
+
+As soon as one slot is free, start Unit 4. It is file-disjoint from every first-wave unit. Merge and
+review Units 1 to 4 independently.
+
+Start Unit 5 only after all four foundations and #234 are available. Unit 5 is the only high-conflict
+integration branch, so no other active unit should touch its file list.
+
+## Checks performed for this refinement
+
+- Read issue #201 and issue #227 through their Gitea pages. Both showed zero comments.
+- Read the source and tests named in the evidence section.
+- Ran `git status --short --branch`; the branch was clean before this document was added.
+- Ran `git log --oneline -12` to identify the branch base.
+- I did not run Maven because this change adds only a design document.
+- Rendered both Mermaid blocks with `npx @mermaid-js/mermaid-cli`; both commands succeeded.
@@ -117,6 +117,15 @@ herdrSocket: ~/.config/herdr/herdr.sock
 # Optional socket for member panes. Omit this to use herdrSocket for both leads and members.
 # memberHerdrSocket: /Users/member/.config/herdr/herdr.sock

+# fleetd #213: the login shell the member OS user (memberHerdrSocket above) actually runs. ONLY
+# read when memberHerdrSocket is set — fleetd's own $SHELL says nothing about a pane running
+# under a different OS user, and there is no channel to ask herdr for that user's shell, so this
+# must be told rather than guessed. Absent, blank, or anything not ending in "zsh" is treated the
+# same as "not zsh": the memberCredentials.policy: allow-list ZDOTDIR scrub (see worktreeGroup
+# below) is skipped in favour of the weaker CB-596 sentinel overlay — a degraded control, never a
+# refusal to spawn. When memberHerdrSocket is absent this key is never consulted at all.
+# memberLoginShell: /bin/zsh
+
 # How member sessions are spawned. Define one or more named profiles (backends) under
 # `profiles`; each key is the profile name (also the ccs profile). A profile says only WHICH
 # BACKEND — model, CLI adapter, credentials, cost. It says nothing about what a member spawned on
@@ -634,6 +643,24 @@ guard:
 # to a sibling directory of the repo root.
 # worktreeRoot: /Users/me/src/.bridged-worktrees

+# Worktree group sharing (fleetd #185 stage 3). OPTIONAL, off by default. Names an OS group
+# that a provisioned worktree's repo is made group-writable for (git config
+# core.sharedRepository group, plus a one-time chgrp/chmod/setgid fix-up), so a member spawned
+# under a DIFFERENT OS user (see memberHerdrSocket) can write its own worktree, its
+# per-worktree git metadata, and its own commit objects — without it, every file GitWorktrees
+# creates is owned by fleetd's own uid and unwritable by another user.
+# CAUTION: this isolates credentials, not the repository — a member in the group can still
+# write the operator's git objects and refs in the shared repo. The operator running fleetd
+# must already be a member of the named group, or every provisioning spawn fails loudly.
+#
+# fleetd #213: this is also the ONE group the memberCredentials.policy: allow-list ZDOTDIR scrub
+# reuses when memberHerdrSocket is set — deliberately not a second config key. Under
+# memberHerdrSocket, the scrub directory is generated under worktreeRoot (never java.io.tmpdir,
+# which the member OS user cannot reach) and shared read-only with this group. If worktreeGroup
+# is unset while memberHerdrSocket is set, the scrub cannot be guaranteed reachable by the member,
+# so fleetd falls back to the weaker CB-596 sentinel overlay instead (a WARN names the gap).
+# worktreeGroup: fleet-workers
+
 # Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
 # the feature disabled. By default the daemon never reaps, caps, or drains sessions.
 #   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)
@@ -169,6 +169,18 @@ public final class Fleetd {
            }
        });
        List<HerdrPeerLauncher> adapters = new ArrayList<>();
+        // fleetd #175: the daemon's real ExhaustionSink can only be built once `sessions` exists
+        // (below), but `sessions` needs `workers`, which needs the adapters built right here — a
+        // genuine cycle. Break it exactly like liveCountRef below: a forwarding sink built now,
+        // pointed at the real one once it exists.
+        AtomicReference<ExhaustionSink> exhaustionSinkRef = new AtomicReference<>(ExhaustionSink.none());
+        // fleetd #234, round 4: routed through the shared ExhaustionSink.forwardingTo factory
+        // rather than written inline here — not because a lambda at this call site is unsafe
+        // anymore (it is not: the 3-arg overload is now the interface's single abstract method, so
+        // there is no 2-arg overload left for any lambda to silently bind to instead), but so a
+        // test can call the exact same object this line builds, instead of asserting a copy of its
+        // shape (round 3's lesson).
+        ExhaustionSink forwardingExhaustionSink = ExhaustionSink.forwardingTo(exhaustionSinkRef::get);
        // The claude-code adapter is the always-present default; keep it even with no profiles (so a
        // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
        // unless opencode is the only kind configured.
@@ -184,7 +196,7 @@ public final class Fleetd {
                    opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                    () -> config.get().fleet(),
-                    () -> config.get().memberCredentials(), config::get));
+                    () -> config.get().memberCredentials(), config::get, forwardingExhaustionSink));
        }
        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
        // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
@@ -224,7 +236,7 @@ public final class Fleetd {
            contextCap = cfg.lifecycle().contextCap();
        }
        boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup()),
                System::nanoTime, contextCap, clearAfterTurn);
        liveCountRef.set(profileName -> (int) sessions.roster().stream()
                .filter(s -> profileName.equals(s.profile()))
@@ -334,20 +346,56 @@ public final class Fleetd {
        // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
        // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
        // the profile config live off `config`, so a credentialId edit is hot: no restart needed.
-        ExhaustionSink exhaustionSink = (target, reason) -> sessions.roster().stream()
-                .filter(session -> target.equals(session.terminalId()))
-                .findFirst()
-                .map(MemberSession::profile)
-                .map(profileName -> config.get().profiles().get(profileName))
-                .ifPresent(profile -> {
-                    String credentialId = profile.effectiveCredentialId();
-                    quarantine.quarantine(credentialId);
-                    log.warn("credential '{}' quarantined for {}s (profile '{}' classified "
-                                    + "BACKEND_EXHAUSTED): {}", credentialId,
-                            cfg.quarantineCooldownSeconds(), profile.profile(), reason);
-                });
+        //
+        // fleetd #175: this sink is now also the quarantine target for OpenCodeLauncher's
+        // model-mismatch check — it needs nothing profile-specific from the caller beyond `target`
+        // (a herdr terminal id) and `reason`, so reusing it here is exactly "the existing
+        // ExhaustionSink path", not a new mechanism.
+        //
+        // fleetd #234: that check fires from SessionAwareHandle.agentSessionId(), which runs during
+        // SessionManager.acquire() BEFORE this session is registered in sessions.roster() — so the
+        // roster-only lookup below used to find nothing, .ifPresent silently no-op'd, and the
+        // ERROR the check had just logged ("quarantining this profile's credential") was a lie:
+        // nothing was quarantined, and nothing said so. Two changes: (1) OpenCodeLauncher now
+        // passes its OWN profile name via ExhaustionSink's 3-arg overload — it already has the
+        // FleetConfig.Profile in hand and does not need the roster at all — used here as a
+        // fallback whenever the roster lookup misses; (2) if a profile still cannot be resolved
+        // (neither the roster nor the hint names a configured one), this logs loudly at ERROR
+        // instead of silently doing nothing — a control that cannot act must say so.
+        // fleetd #234, round 4: the 3-arg overload is now ExhaustionSink's single abstract method,
+        // so this is safely a lambda — there is no separate 2-arg overload left for it to bind to
+        // instead and silently drop profileHint (that was rounds 1-3's whole hazard).
+        ExhaustionSink exhaustionSink = (target, reason, profileHint) -> {
+            String profileName = sessions.roster().stream()
+                    .filter(session -> target.equals(session.terminalId()))
+                    .findFirst()
+                    .map(MemberSession::profile)
+                    .orElse(profileHint);
+            FleetConfig.Profile profile = profileName == null ? null : config.get().profiles().get(profileName);
+            if (profile == null) {
+                log.error("quarantine requested for target '{}' ({}) but no profile could be "
+                                + "resolved — the target is not (yet) in the roster, and {} — "
+                                + "credential NOT quarantined (fleetd #234)",
+                        target, reason,
+                        profileHint == null ? "no profile hint was given"
+                                : "the hinted profile '" + profileHint + "' is not configured");
+                return;
+            }
+            String credentialId = profile.effectiveCredentialId();
+            quarantine.quarantine(credentialId);
+            log.warn("credential '{}' quarantined for {}s (profile '{}'): {}", credentialId,
+                    cfg.quarantineCooldownSeconds(), profile.profile(), reason);
+        };
+        // fleetd #175: point the forwarding sink handed to OpenCodeLauncher above at the real one,
+        // now that `sessions` exists to resolve target -> session -> profile.
+        exhaustionSinkRef.set(exhaustionSink);
        AgentControl agents = router.memberAgents();
-        CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns, exhaustionSink);
+        CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns, exhaustionSink,
+                target -> sessions.roster().stream()
+                        .filter(session -> target.equals(session.terminalId()))
+                        .findFirst()
+                        .map(session -> new CompletionResolver.WorktreeBranch(session.worktree(), session.branch()))
+                        .orElse(null));
        // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
        // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
        MemberPresence presence = sessions.asPresence();
@@ -782,7 +830,7 @@ public final class Fleetd {

    /**
     * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
-     * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
+     * subscription} profile's explicitly configured {@code tokenEnv} (a subscription profile never reads one, see
     * {@link FleetConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
     * where set (opt-in), plus a configured {@code broker.uriEnv} (CB-151). Derived from the
     * config, not hard-coded, so a new profile is covered for free. A var required by more than one
@@ -799,7 +847,9 @@ public final class Fleetd {
    static Map<String, List<String>> requiredSecretEnvVars(FleetConfig cfg) {
        Map<String, List<String>> requiredBy = new LinkedHashMap<>();
        cfg.profiles().forEach((name, profile) -> {
-            if (!profile.isSubscription()) {
+            // All kinds are checked when tokenEnv is explicit. OpenCode may use provider credentials,
+            // but an explicit tokenEnv still declares a required host secret for its configured provider.
+            if (!profile.isSubscription() && profile.hasTokenEnv()) {
                requiredBy.computeIfAbsent(profile.tokenEnv(), _ -> new ArrayList<>())
                        .add("profile '" + name + "' tokenEnv");
            }
@@ -825,7 +875,7 @@ public final class Fleetd {
     * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
     * what is wrong is strictly more useful than one that will not boot at all.
     */
-    private static void reportRequiredSecrets(FleetConfig cfg) {
+    static void reportRequiredSecrets(FleetConfig cfg) {
        Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
        if (requiredBy.isEmpty()) {
            log.info("startup secrets: no profile references a token env var — nothing to check");
@@ -5,17 +5,70 @@ import dev.ltms.fleet.peer.MemberRole;
 /** Optional session lifecycle hook for live member-slot bindings. */
 public interface MemberLifecycle {

+    /** A slot held before a member process starts. */
+    record SlotReservation(String slot, String profile) { }
+
    MemberLifecycle NONE = new MemberLifecycle() {
        @Override
-        public void acquired(MemberRole role, String profile, String terminal) {
+        public MemberRole acquired(MemberRole role, String profile, String terminal) {
+            return role; // no registry configured — nothing to bind against, so the request stands
        }

        @Override
        public void released(String terminal) {
        }
+
+        @Override
+        public void requireSlotFor(MemberRole role, String profile) {
+            // no registry configured — nothing to validate against, so nothing is refused
+        }
+
+        @Override
+        public SlotReservation reserve(MemberRole role, String profile) {
+            return null;
+        }
+
+        @Override
+        public boolean bind(SlotReservation reservation, String terminal) {
+            return false;
+        }
+
+        @Override
+        public void release(SlotReservation reservation) {
+        }
    };

-    void acquired(MemberRole role, String profile, String terminal);
+    /**
+     * Try to bind a newly spawned {@code terminal} into the role it was granted.
+     *
+     * @return the role this session actually holds: {@code role} unchanged for a role with no
+     *         live slot-binding semantics (dev, reviewer), or when the bind succeeded; a fallback
+     *         role — never {@code role} — when a slot-bound role (architect) could not be bound.
+     *         Callers must record THIS value on the session, never the requested {@code role}, so
+     *         a later roster read never reports a role the session does not hold (CB-619). In
+     *         normal operation this fallback should not happen once a reservation has been bound.
+     *         It remains the honest answer if a caller has no reservation, or if binding a
+     *         reservation unexpectedly fails.
+     */
+    MemberRole acquired(MemberRole role, String profile, String terminal);

    void released(String terminal);
+
+    /**
+     * Refuse an acquire before anything spawns when {@code role} requires a live slot binding and
+     * no configured slot carries {@code profile} (CB-619 / fleetd #123). A no-op for a role with
+     * no slot-binding semantics.
+     *
+     * @throws IllegalArgumentException naming the role, the profile, and the pools that do carry it
+     */
+    void requireSlotFor(MemberRole role, String profile);
+
+    /** Reserve a matching slot before launch, or refuse before a charter can be delivered. */
+    SlotReservation reserve(MemberRole role, String profile);
+
+    /** Convert a reservation into a live terminal binding. */
+    boolean bind(SlotReservation reservation, String terminal);
+
+    /** Return an unbound reservation after a failed launch. */
+    void release(SlotReservation reservation);
 }
@@ -8,6 +8,7 @@ import org.slf4j.LoggerFactory;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;

@@ -55,8 +56,10 @@ public final class MemberRegistry implements MemberLifecycle {
    }

    private final Map<String, Entry> slots;
-    /** Live {@code terminal_id → qualified slot key}; guarded by {@code this}. */
+    /** Live {@code terminal_id → qualified slot key}; guarded by {@code terminalToSlot}. */
    private final Map<String, String> terminalToSlot = new HashMap<>();
+    /** Slot keys held between reservation and the terminal binding. Guarded by terminalToSlot. */
+    private final java.util.Set<String> reservedSlots = new java.util.HashSet<>();

    /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
    public MemberRegistry(FleetConfig.Fleet fleet) {
@@ -166,7 +169,7 @@ public final class MemberRegistry implements MemberLifecycle {
            if (existingSlot != null) {
                return slot.equals(existingSlot); // already this slot (idempotent) or a different one
            }
-            if (terminalToSlot.containsValue(slot)) {
+            if (terminalToSlot.containsValue(slot) || reservedSlots.contains(slot)) {
                return false; // slot already hosts a terminal — no second one
            }
            terminalToSlot.put(terminal, slot);
@@ -206,19 +209,116 @@ public final class MemberRegistry implements MemberLifecycle {
     *
     * <p>The role check is lifecycle policy. {@link CallerResolver} repeats it when resolving a
     * binding, so a later lifecycle regression cannot turn a worker into an architect.
+     *
+     * <p>CB-619 / fleetd #123: the return value is the role this session actually holds, and the
+     * caller is required to record THAT — never the requested {@code role} — on the session. Before
+     * this fix the caller kept the requested role regardless of whether the bind below succeeded, so
+     * a demoted session's {@code GET /members} row still said {@code "architect"} while
+     * {@code fleet_whoami} (which reads the live binding, not the request) correctly said
+     * {@code "worker"} — three sources of truth that disagreed about one live member, silently.
     */
    @Override
-    public void acquired(MemberRole role, String profile, String terminal) {
+    public MemberRole acquired(MemberRole role, String profile, String terminal) {
        if (role != MemberRole.ARCHITECT || terminal == null || terminal.isBlank()) {
-            return;
+            return role;
        }
        // slotsFor preserves definition order, so duplicate-profile slots use the first free one.
        for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
            if (Objects.equals(profile, entry.profile()) && bind(entry.key(), terminal)) {
-                return;
+                return MemberRole.ARCHITECT;
+            }
+        }
+        // fleetd #123: at least WARN — a role downgrade that the roster must now also reflect is
+        // not routine bookkeeping. requireSlotFor already refuses the config-gap case (no slot at
+        // all carries this profile) before a process ever spawns; reaching here means the config DID
+        // carry a matching slot but every one of them was already bound to a different terminal — a
+        // race this pre-spawn check cannot close on its own (see requireSlotFor's javadoc).
+        log.warn("member slot: no free architect slot for profile={} terminal={}; holding the session "
+                + "as {} instead of the architect it asked for — every configured slot for this "
+                + "profile is already bound to a different terminal", profile, terminal,
+                MemberRole.DEV.wireName());
+        return MemberRole.DEV;
+    }
+
+    /**
+     * CB-619 / fleetd #123: refuse an architect acquire before anything spawns when no configured
+     * slot carries {@code profile} — the config-gap case from the original defect report (a spawn
+     * asked for {@code role=architect, profile=sonnet}, and {@code fleet.architects} carried only
+     * {@code opus} and {@code sol}). A dev/reviewer acquire is always a no-op: those pools are
+     * placement candidates only (see {@code CompositePeerLauncher}), never a live identity binding,
+     * so there is nothing here to refuse — an explicit profile outside the pool for those roles is a
+     * documented operator override, not a defect.
+     *
+     * <p>This closes the config-gap case, not the live-capacity case: a profile that DOES carry a
+     * slot can still lose the race to a concurrent spawn between this check and the actual
+     * {@link #bind}, which is why {@link #acquired} must still answer honestly even after this
+     * check has passed.
+     */
+    @Override
+    public void requireSlotFor(MemberRole role, String profile) {
+        if (role != MemberRole.ARCHITECT) {
+            return;
+        }
+        boolean hasSlot = slotsFor(MemberRole.ARCHITECT).values().stream()
+                .anyMatch(e -> Objects.equals(profile, e.profile()));
+        if (hasSlot) {
+            return;
+        }
+        List<String> pools = slotsFor(MemberRole.ARCHITECT).values().stream()
+                .map(Entry::profile)
+                .distinct()
+                .toList();
+        throw new IllegalArgumentException(
+                "no " + role.wireName() + " slot for profile '" + profile + "' — an architect's "
+                        + "identity IS the slot it is bound to, so there is nothing to bind this "
+                        + "session's identity to. fleet." + role.configKey() + " carries profiles: "
+                        + (pools.isEmpty() ? "(none configured)" : String.join(", ", pools))
+                        + "; add profile '" + profile + "' there, or spawn " + role.wireName()
+                        + " on one of those profiles instead");
+    }
+
+    @Override
+    public SlotReservation reserve(MemberRole role, String profile) {
+        if (role != MemberRole.ARCHITECT) {
+            return null;
+        }
+        synchronized (terminalToSlot) {
+            for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
+                if ((profile == null || profile.isBlank() || Objects.equals(profile, entry.profile()))
+                        && !terminalToSlot.containsValue(entry.key()) && reservedSlots.add(entry.key())) {
+                    return new SlotReservation(entry.key(), entry.profile());
+                }
+            }
+        }
+        throw new IllegalArgumentException("no free architect slot for profile '" + profile
+                + "' — every matching slot is already bound or reserved");
+    }
+
+    @Override
+    public boolean bind(SlotReservation reservation, String terminal) {
+        if (reservation == null || terminal == null || terminal.isBlank()) {
+            return false;
+        }
+        synchronized (terminalToSlot) {
+            if (!reservedSlots.remove(reservation.slot())) {
+                return false;
+            }
+            if (!isSlot(reservation.slot()) || terminalToSlot.containsKey(terminal)
+                    || terminalToSlot.containsValue(reservation.slot())) {
+                return false;
+            }
+            terminalToSlot.put(terminal, reservation.slot());
+            return true;
+        }
+    }
+
+    @Override
+    public void release(SlotReservation reservation) {
+        if (reservation != null) {
+            synchronized (terminalToSlot) {
+                reservedSlots.remove(reservation.slot());
            }
        }
-        log.info("member slot: no free architect slot for profile={}; session remains a worker", profile);
    }

    /** Unbind a released terminal using the compare-safe registry operation. */
@@ -76,6 +76,26 @@ import java.util.Set;
 *                      stay on {@code broker}'s vhost). {@code null} → no lead mailbox is opened.
 *                      Config parsing + accessors only — nothing here wires it into a live
 *                      {@code LeadMailbox}; that is a separate ticket. See {@link Coordinator}.
+ * @param worktreeGroup optional OS group name (fleetd #185 stage 3) that makes a provisioned
+ *                      worktree's repo group-shared, so a member running as a different OS user
+ *                      (see {@code memberHerdrSocket}) can write its own worktree, its per-worktree
+ *                      git metadata, and its own commit objects. {@code null}/blank/empty ⇒ off,
+ *                      today's behaviour unchanged (every file stays owned by fleetd's own uid).
+ *                      <strong>This isolates credentials, not the repository</strong>: a member in
+ *                      the group can still write the operator's git objects and refs in the shared
+ *                      repo. See {@link dev.ltms.fleet.session.Worktrees#shareWithGroup}.
+ * @param memberLoginShell fleetd #213: the login shell the member's OS user actually runs, ONLY
+ *                      meaningful (and only ever read) when {@code memberHerdrSocket} is
+ *                      configured — that mode spawns member panes under a different OS user than
+ *                      fleetd's own process, so fleetd's own {@code $SHELL} says nothing about what
+ *                      that pane runs. There is no channel to ask herdr for another user's shell, so
+ *                      this must be told, never guessed. {@code null}/blank (or a value not ending
+ *                      in {@code zsh}) is treated the same as "not zsh": the {@code
+ *                      memberCredentials.policy: allow-list} ZDOTDIR scrub is skipped in favour of
+ *                      the CB-596 sentinel overlay — a degraded control, never a refusal to spawn.
+ *                      When {@code memberHerdrSocket} is NOT configured this field is never
+ *                      consulted at all; fleetd keeps reading its own {@code $SHELL}, exactly as
+ *                      before this field existed.
 */
@JsonIgnoreProperties(ignoreUnknown = true)
 public record FleetConfig(
@@ -98,7 +118,33 @@ public record FleetConfig(
        ConfigReload configReload,
        Integer quarantineCooldownSeconds,
        MemberCredentials memberCredentials,
-        Coordinator coordinator) {
+        Coordinator coordinator,
+        String worktreeGroup,
+        String memberLoginShell) {
+
+    /** Back-compat form before the {@code memberLoginShell} key was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup, null);
+    }
+
+    /** Back-compat form before the {@code worktreeGroup} key was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, null, null);
+    }

    /** Back-compat form before the {@code coordinator:} block was added. */
    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
@@ -109,7 +155,7 @@ public record FleetConfig(
                         MemberCredentials memberCredentials) {
        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, memberCredentials, null);
+                configReload, quarantineCooldownSeconds, memberCredentials, null, null);
    }

    /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
@@ -194,7 +240,8 @@ public record FleetConfig(
     * @param configDir {@code CLAUDE_CONFIG_DIR} so the worker inherits the profile's
     *                  skills/MCP/hooks (may be {@code null})
     * @param tokenEnv  name of the host env var holding the worker's auth token; its value
-     *                  is injected as {@code ANTHROPIC_AUTH_TOKEN} (never stored in config)
+     *                  is injected as {@code ANTHROPIC_AUTH_TOKEN} (never stored in config).
+     *                  {@code null}/blank means this profile needs no token.
     * @param argv      launch command; defaults to {@code ["claude"]}
     * @param placement where a worker lands: {@code "tab"} (default — its own tab in the
     *                  worker space) or {@code "pane"} (legacy — split the focused tab)
@@ -343,7 +390,7 @@ public record FleetConfig(
                    ? (KIND_CLAUDE_CODE.equals(k) ? List.of("claude") : List.of(k))
                    : List.copyOf(argv);
            kind = k;
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "FLEETD_WORKER_TOKEN" : tokenEnv;
+            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? null : tokenEnv;
            placement = (placement == null || placement.isBlank()) ? "tab" : placement.toLowerCase();
            workspace = (workspace == null || workspace.isBlank()) ? "fleet" : workspace;
            // CB-557: no per-profile default any more. A label is generated from the member's ROLE
@@ -558,6 +605,11 @@ public record FleetConfig(
            return gitTokenEnv != null && !gitTokenEnv.isBlank();
        }

+        /** True when this profile explicitly names a host token environment variable. */
+        public boolean hasTokenEnv() {
+            return tokenEnv != null && !tokenEnv.isBlank();
+        }
+
        /**
         * True when this profile's {@code env:} block names a worker-side Anthropic binding variable.
         * Those two keys are the adapter's, never the operator's: on a claude-code worker
@@ -1325,7 +1377,7 @@ public record FleetConfig(
            "bind", "herdrSocket", "memberHerdrSocket", "profiles", "guard", "worktreeRoot",
            "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
            "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
-            "memberCredentials", "coordinator");
+            "memberCredentials", "coordinator", "worktreeGroup", "memberLoginShell");

    /** Load and validate config from {@code path}. */
    public static FleetConfig load(Path path) {
@@ -1943,9 +1995,14 @@ public record FleetConfig(
                : new MemberCredentials(null, List.of(), List.of());
        // coordinator is left as-is, like broker/primary above: null keeps no LeadMailbox opened,
        // and this ticket's Coordinator is config-only anyway (nothing yet reads it at startup).
+        // worktreeGroup is left as-is (fleetd #185 stage 3): null/blank is "off", and there is no
+        // sane non-null default — an OS group name is operator-specific.
+        // memberLoginShell is left as-is (fleetd #213), like worktreeGroup: null/blank is "not
+        // configured", and there is no sane non-null default — a member's login shell is
+        // operator-specific and only meaningful when memberHerdrSocket is also set.
        return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
-                quarantineCooldown, mc, coordinator);
+                quarantineCooldown, mc, coordinator, worktreeGroup, memberLoginShell);
    }

    /**
@@ -0,0 +1,35 @@
+package dev.ltms.fleet.inject;
+
+import java.util.regex.Pattern;
+
+/**
+ * Per-target lookup for a profile's configured backend-error pattern (fleetd#201 / #227): how
+ * {@link CompletionResolver} recognizes a backend that failed a turn outright (a credential
+ * outage, a provider 5xx) from whatever ends up on the member's pane, apart from a genuine
+ * completion.
+ *
+ * <p>The pattern is always profile config, never a vendor string in Java source: every backend
+ * words its failure differently, so a hardcoded sentence would only ever match one of them. A
+ * target with no configured pattern is not "off" the way {@link ExhaustedPatternLookup#none()}
+ * is — {@link CompletionResolver} falls back to its narrow {@code (?i)\bAPI Error\s*:}
+ * compatibility pattern instead, so classification still happens, just without a profile-specific
+ * match. {@link #legacy()} is the explicit stand-in existing (pre-fleetd#201) callers pass to get
+ * exactly that fallback-only behavior until a caller wires a real, profile-driven lookup
+ * (fleetd#201 Unit 5).
+ */
+@FunctionalInterface
+public interface BackendErrorPatternLookup {
+
+    /** The compiled pattern configured for {@code target}'s profile, or {@code null} if none. */
+    Pattern patternFor(String target);
+
+    /**
+     * Legacy lookup — no profile has a configured pattern, so {@link CompletionResolver} classifies
+     * every target using only its built-in {@code (?i)\bAPI Error\s*:} compatibility pattern. The
+     * explicit stand-in existing constructors pass so their behavior is unchanged until a caller
+     * wires a real, profile-driven lookup.
+     */
+    static BackendErrorPatternLookup legacy() {
+        return target -> null;
+    }
+}
@@ -0,0 +1,35 @@
+package dev.ltms.fleet.inject;
+
+/**
+ * Notified when {@link CompletionResolver} actually delivers a typed backend-error classification
+ * to a waiting send (fleetd#201 / #227) — never on a race that lost. {@link CompletionResolver}
+ * calls this only after {@code Rendezvous.resolveFailure} returns {@code true} for that exact
+ * waiter, mirroring the win-only race rule {@link ExhaustionSink} already uses.
+ *
+ * <p>The public send result is unchanged by this classification — it is still a failed send
+ * ({@code Rendezvous.Kind#FAILED}); this sink is the internal seam a later stage (fleetd#201 Unit
+ * 5, the policy that cools a credential off after two such failures in 60 seconds and tells the
+ * lead) consumes. {@link CompletionResolver} knows only {@code target} (a herdr terminal id); it
+ * has no notion of profiles or credentials, so mapping {@code target} to whatever should be
+ * quarantined is entirely the sink's job — exactly like {@link ExhaustionSink}.
+ */
+@FunctionalInterface
+public interface BackendErrorSink {
+
+    /**
+     * @param target      the herdr terminal id whose turn was classified as a backend error
+     * @param matchedLine the single pane line that matched the backend-error pattern
+     * @param reason      the full failure reason carried by the classification (the matched line
+     *                    plus whatever pane context the classifying path attaches)
+     */
+    void onBackendError(String target, String matchedLine, String reason);
+
+    /**
+     * Inert sink — nothing happens on a backend-error classification. The explicit stand-in a
+     * caller (or a test not exercising this feature) passes instead of a defaulting overload,
+     * exactly like {@link ExhaustionSink#none()}.
+     */
+    static BackendErrorSink none() {
+        return (target, matchedLine, reason) -> { };
+    }
+}
@@ -14,6 +14,7 @@ import java.util.TreeSet;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.LongSupplier;
+import java.util.function.Function;
 import java.util.regex.Pattern;

 /**
@@ -85,11 +86,29 @@ public final class CompletionResolver implements TurnListener {
    private static final String CLIPPED_PANE_TAIL_MARKER =
            "[Pane tail clipped: member did not call fleet_reply.]";

+    /** A pane echo must be this large before it can replace a completion report. */
+    static final int ECHO_MIN_CHARS = 400;
+
+    /** Normalised TUI chrome may add this many characters to an otherwise echoed brief. */
+    static final int MAX_ECHO_EXCESS_CHARS = 160;
+
+    /** The explicit result returned instead of a lead's echoed injected brief. */
+    public static final String NO_REPORT_PREFIX = "[no report — the member ended its turn without fleet_reply, "
+            + "and the pane still shows the injected brief. Nothing was produced on the pane. Check the "
+            + "member's worktree and branch for committed work before re-delegating.";
+
    private final AgentControl agents;
    private final Rendezvous rendezvous;
    private final ExhaustedPatternLookup exhaustedPatterns;
    private final ExhaustionSink exhaustionSink;
+    private final BackendErrorPatternLookup backendErrorPatterns;
+    private final BackendErrorSink backendErrorSink;
    private final LongSupplier nowNanos;
+    private final Function<String, WorktreeBranch> worktreeBranches;
+
+    /** Known member location, used only to guide a lead after an echoed brief. */
+    public record WorktreeBranch(String worktree, String branch) {
+    }

    /**
     * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
@@ -106,7 +125,8 @@ public final class CompletionResolver implements TurnListener {
     * the other half of the {@link #MIN_TURN_NANOS} floor check, compared against a fresh reading at
     * resolution time.
     */
-    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline, long deliveredAtNanos) {
+    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline, long deliveredAtNanos,
+                    String injectedText) {

        /**
         * Convenience for tests exercising scrape/suppression logic that don't care about turn
@@ -114,7 +134,11 @@ public final class CompletionResolver implements TurnListener {
         * Not used by production code — {@link #captureBaseline} always records a real reading.
         */
        InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
-            this(waiter, baseline, Long.MIN_VALUE / 2);
+            this(waiter, baseline, Long.MIN_VALUE / 2, null);
+        }
+
+        InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline, long deliveredAtNanos) {
+            this(waiter, baseline, deliveredAtNanos, null);
        }
    }

@@ -129,10 +153,55 @@ public final class CompletionResolver implements TurnListener {
     *                          classification actually resolves a waiter. Required for the same
     *                          reason as {@code exhaustedPatterns} — pass {@link ExhaustionSink#none()}
     *                          to opt out.
+     *
+     * <p>Transition constructor (fleetd#201 Unit 1): delegates to the full constructor below with
+     * {@link BackendErrorPatternLookup#legacy()} and {@link BackendErrorSink#none()}, so every
+     * existing caller keeps today's behavior — the narrow built-in {@code API Error:} match, no
+     * sink notified — until a caller wires a real, profile-driven backend-error lookup and sink
+     * (fleetd#201 Unit 5).
     */
    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
-                              ExhaustionSink exhaustionSink) {
-        this(agents, rendezvous, exhaustedPatterns, exhaustionSink, System::nanoTime);
+                               ExhaustionSink exhaustionSink) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink,
+                BackendErrorPatternLookup.legacy(), BackendErrorSink.none(), System::nanoTime);
+    }
+
+    /** Production constructor with a lookup for the member worktree and branch. */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                              ExhaustionSink exhaustionSink, Function<String, WorktreeBranch> worktreeBranches) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink,
+                BackendErrorPatternLookup.legacy(), BackendErrorSink.none(), System::nanoTime, worktreeBranches);
+    }
+
+    /**
+     * Transition constructor (fleetd#201 Unit 1): same legacy backend-error defaults as the 4-arg
+     * constructor above, but with the injectable clock. Kept so existing fleetd#164 timing tests
+     * (and any other caller that wants a controllable clock but not the backend-error feature)
+     * keep compiling unchanged.
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                       ExhaustionSink exhaustionSink, LongSupplier nowNanos) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink,
+                BackendErrorPatternLookup.legacy(), BackendErrorSink.none(), nowNanos);
+    }
+
+    /**
+     * Production constructor (fleetd#201 Unit 1): adds the target-keyed backend-error pattern
+     * lookup and sink alongside the existing exhaustion pair. Required, like {@code exhaustedPatterns}
+     * and {@code exhaustionSink} — pass {@link BackendErrorPatternLookup#legacy()} and
+     * {@link BackendErrorSink#none()} to opt out.
+     *
+     * @param backendErrorPatterns fleetd#201: per-target lookup for a profile's configured
+     *                             backend-error pattern; a target with none configured is matched
+     *                             against the built-in compatibility pattern instead (never "off").
+     * @param backendErrorSink     fleetd#201: notified when a backend-error classification actually
+     *                             resolves a waiter — never on a race that lost.
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                       ExhaustionSink exhaustionSink, BackendErrorPatternLookup backendErrorPatterns,
+                       BackendErrorSink backendErrorSink) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink, backendErrorPatterns, backendErrorSink,
+                System::nanoTime, _ -> null);
    }

    /**
@@ -145,12 +214,25 @@ public final class CompletionResolver implements TurnListener {
     * package.
     */
    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
-                       ExhaustionSink exhaustionSink, LongSupplier nowNanos) {
+                        ExhaustionSink exhaustionSink, BackendErrorPatternLookup backendErrorPatterns,
+                        BackendErrorSink backendErrorSink, LongSupplier nowNanos) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink, backendErrorPatterns, backendErrorSink,
+                nowNanos, _ -> null);
+    }
+
+    /** Full constructor with injectable clock and member location lookup. */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                        ExhaustionSink exhaustionSink, BackendErrorPatternLookup backendErrorPatterns,
+                        BackendErrorSink backendErrorSink, LongSupplier nowNanos,
+                        Function<String, WorktreeBranch> worktreeBranches) {
        this.agents = agents;
        this.rendezvous = rendezvous;
        this.exhaustedPatterns = Objects.requireNonNull(exhaustedPatterns, "exhaustedPatterns");
        this.exhaustionSink = Objects.requireNonNull(exhaustionSink, "exhaustionSink");
+        this.backendErrorPatterns = Objects.requireNonNull(backendErrorPatterns, "backendErrorPatterns");
+        this.backendErrorSink = Objects.requireNonNull(backendErrorSink, "backendErrorSink");
        this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
+        this.worktreeBranches = Objects.requireNonNull(worktreeBranches, "worktreeBranches");
    }

    @Override
@@ -180,7 +262,7 @@ public final class CompletionResolver implements TurnListener {
            baseline = null; // fail open: no baseline ⇒ no suppression
            log.debug("delivery baseline for {} failed: {}", target, e.getMessage());
        }
-        inFlight.put(target, new InFlight(waiter, baseline, nowNanos.getAsLong()));
+        inFlight.put(target, new InFlight(waiter, baseline, nowNanos.getAsLong(), token.injectedText()));
    }

    /** The turn currently baselined for {@code target}, or {@code null} — a test hook for the captureBaseline path. */
@@ -232,16 +314,18 @@ public final class CompletionResolver implements TurnListener {
        // screen, since that is usually the backend's own error.
        long elapsedNanos = nowNanos.getAsLong() - turn.deliveredAtNanos();
        if (elapsedNanos < MIN_TURN_NANOS) {
-            fail(target, turn, tooFastReason(target, elapsedNanos));
+            failTooFast(target, turn, waiter, elapsedNanos);
            return;
        }
        String tail;
        String assistantBlock = null;
+        String rawScrape = null;
        int originalLength = 0;
        boolean clipped = false;
        boolean scrapeFailed = false;
        try {
-            assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
+            rawScrape = agents.read(target, SCRAPE_SOURCE);
+            assistantBlock = lastAssistantBlock(rawScrape);
            originalLength = assistantBlock.strip().length();
            clipped = originalLength > MAX_SCRAPE_CHARS;
            tail = clip(assistantBlock);
@@ -256,6 +340,20 @@ public final class CompletionResolver implements TurnListener {
        // member, so a caller (including a lead deciding whether to delegate again) can tell a lost
        // turn from a real empty answer.
        if (scrapeFailed || tail.isEmpty()) {
+            // fleetd#211: lastAssistantBlock() found nothing usable — most often a pane with no ⏺
+            // marker at all, whose boundary scan then starts at the top of the raw screen and breaks
+            // immediately on the first line of TUI chrome (╭, │, ❯, …). Before giving up as a lost
+            // turn, run the same exhaustion/backend-error classification against the RAW scrape as a
+            // fallback, ONLY here. A pane that already yielded a usable block never reaches this
+            // branch, so the narrow (trimmed) match on the normal path below is completely unchanged
+            // — zero new false positives there. Every pane this fallback examines was already headed
+            // for the empty-scrape failure, so a wrong label here is strictly less bad than silently
+            // losing an exhaustion signal: the alternative outcome is already a failure, just one that
+            // never quarantines the credential. lastAssistantBlock stays the source of the reply
+            // TEXT everywhere else; only classification ever consults the raw scrape, and only here.
+            if (rawScrape != null && classifyRawScrapeFallback(target, turn, waiter, rawScrape)) {
+                return;
+            }
            fail(target, turn, emptyScrapeReason(target, scrapeFailed));
            return;
        }
@@ -286,21 +384,33 @@ public final class CompletionResolver implements TurnListener {
            }
            return;
        }
-        // fleetd#164 (part 2): a scrape that read cleanly and produced content still isn't a real
-        // reply when that content is the backend's own rejection (e.g. an HTTP 400 before the worker
-        // did any work). Classify it as a failure naming the member, rather than handing the caller a
-        // scrape that reads like a completed answer.
-        String backendError = firstMatchingLine(assistantBlock, BACKEND_ERROR);
+        // fleetd#164 (part 2) / fleetd#201: a scrape that read cleanly and produced content still
+        // isn't a real reply when that content is the backend's own rejection (e.g. an HTTP 400
+        // before the worker did any work). Classify it as a failure naming the member, rather than
+        // handing the caller a scrape that reads like a completed answer, and — only on the
+        // resolution that actually wins the race, mirroring the exhaustion sink above — notify the
+        // typed backend-error sink so a later stage can act on repeated failures.
+        String backendError = firstMatchingLine(assistantBlock, backendErrorPatternOrFallback(target));
        if (backendError != null) {
            // Carry the whole scrape, not just the matched line. The pattern is a heuristic: a member
            // that forgot fleet_reply while reporting *about* a backend error matches it too. Failing
            // is still right — the caller must not read a scrape as an answer — but dropping the rest
            // of the pane would destroy the report, which is the same defect fleetd#164 is about.
-            fail(target, turn, "member " + target + " ended on a backend error: " + backendError
-                    + "\n--- pane tail ---\n" + tail);
+            String reason = "member " + target + " ended on a backend error: " + backendError
+                    + "\n--- pane tail ---\n" + tail;
+            if (rendezvous.resolveFailure(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
+                // fleetd#201 Unit 1: only on the resolution that actually won the race — a late
+                // duplicate must never double-count one backend failure.
+                backendErrorSink.onBackendError(target, backendError, reason);
+            }
            return;
        }
        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
+        if (echoesInjectedBrief(tail, turn.injectedText())) {
+            completion = noReportMessage(target) + (clipped ? "\n" + CLIPPED_PANE_TAIL_MARKER : "");
+        }
        if (rendezvous.resolveCompletion(waiter, completion)) {
            inFlight.remove(target, turn);
            if (clipped) {
@@ -313,6 +423,83 @@ public final class CompletionResolver implements TurnListener {
        }
    }

+    /**
+     * A full echoed brief is at least 400 normalised characters. A scrape that contains the brief may
+     * add no more than 160 normalised characters of TUI chrome. This accepts harmless status text, but
+     * preserves a real report that restates the full brief before adding substantive content.
+     */
+    static boolean echoesInjectedBrief(String scrape, String injectedText) {
+        String normalScrape = normalize(scrape);
+        String normalInjected = normalize(injectedText);
+        if (normalScrape.length() < ECHO_MIN_CHARS || normalInjected.length() < ECHO_MIN_CHARS) {
+            return false;
+        }
+        if (normalInjected.contains(normalScrape)) {
+            return true;
+        }
+        return normalScrape.contains(normalInjected)
+                && normalScrape.length() - normalInjected.length() <= MAX_ECHO_EXCESS_CHARS;
+    }
+
+    private static String normalize(String text) {
+        return text == null ? "" : text.toLowerCase().replaceAll("[^a-z0-9]+", "");
+    }
+
+    private String noReportMessage(String target) {
+        WorktreeBranch location = worktreeBranches.apply(target);
+        if (location == null || (location.worktree() == null && location.branch() == null)) {
+            return NO_REPORT_PREFIX + "]";
+        }
+        String locationText = location.worktree() == null ? "" : " worktree=" + location.worktree();
+        if (location.branch() != null) {
+            locationText += " branch=" + location.branch();
+        }
+        return NO_REPORT_PREFIX + locationText + "]";
+    }
+
+    /**
+     * fleetd#211: the raw-scrape fallback classification, run only when {@link #lastAssistantBlock}
+     * found nothing usable (see the call site in {@link #resolve}). Mirrors the two classifications
+     * the normal path already applies to the trimmed assistant block — exhaustion first, then the
+     * narrow {@link #BACKEND_ERROR} pattern — against {@code raw} instead, and reports whether one of
+     * them handled the turn (resolved the waiter or failed it) so the caller skips the empty-scrape
+     * failure. Never runs on the normal (non-empty-block) path, and never touches the reply text.
+     */
+    private boolean classifyRawScrapeFallback(String target, InFlight turn,
+                                               CompletableFuture<Rendezvous.Resolution> waiter, String raw) {
+        Pattern exhausted = exhaustedPatterns.patternFor(target);
+        String matchedLine = exhausted == null ? null : firstMatchingLine(raw, exhausted);
+        if (matchedLine != null) {
+            String reason = "backend exhausted (usage limit): " + matchedLine;
+            if (rendezvous.resolveExhausted(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("completion for {} classified BACKEND_EXHAUSTED from the raw scrape (no "
+                        + "usable assistant block; no fleet_reply): {}", target, reason);
+                // CB-578 stage B: only on the resolution that actually won the race — a late
+                // duplicate must never quarantine a credential twice for one refusal.
+                exhaustionSink.onExhausted(target, reason);
+            }
+            return true;
+        }
+        String backendError = firstMatchingLine(raw, backendErrorPatternOrFallback(target));
+        if (backendError != null) {
+            // Carry the pane, not just the matched line — the same fleetd#164 rule the normal path
+            // above applies. Here it matters more, not less: the trimmed block was empty, so the raw
+            // scrape is the ONLY copy of whatever the member managed to say. Clipped to the same cap
+            // the normal path uses, since a raw screen has no boundary trimming to bound it.
+            String reason = "member " + target + " ended on a backend error: " + backendError
+                    + "\n--- pane tail ---\n" + clip(raw);
+            if (rendezvous.resolveFailure(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("failing send to {} via turn-stall fallback from the raw scrape: {}", target, reason);
+                // fleetd#201 Unit 1: only on the resolution that actually won the race.
+                backendErrorSink.onBackendError(target, backendError, reason);
+            }
+            return true;
+        }
+        return false;
+    }
+
    /** Synchronous fail (the unit-testable core of {@link #onTurnFailed}). */
    void fail(String target, InFlight turn) {
        fail(target, turn, null);
@@ -349,22 +536,53 @@ public final class CompletionResolver implements TurnListener {
    }

    /**
-     * fleetd#164: the failure reason for a turn that settled inside {@link #MIN_TURN_NANOS} — names
-     * the member and both timings, and appends whatever the pane shows (usually the backend's own
-     * error) so the caller sees the cause, not just "it failed".
+     * fleetd#164 (floor) / fleetd#201 (classification): fail a turn that settled inside
+     * {@link #MIN_TURN_NANOS} — a crash signature (e.g. a backend HTTP 400 before the worker did
+     * anything) that a bare {@code BUSY -> DONE} transition cannot be told apart from a genuinely
+     * fast completion. Runs the same backend-error classification the normal and raw-scrape paths
+     * apply, against whatever is on screen right now: a match is a typed failure that notifies
+     * {@link #backendErrorSink} (only on the resolution that wins the race); a non-match stays the
+     * original generic too-fast failure, naming the member and both timings, with whatever the pane
+     * shows appended so the caller sees the cause, not just "it failed".
     */
-    private String tooFastReason(String target, long elapsedNanos) {
+    private void failTooFast(String target, InFlight turn, CompletableFuture<Rendezvous.Resolution> waiter,
+                              long elapsedNanos) {
        String scrape;
        try {
-            scrape = clip(agents.read(target, SCRAPE_SOURCE));
+            scrape = agents.read(target, SCRAPE_SOURCE);
        } catch (RuntimeException e) {
            scrape = "";
        }
-        String reason = String.format(
+        String clippedScrape = clip(scrape);
+        String baseReason = String.format(
                "member %s went BUSY -> DONE in %dms (floor %dms) — too fast to be real work, most "
                        + "likely a backend error before any work started",
                target, elapsedNanos / 1_000_000, MIN_TURN_NANOS / 1_000_000);
-        return scrape.isBlank() ? reason : reason + ": " + scrape;
+        String backendError = firstMatchingLine(scrape, backendErrorPatternOrFallback(target));
+        if (backendError != null) {
+            String reason = baseReason + ": " + clippedScrape;
+            if (rendezvous.resolveFailure(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
+                // fleetd#201 Unit 1: only on the resolution that actually won the race.
+                backendErrorSink.onBackendError(target, backendError, reason);
+            }
+            return;
+        }
+        fail(target, turn, clippedScrape.isBlank() ? baseReason : baseReason + ": " + clippedScrape);
+    }
+
+    /**
+     * fleetd#201: the pattern to classify a backend error against for {@code target} — its
+     * profile's configured {@link BackendErrorPatternLookup} entry when there is one, else the
+     * built-in {@link #BACKEND_ERROR} compatibility pattern. A target with no configured pattern is
+     * never "off": it always falls back to this narrow default, exactly like the classification
+     * behaved before fleetd#201 (Unit 5 reports a target relying on this fallback separately, as
+     * legacy-default coverage rather than full per-profile coverage).
+     */
+    private Pattern backendErrorPatternOrFallback(String target) {
+        Pattern configured = backendErrorPatterns.patternFor(target);
+        return configured != null ? configured : BACKEND_ERROR;
    }

    /**
@@ -1,5 +1,7 @@
 package dev.ltms.fleet.inject;

+import java.util.function.Supplier;
+
 /**
 * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
 * classification to a waiting send (CB-578 stage B) — never on a race that lost (see
@@ -10,22 +12,81 @@ package dev.ltms.fleet.inject;
 * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
 * the sink's job — see {@code Fleetd.main}'s wiring, which resolves target → session → profile →
 * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
+ *
+ * <p><strong>The 3-arg overload is the single abstract method — fleetd #234, round 4.</strong> Two
+ * earlier rounds each shipped a caller that silently dropped the profile hint (see {@link
+ * #onExhausted(String, String, String)}): a lambda written against this interface can only ever
+ * implement whichever overload is abstract, and while the 2-arg form held that position, EVERY
+ * lambda site — a call-site forwarder in {@code Fleetd.java}, a hand-built test double — bound to
+ * it and silently inherited the profile-dropping default, whether or not its author remembered the
+ * hazard. Making the 3-arg form abstract instead removes the shape entirely: a lambda declared
+ * against this interface today is <em>forced</em> by the compiler to take {@code (target, reason,
+ * profile)}, so there is no overload left for it to bind to that can drop the hint. This is a type
+ * change, not a test — it holds even for a caller that has never heard of fleetd #234.
 */
@FunctionalInterface
 public interface ExhaustionSink {

    /**
-     * @param target the herdr terminal id whose turn was classified {@code BACKEND_EXHAUSTED}
-     * @param reason the matched-line reason carried by the classification
+     * @param target  the herdr terminal id whose turn was classified {@code BACKEND_EXHAUSTED}
+     * @param reason  the matched-line reason carried by the classification
+     * @param profile the profile the caller already knows should be quarantined, or {@code null}
+     *                when the caller has no better answer than {@code target} alone (fleetd #234):
+     *                a caller whose {@code target} is not yet resolvable through whatever roster
+     *                the sink's implementation consults — {@link
+     *                dev.ltms.fleet.member.OpenCodeLauncher}'s model-mismatch check fires from
+     *                {@code SessionAwareHandle.agentSessionId()}, which runs during {@code
+     *                SessionManager.acquire()} <em>before</em> that session is registered, so a
+     *                target -> session -> profile lookup finds nothing at that point. That launcher
+     *                already has its own {@code FleetConfig.Profile} in hand and does not need the
+     *                roster to know which profile to quarantine, so it supplies this directly
+     *                instead of leaving the sink to guess.
     */
-    void onExhausted(String target, String reason);
+    void onExhausted(String target, String reason, String profile);
+
+    /**
+     * Convenience for a caller with no profile to offer — every existing call site that predates
+     * the hint (fleetd #234): {@link dev.ltms.fleet.inject.CompletionResolver}'s two call sites
+     * always call with a {@code target} that IS live in the roster at the time of the call, so they
+     * need no hint and keep working exactly as before, unchanged by this default.
+     *
+     * @param target as {@link #onExhausted(String, String, String)}
+     * @param reason as {@link #onExhausted(String, String, String)}
+     */
+    default void onExhausted(String target, String reason) {
+        onExhausted(target, reason, null);
+    }

    /**
     * Inert sink — nothing happens on exhaustion. The explicit stand-in a caller (or a test not
     * exercising this feature) passes instead of a defaulting overload, exactly like
-     * {@link ExhaustedPatternLookup#none()}.
+     * {@link ExhaustedPatternLookup#none()}. Safe as a lambda: the 3-arg form is now the interface's
+     * single abstract method, so a lambda here has no other overload to silently bind to instead —
+     * it simply does nothing with all three arguments.
     */
    static ExhaustionSink none() {
-        return (target, reason) -> { };
+        return (target, reason, profile) -> { };
+    }
+
+    /**
+     * A sink that forwards to whatever {@code target} currently supplies (fleetd #234). Exists to
+     * break a genuine construction-order cycle: {@code Fleetd.main} builds its adapters (including
+     * {@link dev.ltms.fleet.member.OpenCodeLauncher}) before {@code sessions} exists, so it cannot
+     * hand them the real sink yet — it hands them a forwarder pointed at an {@code
+     * AtomicReference<ExhaustionSink>} that starts at {@link #none()} and gets {@code .set()} to the
+     * real sink once {@code sessions} is built. {@code target} is evaluated on every call, never
+     * cached, so the forwarder keeps working after the reference is repointed.
+     *
+     * <p>Now safe as a one-line lambda (round 4): forwarding the single 3-arg abstract method
+     * forwards everything a caller can supply — there is no separate 2-arg overload left for a
+     * forwarder to bind to instead and silently lose the hint. Kept as a named factory rather than
+     * written inline at each call site anyway, so a test can call the exact object {@code
+     * Fleetd.java} builds instead of asserting a rebuilt copy of its shape (round 3's lesson).
+     *
+     * @param target supplies the sink to forward to, evaluated fresh on every call
+     * @return a sink whose call delegates to {@code target.get()}
+     */
+    static ExhaustionSink forwardingTo(Supplier<ExhaustionSink> target) {
+        return (t, r, p) -> target.get().onExhausted(t, r, p);
    }
 }
@@ -10,6 +10,7 @@ import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
 import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.inject.CompletionResolver;
 import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.msg.LeadChannel;
 import dev.ltms.fleet.msg.LeadMessage;
@@ -543,8 +544,9 @@ public final class FleetMcp {
            case REPLIED -> text(r.text());
            // The worker's turn finished but it never called fleet_reply — hand back the scraped
            // transcript tail, flagged so the primary knows it isn't a structured reply.
-            case COMPLETED_UNREPLIED -> text(
-                    "[worker finished without a structured fleet_reply — transcript tail follows]\n" + r.text());
+            case COMPLETED_UNREPLIED -> text(r.text().startsWith(CompletionResolver.NO_REPORT_PREFIX)
+                    ? r.text()
+                    : "[worker finished without a structured fleet_reply — transcript tail follows]\n" + r.text());
            // The worker ran the turn then wedged (CB-109) — surface the error context.
            case WORKER_FAILED -> text("[worker failed — turn ended in an unrecoverable state]\n" + r.text());
            // The backend refused on a subscription usage limit (CB-578 stage A) — the worker's
@@ -659,6 +661,7 @@ public final class FleetMcp {
        }
        return switch (v.phase()) {
            case DONE -> text(v.replySource() != null && v.replySource().equals("transcript")
+                            && !v.reply().startsWith(CompletionResolver.NO_REPORT_PREFIX)
                    ? "[done — worker finished without a structured fleet_reply; transcript tail follows]\n" + v.reply()
                    : v.reply());
            case PENDING -> text("[pending — " + v.detail() + "]");
@@ -951,7 +954,10 @@ public final class FleetMcp {
                    .sorted(Map.Entry.comparingByValue())
                    .map(e -> leadView(e.getKey(), e.getValue(), live.get(e.getKey()), selfTerm))
                    .toList();
-            List<MemberSession> roster = sessions.roster();
+            // fleetd #209: this is the caller-driven fleet_list read that actually reports
+            // agentSessionId (via memberCapacityView -> SessionManager.rosterView), so it uses the
+            // resolving roster; the heartbeat/health/metrics timers stay on the plain sessions.roster().
+            List<MemberSession> roster = sessions.rosterResolved();
            List<Map<String, Object>> out = roster.stream()
                    .map(s -> memberCapacityView(s, live.get(s.terminalId()), messages, capacity.clock().getAsLong()))
                    .toList();
@@ -258,7 +258,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
            workerEnv.remove("ANTHROPIC_AUTH_TOKEN");
        } else {
            workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
-            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
+            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", resolveEnv(cfg.tokenEnv()));
        }
        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
@@ -278,18 +278,22 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {

    /**
     * Add the Claude-specific session-identity flags to {@code argv} and return the peer's OWN
-     * session id — the resume handle. A resume request passes the prior id via {@code -r} and
-     * returns that id; a fresh named session mints a new UUID, passes it via {@code --session-id},
-     * and returns the mint. The bridge's logical name rides along as {@code -n} when present. When
-     * <em>no</em> identity is requested (sessionName and resumeSessionId both blank) this adds
-     * nothing and returns {@code null}, keeping the legacy no-identity launch byte-identical.
+     * session id — the resume handle. A resume passes the prior id via {@code -r} and returns
+     * that id; every other spawn mints a new UUID, passes it via {@code --session-id}, and
+     * returns the mint. The bridge's logical name rides along as {@code -n} when present.
+     *
+     * <p>fleetd #214: the mint is unconditional. A plain {@code fleet_spawn} passes neither
+     * sessionName nor resumeSessionId, yet the member must still be resumable, and this id is
+     * the only resume handle a claude-code member has — unlike opencode, nothing resolves it
+     * after the launch. Checked against the real binary (claude 2.1.252): the flag is safe on
+     * every spawn. The binary takes only a valid UUID — it refuses any other value at argument
+     * parsing ("Invalid session ID. Must be a valid UUID.") — so the {@code UUID.randomUUID()}
+     * mint is required, not incidental. The only flag interaction the binary documents is with
+     * {@code -r} (both claim the session id), and the resume branch above never combines the two.
     */
    private static String applySessionIdentity(List<String> argv, String sessionName, String resumeSessionId) {
        boolean resuming = resumeSessionId != null && !resumeSessionId.isBlank();
        boolean named = sessionName != null && !sessionName.isBlank();
-        if (!resuming && !named) {
-            return null; // no identity requested — keep the legacy launch byte-identical
-        }
        if (named) {
            argv.add("-n");
            argv.add(sessionName);
@@ -320,11 +324,19 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     *
     * <p>CB-618: Claude Code refuses to start when BOTH {@code --append-system-prompt} and
     * {@code --append-system-prompt-file} are on the command line ("Cannot use both ... Please use
-     * only one"), so the two charters can never travel on separate flags. When both are present they
-     * are concatenated into the one file, role charter first and reply charter last — last is where
-     * the reply rule must sit, because it is the rule that must survive. When only the reply charter
-     * is present it keeps its proven inline {@code --append-system-prompt} delivery, which is also
-     * the only form that reaches a member with no repo checkout.
+     * only one"), so the two charters can never travel on separate flags. They are concatenated
+     * into the one file, role charter first and reply charter last — last is where the reply rule
+     * must sit, because it is the rule that must survive.
+     *
+     * <p>fleetd #220: a lone reply charter used to ride inline on {@code --append-system-prompt},
+     * which put ~800 bytes of prose on the command line herdr types into the pane. That line is
+     * capped at {@value HerdrPeerLauncher#PANE_COMMAND_BYTE_LIMIT} bytes by the pty itself, and
+     * everything past the cap is dropped with no error from any layer. The charter alone left about
+     * 50 bytes of headroom, so adding one flag ({@code --session-id}, fleetd #214) truncated the
+     * LAST argument instead — {@code --autocompact 250000} arrived as {@code --autocompact 25},
+     * claude rejected it, and every claude-code spawn died as an unexplained readiness timeout.
+     * The charter now always travels as a file, which takes the prose off the command line for
+     * good; {@link HerdrPeerLauncher#checkPaneCommandFits} is the backstop for whatever grows next.
     */
    private List<String> argvWithFleet(FleetConfig.Profile cfg, LaunchSpec spec) {
        String roleCharter = nonBlank(spec.roleCharter());
@@ -341,16 +353,13 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
            argv.add("--mcp-config");
            argv.add(mcpConfigJson(cfg));
        }
-        // Combine the charters in order role -> reply, dropping any that are absent. When two
-        // or more survive they must ride one --append-system-prompt-file (CB-618 forbids the inline
-        // flag and the file flag together). A lone reply charter keeps its proven inline delivery.
+        // Combine the charters in order role -> reply, dropping any that are absent. They ride one
+        // --append-system-prompt-file (CB-618 forbids the inline flag and the file flag together),
+        // always — fleetd #220: charter prose on the command line overruns the pane's byte cap.
        List<String> charters = new java.util.ArrayList<>(2);
        if (roleCharter != null) charters.add(roleCharter);
        if (replyCharter != null) charters.add(replyCharter);
-        if (charters.size() == 1 && replyCharter != null && roleCharter == null) {
-            argv.add("--append-system-prompt");
-            argv.add(replyCharter);
-        } else if (!charters.isEmpty()) {
+        if (!charters.isEmpty()) {
            argv.add("--append-system-prompt-file");
            argv.add(writeCharterFile(String.join("\n\n", charters)).toString());
        }
@@ -450,12 +459,83 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * {@link OpenCodeLauncher#writeConfig} already uses for its charter file, since the process that
     * reads this file (the spawned peer) outlives this JVM call and there is no spawn-scoped teardown
     * hook to delete it synchronously.
+     *
+     * <p><b>fleetd #222.</b> {@code Files.createTempFile(prefix, suffix)} with no directory argument
+     * resolves against {@code java.io.tmpdir} — on macOS the per-user {@code $TMPDIR} under
+     * {@code /var/folders/...}, mode {@code 0700}, both resolved against FLEETD's own OS user. Under
+     * {@code memberHerdrSocket:} the member pane runs as a DIFFERENT OS user, so that user cannot even
+     * traverse the directory, let alone read the file — and since fleetd #220 the charter file is the
+     * ONLY delivery path for {@code --append-system-prompt-file}, always, not merely the fallback it
+     * used to be. A member handed a path it cannot read is not degraded, it is broken: see this
+     * method's refusal branch below.
+     *
+     * <p><b>Measured severity (fleetd #222 real-binary check, claude 2.1.258):</b> an unreadable
+     * {@code --append-system-prompt-file} is the LOUD failure, not the silent one. {@code claude}
+     * checks the file before touching auth or the network — invoked with a bogus API key against a
+     * {@code chmod 000} file, it printed {@code Error reading append system prompt file: EACCES:
+     * permission denied, open '<path>'} and exited 1 immediately (a nonexistent path gets {@code
+     * Error: Append system prompt file not found: <path>}, same exit code). So the pre-fix bug did
+     * NOT leave a charter-less member silently occupying a pane and never calling {@code
+     * fleet_reply} — it made the herdr pane exit immediately, which the CB-306 spawn-readiness gate
+     * (this launcher's {@code spawnReadyTimeoutMs} poll) would have surfaced as "did not reach
+     * injectable state", the same unexplained-timeout shape fleetd #220 already describes. Still a
+     * real defect (every claude-code member under {@code memberHerdrSocket} would have failed to
+     * spawn), but not the worse, undetectable failure mode.
+     *
+     * <ul>
+     *   <li>{@code memberHerdrSocket} ABSENT (today's only live mode): byte-identical to before this
+     *       fix — {@code Files.createTempFile("fleetd-role-charter-", ".md")} with no directory
+     *       argument, i.e. still resolved against {@code java.io.tmpdir}.</li>
+     *   <li>{@code memberHerdrSocket} PRESENT: a fresh per-spawn directory is created under {@code
+     *       worktreeRoot} (never {@code java.io.tmpdir}) holding just the charter file, then shared
+     *       read-only with {@code worktreeGroup} via {@link EnvAllowListScrub#shareWithGroup} — the
+     *       SAME mechanism fleetd #213 built for the ZDOTDIR scrub and fleetd #219 reused for {@link
+     *       OpenCodeLauncher#writeConfig}'s {@code opencode.json} directory, reused here rather than
+     *       duplicated a third time. A per-spawn subdirectory (not {@code worktreeRoot} itself) is the
+     *       unit {@code shareWithGroup} chmods, so this never touches permissions on anything else
+     *       under {@code worktreeRoot}.</li>
+     * </ul>
+     *
+     * <p><b>Follows fleetd #219's REFUSAL decision, not #213's degrade decision.</b> The ZDOTDIR
+     * scrub is a credential CONTROL — a degraded control (the CB-596 sentinel overlay) still has
+     * value, so #213 falls back rather than refusing. A charter is NOT a control, it is the member's
+     * TURN CONTRACT (the rule that ends every turn with {@code fleet_reply}). A member spawned with no
+     * charter is not degraded, it is broken: either claude-code exits on the unreadable
+     * {@code --append-system-prompt-file} path and the spawn dies at the readiness gate (loud), or it
+     * starts anyway with no charter and never calls {@code fleet_reply} — the sender silently gets
+     * nothing (silent). Neither outcome is worth trading for "spawn something." So a missing {@code
+     * worktreeRoot}/{@code worktreeGroup} under {@code memberHerdrSocket} refuses the spawn here,
+     * naming the missing key, exactly like {@link OpenCodeLauncher#configParentDir()}.
+     *
+     * @throws IllegalStateException when {@code memberHerdrSocket} is configured but {@code
+     *                                worktreeRoot} and/or {@code worktreeGroup} is not
     */
-    private static Path writeCharterFile(String charterText) {
+    private Path writeCharterFile(String charterText) {
        try {
-            Path file = Files.createTempFile("fleetd-role-charter-", ".md");
+            if (!memberHerdrSocketConfigured()) {
+                Path file = Files.createTempFile("fleetd-role-charter-", ".md");
+                Files.writeString(file, charterText);
+                file.toFile().deleteOnExit();
+                return file;
+            }
+            Path parentDir = memberScrubParentDir();
+            String group = memberGroup();
+            if (parentDir == null || group == null) {
+                throw new IllegalStateException("memberHerdrSocket is configured, so the role/reply "
+                        + "charter file (mounted via --append-system-prompt-file) must be placed where "
+                        + "the member's OS user can read it — worktreeRoot, shared via worktreeGroup — "
+                        + "but " + (parentDir == null ? "worktreeRoot" : "worktreeGroup") + " is not "
+                        + "configured. Refusing to spawn rather than hand the member a charter path it "
+                        + "cannot read: that member's turn contract (the fleet_reply rule) would never "
+                        + "reach it. Configure both worktreeRoot and worktreeGroup to enable claude-code "
+                        + "member spawns under memberHerdrSocket.");
+            }
+            Path dir = Files.createTempDirectory(parentDir, "fleetd-role-charter-");
+            dir.toFile().deleteOnExit();
+            Path file = dir.resolve("charter.md");
            Files.writeString(file, charterText);
            file.toFile().deleteOnExit();
+            EnvAllowListScrub.shareWithGroup(dir, group);
            return file;
        } catch (IOException e) {
            throw new UncheckedIOException("cannot write role charter temp file", e);
@@ -7,6 +7,9 @@ import java.io.IOException;
 import java.io.UncheckedIOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.attribute.GroupPrincipal;
+import java.nio.file.attribute.PosixFileAttributeView;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.ArrayList;
@@ -116,6 +119,77 @@ public final class EnvAllowListScrub {
        }
    }

+    /**
+     * fleetd #213: as {@link #generate(Path, Set)}, plus share the generated directory with
+     * {@code group} — the member OS user's group (the operator's existing {@code worktreeGroup:}
+     * name, reused rather than inventing a second one) — so a member running under a different OS
+     * user than fleetd's own process can still read what it needs from a directory placed outside
+     * {@code java.io.tmpdir}. {@code group} null/blank ⇒ identical to {@link #generate(Path, Set)};
+     * this is the single-daemon (no {@code memberHerdrSocket}) shape, where the pane is fleetd's own
+     * uid and no group sharing is needed.
+     *
+     * @throws UncheckedIOException also when {@code group} does not resolve on this host, or a
+     *                              group-ownership/permission call is refused — the same "fail
+     *                              loudly rather than start unprotected" contract as above: a scrub
+     *                              the configured member user cannot even read is not a working
+     *                              control.
+     */
+    public static Path generate(Path parentDir, Set<String> allowedNames, String group) {
+        Path dir = generate(parentDir, allowedNames);
+        if (group != null && !group.isBlank()) {
+            shareWithGroup(dir, group);
+        }
+        return dir;
+    }
+
+    /**
+     * chgrp/chmod-equivalent over a freshly generated directory and the flat files already written
+     * into it: owner keeps full access, {@code group} gets traverse+read on the directory ({@code
+     * rwxr-x---}, so a member process — a login shell reading it via {@code ZDOTDIR}, or another
+     * process simply opening a file under it — running under that group can find and read the
+     * files) and read-only on each file ({@code rw-r-----}) — deliberately no group WRITE anywhere,
+     * since a member never needs to add or change what fleetd generated. (For the ZDOTDIR scrub
+     * specifically, this also means the scrub script's own report write inside the pane fails
+     * closed rather than open — see {@code scrub.zsh}'s trailing {@code 2>/dev/null} — which {@link
+     * dev.ltms.fleet.member.HerdrPeerLauncher#releaseZdotdir} already treats as "cannot be
+     * confirmed to have run" rather than success.)
+     *
+     * <p>Package-private and named generically on purpose: fleetd #213 built this for the ZDOTDIR
+     * scrub directory, and fleetd #219 reuses it verbatim for {@link
+     * dev.ltms.fleet.member.OpenCodeLauncher}'s ephemeral {@code opencode.json} directory — both are
+     * "a fleetd-generated directory of flat files that a different-uid member process must read but
+     * never write," so the sharing mechanism is shared rather than copied a second time.
+     */
+    static void shareWithGroup(Path dir, String group) {
+        try {
+            GroupPrincipal principal = dir.getFileSystem().getUserPrincipalLookupService()
+                    .lookupPrincipalByGroupName(group);
+            setGroupAndPermissions(dir, principal, "rwxr-x---");
+            try (Stream<Path> entries = Files.list(dir)) {
+                for (Path file : entries.toList()) {
+                    setGroupAndPermissions(file, principal, "rw-r-----");
+                }
+            }
+        } catch (IOException e) {
+            throw new UncheckedIOException("cannot share generated directory " + dir + " with group '"
+                    + group + "' — the group must exist, and the fleetd operator ("
+                    + System.getProperty("user.name") + ") must be a member of it", e);
+        } catch (UnsupportedOperationException e) {
+            throw new UncheckedIOException("cannot share generated directory " + dir + " with group '"
+                    + group + "' — this filesystem does not support POSIX group ownership",
+                    new IOException(e));
+        }
+    }
+
+    private static void setGroupAndPermissions(Path path, GroupPrincipal group, String perms) throws IOException {
+        PosixFileAttributeView view = Files.getFileAttributeView(path, PosixFileAttributeView.class);
+        if (view == null) {
+            throw new IOException("POSIX file attributes are not supported for " + path);
+        }
+        view.setGroup(group);
+        Files.setPosixFilePermissions(path, PosixFilePermissions.fromString(perms));
+    }
+
    /** One operator-sourcing startup file: source the {@code $HOME} counterpart, change nothing else. */
    private static String homeSourcingFile(String name) {
        return """
@@ -3,11 +3,13 @@ package dev.ltms.fleet.member;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
 import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.herdr.Tab;
 import dev.ltms.fleet.herdr.Workspace;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.StatusRefiner;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.CharterReceipt;
 import dev.ltms.fleet.peer.MemberRole;
@@ -112,6 +114,12 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * daemon's own process is started the same way (a login shell sourcing the same secret store —
     * see CB-592's investigation of {@code secrets.sh}), so on a single-host deployment its env
     * mirrors what the pane's login shell is about to export.
+     *
+     * <p>fleetd #185 stage 2: that mirroring assumption holds only while the member pane runs under
+     * the SAME OS user as the daemon. When {@code memberHerdrSocket:} is configured, member panes
+     * run on a second herdr owned by a different user — different {@code $HOME}, different {@code
+     * secrets.sh}, different environment entirely — so this field's data no longer describes what a
+     * member pane inherits. See {@link #logCredentialGap} for how that mode is handled.
     */
    private final Supplier<Set<String>> hostEnvNames;

@@ -145,6 +153,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    private final LongSupplier nowMillis; // monotonic clock (injectable for tests)
    private final Runnable sleeper; // sleep/wait hook (injectable for tests; never real-sleep in unit tests)

+    /**
+     * fleetd #176 fix 2: the same UNKNOWN-refinement {@code dev.ltms.fleet.inject.StatusPoller}
+     * uses, reused here for the spawn-readiness gate. Constructed once from {@link #agents} — see
+     * {@link #refinedInjectable(String, Agent)} for the corroboration that keeps it from firing on
+     * a dead pane's bare shell prompt.
+     */
+    private final StatusRefiner statusRefiner;
+
    // Per-process token mixed into each peer name so a fresh process (nameSeq back at 0) cannot
    // collide with same-profile peers that outlived a restart. See startUniquelyNamed.
    private final String nameNonce = String.format("%06x", new SecureRandom().nextInt(1 << 24));
@@ -266,6 +282,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        this.memberCredentials = memberCredentials;
        this.hostEnvNames = hostEnvNames != null ? hostEnvNames : () -> System.getenv().keySet();
        this.config = config;
+        this.statusRefiner = new StatusRefiner(agents);
    }

    // --- adapter seams -------------------------------------------------------------------------
@@ -676,6 +693,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        // Protocol 19 resolves the executable from the agent kind (== namePrefix here), so
        // argv[0] — the configured executable — is dropped and only the extra args are passed.
        List<String> args = argv.isEmpty() ? argv : argv.subList(1, argv.size());
+        checkPaneCommandFits(cfg, argv);
        HerdrException last = null;
        for (int attempt = 0; attempt < NAME_RETRIES; attempt++) {
            long seq = nameSeq.incrementAndGet();
@@ -691,6 +709,59 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        throw last;
    }

+    /**
+     * fleetd #220: herdr does not exec the launch command — it TYPES it into the pane as one line,
+     * and a pty line buffer holds only {@value #PANE_COMMAND_BYTE_LIMIT} bytes (BSD/macOS {@code
+     * MAX_CANON}). Everything past that byte is dropped. Nothing reports it: herdr answers "agent
+     * started", the backend exits on the mangled argument it was handed, the pane closes, and the
+     * only symptom is {@link #waitUntilInjectableOrThrow} timing out 20 seconds later with no
+     * reason. That is exactly how #214 broke every claude-code spawn — one 50-byte flag pushed a
+     * 978-byte command to 1028, and the tail that got cut was {@code --autocompact 250000}.
+     *
+     * <p>So measure it here and refuse, loudly and immediately, rather than spawn something that
+     * cannot work. The estimate is deliberately conservative: fleetd cannot see herdr's quoting, so
+     * every argument is charged its own bytes plus a separator and a quote pair. An over-estimate
+     * costs a clear error at a length that was already unsafe; an under-estimate would let the
+     * silent truncation back in.
+     *
+     * @throws PeerUnreachableException when the command cannot fit — the same failure the spawn
+     *                                  would have hit anyway, named at the point it is still
+     *                                  explainable
+     */
+    private void checkPaneCommandFits(FleetConfig.Profile cfg, List<String> argv) {
+        int bytes = 0;
+        String longest = null;
+        int longestBytes = 0;
+        for (String arg : argv) {
+            int argBytes = arg == null ? 0 : arg.getBytes(java.nio.charset.StandardCharsets.UTF_8).length;
+            bytes += argBytes + QUOTING_OVERHEAD_PER_ARG;
+            if (argBytes > longestBytes) {
+                longestBytes = argBytes;
+                longest = arg;
+            }
+        }
+        if (bytes <= PANE_COMMAND_BYTE_LIMIT) {
+            return;
+        }
+        String culprit = longest == null ? "<none>"
+                : longest.substring(0, Math.min(longest.length(), 60)) + (longest.length() > 60 ? "…" : "");
+        throw new PeerUnreachableException(
+                "launch command for profile " + cfg.profile() + " is about " + bytes + " bytes, over the "
+                        + PANE_COMMAND_BYTE_LIMIT + "-byte limit of the pane line herdr types it into. "
+                        + "The pty would drop the tail silently and the backend would exit on a mangled "
+                        + "argument. Longest argument is " + longestBytes + " bytes: " + culprit
+                        + " — move it off the command line (a file flag) or shorten it.");
+    }
+
+    /**
+     * The pty line buffer herdr types a launch command into: BSD/macOS {@code MAX_CANON}. Not a
+     * fleetd choice and not configurable — see {@link #checkPaneCommandFits}.
+     */
+    static final int PANE_COMMAND_BYTE_LIMIT = 1024;
+
+    /** Per-argument allowance for the separating space and a shell quote pair fleetd cannot see. */
+    private static final int QUOTING_OVERHEAD_PER_ARG = 3;
+
    /** Start the agent into {@code paneId}, waiting out the seed shell's boot with the sleeper. */
    private Agent startAwaitingShellPrompt(String name, List<String> args, String paneId) {
        HerdrException busy = null;
@@ -849,25 +920,135 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    // --- spawn-readiness gate (CB-306) ---------------------------------------------------------

    /**
-     * Poll {@link AgentControl#status} until the pane reports an injectable state or the configured
+     * Poll {@link AgentControl#get} until the pane reports an injectable state or the configured
     * timeout elapses. On timeout, close the pane (self-reap) and throw.
+     *
+     * <p>fleetd #176 fix 1: {@code agents.get} was previously unguarded here, so a herdr
+     * {@code *_not_found} answer — which is what happens when the backend process EXITED rather
+     * than being slow — propagated as a raw {@link HerdrException} instead of the
+     * {@link PeerUnreachableException} every other failure path of this gate produces, and skipped
+     * teardown ({@link #stop}) entirely, leaking the pane/tab. {@link #failFastOnGoneBackend} closes
+     * that gap: it stops waiting immediately (never burns the rest of the timeout), runs the same
+     * teardown the timeout path below runs, and throws with a message that says the backend exited
+     * rather than that the pane was slow. Any other {@link HerdrException} still propagates
+     * unchanged — this gate does not know how to recover from it.
     */
    private void waitUntilInjectableOrThrow(String paneId) {
-        long deadline = nowMillis.getAsLong() + spawnReadyTimeoutMs;
+        long start = nowMillis.getAsLong();
+        long deadline = start + spawnReadyTimeoutMs;
+        AgentStatus lastStatus = null;
        while (nowMillis.getAsLong() < deadline) {
-            if (agents.status(paneId).injectable()) {
+            Agent sample;
+            try {
+                sample = agents.get(paneId);
+            } catch (HerdrException e) {
+                if (isAlreadyGone(e)) {
+                    failFastOnGoneBackend(paneId, e, nowMillis.getAsLong() - start);
+                }
+                throw e; // any other herdr failure is not ours to interpret — let it propagate
+            }
+            lastStatus = sample.status();
+            if (lastStatus.injectable() || refinedInjectable(paneId, sample)) {
                log.debug("peer pane={} reached injectable state", paneId);
                return;
            }
            sleeper.run();
        }
-        log.warn("peer pane={} did not become injectable within {}ms — closing", paneId, spawnReadyTimeoutMs);
+        // fleetd #220: read the pane BEFORE stop() closes it. Without this the gate says only that
+        // it timed out, which is true of every cause — a backend that never launched, a binary that
+        // rejected an argument and exited, a trust prompt, a login shell that hung. The pane holds
+        // the one copy of that answer and it is destroyed a line later.
+        log.warn("peer pane={} did not become injectable within {}ms (last status {}) — closing. "
+                        + "Pane tail:\n{}",
+                paneId, spawnReadyTimeoutMs, lastStatus, readPaneQuietly(paneId));
        stop(paneId);
        throw new PeerUnreachableException(
                "worker pane " + paneId + " did not reach injectable state within "
                        + spawnReadyTimeoutMs + "ms");
    }

+    /**
+     * fleetd #176 fix 1: the backend process exited while the gate was still waiting — herdr
+     * answered {@code *_not_found} instead of ever reporting an injectable status. Fails
+     * immediately (never burns the rest of {@link #spawnReadyTimeoutMs}), runs the exact same
+     * teardown {@link #waitUntilInjectableOrThrow}'s timeout path runs, and throws a
+     * {@link PeerUnreachableException} whose message says the process exited rather than that the
+     * pane was slow.
+     *
+     * @throws PeerUnreachableException always — this method never returns normally
+     */
+    private void failFastOnGoneBackend(String paneId, HerdrException cause, long elapsedMs) {
+        String tail = readPaneQuietly(paneId); // read before stop() closes the pane
+        log.warn("peer pane={} backend process exited after {}ms while waiting for injectable "
+                        + "state (herdr: {}) — closing. Pane tail:\n{}",
+                paneId, elapsedMs, cause.getMessage(), tail);
+        stop(paneId);
+        throw new PeerUnreachableException(
+                "worker pane " + paneId + " backend process exited after " + elapsedMs
+                        + "ms while waiting to become injectable (herdr reported: " + cause.getMessage()
+                        + "). Pane tail:\n" + tail);
+    }
+
+    /**
+     * fleetd #176 fix 2: resolve a raw {@link AgentStatus#UNKNOWN} sample into a trustworthy
+     * injectable state via pane content, the same refinement {@code StatusPoller} applies during a
+     * peer's working life — but corroborated, because the trap this gate is exposed to that the
+     * poller is not: a pane whose backend has already exited settles at a plain shell prompt, and
+     * that prompt commonly contains the same {@code ❯} glyph {@link StatusRefiner#classify} treats
+     * as "idle at the Claude Code TUI prompt". Naively wiring the refiner in would turn "the backend
+     * died" into "ready to inject" — strictly worse than today's timeout.
+     *
+     * <p>Two guards, both required:
+     * <ul>
+     *   <li>{@link StatusRefiner#classify} is written for the Claude Code TUI only (its own javadoc
+     *       says so), so refinement only ever runs for the {@code claude} adapter — never for
+     *       {@code opencode} or any future non-Claude backend, whatever its pane looks like.</li>
+     *   <li>The refined status is accepted only when the <em>same</em> {@code agents.get} sample
+     *       ({@code sample}, taken once by the caller) still reports a non-null
+     *       {@link Agent#agentType()} — herdr's own "a supported backend is still detected here"
+     *       signal, read from the very sample the raw status came from so the two can never
+     *       disagree. A bare shell prompt left by an exited backend reports no {@code agentType}.</li>
+     * </ul>
+     *
+     * <p>Called only when {@code sample.status() == UNKNOWN}, so a healthy spawn — which never sees
+     * {@code UNKNOWN} — triggers zero extra herdr calls; only a persistently-{@code unknown} pane
+     * pays the one extra {@code agent.read} {@link StatusRefiner#refine} performs.
+     */
+    private boolean refinedInjectable(String paneId, Agent sample) {
+        if (sample.status() != AgentStatus.UNKNOWN) {
+            return false;
+        }
+        if (!"claude".equals(namePrefix)) {
+            return false; // StatusRefiner.classify reads a Claude Code TUI prompt specifically
+        }
+        if (sample.agentType() == null) {
+            return false; // no corroborating liveness signal — could be a dead pane's bare shell
+        }
+        return statusRefiner.refine(paneId, AgentStatus.UNKNOWN, agents).injectable();
+    }
+
+    /**
+     * fleetd #220: the pane's recent output, clipped, for the readiness-gate timeout log — or a
+     * short note when it cannot be read. Best-effort by construction: this runs on a path that is
+     * already failing, so it must never replace the real error with one of its own.
+     */
+    private String readPaneQuietly(String paneId) {
+        try {
+            String pane = agents.read(paneId, "recent");
+            if (pane == null || pane.isBlank()) {
+                return "<pane read returned nothing>";
+            }
+            return pane.length() <= SPAWN_FAILURE_PANE_CHARS
+                    ? pane
+                    : pane.substring(pane.length() - SPAWN_FAILURE_PANE_CHARS);
+        } catch (RuntimeException e) {
+            return "<pane could not be read: " + e.getMessage() + ">";
+        }
+    }
+
+    /** How much of a failed spawn's pane the timeout log carries. */
+    private static final int SPAWN_FAILURE_PANE_CHARS = 4000;
+
    /**
     * A concrete {@link PeerHandle} wrapping herdr agent coordinates, the profile that spawned it,
     * the session identity the launch resolved (CB-547a): the bridge's logical name and the peer's
@@ -1071,6 +1252,29 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * name. It stays a one-off decision because it is a live handle to the operator's ssh-agent, not
     * a value — a member holding it can sign with every key the agent holds, so letting it ride in
     * on the generic {@code allow:} list would hand that out for an unrelated reason.
+     *
+     * <p>fleetd #213: which shell decides the zsh gate, and where the generated directory lives,
+     * both depend on whether {@code memberHerdrSocket:} is configured — see {@link
+     * #memberHerdrSocketConfigured()}'s javadoc for why fleetd's own {@code $SHELL} and {@code
+     * java.io.tmpdir} describe the wrong process once member panes run under a different OS user.
+     * <ul>
+     *   <li>{@code memberHerdrSocket} ABSENT (today's only mode): byte-identical to before this
+     *       fix — fleetd's own {@code $SHELL} decides zsh, and the directory is generated under
+     *       {@code java.io.tmpdir}.</li>
+     *   <li>{@code memberHerdrSocket} PRESENT: the configured {@code memberLoginShell:} decides
+     *       zsh instead — fleetd's own {@code $SHELL} is never consulted, since it names a
+     *       different user's shell, not the member's. Absent/non-zsh falls back exactly like the
+     *       non-zsh case below. When it IS zsh, the directory still cannot go under {@code
+     *       java.io.tmpdir} (mode 0700, unreadable by another uid — the exact gap fleetd #213
+     *       exists to close), so it is generated under {@code worktreeRoot} instead and shared
+     *       read-only with {@code worktreeGroup} — the same group {@link
+     *       dev.ltms.fleet.session.Worktrees#shareWithGroup} already uses, reused rather than
+     *       inventing a second group key. Either one missing means the scrub cannot be guaranteed
+     *       reachable by the member, which is the same "cannot guarantee the scrub runs" case as a
+     *       non-zsh shell, so it gets the identical fallback.</li>
+     * </ul>
+     * In every branch: never refuse to spawn. A degraded credential control must not become an
+     * outage for an opt-in feature.
     */
    private Path applyEnvironmentAllowListPolicy(FleetConfig.Profile cfg, Launch launch) {
        FleetConfig.MemberCredentials creds = memberCredentials == null ? null : memberCredentials.get();
@@ -1078,8 +1282,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
            return null;
        }
        Set<String> allowed = derivedAllowedNames(creds, launch);
-        String loginShell = resolveEnv("SHELL");
-        boolean zsh = loginShell != null && (loginShell.endsWith("/zsh") || loginShell.equals("zsh"));
+        boolean memberHerdrSocket = memberHerdrSocketConfigured();
+        // fleetd #213 defect 1: under memberHerdrSocket the member pane runs as a DIFFERENT OS
+        // user, so fleetd's own $SHELL says nothing about what that pane runs — resolveEnv("SHELL")
+        // must not even be called on this path, only the explicit memberLoginShell: config can
+        // answer it. With memberHerdrSocket absent, nothing here changes: fleetd's own $SHELL is
+        // still the input, exactly as before this fix.
+        String loginShell = memberHerdrSocket ? configuredMemberLoginShell() : resolveEnv("SHELL");
+        boolean zsh = isZshShell(loginShell);
        if (!zsh) {
            // A non-zsh login shell ignores ZDOTDIR entirely: NO scrub would run, so pretending
            // otherwise would be worse than saying so. Warn loudly and fall back to the CB-596
@@ -1093,13 +1303,35 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
            logCredentialGap(creds, null);
            return null;
        }
+        Path parentDir;
+        String group = null;
+        if (memberHerdrSocket) {
+            // fleetd #213 defect 2: java.io.tmpdir is fleetd's own per-user temp dir (mode 0700 on
+            // macOS) — a member running as a different uid cannot even traverse it, let alone read
+            // the generated files. worktreeRoot is the only configured location a different-uid
+            // member can be given access to, and only WITH worktreeGroup to grant that access —
+            // absent either, the scrub cannot be guaranteed reachable, so this falls back exactly
+            // like the non-zsh case above rather than generating a directory nothing can read.
+            parentDir = memberScrubParentDir();
+            group = memberGroup();
+            if (parentDir == null || group == null) {
+                warnCannotShareScrubDirectory();
+                overlayBlockedCredentials(launch.env(), creds);
+                logCredentialGap(creds, null);
+                return null;
+            }
+        } else {
+            parentDir = Path.of(System.getProperty("java.io.tmpdir"));
+        }
        // Only reached when the scrub is actually about to run — the count below describes that
        // scrub, so it must not be logged before this gate (see the non-zsh branch above). Same
        // reasoning gates logCredentialGap's wording: passing the derived `allowed` set (non-null)
        // here, and ONLY here, is what tells it the scrub will really blank an unkept name — #192.
        logAllowListCoverage(allowed);
        logCredentialGap(creds, allowed);
-        Path dir = EnvAllowListScrub.generate(Path.of(System.getProperty("java.io.tmpdir")), allowed);
+        Path dir = memberHerdrSocket
+                ? EnvAllowListScrub.generate(parentDir, allowed, group)
+                : EnvAllowListScrub.generate(parentDir, allowed);
        launch.env().put("ZDOTDIR", dir.toAbsolutePath().toString());
        log.info("memberCredentials policy=allow-list: profile={} generated ZDOTDIR {} — derived "
                        + "allow-list holds {} name(s); the pane reports allowed N of M at release",
@@ -1107,6 +1339,63 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        return dir;
    }

+    /** True when {@code shell} is a zsh login shell path or bare name — the ZDOTDIR gate. */
+    private static boolean isZshShell(String shell) {
+        return shell != null && (shell.endsWith("/zsh") || shell.equals("zsh"));
+    }
+
+    /**
+     * fleetd #213: the configured {@code memberLoginShell:}, or {@code null} when unconfigured.
+     * Called ONLY from the {@code memberHerdrSocket}-configured branch of {@link
+     * #applyEnvironmentAllowListPolicy} — fleetd's own {@code $SHELL} is never read on that path.
+     * {@link #config} being {@code null} (an older test call site, or a launcher that never
+     * threaded the full config through) is treated the same as "not configured".
+     */
+    private String configuredMemberLoginShell() {
+        FleetConfig cfg = config == null ? null : config.get();
+        return cfg == null ? null : cfg.memberLoginShell();
+    }
+
+    /**
+     * fleetd #213: {@code worktreeRoot}, as the ZDOTDIR scrub's parent directory under {@code
+     * memberHerdrSocket}, or {@code null} when unconfigured — the same "cannot guarantee the scrub
+     * runs" gap as {@link #memberGroup()} being unset (see {@link
+     * #applyEnvironmentAllowListPolicy}). Deliberately no sibling-of-repo-root default here, unlike
+     * {@code GitWorktrees}' own {@code worktreeRoot} resolution: that default is a convenience for
+     * provisioning a worktree that will exist regardless, whereas an unconfigured value here means
+     * fleetd has no operator-endorsed location to put a credential-bearing directory a different OS
+     * user must reach, so falling back to the overlay is the honest answer, not a guess.
+     *
+     * <p>Package-private (fleetd #219) so {@link OpenCodeLauncher} can reuse the exact same
+     * "different OS user, put it under worktreeRoot instead of java.io.tmpdir" resolution for its
+     * own ephemeral {@code opencode.json} directory, rather than re-reading {@code config} a second
+     * time with a second copy of this null/blank handling.
+     */
+    Path memberScrubParentDir() {
+        FleetConfig cfg = config == null ? null : config.get();
+        if (cfg == null || cfg.worktreeRoot() == null || cfg.worktreeRoot().isBlank()) {
+            return null;
+        }
+        return Path.of(cfg.worktreeRoot());
+    }
+
+    /**
+     * fleetd #213: the configured {@code worktreeGroup:}, or {@code null} when unset/blank. Reuses
+     * the group {@link dev.ltms.fleet.session.Worktrees#shareWithGroup} already establishes for
+     * provisioned worktrees, rather than a second group key — see {@link
+     * #applyEnvironmentAllowListPolicy}.
+     *
+     * <p>Package-private (fleetd #219) — reused by {@link OpenCodeLauncher} alongside {@link
+     * #memberScrubParentDir()}; see that method's javadoc.
+     */
+    String memberGroup() {
+        FleetConfig cfg = config == null ? null : config.get();
+        if (cfg == null || cfg.worktreeGroup() == null || cfg.worktreeGroup().isBlank()) {
+            return null;
+        }
+        return cfg.worktreeGroup();
+    }
+
    /**
     * The full kept-name set for this spawn: the profile-derived names, unioned with {@code
     * memberCredentials.allow:} (CB-633 follow-up — previously ignored by this whole policy), the
@@ -1164,6 +1453,30 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        }
    }

+    /** Guards {@link #warnCannotShareScrubDirectory} to one WARN per launcher instance. */
+    private final AtomicBoolean cannotShareScrubDirWarned = new AtomicBoolean();
+
+    /**
+     * fleetd #213: {@code memberHerdrSocket} is configured and the member login shell IS zsh, but
+     * {@code worktreeRoot} and/or {@code worktreeGroup} is missing, so the generated ZDOTDIR cannot
+     * be placed anywhere the member's OS user can reach — {@code java.io.tmpdir} is fleetd's own
+     * 0700 temp dir, unreadable by another uid, which is the exact gap this ticket exists to close.
+     * Say so once per launcher instance, instead of either generating a directory nothing can read
+     * (protection theatre) or refusing to spawn (turning a degraded credential control into an
+     * outage for an opt-in feature).
+     */
+    private void warnCannotShareScrubDirectory() {
+        if (cannotShareScrubDirWarned.compareAndSet(false, true)) {
+            log.warn("memberCredentials policy=allow-list: memberHerdrSocket is configured and the "
+                    + "member login shell is zsh, but worktreeRoot and/or worktreeGroup is not "
+                    + "configured — the generated ZDOTDIR cannot be placed where the member's OS "
+                    + "user can read it (java.io.tmpdir is fleetd's own, unreadable by another uid), "
+                    + "so the scrub cannot be guaranteed to run. Falling back to the CB-596 sentinel "
+                    + "overlay. Configure both worktreeRoot and worktreeGroup to enable the "
+                    + "allow-list scrub under memberHerdrSocket.");
+        }
+    }
+
    /**
     * CB-633 teardown half: read the pane's scrub report (the denominator report the generated
     * scrub wrote) and delete the directory. Called from {@link #stop}, which is the one funnel
@@ -1230,6 +1543,71 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     */
    private final AtomicBoolean allowListGapLogged = new AtomicBoolean();

+    /**
+     * fleetd #185 stage 2: guards {@link #warnUnknownMemberEnvironment} to one WARN per launcher
+     * instance, not one per spawn — the same one-per-instance shape as {@link #unprotectedGapLogged}
+     * and {@link #allowListGapLogged}, kept as its own flag for the same reason those two are split:
+     * this mode is orthogonal to which of the other two branches would otherwise have fired.
+     */
+    private final AtomicBoolean unknownMemberEnvironmentWarned = new AtomicBoolean();
+
+    /**
+     * fleetd #185 stage 2: whether {@code memberHerdrSocket:} is configured, i.e. member panes run
+     * on a second herdr owned by a different OS user than the daemon's own process. Re-read from the
+     * live config on every call (same hot-reload shape as {@link #memberCredentials}), never cached,
+     * so a config reload takes effect on the next spawn without a restart.
+     *
+     * <p>{@link #config} is {@code null} on any call site that never threaded the full config
+     * through (every production {@code HerdrPeerLauncher} does; a handful of older tests do not) —
+     * treated the same as "not configured", which is the correct, permissive default: it is exactly
+     * today's single-daemon behaviour.
+     *
+     * <p>Package-private (fleetd #219) — {@link OpenCodeLauncher} reuses this same gate to decide
+     * where its own ephemeral {@code opencode.json} directory (site 1) and its opencode session
+     * discovery (site 2) may run, rather than re-deriving "is this a multi-uid fleet" a second way.
+     */
+    boolean memberHerdrSocketConfigured() {
+        if (config == null) {
+            return false;
+        }
+        FleetConfig cfg = config.get();
+        return cfg != null && cfg.memberHerdrSocket() != null && !cfg.memberHerdrSocket().isBlank();
+    }
+
+    /**
+     * fleetd #185 stage 2: the single replacement WARN for {@link #logCredentialGap}'s usual
+     * conclusions when {@code memberHerdrSocket:} is configured. {@link #hostEnvNames} (and
+     * everything derived from it — {@code known}/{@code allow} coverage, the allow-list scrub's
+     * derived set) describes the DAEMON's own environment; under this config key member panes run as
+     * a different OS user with a different environment entirely, so neither "every member pane
+     * inherits them UNBLOCKED" nor "the scrub blanks them" is evidence-backed here — both would be
+     * reporting on the wrong process. Logged once, names the config key, and states the honest
+     * conclusion: the gap for member panes is UNKNOWN, not clean, so {@code memberCredentials} cannot
+     * be verified from this daemon. The one count it does report is scoped explicitly to fleetd's own
+     * environment, never presented as if it said anything about the member's — see {@link
+     * #logCredentialGap}'s javadoc for why this branch exists.
+     */
+    private void warnUnknownMemberEnvironment(FleetConfig.MemberCredentials creds) {
+        if (!unknownMemberEnvironmentWarned.compareAndSet(false, true)) {
+            return;
+        }
+        Set<String> covered = new HashSet<>(creds.known());
+        covered.addAll(creds.allow());
+        Set<String> hostNames = hostEnvNames.get();
+        long gapInFleetdsOwnEnv = hostNames.stream()
+                .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
+                .filter(name -> !covered.contains(name))
+                .count();
+        log.warn("memberCredentials gap: memberHerdrSocket is configured, so member panes run under "
+                        + "a different OS user than fleetd's own process, with a different environment "
+                        + "entirely — fleetd has no channel to read that user's environment. {} of the "
+                        + "{} names in fleetd's OWN environment are credential-shaped and not on "
+                        + "known:/allow:, but that count describes fleetd's process, not the member "
+                        + "herdr's. The credential gap for member panes is UNKNOWN, not clean, and "
+                        + "memberCredentials cannot be verified from here.",
+                gapInFleetdsOwnEnv, hostNames.size());
+    }
+
    /**
     * CB-596 criterion 4: a credential-shaped host env var name on neither {@code known} nor
     * {@code allow} is not silently allowed — it is reported. {@link #hostEnvNames} enumerates the
@@ -1258,8 +1636,22 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * (same severity, and same guard, as the deny-by-default case — a name genuinely reaching a
     * member unprotected is equally serious whichever path put it there), and the names it says are
     * blanked keep the INFO.
+     *
+     * <p>fleetd #185 stage 2: everything above assumes the member pane runs under the same OS user
+     * as the daemon, so {@link #hostEnvNames} mirrors what the pane inherits — see that field's
+     * javadoc. When {@code memberHerdrSocket:} is configured that assumption is false: the member
+     * pane runs on a second herdr owned by a <em>different</em> user, and neither conclusion below
+     * ("inherits them UNBLOCKED" / "the scrub blanks them") is backed by evidence about that user's
+     * environment. So this method checks that first and, when configured, reports the honest
+     * "unknown, not clean" conclusion instead — see {@link #warnUnknownMemberEnvironment}. When
+     * {@code memberHerdrSocket:} is absent (the default, and the only mode this host runs) this
+     * branch is never taken and every line below is unchanged.
     */
    private void logCredentialGap(FleetConfig.MemberCredentials creds, Set<String> effectiveAllowed) {
+        if (memberHerdrSocketConfigured()) {
+            warnUnknownMemberEnvironment(creds);
+            return;
+        }
        Set<String> covered = new HashSet<>(creds.known());
        covered.addAll(creds.allow());
        List<String> gap = hostEnvNames.get().stream()
@@ -6,6 +6,7 @@ import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.ExhaustionSink;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.CharterReceipt;
 import dev.ltms.fleet.peer.PeerHandle;
@@ -20,6 +21,9 @@ import java.util.EnumSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.BooleanSupplier;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
 import java.util.function.Supplier;
@@ -71,6 +75,19 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     */
    private final OpenCodeSessionDiscovery discovery;

+    /**
+     * fleetd #175: notified when {@link SessionAwareHandle} detects, on the same late-resolve
+     * read that discovers the session id, that the live opencode session is running a DIFFERENT
+     * model than the profile requested — opencode does not fail on an unknown {@code -m}, it
+     * silently falls back to a default (potentially paid) model. Reused exactly as
+     * {@code CompletionResolver}'s {@code BACKEND_EXHAUSTED} path uses it: this launcher supplies
+     * only the herdr terminal id and a reason string; mapping target → session → profile →
+     * credential stays entirely the sink's job (see {@code Fleetd.main}'s wiring). Defaults to
+     * {@link ExhaustionSink#none()} for a caller (an older constructor, or a test not exercising
+     * this) that opts out.
+     */
+    private final ExhaustionSink exhaustionSink;
+
    /**
     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so it
     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
@@ -130,9 +147,25 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                             Supplier<FleetConfig.Fleet> fleet,
                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
                             Supplier<FleetConfig> config) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, spawnReadyPollMs,
+                fleet, memberCredentials, config, ExhaustionSink.none());
+    }
+
+    /**
+     * Production constructor, plus the live config for URI environment exclusions and the fleetd
+     * #175 model-mismatch quarantine sink.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                             Function<String, String> env, long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                             Supplier<FleetConfig.Fleet> fleet,
+                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
+                             Supplier<FleetConfig> config,
+                             ExhaustionSink exhaustionSink) {
        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials, config);
+                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials, config,
+                exhaustionSink);
    }

    /**
@@ -180,6 +213,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
        this.configRoot = configRoot;
        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+        this.exhaustionSink = ExhaustionSink.none();
    }

    /**
@@ -205,17 +239,72 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                             Supplier<FleetConfig.Fleet> fleet,
                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
                             Supplier<FleetConfig> config) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, nowMillis, sleeper,
+                configRoot, discoveryRoot, fleet, memberCredentials, config, ExhaustionSink.none());
+    }
+
+    /**
+     * Full testability constructor, plus the live config for URI environment exclusions and the
+     * fleetd #175 model-mismatch quarantine sink — the constructor a test drives directly to
+     * observe {@link ExhaustionSink#onExhausted} without going through {@code Fleetd.main}'s
+     * wiring.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                             Function<String, String> env, long spawnReadyTimeoutMs,
+                             LongSupplier nowMillis, Runnable sleeper, Path configRoot, Path discoveryRoot,
+                             Supplier<FleetConfig.Fleet> fleet,
+                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
+                             Supplier<FleetConfig> config,
+                             ExhaustionSink exhaustionSink) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, null, config);
        this.configRoot = configRoot;
        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+        this.exhaustionSink = exhaustionSink == null ? ExhaustionSink.none() : exhaustionSink;
    }

    private static Path defaultConfigRoot() {
        return Path.of(System.getProperty("java.io.tmpdir"));
    }

-    /** The default opencode storage root: {@code ~/.local/share/opencode} (the XDG data dir). */
+    /**
+     * The default opencode storage root: {@code ~/.local/share/opencode} (the XDG data dir) —
+     * always FLEETD's OWN {@code user.home}, whichever OS user runs the daemon.
+     *
+     * <p><b>fleetd #219 site 2 — a decision, not a patch.</b> Under {@code memberHerdrSocket:} the
+     * member pane runs as a <em>different</em> OS user, and opencode writes {@code opencode.db}
+     * under <em>that</em> user's {@code $HOME}, not fleetd's. Scanning fleetd's own {@code
+     * user.home} is therefore looking in the wrong place — a wrong-LOCATION failure, not a
+     * wrong-PERMISSION one like site 1, and it fails quietly: {@link
+     * SessionAwareHandle#agentSessionId()} would keep returning {@code null} forever, which reads
+     * as "opencode does not support resume" rather than "fleetd looked in the wrong home." fleetd
+     * #209 is the reason that silence is unacceptable.
+     *
+     * <p>Three ways to close the gap were weighed:
+     * <ol>
+     *   <li><b>Make the member's home configurable.</b> Correct in principle, but this ticket's
+     *       scope is the two existing call sites, not a new config key — {@code memberHerdrSocket}
+     *       already carries the second herdr's socket path, not its user's home, and inventing a
+     *       parallel key here without also wiring it through discovery's actual callers is a
+     *       half-shipped feature (the exact shape CB-596/CB-611 warn against).</li>
+     *   <li><b>Derive it</b> (e.g. from {@code worktreeRoot}'s owner, or {@code getent passwd}).
+     *       Rejected: nothing in this codebase resolves a Unix username to a home directory today,
+     *       and guessing wrong would silently point discovery at a THIRD wrong location — worse
+     *       than the current gap, because it would look like it should work.</li>
+     *   <li><b>Declare discovery unavailable</b> under {@code memberHerdrSocket}, and say so once,
+     *       loudly, instead of scanning a directory that structurally cannot hold the answer.</li>
+     * </ol>
+     *
+     * <p>Option 3 is taken — the one this ticket says to default to when unsure. {@link
+     * OpenCodeLauncher#spawn} routes {@link SessionAwareHandle#agentSessionId()} through {@link
+     * HerdrPeerLauncher#memberHerdrSocketConfigured()} before ever calling {@link
+     * OpenCodeSessionDiscovery#sessionIdForDirectory}, so under {@code memberHerdrSocket} the
+     * database at this root is never even opened, and one WARN per launcher instance names the gap
+     * instead of the {@code null} return reading as "unsupported." Capability advertising is
+     * unaffected: {@link #capabilities()} always includes {@code SESSION_RESUME}, since {@code
+     * memberHerdrSocket} absent (today's only live mode) is unchanged by this decision.
+     */
    private static Path defaultDiscoveryRoot() {
        return Path.of(System.getProperty("user.home"), ".local", "share", "opencode");
    }
@@ -331,7 +420,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     */
    private Path writeConfig(FleetConfig.Profile cfg, String charterText, String cwd) {
        try {
-            Path dir = Files.createTempDirectory(configRoot, "fleetd-opencode-");
+            Path dir = Files.createTempDirectory(configParentDir(), "fleetd-opencode-");
            dir.toFile().deleteOnExit();

            ObjectNode root = JSON.createObjectNode();
@@ -402,6 +491,14 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            // carries operator-supplied values (URL, model id, api key), so escaping must be real.
            Files.writeString(cfgFile, JSON.writerWithDefaultPrettyPrinter().writeValueAsString(root));
            cfgFile.toFile().deleteOnExit();
+            if (memberHerdrSocketConfigured()) {
+                // fleetd #219: the same "different OS user" gap fleetd #213 closed for the ZDOTDIR
+                // scrub — share read-only with worktreeGroup rather than leaving the directory under
+                // fleetd's own 0700 java.io.tmpdir, where the member's OS user could not even
+                // traverse it. memberGroup() cannot be null here: configParentDir() above already
+                // refused this spawn if either worktreeRoot or worktreeGroup was missing.
+                EnvAllowListScrub.shareWithGroup(dir, memberGroup());
+            }
            return cfgFile;
        } catch (IOException e) {
            throw new UncheckedIOException(
@@ -409,6 +506,57 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
        }
    }

+    /**
+     * fleetd #219 site 1: where {@link #writeConfig} creates its per-spawn directory.
+     *
+     * <ul>
+     *   <li>{@code memberHerdrSocket} ABSENT (today's only mode): byte-identical to before this
+     *       fix — always {@link #configRoot} (defaults to {@code java.io.tmpdir}, fleetd's own
+     *       process).</li>
+     *   <li>{@code memberHerdrSocket} PRESENT: {@code java.io.tmpdir} is fleetd's own per-user temp
+     *       dir (mode {@code 0700} on macOS) — the member pane runs as a DIFFERENT OS user under
+     *       this config key and cannot even traverse it, so the directory holding {@code
+     *       opencode.json} (which tells the member where the bridge MCP is) and the member charter
+     *       would be unreadable to the very process it is written for. The directory instead goes
+     *       under {@code worktreeRoot}, shared read-only with {@code worktreeGroup} via {@link
+     *       EnvAllowListScrub#shareWithGroup} — the SAME mechanism fleetd #213 built for the ZDOTDIR
+     *       scrub, reused here rather than duplicated (see {@link
+     *       HerdrPeerLauncher#memberScrubParentDir()}).</li>
+     * </ul>
+     *
+     * <p><b>Unlike the ZDOTDIR scrub, a missing {@code worktreeRoot}/{@code worktreeGroup} here
+     * REFUSES the spawn instead of degrading.</b> The ZDOTDIR scrub is a credential CONTROL: a
+     * degraded control (CB-596's sentinel overlay) is still worth having. This config file is not a
+     * control — it is the ONLY way the member learns where the bridge MCP lives. Writing it
+     * somewhere the member cannot read would not degrade anything; it would spawn a member that
+     * occupies a pane and never becomes deliverable, since {@code fleet_send} waits ~60s on the
+     * readiness gate and then fails with nothing pointing at a temp directory as the cause. Refusing
+     * up front, with a message that names the missing config key, is the honest failure — an
+     * undeliverable member is not a working spawn either way, so nothing is lost by refusing loudly
+     * instead of failing silently later.
+     *
+     * @throws IllegalStateException when {@code memberHerdrSocket} is configured but {@code
+     *                                worktreeRoot} and/or {@code worktreeGroup} is not
+     */
+    private Path configParentDir() {
+        if (!memberHerdrSocketConfigured()) {
+            return configRoot;
+        }
+        Path root = memberScrubParentDir();
+        String group = memberGroup();
+        if (root == null || group == null) {
+            throw new IllegalStateException("memberHerdrSocket is configured, so opencode's config "
+                    + "directory (opencode.json + member charter) must be placed where the member's "
+                    + "OS user can read it — worktreeRoot, shared via worktreeGroup — but "
+                    + (root == null ? "worktreeRoot" : "worktreeGroup") + " is not configured. "
+                    + "Refusing to spawn rather than write a config the member cannot read: that "
+                    + "member would occupy a pane and never become deliverable, with nothing "
+                    + "pointing at the real cause. Configure both worktreeRoot and worktreeGroup to "
+                    + "enable opencode member spawns under memberHerdrSocket.");
+        }
+        return root;
+    }
+
    /**
     * Declare a custom OpenAI-compatible provider so the worker talks to a pinned endpoint (a local
     * vLLM, say) instead of opencode's default gateway (CB-508).
@@ -517,11 +665,21 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
        return afterScheme.contains("/") ? trimmed : trimmed + "/v1";
    }

+    /** One WARN per launcher instance for the fleetd #219 site-2 discovery-unavailable gap. */
+    private final AtomicBoolean discoveryUnavailableWarned =
+            new AtomicBoolean();
+
    /** Add lazy on-disk session discovery to the base handle. */
    @Override
    public PeerHandle spawn(SpawnRequest req) {
        PeerHandle inner = super.spawn(req);
-        return new SessionAwareHandle(inner, discovery, effectiveCwd(req));
+        // fleetd #175: the same profile config buildLaunch resolved for this spawn (requireProfile
+        // is deterministic on req.profileName(), so re-resolving here costs a map lookup, not a
+        // second decision) — SessionAwareHandle needs cfg.model() to know what THIS session should
+        // be running.
+        FleetConfig.Profile cfg = requireProfile(req.profileName());
+        return new SessionAwareHandle(inner, discovery, effectiveCwd(req), cfg,
+                this::memberHerdrSocketConfigured, discoveryUnavailableWarned, exhaustionSink);
    }

    /**
@@ -531,16 +689,48 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * are untouched — only the opencode-specific identity answer is added. {@code sessionName()}
     * stays null: opencode has no display-name seam, so the logical name lives only in the bridge's
     * roster (see the SESSION_NAME capability).
+     *
+     * <p>fleetd #175: {@link #agentSessionId()} is also where the model-mismatch check lives (see
+     * {@link #checkModelMatch()}) — it is the one method the real late-resolve path
+     * ({@code SessionManager.resolveAgentSessionId}, via {@code get}/{@code rosterResolved}/
+     * {@code release}) actually calls, and only while the session id is still unknown. Putting the
+     * check anywhere else risks repeating PR #203's mistake: a check that runs before opencode has
+     * written the row it needs, and so never fires.
     */
    private static final class SessionAwareHandle implements PeerHandle {
        private final PeerHandle delegate;
        private final OpenCodeSessionDiscovery discovery;
        private final String cwd;
+        private final FleetConfig.Profile cfg;
+        private final BooleanSupplier discoveryUnavailable;
+        private final AtomicBoolean discoveryUnavailableWarned;
+        private final ExhaustionSink exhaustionSink;
+        /** CAS'd true the first (and only) time a model mismatch is reported for this handle. */
+        private final AtomicBoolean modelMismatchReported = new AtomicBoolean();
+        /**
+         * The session id, once {@link OpenCodeSessionDiscovery#sessionIdForDirectory} first
+         * resolves a non-null answer for this handle (fleetd #234). Sticky on purpose: {@code
+         * directory} is a shared-cwd heuristic (see {@link OpenCodeSessionDiscovery}'s class
+         * javadoc) that can start returning a DIFFERENT row once another session shares the same
+         * directory and writes a newer one — re-deriving it on every call would let this handle's
+         * identity silently drift to a sibling's session. Once resolved, this IS the answer, and
+         * {@link #checkModelMatch} reads only the row this id names, never "whatever is newest in
+         * the directory right now."
+         */
+        private final AtomicReference<String> resolvedSessionId = new AtomicReference<>();

-        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd) {
+        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd,
+                            FleetConfig.Profile cfg,
+                            BooleanSupplier discoveryUnavailable,
+                            AtomicBoolean discoveryUnavailableWarned,
+                            ExhaustionSink exhaustionSink) {
            this.delegate = delegate;
            this.discovery = discovery;
            this.cwd = cwd;
+            this.cfg = cfg;
+            this.discoveryUnavailable = discoveryUnavailable;
+            this.discoveryUnavailableWarned = discoveryUnavailableWarned;
+            this.exhaustionSink = exhaustionSink;
        }

        @Override
@@ -565,11 +755,109 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {

        @Override
        public String agentSessionId() {
+            // fleetd #219 site 2: under memberHerdrSocket the member pane runs as a different OS
+            // user, so opencode.db lives under THAT user's $HOME, not the one discoveryRoot was
+            // built from (see OpenCodeLauncher#defaultDiscoveryRoot's javadoc for the full
+            // reasoning). Scanning fleetd's own $HOME under that config would only ever find "no
+            // row" and read as "resume unsupported" — declare it unavailable instead, once, loudly.
+            if (discoveryUnavailable.getAsBoolean()) {
+                if (discoveryUnavailableWarned.compareAndSet(false, true)) {
+                    log.warn("opencode session discovery unavailable: memberHerdrSocket is "
+                            + "configured, so opencode's on-disk session database lives under the "
+                            + "MEMBER's own $HOME, not fleetd's ({}) — agentSessionId will stay null "
+                            + "for every opencode member under this config, and SESSION_RESUME "
+                            + "cannot be honored (fleetd #209/#219).",
+                            System.getProperty("user.home"));
+                }
+                return null;
+            }
+            // fleetd #234: once resolved, stay resolved. Re-deriving from `directory` on every call
+            // would let this handle's identity drift to a sibling session that later shares the
+            // same cwd and writes a newer row — see resolvedSessionId's javadoc.
+            String cached = resolvedSessionId.get();
+            if (cached != null) {
+                return cached;
+            }
            // Lazy + retried, never a spawn-time blocker: opencode writes the session record only
            // when the session is first persisted, so null here is the correct interim answer and
            // the caller re-calls later (each call re-scans, picking up a record that has since
            // appeared).
-            return discovery.sessionIdForDirectory(cwd);
+            String id = discovery.sessionIdForDirectory(cwd);
+            if (id != null) {
+                resolvedSessionId.compareAndSet(null, id);
+            }
+            // fleetd #175: check on the SAME tick — while the caller (SessionManager's late-resolve
+            // step) is still re-polling because the id is unknown, the row this id came from (once
+            // it exists) is exactly the row that also carries the actual model. Once id resolves,
+            // the caller stops calling agentSessionId() for this session, so this is naturally a
+            // once-only check that happens right when the row first appears.
+            checkModelMatch(id);
+            return id;
+        }
+
+        /**
+         * Verify the live opencode session is running the model {@link #cfg} requested (fleetd
+         * #175) and, on a real mismatch, log an ERROR and quarantine through {@link
+         * #exhaustionSink}. A no-op when there is nothing to compare against — no model configured,
+         * already reported once for this handle, {@code sessionId} itself is not resolved yet
+         * (fleetd #234: absent evidence, not a mismatch), or the actual model is still UNKNOWN (no
+         * row yet, unreadable database, or unparseable evidence). UNKNOWN must never be treated as
+         * a mismatch: that is the single most important safety rule here — a false positive would
+         * quarantine a perfectly working profile's credential.
+         *
+         * @param sessionId the id {@link #agentSessionId()} just resolved (or had cached) for THIS
+         *                  handle — the model is read back for this exact session (fleetd #234's
+         *                  {@link OpenCodeSessionDiscovery#actualModelForSessionId}), never
+         *                  re-derived from {@code directory}
+         */
+        private void checkModelMatch(String sessionId) {
+            if (modelMismatchReported.get() || cfg.model() == null || cfg.model().isBlank()) {
+                return;
+            }
+            if (sessionId == null || sessionId.isBlank()) {
+                return; // id not resolved yet — UNKNOWN, never a mismatch (fleetd #175's rule)
+            }
+            OpenCodeSessionDiscovery.ActualModel actual = discovery.actualModelForSessionId(sessionId);
+            if (actual == null) {
+                return; // UNKNOWN evidence — never a mismatch
+            }
+            String[] requestedParts = splitProviderModel(cfg.model());
+            String requestedProvider = requestedParts == null ? null : requestedParts[0];
+            String requestedId = requestedParts == null ? cfg.model() : requestedParts[1];
+            boolean idMatches = requestedId.equals(actual.id());
+            // Compare the provider ONLY when BOTH sides have one. requestedProvider == null covers
+            // a bare profile model with no "/" — the profile never asked for a specific provider.
+            // actual.provider() == null covers opencode's model JSON having an id but no providerID
+            // (a real shape parseModel accepts) — that is missing evidence, not a contradiction, and
+            // acceptance rule 4 says missing evidence is UNKNOWN, never a mismatch. Narrowing the
+            // provider comparison this way keeps the id comparison (the part that actually caught the
+            // xf bug) fully intact — a genuine id mismatch is still caught either way (fleetd #175
+            // review round 2).
+            boolean providerMatches = requestedProvider == null || actual.provider() == null
+                    || requestedProvider.equals(actual.provider());
+            if (idMatches && providerMatches) {
+                return;
+            }
+            if (!modelMismatchReported.compareAndSet(false, true)) {
+                return; // another thread already reported this exact mismatch
+            }
+            String actualDisplay = actual.provider() == null
+                    ? actual.id() : actual.provider() + "/" + actual.id();
+            log.error("opencode profile '{}' requested model '{}' but the live session is actually "
+                            + "running '{}' — opencode does not fail on an unknown -m, it silently "
+                            + "falls back to a default model, which may be a PAID credential "
+                            + "(fleetd #175); quarantining this profile's credential",
+                    cfg.profile(), cfg.model(), actualDisplay);
+            // fleetd #234: pass our OWN profile name too. This check fires from agentSessionId(),
+            // called during SessionManager.acquire() BEFORE this session is registered in
+            // sessions.roster() — a roster-only sink (Fleetd's target -> session -> profile lookup)
+            // finds nothing at this point and silently no-ops (defect 2). We already know exactly
+            // which profile to quarantine without the roster; the sink is passed it explicitly.
+            exhaustionSink.onExhausted(delegate.terminalId(),
+                    "opencode model mismatch: profile '" + cfg.profile() + "' requested '"
+                            + cfg.model() + "' but the live session is running '" + actualDisplay
+                            + "' (fleetd #175)",
+                    cfg.profile());
        }

        @Override
@@ -1,9 +1,12 @@
 package dev.ltms.fleet.member;

+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.sqlite.SQLiteConfig;

+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.sql.Connection;
@@ -29,11 +32,19 @@ import java.util.concurrent.atomic.AtomicBoolean;
 * here, so a layout change, or a switch to the HTTP server, changes exactly one class and nothing
 * in {@link OpenCodeLauncher}.
 *
- * <p>The determinism that makes this useful is structural, not a guess: every fleetd worker runs
- * in its own unique git worktree, so the row's {@code directory} (its project root) equals the
- * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
- * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
- * the CLI listing does not even show the directory.
+ * <p><strong>The {@code directory} match is a heuristic, not an identity — fleetd #234.</strong> A
+ * worktree is opt-in: {@code fleet_spawn} only provisions one when the caller passes {@code
+ * worktree:}; the default spawn inherits the lead's own cwd, which every other worker spawned the
+ * same way (and every past session ever run there) shares. {@code directory} therefore does
+ * <em>not</em> identify a session unambiguously in general — only in the special case of a fresh,
+ * unique worktree does "most recently updated row for this directory" reliably mean "this worker's
+ * own row." {@link #sessionIdForDirectory} still has to use this heuristic (the id has to come from
+ * somewhere, and nothing else is available at this layer — see that method's javadoc), but a caller
+ * that already holds a resolved id must never re-derive evidence about that same session via
+ * {@code directory} again; see {@link #actualModelForSessionId}, which looks up by {@code id}
+ * instead for exactly this reason. We match on {@code directory} rather than diffing
+ * {@code opencode session list} before/after — that races under concurrent spawns, and the CLI
+ * listing does not even show the directory.
 *
 * <p>All reads are best-effort and never throw: a missing or unreadable database, a query that
 * fails, or a directory with no row yet all yield {@code null}, and the caller (the session
@@ -44,6 +55,18 @@ import java.util.concurrent.atomic.AtomicBoolean;
 final class OpenCodeSessionDiscovery {

    private static final Logger log = LoggerFactory.getLogger(OpenCodeSessionDiscovery.class);
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    /**
+     * The model opencode actually ran a session on, parsed from the {@code session.model} JSON
+     * column (fleetd #175). {@code id} is never null/blank on a non-null {@code ActualModel} —
+     * {@link #parseModel} returns {@code null} instead when {@code id} cannot be determined, so a
+     * caller only ever sees a fully-known record or {@code null} (UNKNOWN). {@code provider} may
+     * still be {@code null} on its own when the profile that requested the session named no
+     * provider prefix, or opencode's JSON omitted {@code providerID}.
+     */
+    record ActualModel(String provider, String id) {
+    }

    private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
    private final Path databasePath;
@@ -74,8 +97,16 @@ final class OpenCodeSessionDiscovery {
    /**
     * The opencode session id whose row references {@code directory} (the worker's cwd), or
     * {@code null} when no row matches yet. When several rows share the directory — e.g. repeated
-     * spawns into the same worktree — the row with the highest {@code time_updated} wins: it is
-     * the session the pane most likely corresponds to.
+     * spawns into the same worktree, OR several workers sharing one cwd because none of them was
+     * given a worktree (fleetd #234) — the row with the highest {@code time_updated} wins: it is
+     * the session the pane most likely corresponds to. That "most likely" is a real caveat, not a
+     * formality: when the directory is shared, this can and does pick another session's row (see
+     * the class javadoc). This is the one place fleetd resolves an opencode session id at all —
+     * nothing else is available at this layer to disambiguate further (no {@code opencode session
+     * list} entry names the directory, and diffing before/after races under concurrent spawns) — so
+     * the heuristic stays here unchanged. What must never happen is a SECOND, independent piece of
+     * evidence about the same session being re-derived via {@code directory} once an id has already
+     * come out of this method; see {@link #actualModelForSessionId}.
     *
     * <p>Never throws: a missing {@code opencode.db}, a locked/unreadable database, a query
     * failure, or a directory that has not been persisted yet all resolve to {@code null} rather
@@ -117,4 +148,85 @@ final class OpenCodeSessionDiscovery {
                storageRoot, directory);
        return null;
    }
+
+    /**
+     * The model opencode actually ran the session {@code sessionId} on (fleetd #175/#234), read by
+     * primary-key lookup — the ONE row that id names, and no other. Deliberately keyed on
+     * {@code id} rather than {@code directory}: two independent {@code WHERE directory = ? ORDER BY
+     * time_updated DESC LIMIT 1} queries (one for the id, one for the model) can each pick a
+     * DIFFERENT row once more than one session shares a directory (fleetd #234 — the default
+     * no-worktree spawn shares the lead's cwd with every other worker and every past session ever
+     * run there), silently comparing a profile's requested model against a session that is not even
+     * the one whose id was returned. Keying on {@code id} instead makes that impossible: the model
+     * read back is always the SAME session {@link #sessionIdForDirectory} (or a cached copy of its
+     * answer) already resolved.
+     *
+     * <p>Kept as its own query and its own connection, independent from {@link
+     * #sessionIdForDirectory}: a database whose schema predates the {@code model} column (or any
+     * other read failure on this column alone) can never take id resolution down with it. That
+     * would be a regression of the id-resolution feature #209 shipped; this method degrades on its
+     * own.
+     *
+     * <p>Never throws, and every failure mode — no matching row, a missing/unreadable database, a
+     * missing {@code model} column, a null/blank {@code model} value, or JSON that does not parse
+     * into {@code {"id": "...", "providerID": "..."}} with a non-blank {@code id} — resolves to
+     * {@code null}. That is UNKNOWN evidence, not a mismatch signal: the caller must never
+     * quarantine a profile on the strength of a {@code null} here. A blank/null {@code sessionId}
+     * (the id is not resolved yet) is UNKNOWN too, for the same reason — never call this with one.
+     *
+     * @param sessionId the session id already resolved by {@link #sessionIdForDirectory} for this
+     *                   spawn — never re-derived from {@code directory} here
+     * @return the actual model, or {@code null} when unknown
+     */
+    ActualModel actualModelForSessionId(String sessionId) {
+        if (sessionId == null || sessionId.isBlank()) {
+            return null;
+        }
+        if (!Files.isRegularFile(databasePath)) {
+            // sessionIdForDirectory already WARNs once (shared warnedMissingDatabase) for this
+            // exact condition — do not double-log it here.
+            return null;
+        }
+        String sql = "SELECT model FROM session WHERE id = ?";
+        try (Connection connection = openReadOnly();
+             PreparedStatement statement = connection.prepareStatement(sql)) {
+            statement.setString(1, sessionId);
+            try (ResultSet rows = statement.executeQuery()) {
+                if (rows.next()) {
+                    return parseModel(rows.getString("model"));
+                }
+            }
+        } catch (SQLException e) {
+            // Locked/corrupt database, or a `model` column this schema version does not have —
+            // never fatal, and never a mismatch signal. See the class doc above.
+            log.debug("opencode session model unreadable at {}: {}", databasePath, e.toString());
+            return null;
+        }
+        return null;
+    }
+
+    /**
+     * Parse opencode's {@code model} column — {@code {"id":"...","providerID":"..."}} — into an
+     * {@link ActualModel}, or {@code null} when {@code json} is null/blank, is not valid JSON, or
+     * parses without a non-blank {@code id}. {@code providerID} may be absent; that alone does not
+     * make the record unknown, since a caller comparing against a profile with no provider prefix
+     * never looks at it.
+     */
+    private static ActualModel parseModel(String json) {
+        if (json == null || json.isBlank()) {
+            return null;
+        }
+        try {
+            JsonNode node = MAPPER.readTree(json);
+            String id = node.path("id").asText(null);
+            if (id == null || id.isBlank()) {
+                return null;
+            }
+            String provider = node.path("providerID").asText(null);
+            return new ActualModel(provider, id);
+        } catch (IOException e) {
+            log.debug("opencode session model JSON unparseable: {}", e.toString());
+            return null;
+        }
+    }
 }
@@ -9,6 +9,7 @@ import dev.ltms.fleet.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

+import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
 import java.util.concurrent.CompletableFuture;
@@ -167,6 +168,12 @@ public final class MessageService {
    private static final class Task {
        private final String ticket;
        private final String target;
+        /**
+         * When this task was created (#137 fix): the tiebreaker for which of several open tasks on
+         * one target gets a recovered reply in {@link #abandon} — the oldest, since it is the one
+         * that has been waiting longest.
+         */
+        private final long createdNanos;
        private final CompletableFuture<Reply> future = new CompletableFuture<>();
        /**
         * When {@link #future} resolved, or {@code null} while it is still pending — the clock
@@ -184,6 +191,7 @@ public final class MessageService {
        private Task(String ticket, String target, LongSupplier nowNanos) {
            this.ticket = ticket;
            this.target = target;
+            this.createdNanos = nowNanos.getAsLong();
            future.whenComplete((reply, ex) -> completedNanos = nowNanos.getAsLong());
        }
    }
@@ -375,6 +383,19 @@ public final class MessageService {
     * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
     * are interactive and must never be queued.
     *
+     * <p><strong>Ambiguous match also falls to the inbox.</strong> {@link #askAnsweredAsyncTasks}
+     * cannot actually return more than one entry today (see its own javadoc for why — in short,
+     * {@link #hasAsyncQuestion} keeps a target BUSY, so no second task can reach this state, for as
+     * long as an earlier one's {@code turnId} is still stamped). That is an emergent guarantee from
+     * two other facts, not one this method enforces, so this branch stays in as defence in depth
+     * rather than being removed as dead code: if it ever weakens, returning whichever candidate a
+     * {@code ConcurrentHashMap} iteration reaches first would let a genuine reply complete the
+     * <em>wrong</em> ticket — silently handing the lead something that reads like a correct answer to
+     * a delegation the worker never touched, which is worse than a failure because the lead acts on
+     * it. When more than one candidate exists, guessing is not safe: fall back to the inbox exactly
+     * as the zero-candidate case does, and let {@link #abandon} apply the eventual recovery
+     * deterministically instead.
+     *
     * @return always {@code true} — the reply resolved a live send, completed a parked ticket, or
     *         was queued
     */
@@ -392,13 +413,21 @@ public final class MessageService {
        // FAILED with a misleading "session released before it replied" reason, even though the reply
        // had, in fact, arrived. Completing the matching ticket directly here means fleet_poll{ticket}
        // sees the real reply instead.
-        Task orphan = askAnsweredAsyncTask(session);
-        if (orphan != null && orphan.future.complete(new Reply(Outcome.REPLIED, content))) {
-            if (orphan.turnId != null) {
-                asyncTasksByTurn.remove(orphan.turnId, orphan);
+        List<Task> candidates = askAnsweredAsyncTasks(session);
+        if (candidates.size() == 1) {
+            Task orphan = candidates.get(0);
+            if (orphan.future.complete(new Reply(Outcome.REPLIED, content))) {
+                if (orphan.turnId != null) {
+                    asyncTasksByTurn.remove(orphan.turnId, orphan);
+                }
+                count(FleetMetrics.REPLIES, "path", "async-recovered");
+                return true;                   // the ticket itself took it — no inbox stranding at all
            }
-            count(FleetMetrics.REPLIES, "path", "async-recovered");
-            return true;                       // the ticket itself took it — no inbox stranding at all
+        } else if (candidates.size() > 1) {
+            List<String> tickets = candidates.stream().map(t -> t.ticket).toList();
+            log.warn("reply from {} matches {} open async tickets {} — cannot tell which one it "
+                    + "answers, queuing to the inbox instead of guessing", session, candidates.size(),
+                    tickets);
        }
        inbox.publish(session, UUID.randomUUID().toString(), content);
        // CB-640: record the stranding itself (not just the reply text) so fleet health can see a
@@ -414,21 +443,38 @@ public final class MessageService {
    }

    /**
-     * The still-open async task on {@code target} whose {@code fleet_ask} was already answered — its
-     * {@link Task#turnId} is stamped but its {@link Task#question} was cleared by {@link #answer} —
-     * yet whose future is not resolved yet (#137). {@code null} if no such task exists, including the
+     * Every still-open async task on {@code target} whose {@code fleet_ask} was already answered —
+     * its {@link Task#turnId} is stamped but its {@link Task#question} was cleared by {@link #answer}
+     * — yet whose future is not resolved yet (#137). Empty if no such task exists, including the
     * common case where {@code target}'s worker never used {@code fleet_ask} at all (a task that was
     * never asked has {@code turnId == null}, so it can never match here and only ever completes
     * through the ordinary rendezvous fast path in {@link #reply}).
+     *
+     * <p><strong>Returns at most one entry today — verified, not assumed.</strong> {@link #send}
+     * refuses to open a waiter on {@code target} while {@link #hasAsyncQuestion} is true, and that
+     * check matches ANY task whose {@code turnId} is still stamped in {@code asyncTasksByTurn} —
+     * not only while its question is still open. {@link #answer} deliberately leaves that stamp in
+     * place ({@code clearAsyncQuestion(turnId, false)}) until the resumed turn's own future actually
+     * resolves, at which point {@link #finishAsyncTask} both removes the stamp AND completes that
+     * task's future in the same call. So a second task can never reach "{@code turnId} stamped, future
+     * still open" — the exact pair this method matches on — while a first one already holds it: by
+     * the time the stamp is gone, so is the eligibility. This is an emergent property of those two
+     * facts holding together, not something this method (or its callers) enforces on its own — flip
+     * {@code forgetTurn} to {@code true} in that one {@link #answer} call and it silently stops being
+     * true, with nothing left to fail loudly. The callers below still handle "more than one" as
+     * defence in depth against exactly that, not because they exercise it today: {@link #reply}
+     * treats it as unresolvable and falls back to the inbox; {@link #abandon} would pick the oldest
+     * deterministically (its own {@code matching} list has no such guarantee — see its javadoc).
     */
-    private Task askAnsweredAsyncTask(String target) {
+    private List<Task> askAnsweredAsyncTasks(String target) {
+        List<Task> candidates = new ArrayList<>();
        for (Task task : tasks.values()) {
            if (target.equals(task.target) && task.question == null && task.turnId != null
                    && !task.future.isDone()) {
-                return task;
+                candidates.add(task);
            }
        }
-        return null;
+        return candidates;
    }

    /** Record a counter sample when a registry is wired; a no-op in unit tests. */
@@ -473,16 +519,63 @@ public final class MessageService {
     * outcome is counted, so a torn-down delegation stops being invisible to {@code /metrics}.
     *
     * <p><strong>#137 defence in depth.</strong> {@link #reply} already hands a worker's real
-     * {@code fleet_reply} straight to the async ticket it belongs to whenever one is still parked
-     * waiting for it (see {@link #askAnsweredAsyncTask}), so by the time a session is released its
-     * tasks are normally already resolved — this loop's {@code complete} calls are then harmless
-     * no-ops (a {@link CompletableFuture} can only resolve once). But should some other path someday
-     * strand a reply in the inbox without completing its ticket, checking
+     * {@code fleet_reply} straight to the async ticket it belongs to whenever exactly one is still
+     * parked waiting for it (see {@link #askAnsweredAsyncTasks}), so by the time a session is
+     * released its tasks are normally already resolved — this loop's {@code complete} calls are then
+     * harmless no-ops (a {@link CompletableFuture} can only resolve once). But should some other path
+     * someday strand a reply in the inbox without completing its ticket, checking
     * {@link #hasStrandedReply(String)} here — before ever writing a failure — means a torn-down
     * session whose worker in fact replied is still reported {@code REPLIED} with that reply's own
     * text, never the misleading "the worker session was released before it replied" (which also
     * means the snapshot/worktree recovery hint that follows it never prints once a reply exists).
     *
+     * <p><strong>At most one task gets the recovered reply — and here, unlike {@link #reply}'s
+     * {@link #askAnsweredAsyncTasks}, {@code matching.size() >= 2} alone is reachable today.</strong>
+     * This method's {@code matching} filter has no {@code turnId != null} requirement, so it matches
+     * any plain (never-asked) open task too — and {@link #sendAsync} does not limit a target to one
+     * of those: a second {@code fleet_send{wait:false}} at a target that is still busy returns its own
+     * ticket immediately and simply parks its {@link #send} behind the target's session lock for up
+     * to {@link #ASYNC_TIMEOUT_MS}, exactly as {@code abandonFailsEveryPendingAsyncTicketForTheReleasedTarget}
+     * already proves. Before this fix, the loop below drained the strand once and then reused that
+     * same {@code Reply} for <em>every</em> task it walked past — so two open tasks really did both
+     * complete {@code REPLIED} with the same text (see the pre-fix loop in commit 97f6c33's parent).
+     * A stranded reply is one worker answer, so it can settle at most one open task on this target —
+     * never every open task, and never a guess. When more than one task is still open here, the
+     * recovered reply goes to the <em>oldest</em> (lowest {@link Task#createdNanos}) — it has been
+     * waiting longest, so it is the one most likely to be what the reply actually answers. Every
+     * other open task keeps the ordinary {@code WORKER_FAILED} path it would take without a stranded
+     * reply at all.
+     *
+     * <p><strong>{@code matching.size() >= 2} together with {@code hadStrandedReply} is a different
+     * question, and today it is defence in depth rather than a path this codebase's public API can
+     * drive.</strong> This class has exactly two sites that ever acquire a target's entry in
+     * {@code sessionLocks} — {@link #send} and {@link #answer} — and both open a {@link Rendezvous}
+     * waiter for that same target as the very first thing they do after acquiring the lock, then hold
+     * lock and waiter together for the rest of their critical section ({@link #send} also clears
+     * {@link #strandedReplies} right there, the instant it opens its waiter — before it ever enqueues
+     * delivery). So "the session lock is held" and "a live waiter is open for it" are the same fact
+     * throughout this class, and {@link #reply}'s fast path always resolves a currently-open waiter
+     * directly rather than stranding. The two facts this method wants therefore cannot be produced
+     * side by side: while the lock is held, a real reply resolves the open waiter directly and never
+     * reaches {@link #strandedReplies}; the instant the lock is free, any parked matching task's own
+     * {@link #send} that is scheduled next wins it and, by opening its waiter, clears the strand again
+     * before this method ever runs. There is no way to hold that lock open-but-unaccepted from outside
+     * {@link #send}/{@link #answer} to freeze a window in between. Constructing both facts at once
+     * through {@code sendAsync}/{@code reply}/{@code ask}/{@code answer} would need a race against
+     * virtual-thread scheduling, not a deterministic sequence — so the oldest-wins code below stays as
+     * defence in depth against a regression to that mechanism (e.g. clearing {@link #strandedReplies}
+     * on a narrower condition than "any acceptance"), not because today's test suite exercises the
+     * conjunction. {@code matching.size() >= 2} alone, without a strand, is exactly what
+     * {@code abandonFailsEveryPendingAsyncTicketForTheReleasedTarget} already covers.
+     *
+     * <p><strong>Do not "fix" that gap with a test that reaches past this class.</strong> A test can
+     * build both facts by calling {@link Rendezvous#close} itself on the waiter an accepted
+     * {@link #send} is still blocked on: the send keeps the lock, no waiter is registered any more, a
+     * second parked task stays open, and the next {@link #reply} then strands. That was checked, and
+     * such a test does go red against the pre-fix loop. But it only goes red because it broke the
+     * lock-and-waiter invariant above from outside — no caller of this class ever does that — so it
+     * pins a state production cannot reach, and would read to the next person as if it could.
+     *
     * @return true if a live waiter or an async task was failed (never true for one recovered as a
     *         reply — see the note above)
     */
@@ -494,21 +587,39 @@ public final class MessageService {
        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
        boolean failed = waiter != null && !waiter.isDone() && rendezvous.resolveFailure(waiter, reason);
        boolean asyncFailed = false;
-        Reply recovered = null; // lazily drained at most once, only if a task actually needs it
+
+        List<Task> matching = new ArrayList<>();
        for (Task task : tasks.values()) {
-            if (!target.equals(task.target) || task.question != null || task.future.isDone()) {
-                continue;
+            if (target.equals(task.target) && task.question == null && !task.future.isDone()) {
+                matching.add(task);
            }
-            if (hadStrandedReply && recovered == null) {
-                recovered = recoverStrandedReply(target);
+        }
+        Task recoveryTask = null;
+        if (hadStrandedReply && !matching.isEmpty()) {
+            recoveryTask = matching.get(0);
+            for (Task candidate : matching) {
+                if (candidate.createdNanos < recoveryTask.createdNanos) {
+                    recoveryTask = candidate;
+                }
            }
-            Reply outcome = recovered != null ? recovered : new Reply(Outcome.WORKER_FAILED, reason);
+        }
+        Reply recovered = recoveryTask != null ? recoverStrandedReply(target) : null;
+        for (Task task : matching) {
+            boolean isRecovery = task == recoveryTask && recovered != null;
+            Reply outcome = isRecovery ? recovered : new Reply(Outcome.WORKER_FAILED, reason);
            if (task.future.complete(outcome)) {
                if (outcome.outcome() == Outcome.WORKER_FAILED) {
                    asyncFailed = true;
                } else if (task.turnId != null) {
                    asyncTasksByTurn.remove(task.turnId, task);
                }
+            } else if (isRecovery) {
+                // The recovered reply was already drained out of the inbox, but this task resolved
+                // through another path (e.g. a concurrent reply() or a second abandon() racing this
+                // one) between us choosing it and completing it here. Put the reply back rather than
+                // lose it silently — it may still belong to some other still-open task, or the next
+                // caller that drains this target's inbox.
+                inbox.publish(target, UUID.randomUUID().toString(), recovered.text());
            }
        }
        if (failed) {
@@ -523,6 +634,10 @@ public final class MessageService {
     * stranding fact raced away, e.g. a lead's own {@code fleet_poll} on the raw session already
     * drained it first). When more than one message is queued, only the newest is the worker's actual
     * final answer ({@link #drainReplies} returns them oldest-first).
+     *
+     * <p>This does drain (removes the messages from the inbox) before the caller knows whether the
+     * task it is recovering for will actually accept them — {@link #abandon} is the one that puts a
+     * reply back if its {@code complete} call turns out to lose the race.
     */
    private Reply recoverStrandedReply(String target) {
        var messages = drainReplies(target);
@@ -631,7 +746,7 @@ public final class MessageService {
                if (task != null) {
                    asyncTasksByWaiter.put(reply, task);
                }
-                TurnToken token = new TurnToken(target, reply);
+                TurnToken token = new TurnToken(target, reply, content);
                // The send has won the lock; the accepted-delivery hook records delegator ownership
                // here (CB-548). It runs BEFORE enqueue so a throwing hook — onAccepted is now a
                // public callback — fails the send without queuing a message that would orphan.
@@ -9,8 +9,10 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ScheduledExecutorService;
@@ -68,6 +70,12 @@ public final class ReplyPushLoop {
    static final String QUESTIONS_NUDGE_FORMAT =
            "%d workers are paused on a question — run fleet_poll(ticket=...) for each, then answer "
                    + "with fleet_send(turnId=..., content=...): %s";
+    static final String BACKEND_INCIDENT_NUDGE_FORMAT =
+            "Backend credential %s is cooling for %d remaining seconds; affected profiles: %s; "
+                    + "affected workers: %s. Run fleet_list to see more.";
+    static final String BACKEND_TARGET_UNMAPPED_NUDGE_FORMAT =
+            "A backend error on worker %s could not be mapped to a credential (%s) — no cool-off "
+                    + "was applied. Run fleet_list to check that worker.";

    private final PrimaryRegistry primaryRegistry;
    private final AgentControl agents;
@@ -93,6 +101,13 @@ public final class ReplyPushLoop {
     * how depleted an older, still-open question's count is.
     */
    private final ConcurrentHashMap<String, PendingQuestion> pendingQuestions = new ConcurrentHashMap<>();
+    /** Backend incidents awaiting one successful delivery, keyed by incident id and owning lead. */
+    private final ConcurrentHashMap<IncidentLead, PendingIncident> pendingIncidents = new ConcurrentHashMap<>();
+    /** Incident/lead pairs already delivered. They make repeated incident reports one-shot. */
+    private final Set<IncidentLead> deliveredIncidents = ConcurrentHashMap.newKeySet();
+    private final ConcurrentHashMap<UnmappedTargetLead, PendingUnmappedTarget> pendingUnmappedTargets =
+            new ConcurrentHashMap<>();
+    private final Set<UnmappedTargetLead> deliveredUnmappedTargets = ConcurrentHashMap.newKeySet();
    /** CB-590: leads with an active combined reminder schedule (replies and/or tickets and/or questions). */
    private final ConcurrentHashMap<String, Boolean> activeLeads = new ConcurrentHashMap<>();

@@ -178,7 +193,20 @@ public final class ReplyPushLoop {
     * tracked per question, not per lead per source).
     */
    private record PendingQuestion(String turnId, String ticket, String target, String lead,
-                                   String question, int nudgeCount) {
+                                    String question, int nudgeCount) {
+    }
+
+    private record IncidentLead(String incidentId, String lead) {
+    }
+
+    private record PendingIncident(IncidentLead key, String credential, List<String> profiles,
+                                   List<String> targets, int remainingCoolOffSeconds, int nudgeCount) {
+    }
+
+    private record UnmappedTargetLead(String target, String reason, String lead) {
+    }
+
+    private record PendingUnmappedTarget(UnmappedTargetLead key, int nudgeCount) {
    }

    /** Questions still open for {@code lead}, snapshotted fresh for one tick. */
@@ -192,6 +220,24 @@ public final class ReplyPushLoop {
                .collect(Collectors.toUnmodifiableSet());
    }

+    private List<PendingIncident> pendingIncidentsFor(String lead) {
+        return pendingIncidents.values().stream().filter(i -> lead.equals(i.key().lead())).toList();
+    }
+
+    private Set<IncidentLead> pendingIncidentKeysFor(String lead) {
+        return pendingIncidentsFor(lead).stream().map(PendingIncident::key)
+                .collect(Collectors.toUnmodifiableSet());
+    }
+
+    private List<PendingUnmappedTarget> pendingUnmappedTargetsFor(String lead) {
+        return pendingUnmappedTargets.values().stream().filter(i -> lead.equals(i.key().lead())).toList();
+    }
+
+    private Set<UnmappedTargetLead> pendingUnmappedTargetKeysFor(String lead) {
+        return pendingUnmappedTargetsFor(lead).stream().map(PendingUnmappedTarget::key)
+                .collect(Collectors.toUnmodifiableSet());
+    }
+
    /**
     * The reply-source reminder count {@link #decide} should see for {@code lead} on this tick:
     * the <em>minimum</em> nudge count among the reply targets currently pending for it (CB-598).
@@ -236,6 +282,15 @@ public final class ReplyPushLoop {
        return min == Integer.MAX_VALUE ? 0 : min;
    }

+    private int minIncidentNudgeCountFor(String lead) {
+        return pendingIncidentsFor(lead).stream().mapToInt(PendingIncident::nudgeCount).min().orElse(0);
+    }
+
+    private int minUnmappedTargetNudgeCountFor(String lead) {
+        return pendingUnmappedTargetsFor(lead).stream().mapToInt(PendingUnmappedTarget::nudgeCount)
+                .min().orElse(0);
+    }
+
    /**
     * Pure decision function: examine everything pending for {@code lead} — reply targets and
     * tickets alike — and return what the loop should do.
@@ -272,17 +327,35 @@ public final class ReplyPushLoop {
     * @param questionReminderCount the lowest nudge count among questions open for this lead
     */
    Action decide(String lead, int replyReminderCount, int ticketReminderCount, int questionReminderCount) {
+        return decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount,
+                minIncidentNudgeCountFor(lead));
+    }
+
+    /** As above, with backend incidents as a fourth, independently bounded source. */
+    Action decide(String lead, int replyReminderCount, int ticketReminderCount, int questionReminderCount,
+                  int incidentReminderCount) {
+        return decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount,
+                incidentReminderCount, minUnmappedTargetNudgeCountFor(lead));
+    }
+
+    /** As above, with unmapped backend targets as a fifth, independently bounded source. */
+    Action decide(String lead, int replyReminderCount, int ticketReminderCount, int questionReminderCount,
+                  int incidentReminderCount, int unmappedTargetReminderCount) {
        boolean hasReplyWork = !pendingReplyTargetsFor(lead).isEmpty();
        boolean hasTicketWork = !pendingTicketIdsFor(lead).isEmpty();
        boolean hasQuestionWork = !pendingQuestionTurnIdsFor(lead).isEmpty();
-        if (!hasReplyWork && !hasTicketWork && !hasQuestionWork) {
+        boolean hasIncidentWork = !pendingIncidentKeysFor(lead).isEmpty();
+        boolean hasUnmappedTargetWork = !pendingUnmappedTargetKeysFor(lead).isEmpty();
+        if (!hasReplyWork && !hasTicketWork && !hasQuestionWork && !hasIncidentWork && !hasUnmappedTargetWork) {
            log.debug("push: nothing pending for lead {}, stopping reminder", lead);
            return Action.STOP;
        }
        boolean replyEligible = hasReplyWork && replyReminderCount < maxReminders;
        boolean ticketEligible = hasTicketWork && ticketReminderCount < maxReminders;
        boolean questionEligible = hasQuestionWork && questionReminderCount < maxReminders;
-        if (!replyEligible && !ticketEligible && !questionEligible) {
+        boolean incidentEligible = hasIncidentWork && incidentReminderCount < maxReminders;
+        boolean unmappedTargetEligible = hasUnmappedTargetWork && unmappedTargetReminderCount < maxReminders;
+        if (!replyEligible && !ticketEligible && !questionEligible && !incidentEligible && !unmappedTargetEligible) {
            log.debug("push: reminder cap ({}) reached for lead {} on every source with pending work, stopping",
                    maxReminders, lead);
            countNudge("exhausted");
@@ -394,6 +467,48 @@ public final class ReplyPushLoop {
        pendingQuestions.remove(turnId);
    }

+    /**
+     * Queue a one-shot backend credential outage notice for every distinct lead that owns an
+     * affected worker. A successful injection records its {@code (incidentId, lead)} key, so a
+     * repeat report never reminds that lead again.
+     */
+    public void onBackendIncident(String incidentId, Collection<String> targets, String credential,
+                                  Collection<String> profiles, int remainingCoolOffSeconds) {
+        Map<String, List<String>> targetsByLead = new ConcurrentHashMap<>();
+        for (String target : targets) {
+            var lead = primaryRegistry.nudgeTargetFor(target);
+            if (lead.isEmpty()) {
+                log.warn("push: backend incident {} has no known lead for target {}", incidentId, target);
+                continue;
+            }
+            targetsByLead.computeIfAbsent(lead.get(), _ -> new ArrayList<>()).add(target);
+        }
+        List<String> profileNames = profiles.stream().sorted().toList();
+        for (var entry : targetsByLead.entrySet()) {
+            IncidentLead key = new IncidentLead(incidentId, entry.getKey());
+            if (deliveredIncidents.contains(key)) continue;
+            pendingIncidents.putIfAbsent(key, new PendingIncident(key, credential, profileNames,
+                    entry.getValue().stream().sorted().toList(), remainingCoolOffSeconds, 0));
+            startOrCoalesce(entry.getKey());
+        }
+    }
+
+    /**
+     * Tell the owning lead that a classified backend error could not be tied to a credential.
+     * Without an owning lead, emit a warning because no control can act on the target.
+     */
+    public void onBackendTargetUnmapped(String target, String reason) {
+        var lead = primaryRegistry.nudgeTargetFor(target);
+        if (lead.isEmpty()) {
+            log.warn("push: backend target {} could not map to a credential: {}", target, reason);
+            return;
+        }
+        UnmappedTargetLead key = new UnmappedTargetLead(target, reason, lead.get());
+        if (deliveredUnmappedTargets.contains(key)) return;
+        pendingUnmappedTargets.putIfAbsent(key, new PendingUnmappedTarget(key, 0));
+        startOrCoalesce(lead.get());
+    }
+
    // --- the schedule ----------------------------------------------------------------------------

    /** Start a reminder schedule for {@code lead}, or join the one already running. */
@@ -425,18 +540,25 @@ public final class ReplyPushLoop {
        Set<String> repliesBefore = pendingReplyTargetsFor(lead);
        Set<String> ticketsBefore = pendingTicketIdsFor(lead);
        Set<String> questionsBefore = pendingQuestionTurnIdsFor(lead);
+        Set<IncidentLead> incidentsBefore = pendingIncidentKeysFor(lead);
+        Set<UnmappedTargetLead> unmappedTargetsBefore = pendingUnmappedTargetKeysFor(lead);
        int replyReminderCount = minReplyNudgeCountFor(lead);
        int ticketReminderCount = minTicketNudgeCountFor(lead);
        int questionReminderCount = minQuestionNudgeCountFor(lead);
-        var action = decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount);
+        int incidentReminderCount = minIncidentNudgeCountFor(lead);
+        int unmappedTargetReminderCount = minUnmappedTargetNudgeCountFor(lead);
+        var action = decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount,
+                incidentReminderCount, unmappedTargetReminderCount);
        switch (action) {
            case INJECT -> {
-                injectNudge(lead, replyReminderCount, ticketReminderCount, questionReminderCount);
+                injectNudge(lead, replyReminderCount, ticketReminderCount, questionReminderCount,
+                        incidentReminderCount, unmappedTargetReminderCount);
                scheduleNext(lead);
            }
            // Re-check after the configured backoff; the lead may become injectable soon.
            case WAIT_BUSY -> scheduleNext(lead);
-            case STOP -> stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore);
+            case STOP -> stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore, incidentsBefore,
+                    unmappedTargetsBefore);
        }
    }

@@ -480,11 +602,25 @@ public final class ReplyPushLoop {
     * decision-to-release window reclaims the schedule slot exactly like a raced-in reply or ticket.
     */
    void stopOrRestart(String lead, Set<String> repliesBefore, Set<String> ticketsBefore,
-                       Set<String> questionsBefore) {
+                        Set<String> questionsBefore) {
+        stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore, pendingIncidentKeysFor(lead));
+    }
+
+    private void stopOrRestart(String lead, Set<String> repliesBefore, Set<String> ticketsBefore,
+                               Set<String> questionsBefore, Set<IncidentLead> incidentsBefore) {
+        stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore, incidentsBefore,
+                pendingUnmappedTargetKeysFor(lead));
+    }
+
+    private void stopOrRestart(String lead, Set<String> repliesBefore, Set<String> ticketsBefore,
+                               Set<String> questionsBefore, Set<IncidentLead> incidentsBefore,
+                               Set<UnmappedTargetLead> unmappedTargetsBefore) {
        activeLeads.remove(lead);
        boolean racedIn = pendingReplyTargetsFor(lead).stream().anyMatch(t -> !repliesBefore.contains(t))
                || pendingTicketIdsFor(lead).stream().anyMatch(t -> !ticketsBefore.contains(t))
-                || pendingQuestionTurnIdsFor(lead).stream().anyMatch(t -> !questionsBefore.contains(t));
+                || pendingQuestionTurnIdsFor(lead).stream().anyMatch(t -> !questionsBefore.contains(t))
+                || pendingIncidentKeysFor(lead).stream().anyMatch(i -> !incidentsBefore.contains(i))
+                || pendingUnmappedTargetKeysFor(lead).stream().anyMatch(i -> !unmappedTargetsBefore.contains(i));
        if (racedIn && activeLeads.putIfAbsent(lead, Boolean.TRUE) == null) {
            log.debug("push: new work for lead {} raced the reminder loop's stop — restarting", lead);
            scheduleNext(lead);
@@ -495,18 +631,22 @@ public final class ReplyPushLoop {

    /** Send one combined nudge covering everything currently pending for {@code lead}. */
    private void injectNudge(String lead, int replyReminderCount, int ticketReminderCount,
-                             int questionReminderCount) {
+                              int questionReminderCount, int incidentReminderCount,
+                              int unmappedTargetReminderCount) {
        // Re-read rather than threading it down from decide(): a reply can drain, a ticket be
        // collected, or a question be answered (or another arrive), between the decision and the
        // injection.
        Set<String> replyTargets = pendingReplyTargetsFor(lead);
        List<PendingTicket> tickets = pendingTicketsFor(lead);
        List<PendingQuestion> questions = pendingQuestionsFor(lead);
-        if (replyTargets.isEmpty() && tickets.isEmpty() && questions.isEmpty()) {
+        List<PendingIncident> incidents = pendingIncidentsFor(lead);
+        List<PendingUnmappedTarget> unmappedTargets = pendingUnmappedTargetsFor(lead);
+        if (replyTargets.isEmpty() && tickets.isEmpty() && questions.isEmpty() && incidents.isEmpty()
+                && unmappedTargets.isEmpty()) {
            log.debug("push: pending work for lead {} drained before the nudge could be sent", lead);
            return;
        }
-        String nudge = formatNudge(replyTargets, tickets, questions);
+        String nudge = formatNudge(replyTargets, tickets, questions, incidents, unmappedTargets);
        try {
            agents.send(lead, nudge);
            log.debug("push: nudge sent to lead {} (reply {}/{}, ticket {}/{}, question {}/{}; "
@@ -515,6 +655,16 @@ public final class ReplyPushLoop {
                    questionReminderCount + 1, maxReminders,
                    replyTargets.size(), tickets.size(), questions.size());
            countNudge("delivered");
+            for (PendingIncident incident : incidents) {
+                if (pendingIncidents.remove(incident.key(), incident)) {
+                    deliveredIncidents.add(incident.key());
+                }
+            }
+            for (PendingUnmappedTarget unmappedTarget : unmappedTargets) {
+                if (pendingUnmappedTargets.remove(unmappedTarget.key(), unmappedTarget)) {
+                    deliveredUnmappedTargets.add(unmappedTarget.key());
+                }
+            }
        } catch (RuntimeException e) {
            log.warn("push: failed to nudge lead {} (reply {}/{}, ticket {}/{}, question {}/{}): {}",
                    lead, replyReminderCount + 1, maxReminders, ticketReminderCount + 1, maxReminders,
@@ -526,12 +676,13 @@ public final class ReplyPushLoop {
        // item already at or over the cap keeps riding along in the text (still pending, still
        // named) but its extra bumps here are inert: decide() already treats it as ineligible once
        // its count reaches maxReminders.
-        bumpNudgeCounts(replyTargets, tickets, questions);
+        bumpNudgeCounts(replyTargets, tickets, questions, incidents, unmappedTargets);
    }

    /** Record that every one of these items was just named in a sent (or attempted) nudge. */
    private void bumpNudgeCounts(Set<String> replyTargets, List<PendingTicket> tickets,
-                                 List<PendingQuestion> questions) {
+                                  List<PendingQuestion> questions, List<PendingIncident> incidents,
+                                  List<PendingUnmappedTarget> unmappedTargets) {
        for (String target : replyTargets) {
            pendingReplies.computeIfPresent(target, (t, e) -> new ReplyEntry(e.lead(), e.nudgeCount() + 1));
        }
@@ -544,6 +695,14 @@ public final class ReplyPushLoop {
                    new PendingQuestion(e.turnId(), e.ticket(), e.target(), e.lead(), e.question(),
                            e.nudgeCount() + 1));
        }
+        for (PendingIncident incident : incidents) {
+            pendingIncidents.computeIfPresent(incident.key(), (id, e) -> new PendingIncident(e.key(),
+                    e.credential(), e.profiles(), e.targets(), e.remainingCoolOffSeconds(), e.nudgeCount() + 1));
+        }
+        for (PendingUnmappedTarget unmappedTarget : unmappedTargets) {
+            pendingUnmappedTargets.computeIfPresent(unmappedTarget.key(), (id, e) ->
+                    new PendingUnmappedTarget(e.key(), e.nudgeCount() + 1));
+        }
    }

    /** Schedule the next tick on the scheduler thread pool. */
@@ -556,7 +715,8 @@ public final class ReplyPushLoop {

    /** Render everything pending for one lead as a single nudge line. */
    private static String formatNudge(Set<String> replyTargets, List<PendingTicket> tickets,
-                                      List<PendingQuestion> questions) {
+                                       List<PendingQuestion> questions, List<PendingIncident> incidents,
+                                       List<PendingUnmappedTarget> unmappedTargets) {
        List<String> parts = new ArrayList<>();
        if (!replyTargets.isEmpty()) {
            parts.add(formatRepliesNudge(replyTargets));
@@ -567,6 +727,12 @@ public final class ReplyPushLoop {
        if (!questions.isEmpty()) {
            parts.add(formatQuestionsNudge(questions));
        }
+        if (!incidents.isEmpty()) {
+            parts.addAll(incidents.stream().map(ReplyPushLoop::formatBackendIncidentNudge).toList());
+        }
+        if (!unmappedTargets.isEmpty()) {
+            parts.addAll(unmappedTargets.stream().map(ReplyPushLoop::formatUnmappedTargetNudge).toList());
+        }
        return String.join(" | ", parts);
    }

@@ -606,6 +772,16 @@ public final class ReplyPushLoop {
        return QUESTIONS_NUDGE_FORMAT.formatted(pending.size(), ids);
    }

+    private static String formatBackendIncidentNudge(PendingIncident incident) {
+        return BACKEND_INCIDENT_NUDGE_FORMAT.formatted(incident.credential(), incident.remainingCoolOffSeconds(),
+                String.join(", ", incident.profiles()), String.join(", ", incident.targets()));
+    }
+
+    private static String formatUnmappedTargetNudge(PendingUnmappedTarget unmappedTarget) {
+        return BACKEND_TARGET_UNMAPPED_NUDGE_FORMAT.formatted(unmappedTarget.key().target(),
+                unmappedTarget.key().reason());
+    }
+
    // --- lifecycle -----------------------------------------------------------------------------

    /**
@@ -627,6 +803,10 @@ public final class ReplyPushLoop {
        pendingReplies.clear();
        pendingTickets.clear();
        pendingQuestions.clear();
+        pendingIncidents.clear();
+        deliveredIncidents.clear();
+        pendingUnmappedTargets.clear();
+        deliveredUnmappedTargets.clear();
    }

    /** @see #stop() */
@@ -9,12 +9,19 @@ import java.util.concurrent.CompletableFuture;
 public final class TurnToken {
    private final String target;
    private final CompletableFuture<Rendezvous.Resolution> waiter;
+    private final String injectedText;

    public TurnToken(String target, CompletableFuture<Rendezvous.Resolution> waiter) {
+        this(target, waiter, null);
+    }
+
+    public TurnToken(String target, CompletableFuture<Rendezvous.Resolution> waiter, String injectedText) {
        this.target = target;
        this.waiter = waiter;
+        this.injectedText = injectedText;
    }

    public String target() { return target; }
    public CompletableFuture<Rendezvous.Resolution> waiter() { return waiter; }
+    public String injectedText() { return injectedText; }
 }
@@ -0,0 +1,200 @@
+package dev.ltms.fleet.placement;
+
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.OptionalLong;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.LongSupplier;
+
+/**
+ * Fleetd #201 / #227: correlates classified backend errors (credential outage or provider 5xx,
+ * produced elsewhere by the classifier that turns raw pane text into a typed event — this class
+ * knows nothing about pane text, profiles, sessions, launchers, or leads) and decides, purely from
+ * counts and timing, when a credential's backend is out.
+ *
+ * <p>Two classified errors on the <b>same credential</b> — never the profile name, never the error
+ * text, see {@code FleetConfig.Profile#effectiveCredentialId()} like {@link BackendQuarantine} —
+ * <b>from two distinct targets</b> inside a 60-second window is treated as an outage: {@link
+ * #record} then returns an {@link Incident} and starts a 60-second cool-off for that credential. The
+ * threshold counts distinct targets, not raw events, on purpose: the classifier is a heuristic and a
+ * valid member report can quote an {@code API Error:} line, so one target repeating that line twice
+ * must never remove fleet capacity by itself. Two different targets independently producing a
+ * classified error is far less likely to be a coincidence, and a real backend outage hits every
+ * target on that credential anyway, so this loses nothing against the case being protected against.
+ * This is deliberately a different store from {@link BackendQuarantine}: that one holds a
+ * 1800-second exhaustion cooldown for a spent credential, and reusing it here would both use the
+ * wrong duration and report "backend exhausted" for what is a short transient fault.
+ *
+ * <p>Correlation and cool-off live in <b>one class</b> so that crossing the threshold and setting
+ * the cool-off deadline happen as a single atomic update: every {@link #record} call goes through
+ * {@link ConcurrentHashMap#compute}, which serializes on the credential's map bucket, so a
+ * concurrent second and third event on the same credential can never both observe "about to cross"
+ * and both mint an incident.
+ *
+ * <p>The clock is injected ({@link LongSupplier}, conventionally {@code System::nanoTime} like
+ * {@link BackendQuarantine}), never read inline, so the window and cool-off are testable without a
+ * real sleep.
+ */
+public final class BackendOutagePolicy {
+
+    /** Distinct targets a credential needs a classified error from to declare an outage. */
+    public static final int THRESHOLD = 2;
+
+    /** How long a credential's evidence stays fresh, inclusive of both endpoints. */
+    public static final long WINDOW_NANOS = 60_000_000_000L;
+
+    /** How long a credential sits out once the threshold is crossed. */
+    public static final long COOLOFF_NANOS = 60_000_000_000L;
+
+    private final ConcurrentHashMap<String, CredentialState> states = new ConcurrentHashMap<>();
+    private final LongSupplier nowNanos;
+    private final AtomicLong incidentSequence = new AtomicLong();
+
+    public BackendOutagePolicy(LongSupplier nowNanos) {
+        this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
+    }
+
+    /**
+     * Records one classified backend error for {@code credentialId} against {@code target} (e.g. a
+     * session or worker id — this class never interprets it, only collects it for the incident's
+     * affected-targets list, and counts distinct targets toward the threshold) with {@code reason}
+     * (the classifier's free-text reason, kept per event for whoever renders the eventual notice —
+     * every event's reason is kept even when the same target repeats, so {@link Incident#reasons()}
+     * can be longer than {@link Incident#evidenceCount()}).
+     *
+     * <p>Returns a populated {@link Incident} only at the exact moment a <b>second distinct target</b>
+     * is seen for this credential inside the window — never before, and never again while the
+     * resulting cool-off is active. A repeat error from a target already counted does not advance the
+     * threshold. While a credential is cooling off, a fresh error is ignored outright: it neither
+     * extends the deadline nor produces another incident. Once the cool-off has elapsed, the next
+     * error clears the old evidence and starts a brand-new window — two fresh, distinct targets are
+     * required to rearm.
+     */
+    public Optional<Incident> record(String credentialId, String target, String reason) {
+        Objects.requireNonNull(credentialId, "credentialId");
+        Objects.requireNonNull(target, "target");
+        Objects.requireNonNull(reason, "reason");
+        long now = nowNanos.getAsLong();
+
+        AtomicReference<Incident> minted = new AtomicReference<>();
+        states.compute(credentialId, (_, existing) -> {
+            CredentialState state = existing;
+
+            if (state != null && state.inCoolOff()) {
+                if (now < state.coolOffUntilNanos) {
+                    return state; // still cooling off: no extension, no incident
+                }
+                state = null; // cool-off elapsed: evidence is cleared, rearm from scratch
+            }
+
+            if (state == null || now - state.firstEventNanos > WINDOW_NANOS) {
+                return CredentialState.first(now, target, reason);
+            }
+
+            CredentialState advanced = state.withAdditionalEvidence(target, reason);
+            if (advanced.evidenceCount() < THRESHOLD) {
+                return advanced;
+            }
+
+            long coolOffUntilNanos = now + COOLOFF_NANOS;
+            minted.set(new Incident(
+                    "outage-" + credentialId + "-" + incidentSequence.incrementAndGet(),
+                    credentialId,
+                    Set.copyOf(advanced.targets),
+                    advanced.evidenceCount(),
+                    toSecondsRoundedUp(WINDOW_NANOS),
+                    toSecondsRoundedUp(COOLOFF_NANOS),
+                    List.copyOf(advanced.reasons)));
+            return advanced.enteringCoolOff(coolOffUntilNanos);
+        });
+
+        return Optional.ofNullable(minted.get());
+    }
+
+    /** Seconds left on {@code credentialId}'s cool-off, or empty when it is not cooling off. */
+    public OptionalLong remainingCoolOffSeconds(String credentialId) {
+        Objects.requireNonNull(credentialId, "credentialId");
+        CredentialState state = states.get(credentialId);
+        if (state == null || !state.inCoolOff()) {
+            return OptionalLong.empty();
+        }
+        long remaining = state.coolOffUntilNanos - nowNanos.getAsLong();
+        return remaining > 0 ? OptionalLong.of(toSecondsRoundedUp(remaining)) : OptionalLong.empty();
+    }
+
+    private static long toSecondsRoundedUp(long nanos) {
+        return (nanos + 999_999_999L) / 1_000_000_000L;
+    }
+
+    /**
+     * One credential crossing the outage threshold. {@code remainingCoolOffSeconds} is the cool-off
+     * length as observed at the moment of minting — this incident is only ever produced right as the
+     * cool-off starts, so it is always the full {@link #COOLOFF_NANOS} rounded up.
+     *
+     * <p>{@code evidenceCount} is {@code targets.size()} — the threshold is on distinct targets, not
+     * raw events — while {@code reasons} keeps every event's reason, including repeats from a target
+     * already counted. The two are deliberately different lengths: a single target hammering the same
+     * classified error never grows {@code evidenceCount} past 1, but each occurrence still lands in
+     * {@code reasons} for whoever renders the notice.
+     */
+    public record Incident(
+            String id,
+            String credentialId,
+            Set<String> targets,
+            int evidenceCount,
+            long windowSeconds,
+            long remainingCoolOffSeconds,
+            List<String> reasons) {
+    }
+
+    /** Evidence accumulated for one credential since its window opened, or its active cool-off. */
+    private static final class CredentialState {
+        final long firstEventNanos;
+        final Set<String> targets;
+        final List<String> reasons;
+        final long coolOffUntilNanos; // 0 means "not cooling off"
+
+        private CredentialState(long firstEventNanos, Set<String> targets, List<String> reasons,
+                long coolOffUntilNanos) {
+            this.firstEventNanos = firstEventNanos;
+            this.targets = targets;
+            this.reasons = reasons;
+            this.coolOffUntilNanos = coolOffUntilNanos;
+        }
+
+        static CredentialState first(long nowNanos, String target, String reason) {
+            Set<String> targets = new LinkedHashSet<>();
+            targets.add(target);
+            List<String> reasons = new ArrayList<>();
+            reasons.add(reason);
+            return new CredentialState(nowNanos, targets, reasons, 0L);
+        }
+
+        CredentialState withAdditionalEvidence(String target, String reason) {
+            Set<String> newTargets = new LinkedHashSet<>(targets);
+            newTargets.add(target);
+            List<String> newReasons = new ArrayList<>(reasons);
+            newReasons.add(reason);
+            return new CredentialState(firstEventNanos, newTargets, newReasons, 0L);
+        }
+
+        CredentialState enteringCoolOff(long coolOffUntilNanos) {
+            return new CredentialState(firstEventNanos, targets, reasons, coolOffUntilNanos);
+        }
+
+        /** Distinct targets seen so far — the threshold counts this, never {@code reasons.size()}. */
+        int evidenceCount() {
+            return targets.size();
+        }
+
+        boolean inCoolOff() {
+            return coolOffUntilNanos > 0;
+        }
+    }
+}
@@ -315,10 +315,18 @@ public final class FleetApp {
                .map(Agent.class::cast)
                .filter(a -> a.terminalId() != null)
                .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
-        List<Map<String, Object>> out = sessions.roster().stream()
+        // fleetd #209: this REST roster reports agentSessionId via SessionManager.rosterView, so it
+        // uses the resolving roster read (caller-driven, not a timer) rather than the plain one.
+        List<Map<String, Object>> out = sessions.rosterResolved().stream()
                .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
                .toList();
        Map<String, Object> body = new LinkedHashMap<>();
+        // fleetd #199: the endpoint became /members in the CB-634 rename but the body key stayed
+        // "workers", so a caller that read "members" saw an empty fleet and reported no members at
+        // all. "members" is the canonical key; "workers" stays as a deprecated alias so an existing
+        // REST consumer keeps working — the out-of-band path a lead falls back to when its MCP mount
+        // drops reads this endpoint. Drop the alias once nothing reads it.
+        body.put("members", out);
        body.put("workers", out);
        // CB-586: operator visibility for the refs/wip snapshot store without shelling into the
        // repo — how many snapshot refs exist and roughly what they cost. Present only once a
@@ -13,6 +13,7 @@ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.StandardCopyOption;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.HashSet;
@@ -23,6 +24,7 @@ import java.util.Set;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Consumer;
+import java.util.function.Function;
 import java.util.stream.Collectors;

 /**
@@ -88,24 +90,64 @@ public final class GitWorktrees implements Worktrees {
    );

    private final String configuredRoot;
+    /** OS group name for {@link #shareWithGroup} (fleetd #185 stage 3); {@code null} ⇒ feature off. */
+    private final String group;
    private final Consumer<String> afterWorktreeAdded;
+    /** How {@link #shareWithGroup}'s processes (git config / chgrp / chmod / find) actually run.
+     *  Defaults to the real {@link #exec(String...)}. Package-private test seam so a unit test can
+     *  prove "no group configured ⇒ zero processes spawned" and inspect exactly what a configured
+     *  group runs, without a real second OS user or OS group on this host. */
+    private final Function<String[], String> shareGroupRunner;
    private final SecureRandom random = new SecureRandom();
    private final AtomicLong seq = new AtomicLong();

    /** Default constructor: worktree root is derived per-repo as {@code <repoRoot>/../.bridged-worktrees}. */
    public GitWorktrees() {
-        this(null);
+        this(null, (String) null);
    }

-    /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
+    /**
+     * @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of
+     *                       the repo root. No {@code worktreeGroup} configured — {@link #shareWithGroup}
+     *                       is a no-op.
+     */
    public GitWorktrees(String configuredRoot) {
-        this(configuredRoot, _ -> {});
+        this(configuredRoot, (String) null);
+    }
+
+    /**
+     * @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of
+     *                       the repo root.
+     * @param group          optional OS group name (fleetd #185 stage 3, {@code worktreeGroup:} in
+     *                       config); null/blank ⇒ {@link #shareWithGroup} is a no-op.
+     */
+    public GitWorktrees(String configuredRoot, String group) {
+        this(configuredRoot, group, _ -> {});
    }

    /** Test seam for changing a real worktree between its creation and its security check. */
    GitWorktrees(String configuredRoot, Consumer<String> afterWorktreeAdded) {
+        this(configuredRoot, null, afterWorktreeAdded);
+    }
+
+    /** Test seam combining a configurable {@code group} with {@link #afterWorktreeAdded}. */
+    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded) {
+        this(configuredRoot, group, afterWorktreeAdded, null);
+    }
+
+    /**
+     * Full test seam: also overrides how {@link #shareWithGroup}'s processes run (fleetd #185
+     * stage 3), so a unit test can prove "no group configured ⇒ no process spawned" and inspect
+     * exactly what commands a configured group runs, without a real second OS user/group.
+     *
+     * @param shareGroupRunner {@code null} ⇒ the real {@link #exec(String...)}.
+     */
+    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
+                 Function<String[], String> shareGroupRunner) {
        this.configuredRoot = configuredRoot;
+        this.group = (group == null || group.isBlank()) ? null : group;
        this.afterWorktreeAdded = afterWorktreeAdded == null ? _ -> {} : afterWorktreeAdded;
+        this.shareGroupRunner = shareGroupRunner != null ? shareGroupRunner : this::exec;
    }

    @Override
@@ -120,6 +162,7 @@ public final class GitWorktrees implements Worktrees {
        } catch (IOException e) {
            throw new WorktreeException("cannot create worktree root " + root + ": " + e.getMessage(), e);
        }
+        shareRootWithGroup(root);
        String wt = path.toAbsolutePath().toString();
        log.info("adding worktree branch={} path={} base={}", branch, wt, base);
        removeUserInfoFromHttpsOrigin(repoRoot);
@@ -607,6 +650,174 @@ public final class GitWorktrees implements Worktrees {
        return deleted;
    }

+    /**
+     * {@inheritDoc}
+     *
+     * <p>fleetd #185 stage 3. No-op — no process spawned, nothing logged — when {@link #group} is
+     * null/blank. Otherwise:
+     * <ol>
+     *   <li>{@code git -C repoRoot config core.sharedRepository group} so every future write by
+     *       either uid stays group-writable;</li>
+     *   <li>a one-time {@code chgrp}/{@code chmod g+rwX} fix-up over the worktree directory and,
+     *       under the repo's <em>common</em> git directory, {@code objects}, {@code refs},
+     *       {@code logs}, {@code worktrees} and {@code packed-refs} — with setgid
+     *       ({@code chmod g+s}) applied only to the directories among them, so files created later
+     *       inherit the group;</li>
+     *   <li>one INFO line naming the group and the paths touched.</li>
+     * </ol>
+     *
+     * <p><b>Every path is skipped when it does not exist.</b> {@code .git/logs} is absent in a repo
+     * with {@code core.logAllRefUpdates=false} or one that has had no ref update yet, and
+     * {@code packed-refs} is absent until refs are packed. Passing a missing path to {@code chgrp}
+     * exits non-zero, which would fail <em>every</em> provisioning spawn with a message blaming a
+     * group that is in fact fine.
+     *
+     * <p><b>The git directory is resolved, not assumed.</b> {@code <repoRoot>/.git} is a
+     * <em>file</em>, not a directory, when the checkout is itself a linked worktree — the very
+     * thing this class creates for every member. {@code git rev-parse --git-common-dir} gives the
+     * real shared store, and it may answer relatively, so it is resolved against {@code repoRoot}.
+     *
+     * <p><b>The fix-up re-runs on every spawn, by design.</b> {@code core.sharedRepository=group}
+     * governs only what git writes <em>after</em> it is set; the walk is what covers everything
+     * already on disk. It is not redundant work to optimise away — dropping it silently leaves
+     * pre-existing objects unreadable to the member. It costs three walks of the object store per
+     * spawn (about 3000 files in this repo, well under a second, but it grows with the repo).
+     *
+     * <p>This only fixes up file ownership/permissions on the operator's shared repo so a
+     * different-uid member can write to it — it isolates credentials, not the repository. A member
+     * in the group can still write the operator's git objects and refs.
+     *
+     * <p>Fails loudly: a missing group, or a {@code chgrp}/{@code chmod} refused because the
+     * operator is not a member of it, becomes a {@link WorktreeException} naming the group — never
+     * a silent skip that leaves a member unable to work with nothing in the log to explain why.
+     */
+    @Override
+    public void shareWithGroup(String repoRoot, String worktreePath) {
+        if (group == null) {
+            return;
+        }
+        List<String> touched = new ArrayList<>();
+        try {
+            shareGroupRunner.apply(new String[]{"git", "-C", repoRoot, "config", "core.sharedRepository", "group"});
+            String commonDir = gitCommonDir(repoRoot);
+            shareGroupPathIfPresent(worktreePath, true, touched);
+            for (String name : List.of("objects", "refs", "logs", "worktrees")) {
+                shareGroupPathIfPresent(commonDir + "/" + name, true, touched);
+            }
+            shareGroupPathIfPresent(commonDir + "/packed-refs", false, touched);
+        } catch (WorktreeException e) {
+            throw new WorktreeException("cannot share worktree with group '" + group + "': "
+                    + e.getMessage() + " — the group must exist, and the fleetd operator ("
+                    + System.getProperty("user.name") + ") must be a member of it", e);
+        }
+        log.info("worktreeGroup={} shared repoRoot={} worktreePath={} paths={}",
+                group, repoRoot, worktreePath, touched);
+    }
+
+    /**
+     * fleetd #224: make {@code worktreeRoot} ITSELF group-traversable — established once, here,
+     * where the root is created, never at a use site. {@link #shareWithGroup} shares each worktree
+     * (and the repo's common git dir) with {@link #group}, but never the PARENT directory that
+     * contains every worktree — and under {@code memberHerdrSocket:} the member pane runs as a
+     * different OS user, which needs the execute bit on every ancestor directory to reach anything
+     * underneath, no matter how carefully each child is shared. Without this, a member cannot read
+     * the ephemeral {@code opencode.json} #219 places under this root, cannot reach its own
+     * worktree, and cannot read #213's ZDOTDIR scrub when placed here either.
+     *
+     * <p>No-op — no process spawned — when {@link #group} is null/blank, so behaviour with
+     * {@code worktreeGroup:} unset (today's only live mode) is unchanged. Only {@code root} itself
+     * is touched (non-recursive): each child underneath is shared individually, either by
+     * {@link #shareWithGroup} for a worktree or by the launcher that generates it (fleetd #213/#219)
+     * for a scrub/config directory — sharing this level again would just duplicate that policy in
+     * the wrong layer.
+     *
+     * <p>Fails loudly, naming {@code root}, its mode at the time of the attempt, and {@link #group}:
+     * a member that starts and then cannot see its own checkout is worse than a refused spawn, since
+     * nothing about that failure mode points at a directory's permission bits.
+     */
+    private void shareRootWithGroup(Path root) {
+        if (group == null) {
+            return;
+        }
+        String mode = currentPosixMode(root);
+        try {
+            shareGroupRunner.apply(new String[]{"chgrp", group, root.toString()});
+            shareGroupRunner.apply(new String[]{"chmod", "g+x", root.toString()});
+        } catch (WorktreeException e) {
+            throw new WorktreeException("cannot make worktree root " + root + " (mode " + mode
+                    + ") group-traversable for group '" + group + "': " + e.getMessage()
+                    + " — the group must exist, and the fleetd operator (" + System.getProperty("user.name")
+                    + ") must be a member of it", e);
+        }
+        log.info("worktreeGroup={} made worktree root {} group-traversable (was mode {})", group, root, mode);
+    }
+
+    /** {@code root}'s current POSIX permission string, or {@code "unknown"} on a filesystem that does
+     *  not support POSIX permissions — used only to name the mode in a refusal message. */
+    private static String currentPosixMode(Path root) {
+        try {
+            return PosixFilePermissions.toString(Files.getPosixFilePermissions(root));
+        } catch (IOException | UnsupportedOperationException e) {
+            return "unknown";
+        }
+    }
+
+    /**
+     * The repo's <em>common</em> git directory as an absolute path — where {@code objects},
+     * {@code refs} and {@code worktrees} actually live. {@code git rev-parse --git-common-dir}
+     * answers relative to {@code repoRoot} in the ordinary case ({@code .git}) and absolutely for a
+     * linked worktree, so the answer is resolved against {@code repoRoot} either way. Never
+     * hardcode {@code repoRoot + "/.git"}: that is a FILE when the checkout is itself a linked
+     * worktree.
+     */
+    private String gitCommonDir(String repoRoot) {
+        String answer = shareGroupRunner.apply(
+                new String[]{"git", "-C", repoRoot, "rev-parse", "--git-common-dir"});
+        String trimmed = answer == null ? "" : answer.trim();
+        if (trimmed.isEmpty()) {
+            trimmed = ".git";
+        }
+        return Path.of(repoRoot).resolve(trimmed).normalize().toString();
+    }
+
+    /**
+     * {@link #shareGroupPath} when {@code path} exists, recording it in {@code touched}; otherwise
+     * nothing at all. A missing path is normal, not an error — see {@link #shareWithGroup}'s
+     * javadoc for which ones are routinely absent and why passing them to {@code chgrp} would fail
+     * every spawn.
+     */
+    private void shareGroupPathIfPresent(String path, boolean recursive, List<String> touched) {
+        if (!Files.exists(Path.of(path))) {
+            return;
+        }
+        shareGroupPath(path, recursive);
+        touched.add(path);
+    }
+
+    /**
+     * {@code chgrp}/{@code chmod g+rwX} {@code path} to {@link #group}. When {@code recursive},
+     * also walks the directories under {@code path} (including {@code path} itself, when it is a
+     * directory) and sets setgid on each — directories only, per the javadoc on
+     * {@link #shareWithGroup}.
+     */
+    private void shareGroupPath(String path, boolean recursive) {
+        List<String> chgrp = new ArrayList<>(List.of("chgrp"));
+        if (recursive) chgrp.add("-R");
+        chgrp.add(group);
+        chgrp.add(path);
+        shareGroupRunner.apply(chgrp.toArray(new String[0]));
+
+        List<String> chmod = new ArrayList<>(List.of("chmod"));
+        if (recursive) chmod.add("-R");
+        chmod.add("g+rwX");
+        chmod.add(path);
+        shareGroupRunner.apply(chmod.toArray(new String[0]));
+
+        if (recursive) {
+            shareGroupRunner.apply(new String[]{"find", path, "-type", "d", "-exec", "chmod", "g+s", "{}", "+"});
+        }
+    }
+
    /**
     * Every {@code refs/wip/*} ref (see {@link WipRef}). The committer date is read as a unix
     * count of seconds and converted to millis. {@code %00} (NUL) separates the fields because a
@@ -46,7 +46,8 @@ public record MemberSession(
        String worktree,
        String branch,
        CharterReceipt charterReceipt,
-        String agentSessionId) {
+        String agentSessionId,
+        String failureReason) {

    /** One-shot worker lifecycle states. */
    public enum State {
@@ -54,6 +55,7 @@ public record MemberSession(
        READY,
        BUSY,
        DONE,
+        BACKEND_ERROR,
        FAILED,
        RELEASED
    }
@@ -69,24 +71,51 @@ public record MemberSession(
                         long lastActivityAtNanos, int turnCount, State state,
                         String worktree, String branch) {
        this(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                lastActivityAtNanos, turnCount, state, worktree, branch, null, null);
+                lastActivityAtNanos, turnCount, state, worktree, branch, null, null, null);
+    }
+
+    /** Backward-compatible shape without a backend failure reason. */
+    public MemberSession(String paneId, String terminalId, String profile, MemberRole role,
+                         String cwd, String ownerTerminal, long spawnedAtNanos,
+                         long lastActivityAtNanos, int turnCount, State state,
+                         String worktree, String branch, CharterReceipt charterReceipt,
+                         String agentSessionId) {
+        this(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
+                lastActivityAtNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId, null);
    }

    /** Return a copy of this session in {@code state}. */
    public MemberSession withState(State state) {
        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                lastActivityAtNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId);
+                lastActivityAtNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId, failureReason);
    }

    /** Return a copy with {@code lastActivityAtNanos} updated to {@code nowNanos}. */
    public MemberSession withActivity(long nowNanos) {
        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                nowNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId);
+                nowNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId, failureReason);
    }

    /** Return a copy with the turn count incremented and activity timestamped at {@code nowNanos}. */
    public MemberSession bumpTurn(long nowNanos) {
        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                nowNanos, turnCount + 1, state, worktree, branch, charterReceipt, agentSessionId);
+                nowNanos, turnCount + 1, state, worktree, branch, charterReceipt, agentSessionId, failureReason);
+    }
+
+    /**
+     * Return a copy with {@code agentSessionId} resolved to a non-null value (fleetd #209). Some
+     * adapters (opencode) cannot answer {@link dev.ltms.fleet.peer.PeerHandle#agentSessionId()} at
+     * spawn time — the peer has not persisted its session record yet — so the id is discovered on
+     * a later poll and swapped into the otherwise-immutable session via this wither.
+     */
+    public MemberSession withAgentSessionId(String agentSessionId) {
+        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
+                lastActivityAtNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId, failureReason);
+    }
+
+    /** Return a copy with the durable backend failure detail. */
+    public MemberSession withFailureReason(String failureReason) {
+        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
+                lastActivityAtNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId, failureReason);
    }
 }
@@ -46,6 +46,15 @@ public final class SessionManager implements TurnListener {
    private final PeerLauncher launcher;
    private final Worktrees worktrees;
    private final ConcurrentHashMap<String /*paneId*/, MemberSession> registry = new ConcurrentHashMap<>();
+    /**
+     * fleetd #209: the live {@link PeerHandle} for every registered pane, retained solely so
+     * {@link #resolveAgentSessionId} can re-poll {@link PeerHandle#agentSessionId()} after spawn.
+     * The handle used to go out of scope at the end of the spawn method, so a launcher that answers
+     * the id lazily (opencode — the on-disk session row is written after the pane is created) could
+     * never be re-asked, and {@code fleet_list}/{@code fleet_spawn resumeSessionId} never saw it.
+     * Populated on every spawn path, removed on {@link #release}.
+     */
+    private final ConcurrentHashMap<String /*paneId*/, PeerHandle> handles = new ConcurrentHashMap<>();
    private final MemberPresence presence;
    private final SecureRandom nonceRandom = new SecureRandom();
    private final AtomicLong nonceSeq = new AtomicLong();
@@ -174,45 +183,51 @@ public final class SessionManager implements TurnListener {
                                 String sessionName, String resumeSessionId) {
        MemberRole memberRole = (role == null) ? MemberRole.DEV : role;
        requireResumeCapability(profile, resumeSessionId);
+        // CB-619 / fleetd #123: an explicit profile bypasses placement (CompositePeerLauncher only
+        // constrains an UNQUALIFIED spawn to the role's pool), so it is the one path that can ask
+        // for a role with no slot to bind it to. Refuse before anything spawns. A blank profile is
+        // left to placement, which already restricts an unqualified spawn to the role's pool.
+        if (profile != null && !profile.isBlank()) {
+            memberLifecycle.requireSlotFor(memberRole, profile);
+        }
+        MemberLifecycle.SlotReservation reservation = memberLifecycle.reserve(memberRole, profile);
+        String launchProfile = reservation == null ? profile : reservation.profile();
        if (wt == null) {
            // CB-557: the role must ride on the SpawnRequest, not stay a local. The launcher needs it
            // to pick the profile out of that role's pool and to label the tab; a role kept only on
            // the MemberSession is recorded after the spawn it was supposed to steer.
-            SpawnRequest req = new SpawnRequest(profile, requestedCwd, callerCwd, sessionName, resumeSessionId, memberRole);
+            SpawnRequest req = new SpawnRequest(launchProfile, requestedCwd, callerCwd, sessionName, resumeSessionId, memberRole);
            PeerHandle handle;
+            boolean bound = false;
            try {
                handle = launcher.spawn(req);
+                String resolvedProfile = resolveProfile(handle, launchProfile);
+                String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
+                long now = nowNanos.getAsLong();
+                MemberRole actualRole = acquired(memberRole, resolvedProfile, handle.terminalId(), reservation);
+                bound = reservation == null || actualRole == MemberRole.ARCHITECT;
+                MemberSession session = new MemberSession(
+                        handle.id(), handle.terminalId(), resolvedProfile, actualRole, cwd, ownerTerminal, now, now, 0,
+                        MemberSession.State.SPAWNING, null, null, handle.charterReceipt(), handle.agentSessionId());
+                registry.put(handle.id(), session);
+                handles.put(handle.id(), handle);
+                log.debug("acquired session id={} terminal={} profile={} owner={}",
+                        handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
+                notifyAcquired(session.terminalId());
+                return session;
            } catch (RuntimeException e) {
-                log.warn("spawn failed for profile={} role={}: {}", profile, memberRole, e.getMessage());
+                if (!bound) memberLifecycle.release(reservation);
+                log.warn("spawn failed for profile={} role={}: {}", launchProfile, memberRole, e.getMessage());
                throw e;
            }
-            String resolvedProfile = resolveProfile(handle, profile);
-            String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
-            long now = nowNanos.getAsLong();
-            MemberSession session = new MemberSession(
-                    handle.id(),
-                    handle.terminalId(),
-                    resolvedProfile,
-                    memberRole,
-                    cwd,
-                    ownerTerminal,
-                    now,
-                    now,
-                    0,
-                    MemberSession.State.SPAWNING,
-                    null,
-                    null,
-                    handle.charterReceipt(),
-                    handle.agentSessionId());
-            registry.put(handle.id(), session);
-            memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
-            log.debug("acquired session id={} terminal={} profile={} owner={}",
-                    handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
-            notifyAcquired(session.terminalId());
-            return session;
        }
-        return acquireWithWorktree(profile, memberRole, requestedCwd, callerCwd, ownerTerminal, wt,
-                sessionName, resumeSessionId);
+        try {
+            return acquireWithWorktree(launchProfile, memberRole, requestedCwd, callerCwd, ownerTerminal, wt,
+                    sessionName, resumeSessionId, reservation);
+        } catch (RuntimeException e) {
+            memberLifecycle.release(reservation);
+            throw e;
+        }
    }

    /**
@@ -257,6 +272,10 @@ public final class SessionManager implements TurnListener {
     */
    private void release(String paneId, ReleaseCause cause) {
        MemberSession removed = registry.remove(paneId);
+        // fleetd #209: remove right alongside the registry entry so a released session's handle is
+        // never leaked — but keep the local reference below, so the id can still be resolved for
+        // the ReleaseDetail this teardown notifies with.
+        PeerHandle removedHandle = handles.remove(paneId);
        boolean preserveWorktree = cause == ReleaseCause.SHUTDOWN;
        String snapshotRef = null;
        if (removed != null) {
@@ -303,8 +322,11 @@ public final class SessionManager implements TurnListener {
                // too, so a failed ticket's detail can point a lead at the same tree to re-dispatch.
                // CB-584 (issue #65 criterion 5): carry agentSessionId alongside them, so a lead can
                // also resume the member's conversation, not just re-dispatch onto its files.
-                notifyReleased(new ReleaseDetail(removed.terminalId(), removed.worktree(),
-                        removed.branch(), snapshotRef, removed.agentSessionId()));
+                // fleetd #209: a late-resolving adapter (opencode) may only now have an id — resolve
+                // one last time so a released member's detail carries the id it now has.
+                MemberSession resolved = resolveAgentSessionId(removed, removedHandle);
+                notifyReleased(new ReleaseDetail(resolved.terminalId(), resolved.worktree(),
+                        resolved.branch(), snapshotRef, resolved.agentSessionId()));
            }
        }
        // CB-581: the pane must always stop, even if the dirty check above threw. A session removed
@@ -451,7 +473,8 @@ public final class SessionManager implements TurnListener {

    private MemberSession acquireWithWorktree(String profile, MemberRole memberRole, String requestedCwd, String callerCwd,
                                              String ownerTerminal, WorktreeRequest wt,
-                                              String sessionName, String resumeSessionId) {
+                                               String sessionName, String resumeSessionId,
+                                               MemberLifecycle.SlotReservation reservation) {
        String preResolvedProfile = (profile == null || profile.isBlank())
                ? launcher.defaultProfile() : profile;
        // CB-507: resolve through the launcher's CB-112 chain (requested → profile cwd → caller →
@@ -472,6 +495,10 @@ public final class SessionManager implements TurnListener {
        try {
            path = worktrees.add(repoRoot, branch, wt.baseRef());
            worktrees.overlayParity(repoRoot, path, launcher.parityOverlay(preResolvedProfile));
+            // fleetd #185 stage 3: MUST run after overlayParity, not folded into add() — overlayParity
+            // copies more files into the worktree after add() returns, so sharing the group any earlier
+            // leaves those overlay files operator-owned and read-only for a different-uid member.
+            worktrees.shareWithGroup(repoRoot, path);
            handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd, sessionName, resumeSessionId, memberRole));
        } catch (RuntimeException e) {
            log.warn("spawn failed for profile={} role={} branch={} path={}: {}",
@@ -488,11 +515,14 @@ public final class SessionManager implements TurnListener {
        String resolvedProfile = resolveProfile(handle, profile);
        String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, path, callerCwd));
        long now = nowNanos.getAsLong();
+        // CB-619: see the no-worktree path above — bind before recording, and store the returned
+        // actual role, so this session's role is never a lie about what it actually holds.
+        MemberRole actualRole = acquired(memberRole, resolvedProfile, handle.terminalId(), reservation);
        MemberSession session = new MemberSession(
                handle.id(),
                handle.terminalId(),
                resolvedProfile,
-                memberRole,
+                actualRole,
                cwd,
                ownerTerminal,
                now,
@@ -504,13 +534,25 @@ public final class SessionManager implements TurnListener {
                handle.charterReceipt(),
                handle.agentSessionId());
        registry.put(handle.id(), session);
-        memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
+        handles.put(handle.id(), handle);
        log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
                handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
        notifyAcquired(session.terminalId());
        return session;
    }

+    private MemberRole acquired(MemberRole role, String profile, String terminal,
+                                MemberLifecycle.SlotReservation reservation) {
+        if (reservation == null) {
+            return memberLifecycle.acquired(role, profile, terminal);
+        }
+        if (memberLifecycle.bind(reservation, terminal)) {
+            return role;
+        }
+        memberLifecycle.release(reservation);
+        return memberLifecycle.acquired(role, profile, terminal);
+    }
+
    private String slug(String raw) {
        return raw == null ? "ticket" : raw.toLowerCase().replaceAll("[^a-z0-9]+", "-").replaceAll("^-+|-+$", "");
    }
@@ -535,16 +577,73 @@ public final class SessionManager implements TurnListener {
        return launcher.defaultProfile();
    }

-    /** The session for {@code paneId}, if it is still registered and not released. */
+    /**
+     * The session for {@code paneId}, if it is still registered and not released. fleetd #209:
+     * resolves a still-unknown {@code agentSessionId} against the retained handle before returning,
+     * so {@code fleet_status} sees an id a lazy-resolving adapter has since written.
+     */
    public Optional<MemberSession> get(String paneId) {
-        return Optional.ofNullable(registry.get(paneId));
+        return Optional.ofNullable(registry.get(paneId)).map(this::resolveAgentSessionId);
    }

-    /** Fleet-owned roster: all registered sessions (acquired minus released). */
+    /**
+     * Fleet-owned roster: all registered sessions (acquired minus released). Deliberately does
+     * <strong>not</strong> resolve {@code agentSessionId} (fleetd #209 follow-up) — this is the
+     * roster supplier on the heartbeat and health-tick timers ({@code LeadHeartbeatLoop},
+     * {@code FleetHealthMonitor} in {@code Fleetd}), on the placement/exhaustion paths, and on the
+     * metrics scrape ({@code FleetMetrics}), all called far more often than any caller actually
+     * reads {@code agentSessionId}. Resolving here would mean every tick opens a lazy-resolving
+     * adapter's (opencode's) on-disk session store once per member whose id is still unknown — and
+     * for a member whose id never appears, that cost never stops, for the life of the process. Use
+     * {@link #rosterResolved()} instead wherever the id must be current.
+     */
    public List<MemberSession> roster() {
        return List.copyOf(registry.values());
    }

+    /**
+     * {@link #roster()}, with each session's still-unknown {@code agentSessionId} re-resolved
+     * against its retained handle (fleetd #209) — so a caller that actually reports the id (
+     * {@code fleet_list}, the REST roster) sees one a lazy-resolving adapter (opencode) has since
+     * written, rather than the null frozen in at spawn time. Reserved for caller-driven reads, not
+     * timers: see {@link #roster()}'s javadoc for why the plain roster must stay non-resolving.
+     */
+    public List<MemberSession> rosterResolved() {
+        return registry.values().stream().map(this::resolveAgentSessionId).toList();
+    }
+
+    /**
+     * Resolve {@code session}'s {@code agentSessionId} if still unknown, re-polling the retained
+     * {@link PeerHandle} for this pane (fleetd #209). A no-op — returning {@code session} unchanged
+     * — once the id is already known, once no handle is retained for this pane (never spawned, or
+     * already released), or if the handle throws while answering. A resolved id is best-effort
+     * CAS-swapped into the registry via {@link #replace}; a lost race just means another caller
+     * already applied the same update, so the resolved value is returned either way.
+     */
+    private MemberSession resolveAgentSessionId(MemberSession session) {
+        return resolveAgentSessionId(session, handles.get(session.paneId()));
+    }
+
+    private MemberSession resolveAgentSessionId(MemberSession session, PeerHandle handle) {
+        if (session.agentSessionId() != null || handle == null) {
+            return session;
+        }
+        String resolved;
+        try {
+            resolved = handle.agentSessionId();
+        } catch (RuntimeException e) {
+            log.debug("agentSessionId lookup failed for pane={} terminal={}: {}",
+                    session.paneId(), session.terminalId(), e.toString());
+            return session;
+        }
+        if (resolved == null) {
+            return session;
+        }
+        MemberSession updated = session.withAgentSessionId(resolved);
+        replace(session, updated); // best-effort; a lost CAS just means the resolved value stands anyway
+        return updated;
+    }
+
    /**
     * CB-304 merged roster+live view. The registry is authoritative for worktree, branch,
     * profile, owner, and state; the optional live agent supplies the herdr-reported status.
@@ -559,6 +658,9 @@ public final class SessionManager implements TurnListener {
        m.put("profile", session.profile());
        m.put("role", session.role() == null ? "dev" : session.role().wireName());
        m.put("state", session.state().name().toLowerCase());
+        if (session.failureReason() != null) {
+            m.put("failureReason", session.failureReason());
+        }
        if (session.worktree() != null) {
            m.put("worktree", session.worktree());
        }
@@ -619,6 +721,36 @@ public final class SessionManager implements TurnListener {
        completeTurn(target, false);
    }

+    /**
+     * Record that a member backend failed after a delegated ticket expired. This CAS loop accepts
+     * either side of the completion race: {@code BUSY -> BACKEND_ERROR} or
+     * {@code DONE -> BACKEND_ERROR}. A released or unknown session is never recreated.
+     *
+     * @return {@code true} when the error is recorded on a live session
+     */
+    public boolean onBackendError(String target, String reason) {
+        while (true) {
+            MemberSession current = findByTerminal(target);
+            if (current == null) {
+                log.warn("backend error for unknown member terminal={}", target);
+                return false;
+            }
+            if (current.state() == MemberSession.State.RELEASED) {
+                return false;
+            }
+            if (current.state() == MemberSession.State.BACKEND_ERROR) {
+                return true;
+            }
+            MemberSession updated = current.withState(MemberSession.State.BACKEND_ERROR)
+                    .withFailureReason(reason).withActivity(nowNanos.getAsLong());
+            if (replace(current, updated)) {
+                log.warn("member terminal={} pane={} transitioned {} -> BACKEND_ERROR: {}",
+                        target, current.paneId(), current.state(), reason);
+                return true;
+            }
+        }
+    }
+
    @Override
    public boolean hasPostTurnAction(String target) {
        if (!clearAfterTurn) return false;
@@ -637,10 +769,9 @@ public final class SessionManager implements TurnListener {
        if (current == null || current.state() != MemberSession.State.BUSY) return false;
        long now = nowNanos.getAsLong();
        MemberSession updated = current.withState(MemberSession.State.DONE).withActivity(now);
-        if (replace(current, updated)) {
-            log.debug("session transitioned terminal={} pane={} BUSY -> DONE turn={}",
-                    target, current.paneId(), updated.turnCount());
-        }
+        if (!replace(current, updated)) return false;
+        log.debug("session transitioned terminal={} pane={} BUSY -> DONE turn={}",
+                target, current.paneId(), updated.turnCount());
        if (contextCap > 0 && updated.turnCount() >= contextCap) {
            release(current.paneId());
            return false;
@@ -98,4 +98,21 @@ public interface Worktrees {
    /** CB-586: the operator-visible census of {@code refs/wip/*} in one repository. */
    record WipRefStats(int count, long costBytes) {
    }
+
+    /**
+     * Make {@code repoRoot}'s git store and {@code worktreePath} writable by the configured group
+     * (fleetd #185 stage 3), so a member spawned as a different OS user (see
+     * {@code memberHerdrSocket}) can write its own worktree, its per-worktree git metadata, and
+     * its own commit objects. No-op when no group is configured.
+     *
+     * <p><strong>This isolates credentials, not the repository.</strong> A member in the group can
+     * still write the operator's git objects and refs in the shared repo — this only fixes file
+     * ownership/permissions so a different-uid member can work at all, it grants no narrower access
+     * than that.
+     *
+     * @param repoRoot     the repository whose git store ({@code .git/objects}, {@code refs},
+     *                     {@code logs}, {@code worktrees}, {@code packed-refs}) needs sharing
+     * @param worktreePath the linked worktree's own directory
+     */
+    void shareWithGroup(String repoRoot, String worktreePath);
 }
@@ -1,8 +1,12 @@
 package dev.ltms.fleet;

+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.fleet.config.FleetConfig;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;

 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -26,19 +30,66 @@ class RequiredSecretEnvVarsTest {
        return FleetConfig.load(f);
    }

+    private static ListAppender<ILoggingEvent> attach() {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(ListAppender<ILoggingEvent> appender) {
+        ((Logger) LoggerFactory.getLogger(Fleetd.class)).detachAppender(appender);
+    }
+
    @Test
-    void collectsATokenEnvPerNonSubscriptionProfile(@TempDir Path dir) throws Exception {
+    void explicitlyConfiguredUnsetTokenEnvWarnsWithCurrentWording(@TempDir Path dir) throws Exception {
        FleetConfig cfg = load(dir, """
                profiles:
                  local:
                    baseUrl: http://gx00.gw:8000
-                    tokenEnv: AI_GATEWAY_TOKEN
+                    tokenEnv: CB115_MISSING_TOKEN_ENV_819367
                """);

        Map<String, List<String>> required = Fleetd.requiredSecretEnvVars(cfg);

-        assertTrue(required.containsKey("AI_GATEWAY_TOKEN"));
-        assertEquals(List.of("profile 'local' tokenEnv"), required.get("AI_GATEWAY_TOKEN"));
+        assertTrue(required.containsKey("CB115_MISSING_TOKEN_ENV_819367"));
+        assertEquals(List.of("profile 'local' tokenEnv"), required.get("CB115_MISSING_TOKEN_ENV_819367"));
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportRequiredSecrets(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        assertTrue(appender.list.stream().anyMatch(e ->
+                        e.getLevel() == ch.qos.logback.classic.Level.WARN
+                                && e.getFormattedMessage().contains("startup secret CB115_MISSING_TOKEN_ENV_819367: MISSING")
+                                && e.getFormattedMessage().contains("profile 'local' tokenEnv")),
+                "an explicitly configured but unset tokenEnv must retain the startup warning");
+    }
+
+    @Test
+    void profileWithoutTokenEnvDoesNotRequireTheOldDefault(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  local:
+                    baseUrl: http://gx00.gw:8000
+                """);
+
+        assertTrue(Fleetd.requiredSecretEnvVars(cfg).isEmpty(),
+                "an absent tokenEnv means this profile needs no token, not FLEETD_WORKER_TOKEN");
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportRequiredSecrets(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        assertFalse(appender.list.stream().anyMatch(e -> e.getLevel() == ch.qos.logback.classic.Level.WARN),
+                "a profile without tokenEnv must not produce a startup secret warning");
    }

    @Test
@@ -1036,6 +1036,35 @@ class FleetConfigTest {
        assertEquals(LeadMailbox.DEFAULT_PREFETCH, noEnv.prefetchOrDefault());
    }

+    @Test
+    void absentWorktreeGroupLeavesItNull(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-worktree-group.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\n");
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertNull(cfg.worktreeGroup(), "no worktreeGroup: key → null → GitWorktrees.shareWithGroup is a no-op");
+    }
+
+    @Test
+    void worktreeGroupKeyParses(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("worktree-group.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\nworktreeGroup: fleet-workers\n");
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertEquals("fleet-workers", cfg.worktreeGroup());
+    }
+
+    @Test
+    void absentWorktreeGroupSurvivesTheBackCompatConstructorChain() {
+        // fleetd #185 stage 3: withDefaults() (and every pre-existing call site) must not silently
+        // drop a live worktreeGroup by routing through a back-compat constructor that defaults it
+        // to null.
+        FleetConfig cfg = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null, "fleet-workers");
+        assertEquals("fleet-workers", cfg.withDefaults().worktreeGroup(),
+                "withDefaults() must carry a configured worktreeGroup through unchanged");
+    }
+
    @Test
    void absentPrimaryBlockLeavesPrimaryNull(@TempDir Path dir) throws Exception {
        Path f = dir.resolve("no-primary.yaml");
@@ -44,10 +44,13 @@ public final class FakeHerdr implements HerdrClient {
    private String agentSendErrorCode = null;
    private boolean noPanes = false;
    private volatile String agentStatus = "idle"; // steady-state agent.get status
+    private volatile String agentType = "claude"; // detected agent kind on agent.get; null = undetected
    private volatile String readText = "worker transcript tail"; // canned agent.read output
    private int pinnedStarts = 0;   // how many upcoming agent.start calls report a fixed pane
    private String pinnedStartTerminal;
    private String pinnedStartPane;
+    private volatile int agentGetOkCalls = Integer.MAX_VALUE; // how many agent.get calls succeed first
+    private volatile String agentGetFailCode = null; // error code every agent.get call after that reports

    public FakeHerdr healthy(boolean h) {
        this.healthy = h;
@@ -103,6 +106,27 @@ public final class FakeHerdr implements HerdrClient {
        return this;
    }

+    /**
+     * Set the detected agent kind ({@code "agent"} field) that {@code agent.get} reports —
+     * {@code null} models herdr not (or no longer) detecting a supported backend in the pane, e.g.
+     * a bare shell prompt (fleetd #176 fix 2 corroboration test).
+     */
+    public FakeHerdr agentType(String type) {
+        this.agentType = type;
+        return this;
+    }
+
+    /**
+     * Make {@code agent.get} succeed normally for its first {@code okCalls} invocations, then fail
+     * every call after that with {@code code} — fleetd #176 fix 1's "backend exited mid-wait"
+     * fixture. {@code okCalls == 0} fails from the very first call.
+     */
+    public FakeHerdr agentGetFailsWithAfter(int okCalls, String code) {
+        this.agentGetOkCalls = okCalls;
+        this.agentGetFailCode = code;
+        return this;
+    }
+
    /** The text {@code agent.read} returns (the CB-106 completion scrape). */
    public FakeHerdr readText(String text) {
        this.readText = text;
@@ -208,10 +232,21 @@ public final class FakeHerdr implements HerdrClient {
                    }
                    yield mapper.readTree("{\"type\":\"ok\"}");
                }
-                case "agent.get" -> mapper.readTree(("""
-                        {"type":"agent_info","agent":{"terminal_id":"term_a","agent":"claude",
+                case "agent.get" -> {
+                    if (agentGetFailCode != null) {
+                        long getCalls = calls.stream().filter(c -> c.method().equals("agent.get")).count();
+                        if (getCalls > agentGetOkCalls) {
+                            throw new HerdrException(
+                                    "herdr error [" + agentGetFailCode + "]: agent target not found",
+                                    agentGetFailCode, null);
+                        }
+                    }
+                    String agentField = agentType == null ? "null" : "\"" + agentType + "\"";
+                    yield mapper.readTree(("""
+                        {"type":"agent_info","agent":{"terminal_id":"term_a","agent":%s,
                          "agent_status":"%s","workspace_id":"w2","tab_id":"w2:t7","pane_id":"w2:p7"}}""")
-                        .formatted(agentStatus));
+                            .formatted(agentField, agentStatus));
+                }
                case "agent.read" -> mapper.readTree(mapper.writeValueAsString(
                        java.util.Map.of("type", "agent_read", "read", java.util.Map.of("text", readText))));
                case "agent.start" -> {
@@ -4,8 +4,11 @@ import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.LoggerContext;
 import ch.qos.logback.classic.spi.ILoggingEvent;
 import ch.qos.logback.core.read.ListAppender;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.msg.Rendezvous;
 import dev.ltms.fleet.msg.TestTurnTokens;
 import dev.ltms.fleet.msg.TurnToken;
@@ -193,6 +196,26 @@ class CompletionResolverTest {
        assertEquals("complete report", waiter.getNow(null).text());
    }

+    @Test
+    void suppressesABareEchoWithOnlyTuiChrome() {
+        String injected = "Load the implementer skill. You own fleetd #999. ".repeat(12);
+        String scrape = injected + "\nDev auto - GPT-5.6 Terra OpenAI";
+
+        assertTrue(CompletionResolver.echoesInjectedBrief(scrape, injected));
+    }
+
+    @Test
+    void pinsTheMaximumTuiChromeExcess() {
+        String injected = "a".repeat(CompletionResolver.ECHO_MIN_CHARS);
+        String underMargin = injected + "b".repeat(CompletionResolver.MAX_ECHO_EXCESS_CHARS);
+        String overMargin = injected + "b".repeat(CompletionResolver.MAX_ECHO_EXCESS_CHARS + 1);
+
+        assertTrue(CompletionResolver.echoesInjectedBrief(underMargin, injected),
+                "the configured excess itself remains an echoed brief");
+        assertFalse(CompletionResolver.echoesInjectedBrief(overMargin, injected),
+                "one character beyond the excess must preserve the scrape as a real report");
+    }
+
    @Test
    void resolvesSynchronouslyBeforePostTurnContextClearing() {
        FakeHerdr herdr = new FakeHerdr().readText("⏺ previous answer\n❯ ");
@@ -499,7 +522,7 @@ class CompletionResolverTest {
        Rendezvous rendezvous = new Rendezvous();
        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
        java.util.List<String> notified = new java.util.ArrayList<>();
-        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
+        ExhaustionSink sink = (target, reason, profile) -> notified.add(target + ": " + reason);
        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);

        var waiter = rendezvous.open("term_a");
@@ -520,7 +543,7 @@ class CompletionResolverTest {
        Rendezvous rendezvous = new Rendezvous();
        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
        java.util.List<String> notified = new java.util.ArrayList<>();
-        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
+        ExhaustionSink sink = (target, reason, profile) -> notified.add(target + ": " + reason);
        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);

        var waiter = rendezvous.open("term_a");
@@ -633,6 +656,115 @@ class CompletionResolverTest {
                "the failure carries the rest of the pane, not only the matched line: " + reason);
    }

+    // --- fleetd#211: raw-scrape fallback classification when there is no usable assistant block ---
+
+    @Test
+    void anExhaustionLineWithNoMarkerAndLeadingChromeIsClassifiedFromTheRawScrapeAndNotifiesTheSink() {
+        // No ⏺ anywhere, and the first visible line is TUI chrome (╭). lastAssistantBlock's boundary
+        // scan starts at the top of the raw screen and breaks immediately, so the trimmed block is "".
+        // The fix: fall back to matching the RAW scrape so this doesn't get lost as an empty scrape.
+        String block = """
+                ╭──────────────────────────────────────╮
+                The usage limit has been reached. Try again later.
+                """;
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> notified.add(target + ": " + reason);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "a raw-scrape match still resolves the blocked send");
+        assertEquals(Rendezvous.Kind.BACKEND_EXHAUSTED, waiter.getNow(null).kind(),
+                "classified from the raw scrape even though the trimmed block was empty");
+        assertEquals(1, notified.size(),
+                "the sink is the whole point of this ticket — it must be notified: " + notified);
+        assertTrue(notified.get(0).startsWith("term_a: "), "the sink is told which target exhausted");
+        assertTrue(notified.get(0).contains("The usage limit has been reached"),
+                "the sink is told the matched reason: " + notified.get(0));
+    }
+
+    @Test
+    void aBackendErrorLineWithNoMarkerAndLeadingChromeIsClassifiedFromTheRawScrape() {
+        String block = """
+                ╭──────────────────────────────────────╮
+                API Error: 400 invalid request body
+                """;
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "a raw-scrape backend-error match still resolves the blocked send");
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "classified BACKEND_ERROR from the raw scrape even though the trimmed block was empty");
+        assertTrue(waiter.getNow(null).text().contains("API Error: 400 invalid request body"),
+                "the failure carries the matched line: " + waiter.getNow(null).text());
+        assertTrue(waiter.getNow(null).text().contains("--- pane tail ---"),
+                "fleetd#164: the failure must carry the pane, not only the matched line — with an "
+                        + "empty trimmed block the raw scrape is the only copy of what the member said: "
+                        + waiter.getNow(null).text());
+        assertTrue(waiter.getNow(null).text().contains("╭"),
+                "the carried pane is the raw scrape, chrome included: " + waiter.getNow(null).text());
+    }
+
+    @Test
+    void anOrdinaryPaneWithANormalAssistantBlockIsUnaffectedByTheRawScrapeFallback() {
+        // Pin: on a pane that already yields a usable block, the fallback branch is never reached —
+        // same outcome, same text, sink not called — even though the raw screen around the marker
+        // would itself match the configured exhausted pattern.
+        String block = "The usage limit has been reached, but this is a leading TUI line above the "
+                + "marker.\n⏺ complete report\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> notified.add(target + ": " + reason);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone());
+        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
+                "unchanged: a usable assistant block never reaches the raw-scrape fallback");
+        assertEquals("complete report", waiter.getNow(null).text(), "the reply text is unaffected");
+        assertTrue(notified.isEmpty(), "the fallback never runs, so the sink is never called");
+    }
+
+    @Test
+    void aGenuinelyEmptyScrapeStillFailsAsEmptyAndNeverNotifiesTheSink() {
+        // The false-positive pin: no exhaustion or backend-error text anywhere on the pane (just
+        // chrome, no marker) — the raw-scrape fallback must not manufacture a classification, and
+        // the sink must stay untouched.
+        String block = """
+                ╭──────────────────────────────────────╮
+                │ >                                    │
+                ╰──────────────────────────────────────╯
+                """;
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> notified.add(target + ": " + reason);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "an empty scrape must still resolve the send, not hang");
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "no exhaustion or backend-error text anywhere ⇒ this stays the ordinary empty-scrape failure");
+        assertTrue(waiter.getNow(null).text().toLowerCase().contains("empty"),
+                "the failure still says the scrape was empty: " + waiter.getNow(null).text());
+        assertTrue(notified.isEmpty(), "a genuinely empty pane must never quarantine a credential");
+    }
+
    @Test
    void coverageIsOffWhenNoProfileHasAPatternConfigured() {
        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",
@@ -650,4 +782,202 @@ class CompletionResolverTest {
        assertEquals("partial (configured: [terra]; not configured: [gx10])",
                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra")));
    }
+
+    // --- fleetd#201 Unit 1: target-keyed backend-error pattern + typed sink ----------------------
+
+    @Test
+    void aConfiguredBackendErrorPatternClassifiesAMatchAsAFailureAndNotifiesTheSinkOnce() {
+        String block = "⏺ 503 Service Unavailable: upstream credential rejected\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        BackendErrorPatternLookup patterns = target -> Pattern.compile("(?i)503 Service Unavailable");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        BackendErrorSink sink = (target, matchedLine, reason) -> notified.add(target + ": " + matchedLine);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "a configured-pattern match still resolves the blocked send");
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind());
+        assertEquals(1, notified.size(), "the sink fires exactly once for the winning classification");
+        assertEquals("term_a: 503 Service Unavailable: upstream credential rejected", notified.get(0));
+    }
+
+    @Test
+    void aLosingBackendErrorClassificationNeverNotifiesTheSink() {
+        // The waiter was already resolved (e.g. by the worker's own fleet_reply) before this scrape
+        // landed — resolveFailure loses the race and must return false, so the sink must not fire.
+        String block = "⏺ 503 Service Unavailable: upstream credential rejected\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        BackendErrorPatternLookup patterns = target -> Pattern.compile("(?i)503 Service Unavailable");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        BackendErrorSink sink = (target, matchedLine, reason) -> notified.add(target + ": " + matchedLine);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        var turn = new CompletionResolver.InFlight(waiter, null);
+        assertTrue(rendezvous.resolveCompletion(waiter, "already replied")); // fleet_reply won first
+
+        resolver.resolve("term_a", turn);
+
+        assertTrue(notified.isEmpty(), "a classification that loses the race must not fire the sink");
+        assertEquals("already replied", waiter.getNow(null).text(), "the earlier resolution stands untouched");
+    }
+
+    @Test
+    void aBackendErrorClassificationThatLosesARealRaceDuringTheScrapeNeverNotifiesTheSink() {
+        // The test above pre-resolves the waiter BEFORE calling resolve(), so it is caught by
+        // resolve()'s own top-of-method isDone() guard before ever reaching the win-gated
+        // resolveFailure call this unit adds — it proves the outcome, not the specific gate. This
+        // test forces the actual race window fleetd#201 must be safe in: a genuine fleet_reply lands
+        // WHILE the herdr scrape for this turn is in flight, i.e. AFTER resolve() has already passed
+        // the top guard (waiter not done yet) and committed to reading the pane, but BEFORE it
+        // reaches the "if (rendezvous.resolveFailure(...))" line below. The side effect is attached
+        // to the one real I/O step resolve() performs between those two points: the herdr
+        // "agent.read" call itself.
+        Rendezvous rendezvous = new Rendezvous();
+        var waiter = rendezvous.open("term_a");
+        ObjectMapper mapper = new ObjectMapper();
+        HerdrClient racingDuringScrape = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) {
+                if ("agent.read".equals(method)) {
+                    // The real fleet_reply that wins the race, landing mid-scrape.
+                    assertTrue(rendezvous.resolve("term_a", "a genuine fleet_reply landed first"),
+                            "the racing reply must land while the waiter is still open");
+                }
+                try {
+                    return mapper.readTree(mapper.writeValueAsString(java.util.Map.of(
+                            "type", "agent_read",
+                            "read", java.util.Map.of("text",
+                                    "⏺ 503 Service Unavailable: upstream credential rejected\n❯ "))));
+                } catch (Exception e) {
+                    throw new RuntimeException(e);
+                }
+            }
+
+            @Override
+            public void close() {
+            }
+        };
+        BackendErrorPatternLookup patterns = target -> Pattern.compile("(?i)503 Service Unavailable");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        BackendErrorSink sink = (target, matchedLine, reason) -> notified.add(target + ": " + matchedLine);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(racingDuringScrape), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), patterns, sink);
+
+        var turn = new CompletionResolver.InFlight(waiter, null); // not done yet — passes the top guard
+        resolver.resolve("term_a", turn);
+
+        assertTrue(notified.isEmpty(),
+                "a classification that loses a real race during the scrape must not fire the sink");
+        assertEquals(Rendezvous.Kind.REPLY, waiter.getNow(null).kind(), "the genuine fleet_reply stands");
+        assertEquals("a genuine fleet_reply landed first", waiter.getNow(null).text());
+    }
+
+    @Test
+    void exhaustionKeepsWinningOverBackendErrorEvenWhenBothPatternsMatchTheSameLine() {
+        // A line matching both a configured exhausted pattern AND a configured backend-error pattern
+        // must classify BACKEND_EXHAUSTED and call only the ExhaustionSink — the ordering fleetd#578
+        // already relies on must not change.
+        String block = "⏺ The usage limit has been reached. Try again later.\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        ExhaustedPatternLookup exhausted = target -> Pattern.compile("usage limit has been reached");
+        BackendErrorPatternLookup backendErrors = target -> Pattern.compile("(?i)usage limit");
+        java.util.List<String> exhaustedNotified = new java.util.ArrayList<>();
+        java.util.List<String> backendErrorNotified = new java.util.ArrayList<>();
+        ExhaustionSink exhaustionSink = (target, reason, profile) -> exhaustedNotified.add(target);
+        BackendErrorSink backendErrorSink = (target, matchedLine, reason) -> backendErrorNotified.add(target);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                exhausted, exhaustionSink, backendErrors, backendErrorSink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertEquals(Rendezvous.Kind.BACKEND_EXHAUSTED, waiter.getNow(null).kind(),
+                "exhaustion must keep winning over backend error");
+        assertEquals(1, exhaustedNotified.size(), "the exhaustion sink fires");
+        assertTrue(backendErrorNotified.isEmpty(), "the backend-error sink must never fire for this turn");
+    }
+
+    @Test
+    void aConfiguredPatternAlsoClassifiesTheRawScrapeFallbackAndNotifiesTheSink() {
+        // No ⏺ marker and leading TUI chrome ⇒ lastAssistantBlock() yields "", so classification must
+        // fall back to the raw scrape (fleetd#211) — and it must use the configured pattern too.
+        String block = """
+                ╭──────────────────────────────────────╮
+                503 Service Unavailable: upstream credential rejected
+                """;
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        BackendErrorPatternLookup patterns = target -> Pattern.compile("(?i)503 Service Unavailable");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        BackendErrorSink sink = (target, matchedLine, reason) -> notified.add(target + ": " + matchedLine);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), patterns, sink);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertTrue(waiter.isDone(), "a raw-scrape configured-pattern match still resolves the blocked send");
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "classified from the raw scrape even though the trimmed block was empty");
+        assertEquals(1, notified.size(), "the sink fires exactly once from the raw-scrape path");
+        assertTrue(notified.get(0).contains("503 Service Unavailable"), notified.get(0));
+    }
+
+    // --- fleetd#201 Unit 1: classification inside the fleetd#164 MIN_TURN_NANOS floor -------------
+
+    @Test
+    void aMatchingErrorInsideTheFloorIsTypedAndNotifiesTheSink() {
+        FakeHerdr herdr = new FakeHerdr().readText("⏺ 503 Service Unavailable: upstream credential rejected\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        long[] clock = {10_000_000_000L};
+        BackendErrorPatternLookup patterns = target -> Pattern.compile("(?i)503 Service Unavailable");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        BackendErrorSink sink = (target, matchedLine, reason) -> notified.add(target + ": " + matchedLine);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), patterns, sink, () -> clock[0]);
+
+        var waiter = rendezvous.open("term_a");
+        var turn = new CompletionResolver.InFlight(waiter, null, clock[0]); // delivered "now"
+        clock[0] += CompletionResolver.MIN_TURN_NANOS - 1; // inside the floor
+
+        resolver.resolve("term_a", turn);
+
+        assertTrue(waiter.isDone());
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind());
+        assertEquals(1, notified.size(), "a matching error inside the floor notifies the sink");
+        assertTrue(notified.get(0).contains("503 Service Unavailable"), notified.get(0));
+    }
+
+    @Test
+    void aNonMatchInsideTheFloorStaysGenericAndNeverNotifiesTheSink() {
+        FakeHerdr herdr = new FakeHerdr().readText("⏺ still starting up\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        long[] clock = {10_000_000_000L};
+        BackendErrorPatternLookup patterns = target -> Pattern.compile("(?i)503 Service Unavailable");
+        java.util.List<String> notified = new java.util.ArrayList<>();
+        BackendErrorSink sink = (target, matchedLine, reason) -> notified.add(target + ": " + matchedLine);
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), patterns, sink, () -> clock[0]);
+
+        var waiter = rendezvous.open("term_a");
+        var turn = new CompletionResolver.InFlight(waiter, null, clock[0]); // delivered "now"
+        clock[0] += CompletionResolver.MIN_TURN_NANOS - 1; // inside the floor
+
+        resolver.resolve("term_a", turn);
+
+        assertTrue(waiter.isDone());
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "still a failure — the floor itself, not the pattern, is why");
+        assertTrue(waiter.getNow(null).text().contains("too fast to be real work"),
+                "a non-match inside the floor stays the generic too-fast reason: " + waiter.getNow(null).text());
+        assertTrue(notified.isEmpty(), "a non-match must never notify the typed sink");
+    }
 }
@@ -0,0 +1,41 @@
+package dev.ltms.fleet.inject;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * fleetd #234. Round 3: calls the REAL production factory, {@link ExhaustionSink#forwardingTo},
+ * rather than rebuilding its shape locally — a round-2 version of this test built its own copy of
+ * the forwarder inline, so mutating {@code Fleetd.java}'s actual forwarder back into a lambda left
+ * that copy untouched and the test kept passing while production had regressed. Calling the shared
+ * factory here means the same object under test IS the object {@code Fleetd.java} builds via
+ * {@code ExhaustionSink.forwardingTo(exhaustionSinkRef::get)}.
+ *
+ * <p>Round 4: the 3-arg overload is now {@link ExhaustionSink}'s single abstract method, so {@code
+ * forwardingTo} itself is a one-line lambda and every sink below can safely be one too — there is
+ * no 2-arg overload left for any of them to silently bind to instead. This test still catches a
+ * regression inside {@code forwardingTo}'s body (e.g. one that calls the 2-arg default and drops
+ * the hint that way) because it still goes through the shared factory rather than a rebuilt copy.
+ */
+class ExhaustionSinkForwardingHazardTest {
+
+    @Test
+    void forwardingToDeliversTheProfileHintToWhateverSinkTheSupplierCurrentlyReturns() {
+        AtomicReference<String> hintSeenByRealSink = new AtomicReference<>("NEVER CALLED");
+        ExhaustionSink real = (target, reason, profileHint) -> hintSeenByRealSink.set(profileHint);
+
+        // Same shape Fleetd.java uses: a reference that starts at none() and is repointed later.
+        AtomicReference<ExhaustionSink> ref = new AtomicReference<>(ExhaustionSink.none());
+        ExhaustionSink forwarding = ExhaustionSink.forwardingTo(ref::get);
+        ref.set(real);
+
+        forwarding.onExhausted("term_x", "model mismatch", "gx");
+
+        assertEquals("gx", hintSeenByRealSink.get(),
+                "ExhaustionSink.forwardingTo must deliver the profile hint to the sink the supplier "
+                        + "currently returns — the exact object Fleetd.java's forwarder is built from");
+    }
+}
@@ -1,10 +1,13 @@
 package dev.ltms.fleet.mcp;

+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.auth.Principal;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.PaneLocator;
 import dev.ltms.fleet.herdr.WorkspaceControl;
 import dev.ltms.fleet.inject.Injector;
 import dev.ltms.fleet.msg.MessageService;
@@ -1024,6 +1027,87 @@ class FleetMcpTest {
        assertTrue(textOf(res).contains("architect, dev, reviewer"), textOf(res));
    }

+    // ── CB-619 / fleetd #123: a spawn asking for a role its profile has no slot for must be
+    //    refused, never silently demoted with the roster still lying about it ───────────────────
+
+    /** Two profiles on one launcher, so a role's pool can name one and exclude the other. */
+    private static ClaudeCodeLauncher architectCapableLauncher(FakeHerdr h) {
+        FleetConfig.Profile opus = new FleetConfig.Profile(
+                "opus", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        FleetConfig.Profile sonnet = new FleetConfig.Profile(
+                "sonnet", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        return new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of("opus", opus, "sonnet", sonnet),
+                "sonnet", _ -> "tok");
+    }
+
+    /** {@code fleet.architects} carries only {@code opus} — {@code sonnet} has no matching slot. */
+    private static MemberRegistry architectRegistry() {
+        return new MemberRegistry(new FleetConfig.Fleet(Map.of(),
+                Map.of("opus", new FleetConfig.Slot("opus")), Map.of(), Map.of(), null));
+    }
+
+    /**
+     * The literal defect (fleetd #123): {@code role=architect, profile=sonnet}, where
+     * {@code fleet.architects} carries only {@code opus}. Drives the real path —
+     * {@link FleetMcp#spawn} calls {@link SessionManager#acquire}, which must refuse before ever
+     * reaching the real {@link ClaudeCodeLauncher} — never {@link MemberRegistry#bind} called
+     * directly, which would walk around the gate under test.
+     */
+    @Test
+    void spawnRefusesAnArchitectWithNoMatchingSlotAndNeverTouchesTheLauncher() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(architectCapableLauncher(h));
+        sessions.setMemberLifecycle(architectRegistry());
+
+        McpSchema.CallToolResult res = FleetMcp.spawn(sessions, "sonnet", "architect",
+                null, null, null, null, null, null);
+
+        assertEquals(Boolean.TRUE, res.isError(), textOf(res));
+        String msg = textOf(res);
+        assertTrue(msg.contains("architect"), "names the role asked for: " + msg);
+        assertTrue(msg.contains("sonnet"), "names the profile: " + msg);
+        assertTrue(msg.contains("opus"), "names the pool that does carry the role: " + msg);
+        assertTrue(sessions.roster().isEmpty(), "a refused spawn must register no session");
+        assertTrue(h.calls.stream().noneMatch(c -> c.method().equals("agent.start")),
+                "a refused spawn must never reach the launcher — no process should ever start");
+    }
+
+    /**
+     * Positive control / parity check: when the profile DOES carry a slot, the spawn succeeds, and
+     * {@code GET /members} ({@link FleetMcp#listFleet}) and {@code fleet_whoami}
+     * ({@link FleetMcp#whoami}) — resolved through the SAME live {@link MemberRegistry} binding via
+     * a real {@link CallerResolver}, exactly as the daemon resolves a real MCP caller — must never
+     * disagree about this one live member's role.
+     */
+    @Test
+    void rosterAndWhoamiAgreeOnceTheArchitectSlotBinds() {
+        FakeHerdr h = new FakeHerdr();
+        // Pin the spawn onto the one pane FakeHerdr's canned pane.process_info maps to WORKER_PID,
+        // so a CallerResolver can resolve THIS session's own terminal, not a fixture double.
+        h.pinNextStarts(1, "term_a", "w2:p7");
+        SessionManager sessions = new SessionManager(architectCapableLauncher(h));
+        MemberRegistry members = architectRegistry();
+        sessions.setMemberLifecycle(members);
+
+        McpSchema.CallToolResult spawnRes = FleetMcp.spawn(sessions, "opus", "architect",
+                null, null, null, null, null, null);
+        assertNotEquals(Boolean.TRUE, spawnRes.isError(), textOf(spawnRes));
+        assertTrue(textOf(spawnRes).contains("\"role\":\"architect\""), textOf(spawnRes));
+
+        String roster = textOf(FleetMcp.listFleet(architectCapableLauncher(h), sessions, Map.of(), ""));
+        assertTrue(roster.contains("\"role\":\"architect\""), "GET /members: " + roster);
+
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(h), _ -> FakeHerdr.WORKER_PID);
+        CallerResolver resolver = CallerResolver.withLeadsAndMembers(identity, false, null, Map::of, members);
+        Principal caller = resolver.resolve("127.0.0.1", 42, null);
+        assertTrue(caller.isArchitect(), "fleet_whoami's own resolver must agree the terminal is bound");
+        String whoami = textOf(FleetMcp.whoami(caller, sessions));
+        assertTrue(whoami.contains("\"role\":\"architect\""), "fleet_whoami: " + whoami);
+    }
+
    // ── CB-584: fleet_spawn accepts sessionName/resumeSessionId; roster shows agentSessionId ──

    @Test
@@ -20,8 +20,10 @@ import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.LoggerFactory;

+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -31,6 +33,7 @@ import java.util.function.Function;
 import java.util.function.Supplier;

 import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;

 /** The step-4 launch-flag injection: the bridge MCP + reply charter are appended to the argv. */
 class ClaudeCodeLauncherTest {
@@ -61,8 +64,75 @@ class ClaudeCodeLauncherTest {
        assertTrue(args.stream().noneMatch(a -> a.contains("\"bridge\"")),
                "the mount is named fleet since CB-632 — a member addresses its tools as "
                        + "mcp__fleet__*, and CLAUDE.md's role-detection ladder names that prefix");
-        assertTrue(args.contains("--append-system-prompt"));
-        assertTrue(args.stream().anyMatch(a -> a.contains("fleet_reply")), "reply charter present");
+        // fleetd #220: the charter travels as a FILE, never inline — charter prose on the command
+        // line overruns the byte cap of the pane line herdr types it into.
+        assertTrue(args.contains("--append-system-prompt-file"));
+        assertFalse(args.contains("--append-system-prompt"),
+                "the inline flag would put ~800 bytes of prose on the pane command line");
+        String charterFile = args.get(args.indexOf("--append-system-prompt-file") + 1);
+        assertTrue(readFile(charterFile).contains("fleet_reply"), "reply charter present in the file");
+    }
+
+    /** Read a charter file the launcher wrote, failing the test rather than the build on an IO error. */
+    private static String readFile(String path) {
+        try {
+            return java.nio.file.Files.readString(java.nio.file.Path.of(path));
+        } catch (java.io.IOException e) {
+            throw new AssertionError("charter file " + path + " is not readable", e);
+        }
+    }
+
+    /**
+     * fleetd #220 regression. herdr TYPES the launch command into the pane, and the pty line buffer
+     * holds 1024 bytes — past that the tail is dropped with no error anywhere, so the backend exits
+     * on a mangled argument and the spawn dies as an unexplained readiness timeout. That is what
+     * happened when #214 added --session-id to a command already 978 bytes long: --autocompact
+     * 250000 arrived as --autocompact 25. This asserts the whole assembled command still fits, with
+     * the flags a real spawn carries (MCP mount, charter, model, autocompact, session id).
+     */
+    @Test
+    void theAssembledLaunchCommandFitsThePaneLineLimit() {
+        FakeHerdr herdr = new FakeHerdr();
+        // Shaped like the live sonnet profile, because the bug is a SUM: the charter alone fits,
+        // and so does every flag alone. Only model + autocompact + session id on top of the charter
+        // crossed the cap, which is why nothing caught it until a member failed to spawn.
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "sonnet", null, "claude-sonnet-5", null, null,
+                List.of("claude"), "tab", "fleetd-workers", "w #{n}", "http://127.0.0.1:8765/mcp",
+                null, null, null, null, null, null, null, null, true, null, null, null, null, null,
+                250000);
+        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of()), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null)
+                .spawn();
+
+        List<String> args = spawnedArgs(herdr);
+        int bytes = "claude".length();
+        for (String arg : args) {
+            bytes += arg.getBytes(java.nio.charset.StandardCharsets.UTF_8).length + 3;
+        }
+        assertTrue(bytes <= HerdrPeerLauncher.PANE_COMMAND_BYTE_LIMIT,
+                "the launch command must fit the pane line: " + bytes + " bytes vs limit "
+                        + HerdrPeerLauncher.PANE_COMMAND_BYTE_LIMIT + " — args " + args);
+    }
+
+    /**
+     * fleetd #220: the guard refuses a command that cannot fit, instead of letting the pty drop the
+     * tail. The refusal must name the size and the argument to blame — a spawn that fails with
+     * "did not reach injectable state" tells the operator nothing, which is the whole reason this
+     * bug took a live pane scrape to find.
+     */
+    @Test
+    void anOverlongLaunchCommandIsRefusedWithTheSizeAndTheCulprit() {
+        FakeHerdr herdr = new FakeHerdr();
+        String huge = "x".repeat(1500);
+        ClaudeCodeLauncher launcher = service(herdr, List.of("claude", huge), null);
+
+        PeerUnreachableException refused = assertThrows(PeerUnreachableException.class, launcher::spawn);
+
+        assertTrue(refused.getMessage().contains("1024"), "names the limit: " + refused.getMessage());
+        assertTrue(refused.getMessage().contains("1500"), "names the culprit's size: " + refused.getMessage());
+        assertFalse(herdr.called("agent.start"),
+                "nothing may be started — a truncated command is worse than no spawn");
    }

    // CB-634: a profile with ideMcpUrl set mounts the IDE Index MCP as a second server and pins
@@ -262,10 +332,16 @@ class ClaudeCodeLauncherTest {

        Map<?, ?> start = (Map<?, ?>) herdr.lastCall("agent.start").params();
        assertEquals("claude", start.get("kind"), "herdr launches the canonical executable by kind");
-        // CB-533: the shared fixture pins model "coder", so the model flag is the whole args list.
        // What this test guards is that argv[0] is NOT repeated — herdr supplies it from `kind`.
-        assertEquals(List.of("--model", "coder"), start.get("args"),
-                "the configured executable is not repeated in args");
+        // fleetd #214: a plain spawn now also carries fleetd's own minted session id.
+        List<String> args = spawnedArgs(herdr);
+        assertFalse(args.contains("claude"), "the configured executable is not repeated in args");
+        int flag = args.indexOf("--session-id");
+        assertTrue(flag >= 0, "a plain spawn mints a session id: " + args);
+        assertDoesNotThrow(() -> UUID.fromString(args.get(flag + 1)), "the minted id is a valid UUID");
+        assertEquals(List.of("--model", "coder"),
+                List.of(args.get(args.size() - 2), args.get(args.size() - 1)),
+                "the CB-533 model flag still trails the launch flags: " + args);
    }

    @Test
@@ -278,7 +354,15 @@ class ClaudeCodeLauncherTest {
        assertFalse(args.contains("--append-system-prompt"), "no reply charter without mcpUrl");
        // CB-533: the model flag is independent of the MCP mount — pinning the model is not part of
        // "mount the bridge", so an unmounted worker still runs the model its profile names.
-        assertEquals(List.of("--verbose", "--model", "coder"), args,
+        // fleetd #214: a plain spawn now carries fleetd's own minted session id; drop the two
+        // mint elements when checking the rest of the argv.
+        int flag = args.indexOf("--session-id");
+        assertTrue(flag >= 0, "a plain spawn mints a session id even without a bridge mount: " + args);
+        assertDoesNotThrow(() -> UUID.fromString(args.get(flag + 1)), "the minted id is a valid UUID");
+        List<String> rest = new java.util.ArrayList<>(args);
+        rest.remove(flag + 1);
+        rest.remove(flag);
+        assertEquals(List.of("--verbose", "--model", "coder"), rest,
                "the operator's own args are preserved, in order, ahead of the model flag");
    }

@@ -499,6 +583,24 @@ class ClaudeCodeLauncherTest {
        assertNull(env.get("GITEA_HOST"), "no forge host without a granted token");
    }

+    @Test
+    void noTokenEnvSpawnsWithoutInjectingAnAuthToken() {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "local-direct", "http://gx00.gw:8000", "coder", null, null,
+                List.of("claude"), "tab", "fleetd-workers", "w #{n}", null, null, null);
+        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), System::getenv);
+
+        assertDoesNotThrow(() -> {
+                    launcher.spawn();
+                },
+                "a profile that needs no token must still spawn against its configured endpoint");
+        Map<String, String> env = startEnv(herdr);
+        assertFalse(env.containsKey("ANTHROPIC_AUTH_TOKEN"),
+                "an unconfigured tokenEnv must not inject an auth-token key");
+    }
+
    // --- CB-117 orphan reap: the pure predicate --------------------------------

    @Test
@@ -649,7 +751,7 @@ class ClaudeCodeLauncherTest {
        assertEquals("/work/proj", cwd, "effectiveCwd via SpawnRequest must match the three-arg resolution");
    }

-    // --- CB-547a: durable session identity (mint / resume / no-identity legacy) -----------------
+    // --- CB-547a / fleetd #214: durable session identity (always mint / resume) -----------------

    @Test
    void freshSpawnMintsASessionIdAndPassesTheName() {
@@ -684,18 +786,28 @@ class ClaudeCodeLauncherTest {
    }

    @Test
-    void noIdentitySpawnKeepsTheLegacyArgvAndCarriesNoSessionHandle() {
+    void plainSpawnMintsASessionIdSoEveryMemberIsResumable() {
+        // fleetd #214: a plain spawn passes no sessionName and no resumeSessionId, yet the member
+        // must still be resumable — the id is minted unconditionally, and it is the ONLY resume
+        // handle a claude-code member has (unlike opencode, nothing resolves it after the launch).
+        // The binary requires a valid UUID (checked against claude 2.1.252: a non-UUID is refused
+        // at argument parsing with "Invalid session ID. Must be a valid UUID.").
        FakeHerdr herdr = new FakeHerdr();
        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);

        PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, null));

        List<String> args = spawnedArgs(herdr);
-        assertFalse(args.contains("--session-id"), "no identity → no --session-id");
-        assertFalse(args.contains("-n"), "no identity → no -n");
-        assertFalse(args.contains("-r"), "no identity → no -r");
-        assertNull(handle.agentSessionId(), "no identity → no resume handle");
-        assertNull(handle.sessionName(), "no identity → no logical name");
+        int flag = args.indexOf("--session-id");
+        assertTrue(flag >= 0 && flag + 1 < args.size(),
+                "--session-id is minted even when no identity is requested: " + args);
+        String minted = args.get(flag + 1);
+        assertDoesNotThrow(() -> UUID.fromString(minted), "--session-id is a valid UUID: " + minted);
+        assertEquals(minted, handle.agentSessionId(),
+                "the resume handle is the minted id, so every member is resumable from fleet_list");
+        assertFalse(args.contains("-n"), "no sessionName was requested → no -n");
+        assertFalse(args.contains("-r"), "no resume was requested → no -r");
+        assertNull(handle.sessionName(), "no sessionName was requested → no logical name");
    }

    @Test
@@ -869,6 +981,152 @@ class ClaudeCodeLauncherTest {
        assertDoesNotThrow(() -> UUID.fromString(handle.id()));
    }

+    // --- fleetd #176 fix 1: fail fast when the backend process exits mid-wait -------------------
+
+    @Test
+    void spawnFailsFastWhenBackendProcessExitsMidWaitInsteadOfBurningTheTimeout() {
+        // First agent.get sees UNKNOWN (one normal tick); the second reports the pane gone, exactly
+        // what herdr answers when the backend process has already exited. The timeout is generous
+        // (60s) so a test that wrongly falls through to the old unguarded call — and therefore
+        // waits out the whole window — is unambiguously distinguishable from one that fails fast.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown");
+        herdr.agentGetFailsWithAfter(1, "pane_not_found");
+        long[] clock = {0};
+
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                60_000, () -> clock[0], () -> clock[0] += 50);
+
+        PeerUnreachableException ex = assertThrows(
+                PeerUnreachableException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertTrue(ex.getMessage().contains("w9:pRoot_1"),
+                "exception message references the paneId: " + ex.getMessage());
+        assertTrue(ex.getMessage().toLowerCase().contains("exited"),
+                "exception message says the backend exited, not that the pane was slow: "
+                        + ex.getMessage());
+        assertTrue(clock[0] < 60_000,
+                "the gate must not burn the rest of the 60s timeout: clock only reached " + clock[0]);
+        long getCalls = herdr.calls.stream().filter(c -> c.method().equals("agent.get")).count();
+        assertEquals(2, getCalls,
+                "exactly one normal poll then the not_found answer — no further polling after that: "
+                        + getCalls);
+        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_1"),
+                "the pane is torn down (no orphan) even on the fail-fast path");
+    }
+
+    @Test
+    void spawnLetsAnUnrelatedHerdrErrorPropagateUnchanged() {
+        // Fix 1 must only special-case a "*_not_found" answer. Any other herdr failure keeps
+        // propagating as-is — this gate does not know how to recover from it.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown");
+        herdr.agentGetFailsWithAfter(0, "internal_error");
+        long[] clock = {0};
+
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                60_000, () -> clock[0], () -> clock[0] += 50);
+
+        dev.ltms.fleet.herdr.HerdrException ex = assertThrows(
+                dev.ltms.fleet.herdr.HerdrException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertEquals("internal_error", ex.code());
+        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
+                "an error this gate does not recognize is not this gate's teardown to run");
+    }
+
+    // --- fleetd #176 fix 2: corroborated UNKNOWN refinement --------------------------------------
+
+    @Test
+    void refinedIdleIsNotAcceptedWhenAgentTypeIsNull() {
+        // The trap fix 2 must close: a pane sitting at a bare shell prompt after its backend exited
+        // still contains the same "❯" glyph StatusRefiner.classify treats as "idle at the Claude
+        // Code TUI prompt". Without the agentType corroboration this would be misread as injectable
+        // and the gate would hand back a peer that never started. herdr reports no agentType for
+        // that bare shell.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown"); // always UNKNOWN
+        herdr.agentType(null);        // no supported backend detected — could be a bare shell
+        herdr.readText("some-host:~ user$ ❯ "); // looks exactly like an idle Claude Code prompt
+        long[] clock = {0};
+
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                500, () -> clock[0], () -> clock[0] += 50);
+
+        PeerUnreachableException ex = assertThrows(
+                PeerUnreachableException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertTrue(clock[0] >= 500,
+                "a null agentType must not let the '❯' prompt refine to injectable — the gate has "
+                        + "to wait out the full timeout: clock only reached " + clock[0]);
+        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_1"),
+                "the pane is torn down on timeout, same as any other never-injectable spawn");
+    }
+
+    @Test
+    void refinedIdleIsAcceptedWhenAgentTypeCorroboratesLiveness() {
+        // The positive case: a genuinely live claude pane that herdr misreports as UNKNOWN (CB-115)
+        // still resolves to injectable once agentType corroborates that a supported backend is
+        // detected in the same sample.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown"); // always UNKNOWN at the raw level
+        herdr.agentType("claude");    // herdr still detects a live claude backend
+        herdr.readText("? for shortcuts"); // StatusRefiner.classify's idle footer marker
+        long[] clock = {0};
+
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                60_000, () -> clock[0], () -> clock[0] += 50);
+
+        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
+
+        assertNotNull(handle, "a corroborated refined-IDLE sample lets the spawn succeed");
+        assertTrue(clock[0] < 60_000,
+                "refinement must resolve well before the timeout: clock reached " + clock[0]);
+        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
+                "no pane close — the peer is genuinely injectable");
+    }
+
+    @Test
+    void refinementNeverFiresWhenRawStatusIsAlreadyInjectable() {
+        // Acceptance criterion 4: refinement must trigger only on a raw UNKNOWN sample. Seed the
+        // pane content with an active-generation marker that StatusRefiner.classify would read as
+        // WORKING (never injectable) if refine() were wrongly invoked here — proving that a raw
+        // IDLE status short-circuits before refine() (and its extra agent.read call) ever runs.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("idle"); // already injectable at the raw level
+        herdr.agentType("claude");
+        herdr.readText("esc to interrupt"); // would classify as WORKING if refine() ran anyway
+
+        long[] clock = {0};
+        ClaudeCodeLauncher gated = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                5000, () -> clock[0], () -> clock[0] += 300);
+
+        PeerHandle handle = gated.spawn(new SpawnRequest(null, null, null));
+
+        assertNotNull(handle, "an already-injectable raw status succeeds without ever refining");
+        assertFalse(herdr.called("agent.read"),
+                "refine() must never run (and so never call agent.read) when the raw status is "
+                        + "already injectable");
+    }
+
    // --- CB-511: worker environment seeding -----------------------------------------------------

    @Test
@@ -1660,4 +1918,184 @@ class ClaudeCodeLauncherTest {

        assertEquals(List.of("dev: sonnet #1", "[sonnet] dev 2"), tabLabels(herdr));
    }
+
+    // ── fleetd #222: the charter file must not land under fleetd's own java.io.tmpdir when the ──
+    // ── member pane runs as a different OS user ─────────────────────────────────────────────────
+
+    /** A profile that mounts the bridge MCP (so a reply charter is always generated). */
+    private static FleetConfig.Profile charterCfg() {
+        return new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("claude"), "tab", "fleetd-workers", "worker: {profile} #{n}",
+                "http://127.0.0.1:8765/mcp", null, null);
+    }
+
+    /** A config with {@code memberHerdrSocket:} set, and optionally {@code worktreeRoot:}/{@code worktreeGroup:}. */
+    private static FleetConfig configWithMemberHerdrSocket(String worktreeRoot, String worktreeGroup) {
+        return new FleetConfig(
+                null,                    // bind
+                null,                    // herdrSocket
+                "/tmp/other-user.sock",  // memberHerdrSocket
+                Map.of(),                // profiles
+                null,                    // guard
+                worktreeRoot,            // worktreeRoot
+                null,                    // lifecycle
+                null,                    // spawnReadyTimeoutMs
+                null,                    // spawnReadyPollMs
+                null,                    // broker
+                null,                    // primary
+                null,                    // fleet
+                null,                    // leadHeartbeat
+                null,                    // health
+                null,                    // placement
+                null,                    // auth
+                null,                    // configReload
+                null,                    // quarantineCooldownSeconds
+                null,                    // memberCredentials
+                null,                    // coordinator
+                worktreeGroup,           // worktreeGroup
+                null                     // memberLoginShell
+        ).withDefaults();
+    }
+
+    private static ClaudeCodeLauncher serviceWithConfig(FakeHerdr herdr, FleetConfig.Profile cfg,
+                                                          Supplier<FleetConfig> config) {
+        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
+                0, System::currentTimeMillis, () -> { }, null, null, null, config);
+    }
+
+    /**
+     * The current process's REAL primary group — resolved via {@code id -gn}, never by reading a
+     * directory's owning group (fleetd #225). Those two coincide only by accident: a directory's
+     * group is whichever group happened to own the path Maven was started from — {@code staff} in
+     * a home checkout, {@code wheel} under {@code /private/tmp} on macOS — and the fix-up this test
+     * exercises then fails for real when the operator is not a member of that borrowed group,
+     * exactly the case {@code assumeTrue(view != null, ...)} never covered (it only detects a
+     * filesystem with no POSIX groups at all, not a resolvable-but-wrong one). Skips (never fails)
+     * when {@code id} is unavailable or its primary group cannot be resolved on this host.
+     */
+    private static String currentUserGroup() {
+        String out;
+        boolean ok;
+        try {
+            Process p = new ProcessBuilder("id", "-gn").redirectErrorStream(true).start();
+            try (java.io.BufferedReader r = new java.io.BufferedReader(
+                    new java.io.InputStreamReader(p.getInputStream(), java.nio.charset.StandardCharsets.UTF_8))) {
+                out = r.lines().collect(java.util.stream.Collectors.joining("\n")).trim();
+            }
+            ok = p.waitFor(5, java.util.concurrent.TimeUnit.SECONDS) && p.exitValue() == 0 && !out.isBlank();
+        } catch (IOException e) {
+            out = null;
+            ok = false;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            out = null;
+            ok = false;
+        }
+        assumeTrue(ok, "cannot resolve this process's real primary group via `id -gn` on this host "
+                + "— skipping a POSIX-group-dependent test rather than failing it");
+        return out;
+    }
+
+    /**
+     * fleetd #222 acceptance criterion 1: with {@code memberHerdrSocket} configured and both
+     * {@code worktreeRoot}/{@code worktreeGroup} set, the charter file lives in a fresh per-spawn
+     * directory under {@code worktreeRoot} — NEVER under {@code java.io.tmpdir} (fleetd's own 0700
+     * temp dir, unreadable by the member's different OS user) — and that directory is shared
+     * read-only with the group via the SAME mechanism (fleetd #213/#219's {@link
+     * EnvAllowListScrub#shareWithGroup}) the ZDOTDIR scrub and the opencode config directory use.
+     */
+    @Test
+    void memberHerdrSocketWithWorktreeRootAndGroupPutsCharterUnderWorktreeRootAndSharesIt(
+            @TempDir Path worktreeRoot) throws Exception {
+        String group = currentUserGroup();
+        FakeHerdr herdr = new FakeHerdr();
+        serviceWithConfig(herdr, charterCfg(),
+                () -> configWithMemberHerdrSocket(worktreeRoot.toString(), group)).spawn();
+
+        List<String> args = spawnedArgs(herdr);
+        int fileFlag = args.indexOf("--append-system-prompt-file");
+        assertTrue(fileFlag >= 0, "the charter is still mounted via file: " + args);
+        Path charterFile = Path.of(args.get(fileFlag + 1));
+        Path dir = charterFile.getParent();
+
+        // NOTE: JUnit's own @TempDir provider places worktreeRoot itself under java.io.tmpdir on this
+        // host, so "not under java.io.tmpdir" is not a meaningful assertion here (it would hold by
+        // accident of the fixture, not by anything this method does). What this fix actually promises
+        // is that the directory is created UNDER worktreeRoot specifically — never resolved from the
+        // no-argument Files.createTempFile default (java.io.tmpdir) the pre-fix code always used — so
+        // that is the assertion: the parent is exactly worktreeRoot, whatever directory JUnit gave it.
+        assertEquals(worktreeRoot.toAbsolutePath().normalize(), dir.getParent(),
+                "the generated directory's parent must be worktreeRoot, not java.io.tmpdir — got "
+                        + "parent " + dir.getParent());
+
+        assertEquals("rwxr-x---", PosixFilePermissions.toString(Files.getPosixFilePermissions(dir)),
+                "the directory must be group-traversable+readable, owner-only writable");
+        assertEquals("rw-r-----", PosixFilePermissions.toString(Files.getPosixFilePermissions(charterFile)),
+                "the charter file must be group-readable, never group-writable");
+        assertTrue(Files.readString(charterFile).contains("fleet_reply"),
+                "the charter content itself is unaffected by where it is written");
+    }
+
+    /**
+     * fleetd #222 acceptance criterion 2: with {@code memberHerdrSocket} configured but NEITHER
+     * {@code worktreeRoot} nor {@code worktreeGroup} set, the launcher must refuse the spawn rather
+     * than hand the member a {@code --append-system-prompt-file} path under {@code java.io.tmpdir}
+     * it cannot read — the member's whole turn contract would never reach it.
+     */
+    @Test
+    void memberHerdrSocketWithoutWorktreeRootOrGroupRefusesTheSpawn() {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher launcher = serviceWithConfig(herdr, charterCfg(),
+                () -> configWithMemberHerdrSocket(null, null));
+
+        IllegalStateException ex = assertThrows(IllegalStateException.class, launcher::spawn,
+                "a missing worktreeRoot/worktreeGroup must refuse the spawn, not write an unreadable charter");
+        assertTrue(ex.getMessage().contains("worktreeRoot"),
+                "the refusal must name the missing config key — got: " + ex.getMessage());
+        assertFalse(herdr.called("agent.start"),
+                "the spawn must be refused BEFORE the member is ever started — got calls: " + herdr.calls);
+    }
+
+    /**
+     * fleetd #222 acceptance criterion 2 (the other missing half): {@code worktreeRoot} set but
+     * {@code worktreeGroup} missing must ALSO refuse — either one alone is not enough to guarantee
+     * the member's OS user can read the charter file.
+     */
+    @Test
+    void memberHerdrSocketWithWorktreeRootButNoGroupRefusesTheSpawn(@TempDir Path worktreeRoot) {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher launcher = serviceWithConfig(herdr, charterCfg(),
+                () -> configWithMemberHerdrSocket(worktreeRoot.toString(), null));
+
+        IllegalStateException ex = assertThrows(IllegalStateException.class, launcher::spawn);
+        assertTrue(ex.getMessage().contains("worktreeGroup"),
+                "worktreeRoot alone is not enough — got: " + ex.getMessage());
+    }
+
+    /**
+     * fleetd #222 acceptance criterion 3: with {@code memberHerdrSocket} ABSENT — even when a live,
+     * non-null {@code config} supplier is threaded through (not merely {@code config == null}, which
+     * every other test in this file already exercises) — the charter file must still be created
+     * directly under {@code java.io.tmpdir} via the same no-directory-argument
+     * {@code Files.createTempFile} call as before this fix, byte-identical to today.
+     */
+    @Test
+    void memberHerdrSocketAbsentStaysUnderJavaIoTmpdirEvenWithALiveConfigSupplier() throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig config = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null, null, null).withDefaults();
+        serviceWithConfig(herdr, charterCfg(), () -> config).spawn();
+
+        List<String> args = spawnedArgs(herdr);
+        int fileFlag = args.indexOf("--append-system-prompt-file");
+        assertTrue(fileFlag >= 0);
+        Path charterFile = Path.of(args.get(fileFlag + 1));
+        assertTrue(charterFile.startsWith(Path.of(System.getProperty("java.io.tmpdir"))),
+                "with memberHerdrSocket absent, the charter file must still land directly under "
+                        + "java.io.tmpdir, unchanged from before this fix");
+        assertTrue(charterFile.getFileName().toString().startsWith("fleetd-role-charter-"),
+                "same file-naming scheme as before this fix (no wrapping directory): " + charterFile);
+    }
 }
@@ -114,6 +114,68 @@ class EnvAllowListScrubTest {
        assertNull(EnvAllowListScrub.readReport(dir));
    }

+    /**
+     * fleetd #224 criterion 5 (a gap the #221 reviewer flagged): {@link EnvAllowListScrub#shareWithGroup}
+     * lists one FLAT level of {@code dir} and shares every file it finds there — which does cover the
+     * OPTIONAL files a caller may or may not have written before calling it ({@code member-charter.md},
+     * {@code ide-rules.md} — both written by {@code OpenCodeLauncher#writeConfig}), but nothing
+     * pinned that down.
+     * Without this test, a future change that writes a file AFTER the sharing call, or into a
+     * subdirectory, would pass every existing test while quietly leaving that file unreadable to a
+     * different-uid member.
+     *
+     * <p>This drives {@code shareWithGroup} directly against a directory holding several flat files —
+     * not only {@code opencode.json}, but also the two optional ones named above plus a third,
+     * unrelated file, so the assertion is "every flat file", not "the two files someone thought of".
+     */
+    @Test
+    void shareWithGroupCoversEveryFlatFileIncludingTheOptionalOnes(@TempDir Path dir) throws Exception {
+        String group = currentUserGroup();
+        Files.writeString(dir.resolve("opencode.json"), "{}\n");
+        Files.writeString(dir.resolve("member-charter.md"), "# charter\n");
+        Files.writeString(dir.resolve("ide-rules.md"), "# ide rules\n");
+        Files.writeString(dir.resolve("another-flat-file.txt"), "unrelated\n");
+
+        EnvAllowListScrub.shareWithGroup(dir, group);
+
+        assertEquals("rwxr-x---", java.nio.file.attribute.PosixFilePermissions.toString(
+                        Files.getPosixFilePermissions(dir)),
+                "the directory itself must be group-traversable+readable, owner-only writable");
+        for (String name : List.of("opencode.json", "member-charter.md", "ide-rules.md", "another-flat-file.txt")) {
+            Path file = dir.resolve(name);
+            assertEquals("rw-r-----", java.nio.file.attribute.PosixFilePermissions.toString(
+                            Files.getPosixFilePermissions(file)),
+                    name + " must be group-readable, never group-writable");
+        }
+    }
+
+    /**
+     * The current process's REAL primary group — resolved via {@code id -gn}, never by reading a
+     * directory's owning group (fleetd #225: that reads wherever Maven happened to be started from,
+     * not the process's own group, and the two diverge outside a home checkout). Skips (never fails)
+     * when {@code id} is unavailable or its primary group cannot be resolved on this host.
+     */
+    private static String currentUserGroup() {
+        String out;
+        boolean ok;
+        try {
+            Process p = new ProcessBuilder("id", "-gn").redirectErrorStream(true).start();
+            String raw = new String(p.getInputStream().readAllBytes(), StandardCharsets.UTF_8).trim();
+            out = raw;
+            ok = p.waitFor(5, java.util.concurrent.TimeUnit.SECONDS) && p.exitValue() == 0 && !raw.isBlank();
+        } catch (IOException e) {
+            out = null;
+            ok = false;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            out = null;
+            ok = false;
+        }
+        assumeTrue(ok, "cannot resolve this process's real primary group via `id -gn` on this host "
+                + "— skipping a POSIX-group-dependent test rather than failing it");
+        return out;
+    }
+
    /**
     * The same equality, for a shell that is INTERACTIVE but NOT a login shell — the shape herdr
     * opens on Linux.
@@ -12,20 +12,25 @@ import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.SpawnRequest;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.LoggerFactory;

+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.Function;
 import java.util.function.Supplier;

 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;

 /**
 * CB-633: proves the allow-list scrub is actually WIRED INTO the spawn path — not merely that its
@@ -119,6 +124,18 @@ class HerdrPeerLauncherAllowListWiringTest {
                FleetConfig.MemberCredentials.POLICY_ALLOW_LIST, allow, List.of(), null);
    }

+    /**
+     * Same as {@link #allowList()} but with an operator-configured {@code known:} list, so the
+     * fallback overlay (the non-zsh / no-memberLoginShell path) has something visible to shadow —
+     * {@link FleetConfig.MemberCredentials#blockedSet()} is {@code known - allow}, so an empty
+     * {@code known} (what {@link #allowList()} uses) blocks nothing and a fallback test would have
+     * no sentinel entry to assert on.
+     */
+    private static Supplier<FleetConfig.MemberCredentials> allowListWithKnown(List<String> known) {
+        return () -> new FleetConfig.MemberCredentials(
+                FleetConfig.MemberCredentials.POLICY_ALLOW_LIST, List.of(), known, null);
+    }
+
    /**
     * CB-633 follow-up: a name that lives ONLY in {@code memberCredentials.allow:} — no profile
     * mentions it — must survive the scrub the real spawn path generates. Calling {@code
@@ -257,6 +274,294 @@ class HerdrPeerLauncherAllowListWiringTest {
                        + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
    }

+    /**
+     * fleetd #185 stage 2 pin: with {@code memberHerdrSocket:} absent (today's only mode, and the
+     * default — this host runs no other), the gap detector's WARN/INFO conclusions read exactly as
+     * they did before this fix. Real path: {@code FLEETD_WORKER_TOKEN} (the test profile's own
+     * {@code tokenEnv}) is a name the derived allow-list keeps, so it gets the "UNBLOCKED" WARN;
+     * {@code SOME_UNKNOWN_SECRET_TOKEN} is not derived from anywhere, so it gets the "scrub blanks
+     * them" INFO. This is the exact shape #185 stage 2 must not touch on this path.
+     */
+    @Test
+    void gapConclusionsAreByteIdenticalWhenMemberHerdrSocketIsAbsent() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> config(null));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.contains("memberCredentials gap: 1 credential-shaped env var name(s) are on "
+                        + "neither known: nor allow: — the derived allow-list keeps them anyway (a "
+                        + "profile's gitTokenEnv/gitHostEnv/tokenEnv/env: names one, or this spawn "
+                        + "injects it), so every member pane inherits them UNBLOCKED — [FLEETD_WORKER_TOKEN]. "
+                        + "Add each to memberCredentials.known (or .allow if a member legitimately needs "
+                        + "it), or remove it from whatever profile setting derives it in."),
+                "expected the pre-existing UNBLOCKED WARN unchanged, got: " + messages);
+        assertTrue(messages.contains("memberCredentials gap: 1 credential-shaped env var name(s) are on "
+                        + "neither known: nor allow: — [SOME_UNKNOWN_SECRET_TOKEN]. The allow-list scrub "
+                        + "blanks them anyway (they are not on the derived allow-list), so no member pane "
+                        + "keeps them; add each to memberCredentials.known or .allow to make that explicit."),
+                "expected the pre-existing 'scrub blanks them' INFO unchanged, got: " + messages);
+    }
+
+    /**
+     * fleetd #185 stage 2: with {@code memberHerdrSocket:} configured, member panes run under a
+     * different OS user — {@link HerdrPeerLauncher#hostEnvNames} describes fleetd's own process, not
+     * that user's. Neither "inherits them UNBLOCKED" nor "scrub blanks them" is evidence-backed
+     * there, so neither may print; the single unknown-environment WARN must, naming the config key.
+     */
+    @Test
+    void gapDetectorReportsUnknownInsteadOfAConclusionWhenMemberHerdrSocketIsConfigured() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock"));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.stream().anyMatch(m -> m.contains("memberHerdrSocket")
+                        && m.contains("UNKNOWN") && m.contains("cannot be verified")),
+                "expected the unknown-member-environment WARN naming memberHerdrSocket, got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains("UNBLOCKED")),
+                "the 'inherits them UNBLOCKED' conclusion must not print once the evidence is about "
+                        + "the wrong (daemon's own) environment — got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains("scrub blanks them")),
+                "the 'scrub blanks them' conclusion must not print once the evidence is about the "
+                        + "wrong (daemon's own) environment — got: " + messages);
+    }
+
+    /**
+     * fleetd #185 stage 2: the unknown-environment WARN is a standing fact about this launcher's
+     * configuration, not per-spawn news — it must fire once per launcher instance, the same shape as
+     * every other one-time WARN in this class (e.g. {@code warnNonZsh}).
+     */
+    @Test
+    void theUnknownEnvironmentWarnFiresOnceNotOncePerSpawn() {
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock"));
+
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.WARN);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+
+        long count = appender.list.stream()
+                .filter(e -> e.getFormattedMessage().contains("cannot be verified from here"))
+                .count();
+        assertEquals(1, count, "the unknown-member-environment WARN must fire once per launcher "
+                + "instance, not once per spawn — got " + count + " occurrence(s) among: "
+                + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
+    }
+
+    /**
+     * Hard constraint: the gap detector must never log an env var VALUE, only its NAME. {@code
+     * SOME_UNKNOWN_SECRET_TOKEN} resolves to a distinctive canary value through the same {@code env}
+     * lookup the launcher uses elsewhere (SHELL, PATH, token resolution) — proving the value IS
+     * resolvable does not mean the detector reads it, since {@link HerdrPeerLauncher#hostEnvNames}
+     * (names only) is its data source, never {@code env.apply(name)} for those names.
+     */
+    @Test
+    void theGapDetectorNeverLogsAnEnvVarValueOnlyItsName() {
+        FakeHerdr herdr = new FakeHerdr();
+        String canary = "sekrit-value-CANARY-9f3a1b7c";
+        Set<String> hostEnvNames = Set.of("FLEETD_WORKER_TOKEN", "SOME_UNKNOWN_SECRET_TOKEN");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/zsh", () -> hostEnvNames,
+                () -> config(null), Map.of("SOME_UNKNOWN_SECRET_TOKEN", canary));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertTrue(messages.stream().anyMatch(m -> m.contains("SOME_UNKNOWN_SECRET_TOKEN")),
+                "expected the credential-shaped NAME to appear in the log, got: " + messages);
+        assertFalse(messages.stream().anyMatch(m -> m.contains(canary)),
+                "the log must never contain an env var VALUE, only its NAME — got: " + messages);
+    }
+
+    /**
+     * fleetd #213 defect 1, acceptance criterion 1: {@code memberHerdrSocket} configured and {@code
+     * memberLoginShell} configured as non-zsh must fall back to the sentinel overlay exactly like a
+     * non-zsh {@code $SHELL} does today — and the "generated ZDOTDIR" INFO must not appear, since no
+     * scrub actually runs. The WiringLauncher's own {@code env("SHELL")} is deliberately set to
+     * {@code /bin/zsh} — the OPPOSITE of what {@code memberLoginShell} says — so a launcher that
+     * (incorrectly) fell back to fleetd's own {@code $SHELL} here would wrongly pass the gate and
+     * fail this test.
+     */
+    @Test
+    void memberHerdrSocketWithNonZshMemberLoginShellFallsBackToTheOverlay() {
+        FakeHerdr herdr = new FakeHerdr();
+        WiringLauncher launcher = new WiringLauncher(herdr, allowListWithKnown(List.of("SOME_TOKEN")),
+                "/bin/zsh", null,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock", "/bin/bash"));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertEquals("blocked-by-fleetd-cb596-see-gitea-issue-82", launcher.env.get("SOME_TOKEN"),
+                "a non-zsh memberLoginShell must fall back to the CB-596 sentinel overlay, exactly "
+                        + "like a non-zsh $SHELL does when memberHerdrSocket is absent");
+        assertFalse(launcher.env.containsKey("ZDOTDIR"),
+                "no scrub directory may be generated when the configured member login shell is not zsh");
+        assertFalse(messages.stream().anyMatch(m -> m.contains("generated ZDOTDIR")),
+                "the 'generated ZDOTDIR' INFO must not appear when the scrub never runs — got: " + messages);
+    }
+
+    /**
+     * fleetd #213 defect 1, acceptance criterion 2: {@code memberHerdrSocket} configured and NO
+     * {@code memberLoginShell} configured must fall back exactly like criterion 1 above — AND
+     * fleetd's own {@code $SHELL} must never even be consulted (not merely "not decisive"). The
+     * fixture's {@code env} function reports {@code /bin/zsh} for {@code SHELL} — a value that would
+     * WRONGLY pass the zsh gate if the fix regressed to reading it — while flagging whether it was
+     * ever asked for at all, so this test fails loudly on either kind of regression.
+     */
+    @Test
+    void memberHerdrSocketWithNoMemberLoginShellFallsBackAndNeverConsultsFleetdsOwnShell() {
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicBoolean shellQueried = new AtomicBoolean(false);
+        Function<String, String> env = name -> {
+            if ("SHELL".equals(name)) {
+                shellQueried.set(true);
+                return "/bin/zsh"; // would wrongly pass the zsh gate if this ever leaked through
+            }
+            return null;
+        };
+        WiringLauncher launcher = new WiringLauncher(herdr, allowListWithKnown(List.of("SOME_TOKEN")), env,
+                () -> configWithMemberHerdrSocket("/tmp/other-user-herdr.sock", null));
+
+        List<String> messages = spawnAndCaptureLogs(launcher);
+
+        assertFalse(shellQueried.get(), "fleetd's own $SHELL must never be consulted once "
+                + "memberHerdrSocket is configured — only memberLoginShell: may decide the gate");
+        assertEquals("blocked-by-fleetd-cb596-see-gitea-issue-82", launcher.env.get("SOME_TOKEN"),
+                "no memberLoginShell configured must fall back to the sentinel overlay, same as a "
+                        + "configured non-zsh shell");
+        assertFalse(messages.stream().anyMatch(m -> m.contains("generated ZDOTDIR")),
+                "no scrub may run without a configured memberLoginShell — got: " + messages);
+    }
+
+    /**
+     * fleetd #213 defect 2, acceptance criterion 3: with {@code memberHerdrSocket} configured, a
+     * zsh {@code memberLoginShell}, and {@code worktreeRoot}/{@code worktreeGroup} both configured,
+     * the generated scrub directory must live under {@code worktreeRoot} — NEVER under {@code
+     * java.io.tmpdir}, which is fleetd's own 0700 temp dir and unreadable by the member's different
+     * OS user. {@code worktreeGroup} is set to the CURRENT process's own primary group so {@code
+     * EnvAllowListScrub}'s group-sharing step resolves on whatever host runs this test, rather than
+     * hardcoding a group name that may not exist here.
+     */
+    @Test
+    void memberHerdrSocketWithZshMemberLoginShellPutsTheScrubOutsideJavaIoTmpdir(@TempDir Path worktreeRoot)
+            throws IOException {
+        String group = currentUserGroup();
+        FakeHerdr herdr = new FakeHerdr();
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/bash-should-be-ignored", null,
+                () -> configWithMemberHerdrSocketRootAndGroup("/tmp/other-user-herdr.sock", "/bin/zsh",
+                        worktreeRoot.toString(), group));
+
+        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+
+        String zdotdir = launcher.env.get("ZDOTDIR");
+        assertNotNull(zdotdir, "a zsh memberLoginShell with worktreeRoot+worktreeGroup configured "
+                + "must still generate a ZDOTDIR");
+        Path dir = Path.of(zdotdir);
+        // The immediate PARENT is asserted (not merely startsWith(java.io.tmpdir)), because a
+        // JUnit @TempDir is itself carved out of the JVM's java.io.tmpdir — startsWith alone would
+        // pass by coincidence of the test fixture, not because the launcher used worktreeRoot.
+        assertEquals(worktreeRoot.toAbsolutePath().normalize(), dir.getParent(),
+                "the generated scrub directory's parent must be the configured worktreeRoot, not "
+                        + "System.getProperty(\"java.io.tmpdir\") — got parent " + dir.getParent());
+    }
+
+    /**
+     * fleetd #213, acceptance criterion 4: with {@code memberHerdrSocket} absent (today's only
+     * mode), behaviour must be byte-identical to before this fix — fleetd's own {@code $SHELL}
+     * still decides the gate (proven here, not merely assumed, by flagging the lookup), and the
+     * scrub still lands under {@code java.io.tmpdir}.
+     */
+    @Test
+    void memberHerdrSocketAbsentStillConsultsFleetdsOwnShellAndBehavesAsBefore() {
+        FakeHerdr herdr = new FakeHerdr();
+        AtomicBoolean shellQueried = new AtomicBoolean(false);
+        Function<String, String> env = name -> {
+            if ("SHELL".equals(name)) {
+                shellQueried.set(true);
+                return "/bin/zsh";
+            }
+            return null;
+        };
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), env, null); // memberHerdrSocket absent
+
+        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+
+        assertTrue(shellQueried.get(), "with memberHerdrSocket absent, fleetd's own $SHELL must "
+                + "still decide the zsh gate, unchanged from before this fix");
+        String zdotdir = launcher.env.get("ZDOTDIR");
+        assertNotNull(zdotdir, "SHELL=/bin/zsh with memberHerdrSocket absent must still generate a "
+                + "ZDOTDIR, as before this fix");
+        Path dir = Path.of(zdotdir);
+        assertTrue(dir.startsWith(Path.of(System.getProperty("java.io.tmpdir"))),
+                "with memberHerdrSocket absent the scrub directory must still be generated under "
+                        + "java.io.tmpdir, unchanged from before this fix: " + dir);
+    }
+
+    /**
+     * The current process's REAL primary group — resolved via {@code id -gn}, never by reading a
+     * directory's owning group (fleetd #225). Those two coincide only by accident: a directory's
+     * group is whichever group happened to own the path Maven was started from — {@code staff} in
+     * a home checkout, {@code wheel} under {@code /private/tmp} on macOS — and the fix-up this test
+     * exercises then fails for real when the operator is not a member of that borrowed group,
+     * exactly the case {@code assumeTrue(view != null, ...)} never covered (it only detects a
+     * filesystem with no POSIX groups at all, not a resolvable-but-wrong one). Skips (never fails)
+     * when {@code id} is unavailable or its primary group cannot be resolved on this host.
+     */
+    private static String currentUserGroup() {
+        String out;
+        boolean ok;
+        try {
+            Process p = new ProcessBuilder("id", "-gn").redirectErrorStream(true).start();
+            try (java.io.BufferedReader r = new java.io.BufferedReader(
+                    new java.io.InputStreamReader(p.getInputStream(), java.nio.charset.StandardCharsets.UTF_8))) {
+                out = r.lines().collect(java.util.stream.Collectors.joining("\n")).trim();
+            }
+            ok = p.waitFor(5, java.util.concurrent.TimeUnit.SECONDS) && p.exitValue() == 0 && !out.isBlank();
+        } catch (IOException e) {
+            out = null;
+            ok = false;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            out = null;
+            ok = false;
+        }
+        assumeTrue(ok, "cannot resolve this process's real primary group via `id -gn` on this host "
+                + "— skipping a POSIX-group-dependent test rather than failing it");
+        return out;
+    }
+
+    /** Spawn once through the real launcher path, capturing every INFO+ line this class logs. */
+    private static List<String> spawnAndCaptureLogs(HerdrPeerLauncher launcher) {
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+        return appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList();
+    }
+
    private static String readAll(Path p) {
        try {
            return Files.readString(p);
@@ -294,12 +599,40 @@ class HerdrPeerLauncherAllowListWiringTest {

        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell,
                       Supplier<Set<String>> hostEnvNames, Supplier<FleetConfig> config) {
+            this(herdr, creds, shell, hostEnvNames, config, Map.of());
+        }
+
+        /**
+         * Plus a host-env value map (name → value), resolved through the same {@code env} lookup
+         * every adapter uses for {@code SHELL}/{@code PATH}/token resolution — fleetd #185 stage 2's
+         * "the gap detector never logs a value" tests use this to prove a value that IS resolvable
+         * for a credential-shaped name never reaches the log, since the detector only ever reads
+         * {@code hostEnvNames} (names), never {@code env.apply(name)} (values), for those names.
+         */
+        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell,
+                       Supplier<Set<String>> hostEnvNames, Supplier<FleetConfig> config,
+                       Map<String, String> extraEnvValues) {
            super("test", new AgentControl(herdr), new WorkspaceControl(herdr),
                    Map.of("test", profile()), "test",
-                    name -> "SHELL".equals(name) ? shell : null,
+                    name -> "SHELL".equals(name) ? shell
+                            : (extraEnvValues != null && extraEnvValues.containsKey(name))
+                                    ? extraEnvValues.get(name) : null,
                    0, () -> 0L, () -> { }, null, creds, hostEnvNames, config);
        }

+        /**
+         * Full control over the {@code env} lookup, bypassing the {@code shell}/{@code
+         * extraEnvValues} convenience above entirely — fleetd #213's "fleetd's own $SHELL must
+         * never be consulted" tests need to OBSERVE whether {@code SHELL} was ever looked up, which
+         * a plain value substitution cannot do.
+         */
+        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds,
+                       Function<String, String> env, Supplier<FleetConfig> config) {
+            super("test", new AgentControl(herdr), new WorkspaceControl(herdr),
+                    Map.of("test", profile()), "test",
+                    env, 0, () -> 0L, () -> { }, null, creds, null, config);
+        }
+
        @Override
        protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
            Map<String, String> launchEnv = baseEnv(cfg);
@@ -321,6 +654,82 @@ class HerdrPeerLauncherAllowListWiringTest {
                null, null, null, null, null).withDefaults();
    }

+    /**
+     * fleetd #185 stage 2: a config with {@code memberHerdrSocket:} set — member panes run on a
+     * second herdr owned by a different OS user, so {@link HerdrPeerLauncher#hostEnvNames} no
+     * longer describes what a member pane inherits.
+     */
+    private static FleetConfig configWithMemberHerdrSocket(String memberHerdrSocket) {
+        return new FleetConfig(null, null, memberHerdrSocket, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null).withDefaults();
+    }
+
+    /**
+     * fleetd #213: as {@link #configWithMemberHerdrSocket(String)}, plus the {@code
+     * memberLoginShell:} the member's OS user actually runs — the config key {@link
+     * HerdrPeerLauncher#applyEnvironmentAllowListPolicy} must consult instead of fleetd's own
+     * {@code $SHELL} once {@code memberHerdrSocket} is configured.
+     */
+    private static FleetConfig configWithMemberHerdrSocket(String memberHerdrSocket, String memberLoginShell) {
+        return new FleetConfig(
+                null,               // bind
+                null,               // herdrSocket
+                memberHerdrSocket,  // memberHerdrSocket
+                Map.of(),           // profiles
+                null,               // guard
+                null,               // worktreeRoot
+                null,               // lifecycle
+                null,               // spawnReadyTimeoutMs
+                null,               // spawnReadyPollMs
+                null,               // broker
+                null,               // primary
+                null,               // fleet
+                null,               // leadHeartbeat
+                null,               // health
+                null,               // placement
+                null,               // auth
+                null,               // configReload
+                null,               // quarantineCooldownSeconds
+                null,               // memberCredentials
+                null,               // coordinator
+                null,               // worktreeGroup
+                memberLoginShell    // memberLoginShell
+        ).withDefaults();
+    }
+
+    /**
+     * fleetd #213: as above, plus {@code worktreeRoot:}/{@code worktreeGroup:} — both required for
+     * the ZDOTDIR scrub to run at all once {@code memberHerdrSocket} is configured; either missing
+     * falls back to the sentinel overlay, same as a non-zsh {@code memberLoginShell}.
+     */
+    private static FleetConfig configWithMemberHerdrSocketRootAndGroup(String memberHerdrSocket,
+            String memberLoginShell, String worktreeRoot, String worktreeGroup) {
+        return new FleetConfig(
+                null,               // bind
+                null,               // herdrSocket
+                memberHerdrSocket,  // memberHerdrSocket
+                Map.of(),           // profiles
+                null,               // guard
+                worktreeRoot,       // worktreeRoot
+                null,               // lifecycle
+                null,               // spawnReadyTimeoutMs
+                null,               // spawnReadyPollMs
+                null,               // broker
+                null,               // primary
+                null,               // fleet
+                null,               // leadHeartbeat
+                null,               // health
+                null,               // placement
+                null,               // auth
+                null,               // configReload
+                null,               // quarantineCooldownSeconds
+                null,               // memberCredentials
+                null,               // coordinator
+                worktreeGroup,      // worktreeGroup
+                memberLoginShell    // memberLoginShell
+        ).withDefaults();
+    }
+
    /** The generated directory is a temp directory; make sure the test does not leave a pile. */
    @Test
    void theGeneratedDirectoryIsRemovedWhenThePaneIsStopped() {
@@ -1,30 +1,45 @@
 package dev.ltms.fleet.member;

+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.FakeHerdr;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.ExhaustionSink;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.CharterReceipt;
 import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerHandle;
 import dev.ltms.fleet.peer.PeerUnreachableException;
 import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;

+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
 import java.util.function.Supplier;

 import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;

 /**
 * The opencode adapter's launch build: a file-based MCP mount + reply-charter instructions (no
@@ -39,6 +54,19 @@ class OpenCodeLauncherTest {
                null, null, gitTokenEnv, null, FleetConfig.Profile.KIND_OPENCODE);
    }

+    /**
+     * A profile carrying an explicit {@code credentialId} (fleetd #234 defect 2) — distinct from
+     * the profile's own name, so a test can assert on the credential precisely rather than relying
+     * on {@code effectiveCredentialId()}'s profile-name fallback.
+     */
+    private static FleetConfig.Profile opencodeCfgWithCredential(String profileName, String model,
+                                                                   String credentialId) {
+        return new FleetConfig.Profile(profileName, null, model, null, "FLEETD_WORKER_TOKEN",
+                List.of("opencode"), "tab", "fleetd-workers", "opencode: {model} #{n}", null,
+                null, List.of(), null, null, FleetConfig.Profile.KIND_OPENCODE, Map.of(), 1.0f,
+                null, false, null, credentialId, null);
+    }
+
    /** Gate-disabled launcher whose per-spawn config dirs land under an inspectable temp root. */
    private static OpenCodeLauncher service(FakeHerdr herdr, Path configRoot, FleetConfig.Profile cfg) {
        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
@@ -383,6 +411,46 @@ class OpenCodeLauncherTest {
        assertNotNull(ex.getMessage());
    }

+    /**
+     * fleetd #176 fix 2's per-adapter guard: {@code StatusRefiner.classify} is written for the
+     * Claude Code TUI only, and the spawn-readiness gate must never run it against an opencode
+     * pane. {@code agentType("opencode")} deliberately satisfies the OTHER guard (the corroborating
+     * liveness check) so it cannot be what makes this test pass — only the {@code namePrefix}
+     * check can be. If that check were ever removed, this pane's {@code ❯} content would refine
+     * straight to IDLE and the gate would report ready before the backend actually was.
+     */
+    @Test
+    void opencodePaneIsNeverRefinedEvenWhenItsContentLooksLikeAnIdleClaudePrompt(@TempDir Path root) {
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown"); // always UNKNOWN
+        herdr.agentType("opencode");  // non-null — satisfies the liveness guard on its own
+        herdr.readText("some-host:~ user$ ❯ "); // content StatusRefiner.classify reads as IDLE
+        long[] clock = {0};
+        OpenCodeLauncher svc = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                Map.of("gemini", opencodeCfg(null, null, null)), "gemini", _ -> null,
+                1000, () -> clock[0], () -> clock[0] += 50, root, root);
+
+        assertThrows(PeerUnreachableException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertTrue(clock[0] >= 1000,
+                "an opencode pane must never refine to injectable, however its content reads — "
+                        + "the gate has to wait out the full timeout: clock only reached " + clock[0]);
+        // A blanket "agent.read is never called" does not hold here: the timeout path itself reads
+        // the pane tail (source=recent) for its own log message, on every timeout, regardless of
+        // adapter — see HerdrPeerLauncher.readPaneQuietly. So assert on the refiner's OWN probe
+        // source (StatusRefiner.PROBE_SOURCE = "detection") instead — that call happens only inside
+        // StatusRefiner.refine, so its absence proves the refiner itself was never reached for this
+        // opencode pane, not merely that its answer was discarded.
+        long detectionReads = herdr.calls.stream()
+                .filter(c -> c.method().equals("agent.read"))
+                .filter(c -> "detection".equals(((Map<?, ?>) c.params()).get("source")))
+                .count();
+        assertEquals(0, detectionReads,
+                "the refiner's own pane probe (source=detection) must never run against an "
+                        + "opencode pane — the namePrefix guard has to stop it before that call");
+    }
+
    @Test
    void spawnReturnsHandleWhenGateDisabled(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
@@ -610,4 +678,670 @@ class OpenCodeLauncherTest {
        assertTrue(json.path("mcp").path("intellij").isMissingNode(),
                "no IDE server when ideMcpUrl is unset");
    }
+
+    // --- fleetd #219: config root + discovery root under memberHerdrSocket ------------------------
+
+    /** A config with {@code memberHerdrSocket:} set, and optionally {@code worktreeRoot:}/{@code worktreeGroup:}. */
+    private static FleetConfig configWithMemberHerdrSocket(String worktreeRoot, String worktreeGroup) {
+        return new FleetConfig(
+                null,                    // bind
+                null,                    // herdrSocket
+                "/tmp/other-user.sock",  // memberHerdrSocket
+                Map.of(),                // profiles
+                null,                    // guard
+                worktreeRoot,            // worktreeRoot
+                null,                    // lifecycle
+                null,                    // spawnReadyTimeoutMs
+                null,                    // spawnReadyPollMs
+                null,                    // broker
+                null,                    // primary
+                null,                    // fleet
+                null,                    // leadHeartbeat
+                null,                    // health
+                null,                    // placement
+                null,                    // auth
+                null,                    // configReload
+                null,                    // quarantineCooldownSeconds
+                null,                    // memberCredentials
+                null,                    // coordinator
+                worktreeGroup,           // worktreeGroup
+                null                     // memberLoginShell
+        ).withDefaults();
+    }
+
+    private static OpenCodeLauncher serviceWithConfig(FakeHerdr herdr, Path configRoot, Path discoveryRoot,
+                                                        FleetConfig.Profile cfg, Supplier<FleetConfig> config) {
+        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
+                0, System::currentTimeMillis, () -> { }, configRoot, discoveryRoot, null, null, config);
+    }
+
+    /**
+     * The current process's REAL primary group — resolved via {@code id -gn}, never by reading a
+     * directory's owning group (fleetd #225). Those two coincide only by accident: a directory's
+     * group is whichever group happened to own the path Maven was started from — {@code staff} in
+     * a home checkout, {@code wheel} under {@code /private/tmp} on macOS — and the fix-up this test
+     * exercises then fails for real when the operator is not a member of that borrowed group,
+     * exactly the case {@code assumeTrue(view != null, ...)} never covered (it only detects a
+     * filesystem with no POSIX groups at all, not a resolvable-but-wrong one). Skips (never fails)
+     * when {@code id} is unavailable or its primary group cannot be resolved on this host.
+     */
+    private static String currentUserGroup() {
+        String out;
+        boolean ok;
+        try {
+            Process p = new ProcessBuilder("id", "-gn").redirectErrorStream(true).start();
+            try (java.io.BufferedReader r = new java.io.BufferedReader(
+                    new java.io.InputStreamReader(p.getInputStream(), java.nio.charset.StandardCharsets.UTF_8))) {
+                out = r.lines().collect(java.util.stream.Collectors.joining("\n")).trim();
+            }
+            ok = p.waitFor(5, java.util.concurrent.TimeUnit.SECONDS) && p.exitValue() == 0 && !out.isBlank();
+        } catch (IOException e) {
+            out = null;
+            ok = false;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            out = null;
+            ok = false;
+        }
+        assumeTrue(ok, "cannot resolve this process's real primary group via `id -gn` on this host "
+                + "— skipping a POSIX-group-dependent test rather than failing it");
+        return out;
+    }
+
+    /**
+     * fleetd #219 site 1, acceptance criterion 1: with {@code memberHerdrSocket} configured and both
+     * {@code worktreeRoot}/{@code worktreeGroup} set, the generated {@code opencode.json} directory
+     * lives under {@code worktreeRoot} — NEVER under the injected {@code configRoot} (standing in for
+     * {@code java.io.tmpdir}, fleetd's own 0700 temp dir, unreadable by the member's different OS
+     * user) — and is shared read-only with the group via the SAME mechanism (fleetd #213's {@link
+     * EnvAllowListScrub#shareWithGroup}) the ZDOTDIR scrub uses.
+     */
+    @Test
+    void memberHerdrSocketWithWorktreeRootAndGroupPutsConfigDirUnderWorktreeRootAndSharesIt(
+            @TempDir Path configRoot, @TempDir Path worktreeRoot) throws Exception {
+        String group = currentUserGroup();
+        FakeHerdr herdr = new FakeHerdr();
+        serviceWithConfig(herdr, configRoot, configRoot,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null),
+                () -> configWithMemberHerdrSocket(worktreeRoot.toString(), group)).spawn();
+
+        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
+        assertNotNull(cfgPath, "the profile still needs a config file");
+        Path cfgFile = Path.of(cfgPath);
+        Path dir = cfgFile.getParent();
+        assertEquals(worktreeRoot.toAbsolutePath().normalize(), dir.getParent(),
+                "the generated directory's parent must be worktreeRoot, not the injected configRoot "
+                        + "standing in for java.io.tmpdir — got parent " + dir.getParent());
+        assertFalse(dir.startsWith(configRoot),
+                "the generated directory must NOT be created under configRoot when memberHerdrSocket "
+                        + "is configured: " + dir);
+
+        assertEquals("rwxr-x---", PosixFilePermissions.toString(Files.getPosixFilePermissions(dir)),
+                "the directory must be group-traversable+readable, owner-only writable");
+        assertEquals("rw-r-----", PosixFilePermissions.toString(Files.getPosixFilePermissions(cfgFile)),
+                "opencode.json must be group-readable, never group-writable");
+    }
+
+    /**
+     * fleetd #219 site 1, acceptance criterion 2: with {@code memberHerdrSocket} configured but
+     * NEITHER {@code worktreeRoot} nor {@code worktreeGroup} set, the launcher must refuse the spawn
+     * rather than write a config under {@code java.io.tmpdir} the member cannot read — that member
+     * would occupy a pane and never become deliverable, with nothing pointing at the real cause.
+     */
+    @Test
+    void memberHerdrSocketWithoutWorktreeRootOrGroupRefusesTheSpawn(@TempDir Path configRoot) {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = serviceWithConfig(herdr, configRoot, configRoot,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null),
+                () -> configWithMemberHerdrSocket(null, null));
+
+        IllegalStateException ex = assertThrows(IllegalStateException.class,
+                () -> launcher.spawn(new SpawnRequest(null, null, null)),
+                "a missing worktreeRoot/worktreeGroup must refuse the spawn, not write an unreadable config");
+        assertTrue(ex.getMessage().contains("worktreeRoot"),
+                "the refusal must name the missing config key — got: " + ex.getMessage());
+        assertFalse(herdr.called("tab.create"),
+                "the spawn must be refused BEFORE any pane is created — got calls: " + herdr.calls);
+    }
+
+    /**
+     * fleetd #219 site 1, acceptance criterion 2 (the other missing half): {@code worktreeRoot} set
+     * but {@code worktreeGroup} missing must ALSO refuse — either one alone is not enough to
+     * guarantee the member's OS user can read the directory.
+     */
+    @Test
+    void memberHerdrSocketWithWorktreeRootButNoGroupRefusesTheSpawn(
+            @TempDir Path configRoot, @TempDir Path worktreeRoot) {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = serviceWithConfig(herdr, configRoot, configRoot,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null),
+                () -> configWithMemberHerdrSocket(worktreeRoot.toString(), null));
+
+        IllegalStateException ex = assertThrows(IllegalStateException.class,
+                () -> launcher.spawn(new SpawnRequest(null, null, null)));
+        assertTrue(ex.getMessage().contains("worktreeGroup"),
+                "worktreeRoot alone is not enough — got: " + ex.getMessage());
+    }
+
+    /**
+     * fleetd #219 site 1, acceptance criterion 3: with {@code memberHerdrSocket} ABSENT — even when
+     * a live, non-null {@code config} supplier is threaded through (not merely {@code config == null},
+     * which every other test in this file already exercises) — the generated directory must still
+     * land directly under the injected {@code configRoot}, byte-identical to before this fix.
+     */
+    @Test
+    void memberHerdrSocketAbsentStaysUnderConfigRootEvenWithALiveConfigSupplier(@TempDir Path configRoot)
+            throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig config = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null, null, null).withDefaults();
+        serviceWithConfig(herdr, configRoot, configRoot,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null), () -> config)
+                .spawn();
+
+        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
+        assertNotNull(cfgPath);
+        assertTrue(Path.of(cfgPath).startsWith(configRoot),
+                "with memberHerdrSocket absent, the config directory must still be created directly "
+                        + "under configRoot, unchanged from before this fix");
+    }
+
+    /**
+     * fleetd #219 site 2: under {@code memberHerdrSocket}, opencode session discovery must be
+     * declared unavailable rather than silently scanning fleetd's own {@code discoveryRoot} — which,
+     * under this config key, is NOT where the member's opencode actually writes its session
+     * database. This test proves the gate is real, not merely "no record yet": a matching record IS
+     * written to {@code discoveryRoot} (the exact fixture {@link
+     * #theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears} proves discovery would
+     * otherwise find), and {@code agentSessionId()} must still return {@code null} — proving the
+     * gate, not a coincidental absence of data, is what produced the null. One WARN is also logged,
+     * exactly once even across repeated calls.
+     */
+    @Test
+    void discoveryIsUnavailableUnderMemberHerdrSocketEvenWhenARecordExists(
+            @TempDir Path configRoot, @TempDir Path worktreeRoot, @TempDir Path discRoot) throws Exception {
+        String group = currentUserGroup();
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_should_be_hidden", "/work/dir", 1000L);
+
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
+                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, configRoot, discRoot,
+                null, null, () -> configWithMemberHerdrSocket(worktreeRoot.toString(), group));
+
+        Logger logger = (Logger) LoggerFactory.getLogger(OpenCodeLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        PeerHandle handle;
+        try {
+            handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
+            assertNull(handle.agentSessionId(),
+                    "memberHerdrSocket configured: discovery must stay unavailable even though a "
+                            + "matching record exists in discoveryRoot");
+            assertNull(handle.agentSessionId(), "the gate must hold on a second call too");
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+        List<String> warnings = appender.list.stream()
+                .filter(e -> e.getLevel() == Level.WARN)
+                .map(ILoggingEvent::getFormattedMessage)
+                .toList();
+        assertEquals(1, warnings.size(),
+                "exactly one WARN across two agentSessionId() calls — got: " + warnings);
+        assertTrue(warnings.get(0).contains("memberHerdrSocket"),
+                "the WARN must name memberHerdrSocket as the reason — got: " + warnings.get(0));
+    }
+
+    // --- fleetd #175: opencode silently substitutes a model on an unknown -m flag ----------------
+
+    private static OpenCodeLauncher serviceWithSink(FakeHerdr herdr, Path configRoot, Path discoveryRoot,
+                                                      FleetConfig.Profile cfg, ExhaustionSink sink) {
+        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
+                0, System::currentTimeMillis, () -> { }, configRoot, discoveryRoot,
+                null, null, null, sink);
+    }
+
+    /**
+     * fleetd #175 acceptance criterion 1: the check must fire on the REAL late-resolve path —
+     * {@code SessionManager}'s {@code get}/{@code roster} re-polling a retained {@link PeerHandle}
+     * (fleetd #209) — not on a handle built and queried directly. A handle whose row does not exist
+     * yet, then does, proves the check runs exactly where production runs it: PR #203 shipped a
+     * check that ran inside {@code spawn()}, before opencode had written the row, and every test
+     * passed anyway because none of them drove it through this path. This test would have caught
+     * that: {@code sessions.get(...)} before the row exists must show no mismatch, and the SAME
+     * call, re-driven after the row appears, must be what fires the sink.
+     */
+    @Test
+    void theRealSessionManagerLateResolvePathCatchesAModelMismatch(@TempDir Path configRoot,
+                                                                     @TempDir Path discRoot) throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        // xf's real shape (fleetd #175): weight:80, model "opencode/nemotron-3-ultra-free", no
+        // credentialId — the profile that actually escaped the fleet's accounting.
+        FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(target + "|" + reason);
+        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, sink);
+
+        SessionManager sessions = new SessionManager(launcher);
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+
+        // Real late-resolve path, driven BEFORE opencode has written its session row — same shape
+        // as production the instant a pane goes ready.
+        Optional<MemberSession> beforeRow = sessions.get(acquired.paneId());
+        assertTrue(beforeRow.isPresent());
+        assertNull(beforeRow.get().agentSessionId(), "no opencode row yet");
+        assertTrue(exhausted.isEmpty(), "no row yet → nothing to compare, the sink must stay silent");
+
+        // opencode writes its row late, running gpt-5.6-sol (a PAID credential) instead of the
+        // withdrawn free model the profile actually asked for — the exact fleetd #175 scenario.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+
+        // Drive the SAME real late-resolve path again: sessions.get() -> resolveAgentSessionId ->
+        // the retained PeerHandle's agentSessionId() -> discovery -> checkModelMatch, all in one
+        // call, unmodified SessionManager code from fleetd #209.
+        Optional<MemberSession> afterRow = sessions.get(acquired.paneId());
+        assertEquals("ses_x", afterRow.get().agentSessionId(),
+                "the id itself still resolves correctly alongside the model check");
+
+        assertEquals(1, exhausted.size(), "the mismatch must fire exactly once through the real path");
+        assertTrue(exhausted.get(0).contains(cfg.model()), "reports the requested model: " + exhausted.get(0));
+        assertTrue(exhausted.get(0).contains("gpt-5.6-sol"), "reports the actual model: " + exhausted.get(0));
+    }
+
+    /** THE TRAP, row 1: a provider-prefixed request matching the DB's id AND provider is a match. */
+    @Test
+    void aProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
+                                                                        @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "id and provider both match → never a mismatch: " + exhausted);
+    }
+
+    /** THE TRAP, row 2: same shape as row 1 with a different provider/id pair (the gx profile). */
+    @Test
+    void aGxProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
+                                                                          @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("gx/deepseek-v4-flash", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "id and provider both match → never a mismatch: " + exhausted);
+    }
+
+    /**
+     * Incomplete evidence, not THE TRAP's provider mismatch: opencode's {@code model} JSON had an
+     * {@code id} but no {@code providerID} at all (a real shape {@code parseModel} accepts — see
+     * {@code OpenCodeSessionDiscoveryTest}). The id matches; the provider dimension is simply
+     * unknown, not contradicted. A provider-prefixed profile must NOT be quarantined on this —
+     * that would quarantine on incomplete evidence, which acceptance rule 4 forbids.
+     */
+    @Test
+    void aMissingProviderIdInTheEvidenceIsUnknownNotAMismatchWhenTheIdMatches(
+            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-terra\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(),
+                "id matches and provider is simply unknown (absent), never a mismatch: " + exhausted);
+    }
+
+    /**
+     * The other half of the same fix: a missing {@code providerID} must NOT blind the check to a
+     * genuine id mismatch. This is what proves the fix narrows the comparison rather than switching
+     * the whole check off whenever {@code providerID} happens to be absent.
+     */
+    @Test
+    void aMissingProviderIdInTheEvidenceStillCatchesARealIdMismatch(
+            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-sol\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertEquals(1, exhausted.size(),
+                "the id genuinely differs, so this must still quarantine even with providerID absent: "
+                        + exhausted);
+        assertTrue(exhausted.get(0).contains("gpt-5.6-sol") && exhausted.get(0).contains(cfg.model()),
+                "reports both the requested and actual model: " + exhausted.get(0));
+    }
+
+    /**
+     * THE TRAP, row 3: a profile that names no provider prefix (bare {@code "deepseek-v4-flash"})
+     * must match on id alone — the profile never asked for a specific provider, so opencode
+     * resolving it to {@code gx} is not evidence of anything wrong.
+     */
+    @Test
+    void aBareModelWithNoProviderPrefixMatchesOnIdAloneAndIsNotAMismatch(@TempDir Path configRoot,
+                                                                          @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("deepseek-v4-flash", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(),
+                "no provider was requested, so opencode's own provider resolution is not a mismatch: "
+                        + exhausted);
+    }
+
+    /**
+     * THE TRAP, row 4 (not a row in the table, the reason the table exists): a mismatched id, with
+     * the profile's requested and the actual model both named in the ERROR and the sink's reason —
+     * the exact fleetd #175 scenario (a withdrawn model silently falls back to a paid one).
+     */
+    @Test
+    void aRealIdMismatchLogsAnErrorNamingBothModelsAndQuarantinesThroughTheSink(
+            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(target + "|" + reason);
+        FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
+
+        Logger logger = (Logger) LoggerFactory.getLogger(OpenCodeLauncher.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        PeerHandle handle;
+        try {
+            handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                    .spawn(new SpawnRequest(null, "/work/dir", null));
+            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                    "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+            assertEquals("ses_x", handle.agentSessionId());
+        } finally {
+            logger.detachAppender(appender);
+        }
+
+        assertEquals(1, exhausted.size(), "a real id mismatch must reach the sink exactly once");
+        assertTrue(exhausted.get(0).contains("opencode/nemotron-3-ultra-free"),
+                "the sink reason must name the requested model: " + exhausted.get(0));
+        assertTrue(exhausted.get(0).contains("gpt-5.6-sol"),
+                "the sink reason must name the actual model: " + exhausted.get(0));
+
+        List<ILoggingEvent> errors = appender.list.stream()
+                .filter(e -> e.getLevel() == Level.ERROR)
+                .toList();
+        assertEquals(1, errors.size(), "exactly one ERROR for the mismatch: " + appender.list);
+        String message = errors.get(0).getFormattedMessage();
+        assertTrue(message.contains("opencode/nemotron-3-ultra-free") && message.contains("gpt-5.6-sol")
+                        && message.contains(cfg.profile()),
+                "the ERROR must name the requested model, the actual model, AND the profile: " + message);
+
+        // The check runs at most once per handle even if agentSessionId() is polled again.
+        handle.agentSessionId();
+        assertEquals(1, exhausted.size(), "no duplicate quarantine on a repeated call");
+    }
+
+    /**
+     * fleetd #175's central safety rule: absent, empty, or unparseable model evidence is UNKNOWN,
+     * never a mismatch — it must never quarantine a working profile. Covers every "no real
+     * evidence yet" shape: no row at all, a row with a null model, and a row with unparseable JSON.
+     */
+    @Test
+    void unknownOrUnparseableModelEvidenceNeverQuarantines(@TempDir Path configRoot,
+                                                             @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+
+        // No row yet at all.
+        assertNull(handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "no row yet is UNKNOWN, not a mismatch: " + exhausted);
+
+        // A row exists (for a DIFFERENT directory) so a poll on ours still finds nothing.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_other", "/work/other", 500L,
+                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+        assertNull(handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "a row for a different directory is UNKNOWN, not a mismatch: "
+                + exhausted);
+    }
+
+    /**
+     * A profile with no {@code model:} configured has nothing to compare against — the check must
+     * stay silent no matter what opencode actually ran, since there is no requested value to be
+     * wrong about.
+     */
+    @Test
+    void aProfileWithNoConfiguredModelIsNeverCheckedForAMismatch(@TempDir Path configRoot,
+                                                                  @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg(null, null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"anything-at-all\",\"providerID\":\"anyone\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "no model configured → nothing to compare: " + exhausted);
+    }
+
+    // --- fleetd #234 defect 1: key the model check on the RESOLVED id, not the shared directory --
+
+    /**
+     * The exact shape fleetd #234 reported: {@code fleet_spawn} with no {@code worktree:} shares
+     * the lead's cwd across every worker, so more than one session row can exist for the SAME
+     * {@code directory}. Once THIS handle's own session id is resolved, a sibling member spawned
+     * later into the same shared directory — writing a NEWER, unrelated row — must never make the
+     * already-resolved session look mismatched. Today's code re-derives "the newest row in this
+     * directory" on every call (both for the id AND, independently, for the model), so it would
+     * pick up the sibling's row on the second call and flag a false mismatch AND flip the returned
+     * id. The fix (fleetd #234) makes the id sticky once resolved and reads the model back for
+     * exactly that id (see {@link OpenCodeSessionDiscovery#actualModelForSessionId}) — never
+     * "whatever is newest in the directory right now."
+     */
+    @Test
+    void modelCheckReadsTheResolvedSessionsOwnRowNotWhateverIsNewestInTheSharedDirectory(
+            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+
+        // Our own session's row, correctly matching the profile's requested model.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
+        assertEquals("ses_ours", handle.agentSessionId(), "resolves to our own session");
+        assertTrue(exhausted.isEmpty(), "matching model → no mismatch on first resolve: " + exhausted);
+
+        // A sibling member, spawned later into the SAME shared directory (no worktree, fleetd
+        // #234's default), writes a newer row running a totally different model.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", "/work/dir", 9000L,
+                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
+
+        assertEquals("ses_ours", handle.agentSessionId(),
+                "the session id, once resolved, must not flip to a sibling sharing the directory");
+        assertTrue(exhausted.isEmpty(),
+                "a sibling's later, unrelated row in the same shared directory must never be read "
+                        + "as OUR session's model: " + exhausted);
+    }
+
+    // --- fleetd #234 defect 2: the quarantine the ERROR announces must actually happen -----------
+
+    /**
+     * fleetd #234: {@link OpenCodeLauncher.SessionAwareHandle#checkModelMatch} fires from {@code
+     * agentSessionId()}, which {@code SessionManager.acquire()} calls to build the very first
+     * {@code MemberSession} record — BEFORE that session is put into the registry {@code
+     * sessions.roster()} reads. A sink that resolves {@code target -> profile} ONLY through the
+     * roster (today's {@code Fleetd.java} code, before this fix) therefore finds nothing at this
+     * exact moment and silently does not quarantine, even though it just logged an ERROR saying it
+     * would. This test drives the REAL path — {@code SessionManager.acquire()} — not the sink
+     * directly, because the bug is entirely about this ordering; a direct-sink test cannot see it
+     * (and is exactly why #175's own test suite, which only ever called the sink directly or after
+     * registration, never caught this).
+     *
+     * <p>The sink under test mirrors {@code Fleetd.main()}'s real wiring after the fix: resolve
+     * via the roster first (unchanged for {@code CompletionResolver}'s two call sites), falling
+     * back to the profile hint {@link OpenCodeLauncher} now supplies via {@link
+     * ExhaustionSink#onExhausted(String, String, String)} when the roster lookup misses.
+     */
+    @Test
+    void aSpawnTimeModelMismatchActuallyQuarantinesTheCredentialThroughTheRealAcquirePath(
+            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        FleetConfig.Profile cfg = opencodeCfgWithCredential(
+                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
+        Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.SECONDS.toNanos(1800));
+
+        // fleetd #234, round 4: safely a lambda now — the 3-arg overload is the interface's single
+        // abstract method, so there is no 2-arg overload left to bind to instead.
+        ExhaustionSink sink = (target, reason, profileHint) -> {
+            FleetConfig.Profile profile = profileHint == null ? null : profiles.get(profileHint);
+            if (profile != null) {
+                quarantine.quarantine(profile.effectiveCredentialId());
+            }
+        };
+
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, sink);
+        SessionManager sessions = new SessionManager(launcher);
+
+        // The mismatching row exists BEFORE the spawn — reproducing fleetd #234's exact timing:
+        // opencode's session table already carries evidence by the moment acquire() first asks.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+
+        assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");
+
+        // The real production entrypoint: acquire() builds the MemberSession by calling
+        // handle.agentSessionId() BEFORE registry.put() runs.
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+
+        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
+        assertTrue(quarantine.isQuarantined("openai-shared"),
+                "the mismatch fires DURING acquire(), before roster registration, and must still "
+                        + "reach the quarantine via the profile hint — not silently no-op");
+    }
+
+    /**
+     * The other half of the same proof: a sink that resolves {@code target -> profile} ONLY
+     * through the roster (i.e. ignores the profile hint entirely, ~today's pre-fix {@code
+     * Fleetd.java}) drops the SAME spawn-time mismatch silently — the credential is never
+     * quarantined even though {@link OpenCodeLauncher} logged the mismatch ERROR. This is the
+     * failure fleetd #234 reported, reproduced through the real {@code SessionManager.acquire()}
+     * path rather than asserted by inspecting the fix.
+     */
+    @Test
+    void aRosterOnlySinkSilentlyDropsTheSpawnTimeQuarantine(@TempDir Path configRoot,
+                                                              @TempDir Path discRoot) throws Exception {
+        FleetConfig.Profile cfg = opencodeCfgWithCredential(
+                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.SECONDS.toNanos(1800));
+
+        // Deliberately ignores the profile hint — the pre-fix shape: only a roster lookup (modelled
+        // here as always empty, since acquire() has not registered the session yet either way).
+        ExhaustionSink rosterOnlySink = (target, reason, profile) -> { };
+
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, rosterOnlySink);
+        SessionManager sessions = new SessionManager(launcher);
+
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+
+        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
+        assertFalse(quarantine.isQuarantined("openai-shared"),
+                "a roster-only sink cannot see this target yet — the quarantine silently never "
+                        + "happens, which is exactly fleetd #234 defect 2");
+    }
+
+    /**
+     * fleetd #234, round 2: the two tests above inject a sink DIRECTLY into {@link OpenCodeLauncher},
+     * which is not what {@code Fleetd.main} actually does. Production has one more hop: {@code
+     * Fleetd.java} builds the adapters (including {@code OpenCodeLauncher}) before {@code sessions}
+     * exists — a genuine construction-order cycle — so it hands the launcher a <em>forwarding</em>
+     * sink pointed at an {@code AtomicReference<ExhaustionSink>}, and only later {@code .set(...)}s
+     * that reference to the real sink once {@code sessions} is built.
+     *
+     * <p><strong>Round 3:</strong> a round-2 version of this test built its own copy of that
+     * forwarder's shape as an anonymous class. Mutating {@code Fleetd.java}'s ACTUAL forwarder back
+     * into a broken lambda left this test's own copy untouched, so it kept passing while production
+     * had regressed to the exact bug being fixed. This version instead calls {@link
+     * ExhaustionSink#forwardingTo}, the same factory {@code Fleetd.java} calls — the identical
+     * object, not a rebuilt copy of its shape — so a regression at either the {@code Fleetd.java}
+     * call site or inside {@code forwardingTo} itself has nowhere left to hide. See {@code
+     * ExhaustionSinkForwardingHazardTest} for the same factory exercised in isolation.
+     */
+    @Test
+    void theSpawnTimeQuarantineSurvivesTheFleetdStyleForwardingHop(@TempDir Path configRoot,
+                                                                     @TempDir Path discRoot) throws Exception {
+        FleetConfig.Profile cfg = opencodeCfgWithCredential(
+                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
+        Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.SECONDS.toNanos(1800));
+
+        // Fleetd.java:176 — the forwarding sink is built BEFORE the real one can exist, and the
+        // launcher below is constructed against this forwarder, exactly like Fleetd.main. Calling
+        // the SAME factory Fleetd.java calls — ExhaustionSink.forwardingTo — rather than rebuilding
+        // the forwarder's shape here is the whole point (fleetd #234, round 3): a round-2 version of
+        // this test built its own copy, so mutating Fleetd.java's real forwarder back into a lambda
+        // left this test untouched. Routed through the shared factory, a regression at either the
+        // Fleetd.java call site (reverting to a hand-written lambda) or inside the factory body
+        // itself has nowhere left to hide from this test.
+        java.util.concurrent.atomic.AtomicReference<ExhaustionSink> exhaustionSinkRef =
+                new java.util.concurrent.atomic.AtomicReference<>(ExhaustionSink.none());
+        ExhaustionSink forwardingExhaustionSink = ExhaustionSink.forwardingTo(exhaustionSinkRef::get);
+
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, forwardingExhaustionSink);
+        SessionManager sessions = new SessionManager(launcher);
+
+        // Fleetd.java:359-390 — the real sink is only built and pointed to AFTER `sessions` exists,
+        // same order as production. Safely a lambda (round 4): see the note on the forwarder above.
+        ExhaustionSink realSink = (target, reason, profileHint) -> {
+            FleetConfig.Profile profile = profileHint == null ? null : profiles.get(profileHint);
+            if (profile != null) {
+                quarantine.quarantine(profile.effectiveCredentialId());
+            }
+        };
+        exhaustionSinkRef.set(realSink);
+
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+
+        assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");
+
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+
+        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
+        assertTrue(quarantine.isQuarantined("openai-shared"),
+                "the profile hint must survive the Fleetd-style forwarding hop and reach the real "
+                        + "sink — a lambda forwarder drops it and this must go red");
+    }
 }
@@ -27,19 +27,30 @@ class OpenCodeSessionDiscoveryTest {
     * and insert one row. Static so {@link OpenCodeLauncherTest} can reuse it.
     */
    static void writeRecord(Path root, String id, String directory, long timeUpdated) throws Exception {
+        writeRecord(root, id, directory, timeUpdated, null);
+    }
+
+    /**
+     * Same as {@link #writeRecord(Path, String, String, long)}, plus the {@code model} column
+     * fleetd #175 reads — the raw JSON opencode writes, e.g.
+     * {@code {"id":"gpt-5.6-terra","providerID":"openai"}}. {@code modelJson} may be {@code null}.
+     */
+    static void writeRecord(Path root, String id, String directory, long timeUpdated, String modelJson)
+            throws Exception {
        Path db = root.resolve("opencode.db");
        try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + db)) {
            try (Statement statement = connection.createStatement()) {
                statement.execute("CREATE TABLE IF NOT EXISTS session ("
-                        + "id TEXT PRIMARY KEY, directory TEXT, time_updated INTEGER)");
+                        + "id TEXT PRIMARY KEY, directory TEXT, time_updated INTEGER, model TEXT)");
            }
            // Bound parameters, not string interpolation: the class under test uses a
            // PreparedStatement, and a hand-escaped INSERT here is a pattern someone copies out.
            try (PreparedStatement insert = connection.prepareStatement(
-                    "INSERT INTO session (id, directory, time_updated) VALUES (?, ?, ?)")) {
+                    "INSERT INTO session (id, directory, time_updated, model) VALUES (?, ?, ?, ?)")) {
                insert.setString(1, id);
                insert.setString(2, directory);
                insert.setLong(3, timeUpdated);
+                insert.setString(4, modelJson);
                insert.executeUpdate();
            }
        }
@@ -134,4 +145,107 @@ class OpenCodeSessionDiscoveryTest {
        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
                "an unreadable database resolves to null, not an exception");
    }
+
+    // --- fleetd #175/#234: actualModelForSessionId / the model JSON column -----------------------
+
+    @Test
+    void parsesTheModelJsonIntoProviderAndId(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
+
+        OpenCodeSessionDiscovery.ActualModel actual =
+                new OpenCodeSessionDiscovery(root).actualModelForSessionId("ses_aaa");
+
+        assertNotNull(actual, "a well-formed model JSON parses");
+        assertEquals("gpt-5.6-terra", actual.id());
+        assertEquals("openai", actual.provider());
+    }
+
+    @Test
+    void looksUpByIdEvenWhenAnotherRowInTheSameDirectoryIsNewer(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_ours", "/work/dir", 1000L, "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
+        writeRecord(root, "ses_sibling", "/work/dir", 9000L, "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
+
+        OpenCodeSessionDiscovery discovery = new OpenCodeSessionDiscovery(root);
+        assertEquals("gpt-5.6-terra", discovery.actualModelForSessionId("ses_ours").id(),
+                "querying by id reads OUR row, not the directory's newest row");
+        assertEquals("deepseek-v4-flash", discovery.actualModelForSessionId("ses_sibling").id(),
+                "each id resolves to its own row independently of time_updated ordering");
+    }
+
+    @Test
+    void anUnknownSessionIdYieldsUnknownModelRatherThanAMismatch(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "{\"id\":\"x\",\"providerID\":\"y\"}");
+
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForSessionId("ses_no_such_row"),
+                "no row for this id yet → unknown, not a wrong model");
+    }
+
+    @Test
+    void aBlankOrNullSessionIdYieldsUnknownModel(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "{\"id\":\"x\",\"providerID\":\"y\"}");
+
+        OpenCodeSessionDiscovery discovery = new OpenCodeSessionDiscovery(root);
+        assertNull(discovery.actualModelForSessionId(null));
+        assertNull(discovery.actualModelForSessionId("   "));
+    }
+
+    @Test
+    void aNullModelColumnYieldsUnknownWithoutThrowing(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, null);
+
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForSessionId("ses_aaa"),
+                "a row with no model value yet is unknown, not a mismatch");
+    }
+
+    @Test
+    void unparseableModelJsonYieldsUnknownWithoutThrowing(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "this is not json");
+
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForSessionId("ses_aaa"),
+                "JSON that fails to parse resolves to unknown, never an exception");
+    }
+
+    @Test
+    void modelJsonMissingIdYieldsUnknown(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "{\"providerID\":\"openai\"}");
+
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForSessionId("ses_aaa"),
+                "no id in the JSON → unknown, since id is what a caller actually compares");
+    }
+
+    @Test
+    void aMissingDatabaseYieldsUnknownModelWithoutThrowing(@TempDir Path root) {
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForSessionId("ses_aaa"));
+    }
+
+    /**
+     * fleetd #175 site 2: a schema that predates the {@code model} column entirely — the exact
+     * shape a real opencode upgrade/downgrade could produce. This must degrade to UNKNOWN for the
+     * model, and — the property that actually matters — must NOT take id resolution down with it.
+     * A combined single query for both columns would fail this test; that is why
+     * {@link OpenCodeSessionDiscovery#actualModelForSessionId} runs its own independent query.
+     */
+    @Test
+    void aMissingModelColumnYieldsUnknownButIdResolutionStillWorks(@TempDir Path root) throws Exception {
+        Path db = root.resolve("opencode.db");
+        try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + db)) {
+            try (Statement statement = connection.createStatement()) {
+                statement.execute("CREATE TABLE session (id TEXT PRIMARY KEY, directory TEXT, "
+                        + "time_updated INTEGER)");
+            }
+            try (PreparedStatement insert = connection.prepareStatement(
+                    "INSERT INTO session (id, directory, time_updated) VALUES (?, ?, ?)")) {
+                insert.setString(1, "ses_aaa");
+                insert.setString(2, "/w/a");
+                insert.setLong(3, 1000L);
+                insert.executeUpdate();
+            }
+        }
+
+        OpenCodeSessionDiscovery discovery = new OpenCodeSessionDiscovery(root);
+        assertEquals("ses_aaa", discovery.sessionIdForDirectory("/w/a"),
+                "id resolution must survive a database with no model column at all");
+        assertNull(discovery.actualModelForSessionId("ses_aaa"),
+                "no model column → unknown, not a throw and not a mismatch");
+    }
 }
@@ -56,7 +56,11 @@ class MessageServiceTest {

    /** Run {@code send} on a background thread; the current thread drives the worker's turn. */
    private CompletableFuture<MessageService.Reply> sendAsync() {
-        return CompletableFuture.supplyAsync(() -> messages.send(T, "do the task", 5000));
+        return sendAsync("do the task");
+    }
+
+    private CompletableFuture<MessageService.Reply> sendAsync(String content) {
+        return CompletableFuture.supplyAsync(() -> messages.send(T, content, 5000));
    }

    private void awaitWaiting() throws InterruptedException {
@@ -86,6 +90,94 @@ class MessageServiceTest {
        assertTrue(reply.completed(), "a scraped completion still counts as completed");
    }

+    @Test
+    void completionFallbackReplacesAnEchoedInjectedBriefWithNoReportOutcome() throws Exception {
+        String brief = "Implement the requested change. ".repeat(20);
+        CompletableFuture<MessageService.Reply> send = sendAsync(brief);
+        awaitWaiting();
+
+        herdr.readText("$ prompt");
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        herdr.readText("⏺ " + brief + "\n❯ ");
+        injector.onStatus(T, AgentStatus.IDLE);
+
+        MessageService.Reply reply = send.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.COMPLETED_UNREPLIED, reply.outcome());
+        assertEquals(CompletionResolver.NO_REPORT_PREFIX + "]", reply.text(),
+                "the real injector -> completion fallback path must not return the lead's brief");
+    }
+
+    @Test
+    void completionFallbackKeepsARealReportThatRestatesTheWholeBrief() throws Exception {
+        String brief = "Load the implementer skill. You own fleetd #999. ".repeat(12);
+        String report = brief + "\n\n## Report\n"
+                + ("I implemented the fix in GitWorktrees.java, added five tests, ran mvn clean install "
+                + "and got 1168 tests with 0 failures. Commit 321d8dc pushed. ").repeat(8);
+        CompletableFuture<MessageService.Reply> send = sendAsync(brief);
+        awaitWaiting();
+
+        herdr.readText("$ prompt");
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        herdr.readText("⏺ " + report + "\n❯ ");
+        injector.onStatus(T, AgentStatus.IDLE);
+
+        MessageService.Reply reply = send.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.COMPLETED_UNREPLIED, reply.outcome());
+        assertEquals(report.strip(), reply.text(), "a report that restates the whole brief must survive unchanged");
+    }
+
+    @Test
+    void completionFallbackNamesTheKnownWorktreeAndBranchForAnEchoedBrief() throws Exception {
+        FakeHerdr localHerdr = new FakeHerdr();
+        Rendezvous localRendezvous = new Rendezvous();
+        java.util.concurrent.atomic.AtomicLong localClock = new java.util.concurrent.atomic.AtomicLong();
+        CompletionResolver localCompletion = new CompletionResolver(new AgentControl(localHerdr), localRendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(),
+                dev.ltms.fleet.inject.BackendErrorPatternLookup.legacy(),
+                dev.ltms.fleet.inject.BackendErrorSink.none(),
+                () -> localClock.addAndGet(CompletionResolver.MIN_TURN_NANOS + 1),
+                target -> new CompletionResolver.WorktreeBranch("/tmp/member-worktree", "worker/cb241"));
+        Injector localInjector = new Injector(new AgentControl(localHerdr), localCompletion);
+        MessageService localMessages = new MessageService(new AgentControl(localHerdr), localInjector,
+                localRendezvous, new InMemoryReplyInbox());
+        String brief = "Implement the requested change. ".repeat(20);
+        CompletableFuture<MessageService.Reply> send =
+                CompletableFuture.supplyAsync(() -> localMessages.send(T, brief, 5000));
+        long deadline = System.currentTimeMillis() + 2000;
+        while (!localRendezvous.isWaiting(T) && System.currentTimeMillis() < deadline) {
+            Thread.sleep(5);
+        }
+        assertTrue(localRendezvous.isWaiting(T));
+
+        localHerdr.readText("$ prompt");
+        localInjector.onStatus(T, AgentStatus.IDLE);
+        localInjector.onStatus(T, AgentStatus.WORKING);
+        localHerdr.readText("⏺ " + brief + "\n❯ ");
+        localInjector.onStatus(T, AgentStatus.IDLE);
+
+        assertEquals(CompletionResolver.NO_REPORT_PREFIX + " worktree=/tmp/member-worktree "
+                        + "branch=worker/cb241]", send.get(5, TimeUnit.SECONDS).text());
+    }
+
+    @Test
+    void completionFallbackKeepsTheClippedMarkerWhenAnEchoedBriefIsTooLong() throws Exception {
+        String brief = "a".repeat(4_001); // CompletionResolver's 4,000-character scrape cap
+        CompletableFuture<MessageService.Reply> send = sendAsync(brief);
+        awaitWaiting();
+
+        herdr.readText("$ prompt");
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        herdr.readText("⏺ " + brief + "\n❯ ");
+        injector.onStatus(T, AgentStatus.IDLE);
+
+        assertEquals(CompletionResolver.NO_REPORT_PREFIX + "]\n"
+                        + "[Pane tail clipped: member did not call fleet_reply.]",
+                send.get(5, TimeUnit.SECONDS).text());
+    }
+
    @Test
    void backendErrorScrapeThroughMessageServiceFailsInsteadOfBecomingReplyText() throws Exception {
        // fleetd#164 (part 2 addendum): a scrape that reads cleanly but is only the backend's own
@@ -688,6 +780,32 @@ class MessageServiceTest {
        assertFailedTicket(third, "agent target term_a not found");
    }

+    // --- #137 follow-up: abandon() must not guess when more than one task is open ---------------
+    //
+    // A test combining a genuine stranded reply (hasStrandedReply(T)==true) with two simultaneously
+    // open matching tasks was attempted here and removed after investigation showed the combination
+    // is not reachable through the public API today, not merely hard to time right:
+    //
+    // This class has exactly two call sites that ever hold a target's entry in the session-lock map
+    // (send() and answer()), and both open a Rendezvous waiter for that same target as the first thing
+    // they do after acquiring the lock, holding lock and waiter together for their whole critical
+    // section. So "the lock is held" and "a live waiter is open" are the same fact throughout this
+    // class. reply()'s fast path always resolves a currently-open waiter directly instead of
+    // stranding — so a strand can only be created while NO task is accepted (lock free), and the
+    // instant the lock is next taken (by any parked matching task's own send(), the moment it is
+    // scheduled), that acceptance clears strandedReplies again (see send()'s CB-640 comment) before
+    // abandon() can ever observe both facts together. Confirmed empirically too: an earlier version of
+    // this test stranded a reply, then created an "accepted" task (awaitWaiting()) followed by a
+    // "parked" one — and the accepted task's own acceptance silently cleared the strand it was
+    // supposed to be racing against, so the parked task came back WORKER_FAILED instead of DONE, not
+    // because the fix was missing but because the test's premise could not be constructed.
+    //
+    // The reachable half — matching.size() >= 2 alone, no strand — is exactly what
+    // abandonFailsEveryPendingAsyncTicketForTheReleasedTarget already covers (all fail, none guess).
+    // The oldest-wins code in abandon() stays as defence in depth (see its own javadoc) against a
+    // regression that would make the conjunction reachable, e.g. clearing strandedReplies on a
+    // narrower condition than "any acceptance" — not because this suite exercises it today.
+
    @Test
    void abandonDoesNotFailAnAsyncTicketWaitingForAnAnswer() throws Exception {
        String ticket = messages.sendAsync(T, "task that asks");
@@ -43,6 +43,7 @@ class ReplyPushLoopTest {
    private static final String PRIMARY = "term_primary";
    private static final String WORKER = "term_worker";
    private static final String WORKER2 = "term_worker2";
+    private static final String OTHER_PRIMARY = "term_other_primary";
    private static final ObjectMapper MAPPER = new ObjectMapper();

    private PrimaryRegistry registry;
@@ -529,6 +530,106 @@ class ReplyPushLoopTest {
        assertTrue(nudge.contains("task-1"), "the ticket must not be dropped: " + nudge);
    }

+    // --- CB-201: backend credential outage nudges -----------------------------------------------
+
+    @Test
+    void oneBackendIncidentForTwoWorkersOfOneLeadSendsOnceAndIsOneShot() throws Exception {
+        var rec = recordingClient();
+        agents = new AgentControl(rec);
+        registry.recordDelegation(WORKER, PRIMARY);
+        registry.recordDelegation(WORKER2, PRIMARY);
+        var loop = loop(2, 100);
+
+        loop.onBackendIncident("incident-1", List.of(WORKER, WORKER2), "cred-a",
+                List.of("terra", "codex"), 47);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "one lead gets one outage injection");
+        Thread.sleep(200);
+        assertEquals(1, rec.sendCount(), "two workers for one lead must send only one outage notice");
+        String nudge = rec.sentParams().getFirst().getValue().toString();
+        assertTrue(nudge.contains("cred-a"));
+        assertTrue(nudge.contains("codex, terra"));
+        assertTrue(nudge.contains(WORKER) && nudge.contains(WORKER2));
+        assertTrue(nudge.contains("47 remaining seconds"));
+        assertTrue(nudge.contains("fleet_list"));
+
+        loop.onBackendIncident("incident-1", List.of(WORKER, WORKER2), "cred-a",
+                List.of("terra", "codex"), 47);
+        Thread.sleep(250);
+        assertEquals(1, rec.sendCount(), "a delivered incident id must never be sent again");
+    }
+
+    @Test
+    void oneBackendIncidentSendsOnceToEachAffectedLead() throws Exception {
+        var rec = recordingClient();
+        rec.sendLatch = new CountDownLatch(2);
+        agents = new AgentControl(rec);
+        registry.recordDelegation(WORKER, PRIMARY);
+        registry.recordDelegation(WORKER2, OTHER_PRIMARY);
+        var loop = loop(1, 50);
+
+        loop.onBackendIncident("incident-2", List.of(WORKER, WORKER2), "cred-a", List.of("terra"), 60);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "each affected lead gets its one notice");
+        assertEquals(2, rec.sendCount());
+    }
+
+    @Test
+    void backendIncidentWaitsForBusyLeadThenCombinesWithFailedTicket() throws Exception {
+        var rec = new BusyThenIdleHerdrClient(2);
+        agents = new AgentControl(rec);
+        var loop = loop(1, 50);
+
+        loop.onTicketTerminal("task-failed", WORKER, true);
+        loop.onBackendIncident("incident-3", List.of(WORKER), "cred-b", List.of("terra"), 31);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "busy lead should receive deferred combined nudge");
+        assertEquals(1, rec.sendCount(), "ticket and outage must use the same injection");
+        String nudge = rec.sentParams().getFirst().getValue().toString();
+        assertTrue(nudge.contains("task-failed") && nudge.contains("cred-b"),
+                "the one nudge must name both the failed ticket and outage: " + nudge);
+    }
+
+    @Test
+    void failedBackendIncidentSendRetriesWithinTheExistingReminderCap() throws Exception {
+        var rec = new ThrowOnceHerdrClient();
+        agents = new AgentControl(rec);
+        var loop = loop(2, 50);
+
+        loop.onBackendIncident("incident-4", List.of(WORKER), "cred-c", List.of("terra"), 20);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "failed first send must retry under maxReminders");
+        assertEquals(2, rec.promptAttempts.get(), "one failed send and one retry use the existing cap");
+    }
+
+    @Test
+    void unmappedBackendTargetUsesTheKnownLeadSchedule() throws Exception {
+        var rec = recordingClient();
+        agents = new AgentControl(rec);
+        var loop = loop(1, 50);
+
+        loop.onBackendTargetUnmapped(WORKER, "no credential matched");
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS));
+        String nudge = ((Map<?, ?>) rec.sentParams().getFirst().getValue()).get("text").toString();
+        assertEquals("A backend error on worker term_worker could not be mapped to a credential "
+                        + "(no credential matched) — no cool-off was applied. "
+                        + "Run fleet_list to check that worker.",
+                nudge);
+    }
+
+    @Test
+    void stopClearsPendingBackendIncidents() {
+        agents = agentWithStatus("idle");
+        var loop = loop(1, 100_000);
+        loop.onBackendIncident("incident-stop", List.of(WORKER), "cred-stop", List.of("terra"), 60);
+
+        loop.stop();
+
+        assertEquals(ReplyPushLoop.Action.STOP, loop.decide(PRIMARY, 0, 0, 0),
+                "stop must clear a pending backend incident as well as older sources");
+    }
+
    // --- CB-590 follow-up: per-source reminder budgets — the regression this round exists for ---

    @Test
@@ -928,6 +1029,31 @@ class ReplyPushLoopTest {
        return new RecordingHerdrClient();
    }

+    /** Fails its first prompt call, then records the retry. */
+    private static final class ThrowOnceHerdrClient implements HerdrClient {
+        private final AtomicInteger promptAttempts = new AtomicInteger();
+        private final CountDownLatch sendLatch = new CountDownLatch(1);
+
+        @Override
+        public JsonNode call(String method, Object params) {
+            if ("agent.get".equals(method)) {
+                return MAPPER.createObjectNode().set("agent", MAPPER.createObjectNode()
+                        .put("terminal_id", PRIMARY).put("agent_status", "idle"));
+            }
+            if ("agent.prompt".equals(method) && promptAttempts.getAndIncrement() == 0) {
+                throw new IllegalStateException("first prompt fails");
+            }
+            if ("agent.prompt".equals(method)) {
+                sendLatch.countDown();
+            }
+            return MAPPER.createObjectNode();
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
    /**
     * Thread-safe fake that reports {@code working} (not injectable) for its first
     * {@code busyChecks} status calls, then {@code idle} forever after — used to prove work queued
@@ -0,0 +1,266 @@
+package dev.ltms.fleet.placement;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Optional;
+import java.util.Set;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicLong;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #201 / #227: the credential-keyed outage decision itself, isolated from the classifier
+ * that produces events (Unit 1) and from the lead notice / spawn wiring (Units 3 and 5). The clock
+ * is a plain {@link AtomicLong} of nanos so the window and cool-off are exercised without a real
+ * sleep, exactly like {@code BackendQuarantineTest}.
+ */
+class BackendOutagePolicyTest {
+
+    private static final long SECOND = 1_000_000_000L;
+
+    @Test
+    void oneErrorCreatesNoIncidentAndNoCoolOff() {
+        BackendOutagePolicy policy = new BackendOutagePolicy(() -> 0L);
+
+        Optional<BackendOutagePolicy.Incident> incident =
+                policy.record("shared-openai", "session-1", "API Error: 429");
+
+        assertTrue(incident.isEmpty());
+        assertTrue(policy.remainingCoolOffSeconds("shared-openai").isEmpty());
+    }
+
+    @Test
+    void twoErrorsWithinTheWindowCreateExactlyOneIncidentAndA60SecondCoolOff() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        assertTrue(policy.record("shared-openai", "session-1", "API Error: 429").isEmpty());
+        now.set(30 * SECOND);
+        Optional<BackendOutagePolicy.Incident> incident =
+                policy.record("shared-openai", "session-2", "API Error: 500");
+
+        assertTrue(incident.isPresent());
+        BackendOutagePolicy.Incident value = incident.get();
+        assertEquals("shared-openai", value.credentialId());
+        assertEquals(Set.of("session-1", "session-2"), value.targets());
+        assertEquals(2, value.evidenceCount());
+        assertEquals(60L, value.windowSeconds());
+        assertEquals(60L, value.remainingCoolOffSeconds());
+        assertEquals(OptionalLongOf60(), policy.remainingCoolOffSeconds("shared-openai"));
+    }
+
+    @Test
+    void repeatedErrorsFromTheSameTargetNeverCreateAnIncidentHoweverManyTimesTheyRepeat() {
+        // The classifier is a heuristic and a valid member report can quote an "API Error:" line, so
+        // one target repeating that line inside the window must never, by itself, cost the credential
+        // its capacity — only a SECOND, DISTINCT target crossing the threshold does.
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        for (int i = 0; i < 5; i++) {
+            now.set(i * 10L * SECOND);
+            Optional<BackendOutagePolicy.Incident> incident =
+                    policy.record("shared-openai", "session-1", "API Error: 429");
+            assertTrue(incident.isEmpty(),
+                    "the same target repeating must never create an incident on its own (repeat #" + i + ")");
+        }
+        assertTrue(policy.remainingCoolOffSeconds("shared-openai").isEmpty());
+    }
+
+    @Test
+    void evidenceCountIsDistinctTargetsWhileReasonsKeepsEveryEvent() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        assertTrue(policy.record("shared-openai", "session-1", "API Error: 429").isEmpty());
+        now.set(10 * SECOND);
+        // a repeat from the already-counted target: still no incident, still only 1 distinct target
+        assertTrue(policy.record("shared-openai", "session-1", "API Error: 429 (again)").isEmpty());
+        now.set(20 * SECOND);
+        Optional<BackendOutagePolicy.Incident> incident =
+                policy.record("shared-openai", "session-2", "API Error: 500");
+
+        assertTrue(incident.isPresent());
+        BackendOutagePolicy.Incident value = incident.get();
+        assertEquals(Set.of("session-1", "session-2"), value.targets());
+        assertEquals(2, value.evidenceCount(), "evidenceCount is the distinct-target count");
+        assertEquals(3, value.reasons().size(),
+                "reasons keeps every event, including the same-target repeat that did not advance the count");
+        assertEquals(java.util.List.of("API Error: 429", "API Error: 429 (again)", "API Error: 500"),
+                value.reasons());
+    }
+
+    @Test
+    void twoErrorsMoreThanAMinuteApartCreateNoIncident() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        assertTrue(policy.record("shared-openai", "session-1", "API Error: 429").isEmpty());
+        now.set(60 * SECOND + 1);
+        Optional<BackendOutagePolicy.Incident> incident =
+                policy.record("shared-openai", "session-2", "API Error: 500");
+
+        assertTrue(incident.isEmpty(), "the first error's evidence must not survive past the window");
+        assertTrue(policy.remainingCoolOffSeconds("shared-openai").isEmpty());
+    }
+
+    @Test
+    void exactly60SecondsApartIsInsideTheWindow() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        assertTrue(policy.record("shared-openai", "session-1", "API Error: 429").isEmpty());
+        now.set(60 * SECOND); // exactly the boundary
+        Optional<BackendOutagePolicy.Incident> incident =
+                policy.record("shared-openai", "session-2", "API Error: 500");
+
+        assertTrue(incident.isPresent(), "60 seconds apart is inclusive of the window boundary");
+    }
+
+    @Test
+    void differentCredentialsNeverShareEvidence() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        assertTrue(policy.record("credential-a", "session-1", "API Error: 429").isEmpty());
+        now.set(10 * SECOND);
+        Optional<BackendOutagePolicy.Incident> incident =
+                policy.record("credential-b", "session-2", "API Error: 429");
+
+        assertTrue(incident.isEmpty(), "an unrelated credential must not be swept into the count");
+    }
+
+    @Test
+    void twoDifferentProfilesResolvingToTheSameCredentialShareEvidence() {
+        // The caller is responsible for resolving a profile to its credential id (see
+        // FleetConfig.Profile#effectiveCredentialId(), same as BackendQuarantine); this class only
+        // ever sees the resolved credentialId, so two different profile-originated events landing on
+        // the same credentialId must correlate.
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        assertTrue(policy.record("shared-openai", "session-from-profile-a", "API Error: 429").isEmpty());
+        now.set(5 * SECOND);
+        Optional<BackendOutagePolicy.Incident> incident =
+                policy.record("shared-openai", "session-from-profile-b", "API Error: 500");
+
+        assertTrue(incident.isPresent());
+    }
+
+    @Test
+    void errorsDuringCoolOffNeitherExtendTheDeadlineNorReturnAnotherIncident() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        policy.record("shared-openai", "session-1", "API Error: 429");
+        now.set(1 * SECOND);
+        policy.record("shared-openai", "session-2", "API Error: 500"); // crosses threshold, cool-off starts at t=1s, until t=61s
+
+        now.set(50 * SECOND);
+        Optional<BackendOutagePolicy.Incident> duringCoolOff =
+                policy.record("shared-openai", "session-3", "API Error: 500");
+        assertTrue(duringCoolOff.isEmpty(), "no second incident while cooling off");
+        assertEquals(OptionalLongOf(11), policy.remainingCoolOffSeconds("shared-openai"),
+                "the deadline must not have been pushed out by the error during cool-off");
+    }
+
+    @Test
+    void expiryClearsOldEvidenceSoTwoFreshErrorsAreRequiredToRearm() {
+        // Both errors land at the SAME instant (t=0) so the window boundary (60s from t=0) and the
+        // cool-off boundary (60s from the threshold crossing, also t=0) coincide exactly at t=60s.
+        // That is deliberate: with WINDOW_NANOS == COOLOFF_NANOS, checking "one fresh error" at any
+        // later instant would also be caught by the window naturally going stale, which would pass
+        // even if the explicit evidence-clear on cool-off expiry were missing. Checking exactly AT
+        // t=60s is the one instant where "now - firstEventNanos > WINDOW_NANOS" is false (60 is not
+        // > 60) but the cool-off has already elapsed ("now < coolOffUntilNanos" is false at 60 >= 60)
+        // — so only an explicit clear, not a side effect of the window check, keeps this from
+        // instantly re-mounting the old evidence and minting a bogus incident off one fresh error.
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        policy.record("shared-openai", "session-1", "API Error: 429");
+        policy.record("shared-openai", "session-2", "API Error: 500"); // cool-off until t=60s
+
+        now.set(60 * SECOND); // cool-off just elapsed, exactly at the window's own boundary too
+        Optional<BackendOutagePolicy.Incident> oneFreshError =
+                policy.record("shared-openai", "session-4", "API Error: 500");
+        assertTrue(oneFreshError.isEmpty(), "a single fresh error must not immediately re-trip");
+
+        now.set(61 * SECOND);
+        Optional<BackendOutagePolicy.Incident> secondFreshError =
+                policy.record("shared-openai", "session-5", "API Error: 500");
+        assertTrue(secondFreshError.isPresent(), "two fresh errors after expiry re-arm the policy");
+    }
+
+    @Test
+    void remainingSecondsRoundUp() {
+        AtomicLong now = new AtomicLong(0L);
+        BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+
+        policy.record("shared-openai", "session-1", "API Error: 429");
+        now.set(1); // 1 nanosecond later, still crosses the threshold
+        policy.record("shared-openai", "session-2", "API Error: 500");
+
+        // cool-off deadline is now(=1ns) + 60s exactly; a fraction-of-a-second-remaining check:
+        now.set(1 + 59 * SECOND + 1); // 59.000000001s of the cool-off has passed -> < 1s remains
+        assertEquals(OptionalLongOf(1), policy.remainingCoolOffSeconds("shared-openai"),
+                "a sub-second remainder must round up to a full second, matching BackendQuarantine");
+    }
+
+    @Test
+    void aConcurrentSecondAndThirdCallReturnOnlyOneIncidentBetweenThem() throws InterruptedException {
+        for (int attempt = 0; attempt < 25; attempt++) {
+            AtomicLong now = new AtomicLong(0L);
+            BackendOutagePolicy policy = new BackendOutagePolicy(now::get);
+            int threads = 8;
+            ExecutorService pool = Executors.newFixedThreadPool(threads);
+            CountDownLatch ready = new CountDownLatch(threads);
+            CountDownLatch go = new CountDownLatch(1);
+            AtomicInteger incidents = new AtomicInteger();
+
+            try {
+                for (int i = 0; i < threads; i++) {
+                    int idx = i;
+                    pool.submit(() -> {
+                        ready.countDown();
+                        try {
+                            go.await();
+                        } catch (InterruptedException e) {
+                            Thread.currentThread().interrupt();
+                            return;
+                        }
+                        Optional<BackendOutagePolicy.Incident> incident =
+                                policy.record("shared-openai", "session-" + idx, "API Error: 500");
+                        if (incident.isPresent()) {
+                            incidents.incrementAndGet();
+                        }
+                    });
+                }
+
+                assertTrue(ready.await(5, TimeUnit.SECONDS));
+                go.countDown();
+                pool.shutdown();
+                assertTrue(pool.awaitTermination(5, TimeUnit.SECONDS));
+
+                assertEquals(1, incidents.get(),
+                        "exactly one incident must be minted across every concurrent caller on attempt " + attempt);
+            } finally {
+                pool.shutdownNow();
+            }
+        }
+    }
+
+    private static java.util.OptionalLong OptionalLongOf60() {
+        return OptionalLongOf(60);
+    }
+
+    private static java.util.OptionalLong OptionalLongOf(long value) {
+        return java.util.OptionalLong.of(value);
+    }
+}
@@ -218,9 +218,17 @@ class FleetAppTest {

        HttpResponse<String> res = req(port, "GET", "/members");
        assertEquals(200, res.statusCode());
-        JsonNode workers = mapper.readTree(res.body()).get("workers");
-        assertEquals(1, workers.size());
-        JsonNode w = workers.get(0);
+        JsonNode body = mapper.readTree(res.body());
+        // fleetd #199: "members" is the canonical key. The endpoint is /members, so a caller that
+        // reads "members" must not see an empty fleet. "workers" is kept only as a deprecated alias
+        // and must carry the same rows — assert both, or the alias can silently drift.
+        JsonNode members = body.get("members");
+        assertNotNull(members, "GET /members must return its rows under \"members\"");
+        assertEquals(1, members.size());
+        JsonNode workers = body.get("workers");
+        assertNotNull(workers, "the deprecated \"workers\" alias is still emitted");
+        assertEquals(members, workers, "the alias must carry the same rows as \"members\"");
+        JsonNode w = members.get(0);
        assertEquals(spawned.get("terminalId").asText(), w.get("sessionId").asText());
        assertEquals(paneId, w.get("paneId").asText());
        assertEquals("ltms-local", w.get("profile").asText());
@@ -30,12 +30,19 @@ public final class FakeWorktrees implements Worktrees {
    public record PruneCall(String repoRoot, long minAgeMillis) {
    }

+    public record ShareCall(String repoRoot, String worktreePath) {
+    }
+
    private final List<AddCall> addCalls = new CopyOnWriteArrayList<>();
    private final List<RemoveCall> removeCalls = new CopyOnWriteArrayList<>();
    private final List<OverlayCall> overlayCalls = new CopyOnWriteArrayList<>();
    private final List<RepoRootCall> repoRootCalls = new CopyOnWriteArrayList<>();
    private final List<SnapshotCall> snapshotCalls = new CopyOnWriteArrayList<>();
    private final List<PruneCall> pruneCalls = new CopyOnWriteArrayList<>();
+    private final List<ShareCall> shareCalls = new CopyOnWriteArrayList<>();
+    /** Tags every {@code overlayParity}/{@code shareWithGroup} call in call order, so a test can
+     *  pin that sharing runs after the overlay copy (fleetd #185 stage 3). */
+    private final List<String> overlayShareOrder = new CopyOnWriteArrayList<>();
    private final Set<String> existingPaths = ConcurrentHashMap.newKeySet();
    private final Set<String> trackedPaths = ConcurrentHashMap.newKeySet();
    private final AtomicLong snapshotSeq = new AtomicLong();
@@ -136,6 +143,13 @@ public final class FakeWorktrees implements Worktrees {
        }
        overlayCalls.add(new OverlayCall(repoRoot, worktreePath, List.copyOf(overlay),
                List.copyOf(copied), List.copyOf(skipped)));
+        overlayShareOrder.add("overlay:" + worktreePath);
+    }
+
+    @Override
+    public void shareWithGroup(String repoRoot, String worktreePath) {
+        shareCalls.add(new ShareCall(repoRoot, worktreePath));
+        overlayShareOrder.add("share:" + worktreePath);
    }

    @Override
@@ -203,4 +217,17 @@ public final class FakeWorktrees implements Worktrees {
    public SnapshotCall lastSnapshot() {
        return snapshotCalls.isEmpty() ? null : snapshotCalls.getLast();
    }
+
+    public List<ShareCall> shareCalls() {
+        return List.copyOf(shareCalls);
+    }
+
+    public ShareCall lastShare() {
+        return shareCalls.isEmpty() ? null : shareCalls.getLast();
+    }
+
+    /** Call-order tags ({@code "overlay:<path>"}/{@code "share:<path>"}) — see field javadoc. */
+    public List<String> overlayShareOrder() {
+        return List.copyOf(overlayShareOrder);
+    }
 }
@@ -924,4 +924,257 @@ class GitWorktreesTest {
        assertEquals(2, stats.count(), "two snapshot refs are reported");
        assertTrue(stats.costBytes() > 0, "the cost of the snapshots is a positive byte count");
    }
+
+    /**
+     * fleetd #185 stage 3: a recording {@link java.util.function.Function} test seam stands in for
+     * every process {@link GitWorktrees#shareWithGroup} would run — no real second OS user/group
+     * exists on this host, so these are unit tests against that seam, not a live-group integration
+     * test (out of scope per the ticket).
+     */
+    private static List<String> joined(String[] command) {
+        return List.of(command);
+    }
+
+    /** Remove {@code path} and anything under it. Tolerates an already-absent path. */
+    private static void deleteRecursively(Path path) throws Exception {
+        if (!Files.exists(path)) {
+            return;
+        }
+        if (Files.isDirectory(path)) {
+            try (java.util.stream.Stream<Path> children = Files.list(path)) {
+                for (Path child : children.toList()) {
+                    deleteRecursively(child);
+                }
+            }
+        }
+        Files.delete(path);
+    }
+
+    /** {@code worktreeGroup} absent ⇒ zero processes spawned and no git config written. */
+    @Test
+    void shareWithGroupIsNoopWhenNoGroupConfigured(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString(), null, _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repo.toString(), repo.resolve("some-worktree").toString());
+
+        assertTrue(recorded.isEmpty(), "no group configured must spawn no process at all: " + recorded);
+    }
+
+    /** A configured group runs {@code git config core.sharedRepository group} first, then
+     *  chgrp/chmod/setgid over every path {@link GitWorktrees#shareWithGroup} documents. */
+    @Test
+    void shareWithGroupRunsConfigThenChgrpChmodSetgidPerPath(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        Path worktree = Files.createDirectories(repo.resolve("some-worktree"));
+        String worktreePath = worktree.toString();
+        Files.createDirectories(repo.resolve(".git/worktrees"));
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            // What real git answers for an ordinary (non-linked) checkout: relative to repoRoot.
+            return List.of(cmd).contains("--git-common-dir") ? ".git\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, worktreePath);
+
+        assertEquals(List.of("git", "-C", repoRoot, "config", "core.sharedRepository", "group"), recorded.get(0),
+                "core.sharedRepository must be set first, so it keeps working after the one-time fix-up");
+        assertTrue(recorded.contains(List.of("git", "-C", repoRoot, "rev-parse", "--git-common-dir")),
+                "the git dir must be asked for, never hardcoded as <repoRoot>/.git — that is a FILE "
+                        + "when the checkout is itself a linked worktree: " + recorded);
+
+        for (String dir : List.of(worktreePath, repoRoot + "/.git/objects", repoRoot + "/.git/refs",
+                repoRoot + "/.git/logs", repoRoot + "/.git/worktrees")) {
+            assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", dir)), "missing chgrp -R for " + dir);
+            assertTrue(recorded.contains(List.of("chmod", "-R", "g+rwX", dir)), "missing chmod -R for " + dir);
+            assertTrue(recorded.contains(List.of("find", dir, "-type", "d", "-exec", "chmod", "g+s", "{}", "+")),
+                    "missing setgid find pass for " + dir);
+        }
+        // packed-refs does not exist in a freshly-init'd repo (only git gc / pack-refs creates it) —
+        // tolerated absence, so it must not appear at all: no recursive/-R treatment for a plain file.
+        String packedRefs = repoRoot + "/.git/packed-refs";
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(packedRefs)),
+                "packed-refs is absent here and must be skipped, not chgrp'd: " + recorded);
+    }
+
+    /**
+     * A path that does not exist is skipped, never handed to {@code chgrp}. {@code .git/logs} is
+     * absent whenever {@code core.logAllRefUpdates} is false or no ref has been updated yet, and
+     * {@code chgrp} on a missing path exits non-zero — which would fail EVERY provisioning spawn
+     * with a message blaming a group that is in fact fine.
+     */
+    @Test
+    void shareWithGroupSkipsPathsThatDoNotExist(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        deleteRecursively(repo.resolve(".git/logs"));
+        assertFalse(Files.exists(repo.resolve(".git/logs")), "fixture: .git/logs must be gone");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return List.of(cmd).contains("--git-common-dir") ? ".git\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, repo.resolve("no-such-worktree").toString());
+
+        String logs = repoRoot + "/.git/logs";
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(logs)),
+                "a missing .git/logs must be skipped, not chgrp'd: " + recorded);
+        assertTrue(recorded.stream().noneMatch(c -> c.contains(repo.resolve("no-such-worktree").toString())),
+                "a missing worktree path must be skipped too: " + recorded);
+        assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", repoRoot + "/.git/objects")),
+                "paths that DO exist are still shared: " + recorded);
+    }
+
+    /**
+     * The git store is located by {@code rev-parse --git-common-dir}, not by appending
+     * {@code /.git}. When git answers with an absolute path — what it does for a linked worktree,
+     * where {@code <repoRoot>/.git} is a file — every shared path must follow that answer.
+     */
+    @Test
+    void shareWithGroupFollowsAnAbsoluteGitCommonDir(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path realGitDir = repo.resolve(".git");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return List.of(cmd).contains("--git-common-dir") ? realGitDir + "\n" : "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(tmp.resolve("some/linked/worktree").toString(),
+                repo.resolve("wt").toString());
+
+        assertTrue(recorded.contains(List.of("chgrp", "-R", "devteam", realGitDir + "/objects")),
+                "objects must be taken from the reported common dir, not <repoRoot>/.git: " + recorded);
+    }
+
+    /** {@code packed-refs}, when present, is chgrp/chmod'd but never setgid'd (it is a file, not a dir). */
+    @Test
+    void shareWithGroupIncludesPackedRefsWhenPresent(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        String repoRoot = repo.toString();
+        Path packedRefsPath = repo.resolve(".git/packed-refs");
+        Files.writeString(packedRefsPath, "");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees =
+                new GitWorktrees(tmp.resolve("wts").toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.shareWithGroup(repoRoot, repo.resolve("some-worktree").toString());
+
+        String packedRefs = packedRefsPath.toString();
+        assertTrue(recorded.contains(List.of("chgrp", "devteam", packedRefs)),
+                "packed-refs must be chgrp'd non-recursively when present: " + recorded);
+        assertTrue(recorded.contains(List.of("chmod", "g+rwX", packedRefs)),
+                "packed-refs must be chmod'd non-recursively when present: " + recorded);
+        assertTrue(recorded.stream().noneMatch(c -> c.contains("find") && c.contains(packedRefs)),
+                "packed-refs (a file) must never get the recursive setgid pass: " + recorded);
+    }
+
+    /** A group that does not exist (or that the operator is not a member of) fails loudly, naming it. */
+    @Test
+    void shareWithGroupThrowsNamingTheGroupWhenChgrpFails(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString(), "cb185-nonexistent-group-zz");
+        String wt = new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-185-share", "HEAD");
+
+        WorktreeException e = assertThrows(WorktreeException.class,
+                () -> gitWorktrees.shareWithGroup(repo.toString(), wt));
+        assertTrue(e.getMessage().contains("cb185-nonexistent-group-zz"),
+                "exception must name the missing/refused group: " + e.getMessage());
+    }
+
+    // --- fleetd #224: worktreeRoot itself must be group-traversable, established in add() ---------
+
+    /**
+     * {@code add} must make the worktree ROOT itself group-traversable when a group is configured —
+     * established once here, where the root is created, never at a use site (never inside a
+     * launcher). A recording runner stands in for chgrp/chmod, the same seam
+     * {@link #shareWithGroupRunsConfigThenChgrpChmodSetgidPerPath} uses for the per-worktree share.
+     */
+    @Test
+    void addSharesWorktreeRootWithGroupWhenConfigured(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path root = tmp.resolve("wts");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees = new GitWorktrees(root.toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.add(repo.toString(), "cb-224-branch", "HEAD");
+
+        assertTrue(recorded.contains(List.of("chgrp", "devteam", root.toString())),
+                "the worktree root itself must be chgrp'd to the configured group: " + recorded);
+        assertTrue(recorded.contains(List.of("chmod", "g+x", root.toString())),
+                "the worktree root itself must gain group-execute so a different-uid member can "
+                        + "traverse into it: " + recorded);
+    }
+
+    /** {@code worktreeGroup} unset (today's only live mode) ⇒ {@code add} spawns no share process
+     *  for the root at all — behaviour must be byte-identical to before fleetd #224. */
+    @Test
+    void addSharesNothingForTheRootWhenNoGroupConfigured(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path root = tmp.resolve("wts");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees = new GitWorktrees(root.toString(), null, _ -> {}, recordingRunner);
+
+        gitWorktrees.add(repo.toString(), "cb-224-nogroup", "HEAD");
+
+        assertTrue(recorded.isEmpty(), "no group configured must spawn no share process for the "
+                + "root at all: " + recorded);
+    }
+
+    /**
+     * fleetd #224, acceptance criterion 2/3: when the root cannot be made group-traversable — here
+     * because the configured group does not exist, the same real-failure shape
+     * {@link #shareWithGroupThrowsNamingTheGroupWhenChgrpFails} drives for the per-worktree share —
+     * the spawn is refused with a message naming the root, its current mode, and the group. This
+     * drives the REAL {@code chgrp} (no recording runner), and the refusal happens before {@code git
+     * worktree add} ever runs, so no partial worktree is left behind either.
+     */
+    @Test
+    void addRefusesWhenWorktreeRootCannotBeMadeGroupTraversable(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path root = tmp.resolve("wts");
+        GitWorktrees gitWorktrees = new GitWorktrees(root.toString(), "cb224-nonexistent-group-zz");
+
+        WorktreeException e = assertThrows(WorktreeException.class,
+                () -> gitWorktrees.add(repo.toString(), "cb-224-refuse", "HEAD"));
+
+        assertTrue(e.getMessage().contains(root.toString()),
+                "refusal must name the worktree root: " + e.getMessage());
+        assertTrue(e.getMessage().contains("cb224-nonexistent-group-zz"),
+                "refusal must name the missing/refused group: " + e.getMessage());
+        assertTrue(Files.isDirectory(root), "the root is created before the group check runs");
+        String mode = java.nio.file.attribute.PosixFilePermissions.toString(Files.getPosixFilePermissions(root));
+        assertTrue(e.getMessage().contains(mode),
+                "refusal must name the root's current mode (" + mode + "): " + e.getMessage());
+        try (java.util.stream.Stream<Path> children = Files.list(root)) {
+            assertTrue(children.findAny().isEmpty(), "no worktree must be left behind under the root: "
+                    + "the refusal must happen before `git worktree add` ever runs");
+        }
+    }
 }
@@ -4,6 +4,8 @@ import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.LoggerContext;
 import ch.qos.logback.classic.spi.ILoggingEvent;
 import ch.qos.logback.core.read.ListAppender;
+import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.MemberLifecycle;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -148,6 +150,10 @@ class SessionManagerTest {
            return 0;
        }

+        @Override
+        public void shareWithGroup(String repoRoot, String worktreePath) {
+        }
+
        List<String> removeCalls() {
            return List.copyOf(removeCalls);
        }
@@ -294,6 +300,151 @@ class SessionManagerTest {
        assertTrue(sessions.roster().contains(updated), "FAILED is still in acquired-minus-released roster");
    }

+    @Test
+    void backendErrorWinsBeforeNormalCompletionFromBusy() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        sessions.asPresence().markPresent(session.terminalId());
+        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
+
+        assertTrue(sessions.onBackendError(session.terminalId(), "backend exited"));
+        sessions.onTurnComplete(session.terminalId());
+
+        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
+        assertEquals(MemberSession.State.BACKEND_ERROR, updated.state(),
+                "normal completion must not restore DONE after a backend error from BUSY");
+        assertEquals("backend exited", updated.failureReason());
+    }
+
+    @Test
+    void backendErrorWinsAfterNormalCompletionFromDone() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        sessions.asPresence().markPresent(session.terminalId());
+        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
+        sessions.onTurnComplete(session.terminalId());
+
+        assertTrue(sessions.onBackendError(session.terminalId(), "backend exited"));
+
+        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
+        assertEquals(MemberSession.State.BACKEND_ERROR, updated.state(),
+                "backend error must replace DONE when normal completion won first");
+        assertEquals("backend exited", updated.failureReason());
+    }
+
+    @Test
+    void backendErrorMemberCannotReceiveAnotherDelivery() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        sessions.asPresence().markPresent(session.terminalId());
+        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
+        assertTrue(sessions.onBackendError(session.terminalId(), "backend exited"));
+
+        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
+
+        assertEquals(MemberSession.State.BACKEND_ERROR, sessions.get(session.paneId()).orElseThrow().state(),
+                "onDelivered must refuse a backend-error member");
+    }
+
+    @Test
+    void losingCompletionDoesNotReleaseOrClearABackendErrorMember() {
+        assertLosingCompletionLeavesBackendErrorIntact(1, false,
+                "a stale completion must not release a backend-error member at the context cap");
+        assertLosingCompletionLeavesBackendErrorIntact(0, true,
+                "a stale completion must not clear the context of a backend-error member");
+    }
+
+    private void assertLosingCompletionLeavesBackendErrorIntact(int contextCap, boolean clearAfterTurn,
+                                                                  String protectedAction) {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
+                "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher delegate = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
+        ClearContextSpyLauncher launcher = new ClearContextSpyLauncher(delegate);
+        java.util.concurrent.atomic.AtomicReference<SessionManager> manager = new java.util.concurrent.atomic.AtomicReference<>();
+        java.util.concurrent.atomic.AtomicReference<String> terminal = new java.util.concurrent.atomic.AtomicReference<>();
+        java.util.concurrent.atomic.AtomicBoolean armed = new java.util.concurrent.atomic.AtomicBoolean();
+        SessionManager sessions = new SessionManager(launcher, new RecordingWorktrees(), () -> {
+            if (armed.compareAndSet(true, false)) {
+                manager.get().onBackendError(terminal.get(), "backend exited during completion");
+            }
+            return 1;
+        }, contextCap, clearAfterTurn);
+        manager.set(sessions);
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        terminal.set(session.terminalId());
+        sessions.asPresence().markPresent(session.terminalId());
+        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
+        armed.set(true);
+
+        assertFalse(sessions.onTurnCompleteWithPostAction(session.terminalId()),
+                "the completion CAS loses after the injected backend error");
+
+        assertTrue(sessions.get(session.paneId()).isPresent(), protectedAction);
+        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
+        assertEquals(MemberSession.State.BACKEND_ERROR, updated.state());
+        assertEquals("backend exited during completion", updated.failureReason());
+        assertFalse(herdr.called("pane.close"), protectedAction);
+        assertEquals(0, launcher.clearContextCalls(), protectedAction);
+    }
+
+    @Test
+    void backendErrorForUnknownTargetIsWarnedAndDoesNotCreateASession() {
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger sessionLog =
+                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        sessionLog.addAppender(appender);
+        try {
+            SessionManager sessions = sessionManager(new FakeHerdr());
+
+            assertFalse(sessions.onBackendError("term_missing", "backend exited"));
+
+            assertTrue(sessions.roster().isEmpty(), "unknown target must not create a session");
+            assertTrue(appender.list.stream().anyMatch(e -> e.getLevel().equals(Level.WARN)
+                            && e.getFormattedMessage().contains("term_missing")),
+                    "unknown target is logged at WARN");
+        } finally {
+            sessionLog.detachAppender(appender);
+        }
+    }
+
+    @Test
+    void backendErrorForReleasedTargetDoesNotRecreateTheSession() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        sessions.release(session.paneId());
+
+        assertFalse(sessions.onBackendError(session.terminalId(), "backend exited"));
+        assertTrue(sessions.get(session.paneId()).isEmpty(), "released session must stay absent");
+    }
+
+    @Test
+    void rosterViewIncludesFailureReasonOnlyForBackendError() {
+        MemberSession failed = new MemberSession("pane-error", "term-error", "prof", MemberRole.DEV,
+                "/cwd", null, 0, 0, 1, MemberSession.State.BACKEND_ERROR, null, null,
+                null, null, "backend exited");
+        MemberSession ordinary = new MemberSession("pane-ready", "term-ready", "prof", MemberRole.DEV,
+                "/cwd", null, 0, 0, 0, MemberSession.State.READY, null, null);
+
+        Map<String, Object> failedView = SessionManager.rosterView(failed, null);
+        Map<String, Object> ordinaryView = SessionManager.rosterView(ordinary, null);
+
+        assertEquals("backend_error", failedView.get("state"));
+        assertEquals("backend exited", failedView.get("failureReason"));
+        assertFalse(ordinaryView.containsKey("failureReason"),
+                "ordinary rows must not gain a blank failureReason field");
+    }
+
    @Test
    void onTurnFailedIsLoggedAtWarnWithThePriorState() {
        // CB-564: this transition used to be a bare DEBUG "session marked failed" — a symptom with no
@@ -329,6 +480,110 @@ class SessionManagerTest {
        }
    }

+    /**
+     * fleetd #226: a contended slot is refused through the real {@link SessionManager#acquire}
+     * path before the real launcher can hand an architect charter to a process.
+     */
+    @Test
+    void aContendedArchitectSlotRefusesBeforeTheLauncherStartsAMember() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberRegistry members = architectRegistry();
+        assertTrue(members.bind("architect:opus", "term_already_bound"),
+                "precondition: occupy the sole architect slot before the real spawn under test");
+        sessions.setMemberLifecycle(members);
+
+        assertThrows(IllegalArgumentException.class, () -> sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller", "term_primary", null));
+
+        assertFalse(herdr.called("agent.start"), "a refused slot must never reach the launcher");
+        assertTrue(sessions.roster().isEmpty(), "no member exists to receive the wrong charter");
+    }
+
+    @Test
+    void aSecondArchitectOnAnAlreadyBoundProfileIsHeldAsDevNotArchitectAndWarnsLoudly() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberRegistry members = architectRegistry();
+        sessions.setMemberLifecycle(bindFailureAfterReservation(members));
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger registryLog = (ch.qos.logback.classic.Logger)
+                LoggerFactory.getLogger(MemberRegistry.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        registryLog.addAppender(appender);
+        registryLog.setLevel(Level.WARN);
+        try {
+            MemberSession session = sessions.acquire("ltms-local", MemberRole.ARCHITECT, null,
+                    "/caller", "term_primary", null);
+
+            assertEquals(MemberRole.DEV, session.role(), "a failed reservation bind must use the fallback");
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .findFirst()
+                    .orElse("no slot-exhaustion WARN logged");
+            assertTrue(warn.contains("ltms-local"), "the WARN names the profile: " + warn);
+            assertTrue(warn.contains(session.terminalId()), "the WARN names the terminal: " + warn);
+        } finally {
+            registryLog.detachAppender(appender);
+        }
+    }
+
+    @Test
+    void reservedArchitectSlotBindsTheLaunchedMember() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        sessions.setMemberLifecycle(architectRegistry());
+
+        MemberSession session = sessions.acquire("ltms-local", MemberRole.ARCHITECT, null,
+                "/caller", "term_primary", null);
+
+        assertEquals(MemberRole.ARCHITECT, session.role());
+    }
+
+    private static MemberRegistry architectRegistry() {
+        return new MemberRegistry(new FleetConfig.Fleet(Map.of(), Map.of("opus", new FleetConfig.Slot("ltms-local")),
+                Map.of(), Map.of(), null));
+    }
+
+    private static MemberLifecycle bindFailureAfterReservation(MemberRegistry members) {
+        return new MemberLifecycle() {
+            @Override
+            public MemberRole acquired(MemberRole role, String profile, String terminal) {
+                return members.acquired(role, profile, terminal);
+            }
+
+            @Override
+            public void released(String terminal) {
+                members.released(terminal);
+            }
+
+            @Override
+            public void requireSlotFor(MemberRole role, String profile) {
+                members.requireSlotFor(role, profile);
+            }
+
+            @Override
+            public SlotReservation reserve(MemberRole role, String profile) {
+                return members.reserve(role, profile);
+            }
+
+            @Override
+            public boolean bind(SlotReservation reservation, String terminal) {
+                members.release(reservation);
+                assertTrue(members.bind(reservation.slot(), "term_racer"), "the racer takes the released slot");
+                return false;
+            }
+
+            @Override
+            public void release(SlotReservation reservation) {
+                members.release(reservation);
+            }
+        };
+    }
+
    @Test
    void rosterReflectsAcquiredMinusReleased() {
        FakeHerdr herdr = new FakeHerdr();
@@ -595,6 +850,32 @@ class SessionManagerTest {
                "no session is registered when spawn times out (roster empty)");
    }

+    @Test
+    void failedArchitectLaunchReleasesItsReservationForTheNextLaunch() {
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown");
+        long[] clock = {0};
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
+                "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
+                1, () -> clock[0], () -> clock[0] += 10);
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(), () -> 0L, 0);
+        sessions.setMemberLifecycle(architectRegistry());
+
+        assertThrows(PeerUnreachableException.class, () -> sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller", "term_primary", null));
+
+        herdr.agentStatus("idle");
+        MemberSession retry = sessions.acquire("ltms-local", MemberRole.ARCHITECT, null,
+                "/caller", "term_primary", null);
+        assertEquals(MemberRole.ARCHITECT, retry.role(),
+                "the failed launch returned its reservation instead of silently shrinking the slot pool");
+    }
+
    // --- CB-516: release must notify, so a blocked send can be failed --------------------------

    @Test
@@ -868,6 +1149,76 @@ class SessionManagerTest {
        }
    }

+    /** Delegates all launcher work while recording context clears. */
+    private static final class ClearContextSpyLauncher implements PeerLauncher {
+        private final PeerLauncher delegate;
+        private int clearContextCalls;
+
+        ClearContextSpyLauncher(PeerLauncher delegate) {
+            this.delegate = delegate;
+        }
+
+        @Override
+        public Set<Capability> capabilities() {
+            return delegate.capabilities();
+        }
+
+        @Override
+        public Set<Capability> capabilitiesFor(String profileName) {
+            return delegate.capabilitiesFor(profileName);
+        }
+
+        @Override
+        public PeerHandle spawn(SpawnRequest req) {
+            return delegate.spawn(req);
+        }
+
+        @Override
+        public Set<String> profiles() {
+            return delegate.profiles();
+        }
+
+        @Override
+        public String defaultProfile() {
+            return delegate.defaultProfile();
+        }
+
+        @Override
+        public String effectiveCwd(SpawnRequest req) {
+            return delegate.effectiveCwd(req);
+        }
+
+        @Override
+        public List<String> parityOverlay(String profileName) {
+            return delegate.parityOverlay(profileName);
+        }
+
+        @Override
+        public List<?> list() {
+            return delegate.list();
+        }
+
+        @Override
+        public int reapOrphanWorkers() {
+            return delegate.reapOrphanWorkers();
+        }
+
+        @Override
+        public void stop(String id) {
+            delegate.stop(id);
+        }
+
+        @Override
+        public boolean clearContext(String id) {
+            clearContextCalls++;
+            return delegate.clearContext(id);
+        }
+
+        int clearContextCalls() {
+            return clearContextCalls;
+        }
+    }
+
    @Test
    void acquireRecordsTheAgentSessionIdFromTheHandle() {
        FakeHerdr herdr = new FakeHerdr();
@@ -883,15 +1234,18 @@ class SessionManagerTest {
    }

    @Test
-    void acquireWithNeitherSessionFieldLeavesAgentSessionIdNull() {
+    void acquireWithNeitherSessionFieldStillMintsAnAgentSessionId() {
+        // fleetd #214: the claude-code launcher mints a session id for EVERY spawn, so a member is
+        // resumable even when the spawn asked for no session identity.
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);

        MemberSession s = sessions.acquire("ltms-local", null, null, null);

-        assertNull(s.agentSessionId(), "no identity requested — unchanged from before CB-584");
-        assertFalse(SessionManager.rosterView(s, null).containsKey("agentSessionId"),
-                "a null id is omitted from the roster, like charterSha256 for a receipt-less session");
+        assertNotNull(s.agentSessionId(),
+                "fleetd #214: a plain spawn mints a session id, so every member is resumable");
+        assertTrue(SessionManager.rosterView(s, null).containsKey("agentSessionId"),
+                "the minted id is in the roster, so fleet_list advertises every member's resume handle");
    }

    @Test
@@ -927,4 +1281,235 @@ class SessionManagerTest {
        assertTrue(e.getMessage().contains("SESSION_RESUME"), e.getMessage());
        assertTrue(e.getMessage().contains("stub-profile"), e.getMessage());
    }
+
+    // ── fleetd #209: agentSessionId resolved lazily against the retained handle ─────────────────
+    //
+    // The opencode adapter cannot answer PeerHandle.agentSessionId() at spawn time — the on-disk
+    // session row is written only after the pane is live — so the id must be re-polled on a LATER
+    // call, against the SAME handle instance the launcher returned at spawn. SessionManager used
+    // to let that handle go out of scope at the end of the spawn method, so no caller ever re-asked
+    // it and fleet_list/fleet_status never saw the id. LazyIdHandle below reproduces exactly that
+    // shape: null on the first N calls (the spawn-time call included), a real id after.
+
+    /**
+     * A {@link PeerHandle} whose {@link #agentSessionId()} answers {@code null} for its first
+     * {@code nullCalls} invocations, then either a fixed id or a configured throw on every call
+     * after that — the shape of the opencode bug (fleetd #209): the session row is not written
+     * until after the pane is live, so early polls come back empty and a later one finds it.
+     */
+    private static final class LazyIdHandle implements PeerHandle {
+        private final String id;
+        private final String terminalId;
+        private final int nullCalls;
+        private final String resolvedId;
+        private final java.util.concurrent.atomic.AtomicInteger calls =
+                new java.util.concurrent.atomic.AtomicInteger();
+        private volatile RuntimeException throwAfter;
+
+        LazyIdHandle(String id, String terminalId, int nullCalls, String resolvedId) {
+            this.id = id;
+            this.terminalId = terminalId;
+            this.nullCalls = nullCalls;
+            this.resolvedId = resolvedId;
+        }
+
+        /** After the null calls are exhausted, throw instead of answering the resolved id. */
+        LazyIdHandle throwing(RuntimeException e) {
+            this.throwAfter = e;
+            return this;
+        }
+
+        @Override
+        public String id() {
+            return id;
+        }
+
+        @Override
+        public String terminalId() {
+            return terminalId;
+        }
+
+        @Override
+        public String agentSessionId() {
+            int n = calls.incrementAndGet();
+            if (n <= nullCalls) {
+                return null;
+            }
+            if (throwAfter != null) {
+                throw throwAfter;
+            }
+            return resolvedId;
+        }
+
+        @Override
+        public CharterReceipt charterReceipt() {
+            return null;
+        }
+
+        int callCount() {
+            return calls.get();
+        }
+    }
+
+    /** A minimal {@link PeerLauncher} that hands out pre-built {@link LazyIdHandle}s, one per spawn. */
+    private static final class LazyIdLauncher implements PeerLauncher {
+        private final java.util.Deque<LazyIdHandle> queued = new java.util.ArrayDeque<>();
+
+        LazyIdLauncher queue(LazyIdHandle handle) {
+            queued.add(handle);
+            return this;
+        }
+
+        @Override
+        public Set<Capability> capabilities() {
+            return Set.of(Capability.WORKTREE, Capability.SESSION_RESUME);
+        }
+
+        @Override
+        public Set<Capability> capabilitiesFor(String profileName) {
+            return capabilities();
+        }
+
+        @Override
+        public PeerHandle spawn(SpawnRequest req) {
+            LazyIdHandle handle = queued.poll();
+            if (handle == null) {
+                throw new IllegalStateException("no queued LazyIdHandle for this spawn");
+            }
+            return handle;
+        }
+
+        @Override
+        public Set<String> profiles() {
+            return Set.of("lazy");
+        }
+
+        @Override
+        public String defaultProfile() {
+            return "lazy";
+        }
+
+        @Override
+        public String effectiveCwd(SpawnRequest req) {
+            return "/cwd";
+        }
+
+        @Override
+        public List<String> parityOverlay(String profileName) {
+            return List.of();
+        }
+
+        @Override
+        public List<?> list() {
+            return List.of();
+        }
+
+        @Override
+        public int reapOrphanWorkers() {
+            return 0;
+        }
+
+        @Override
+        public void stop(String id) {
+        }
+
+        @Override
+        public boolean clearContext(String id) {
+            return false;
+        }
+    }
+
+    @Test
+    void plainRosterDoesNotResolveAgentSessionId() {
+        // fleetd #209 follow-up: roster() sits on the heartbeat/health-tick timers (and the metrics
+        // scrape), so it must never trigger the resolve lookup — for opencode that lookup opens an
+        // on-disk session database, and a member whose id never appears would pay that cost forever.
+        // rosterResolved() is the one to use when a caller actually reports the id.
+        LazyIdHandle handle = new LazyIdHandle("p0", "t0", 1, "oc-session-0");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        MemberSession acquired = sessions.acquire("lazy", "/cwd", "/caller", null);
+        assertEquals(1, handle.callCount(), "sanity: only the spawn-time call happened so far");
+
+        List<MemberSession> roster = sessions.roster();
+
+        assertEquals(1, roster.size());
+        assertEquals(acquired.paneId(), roster.getFirst().paneId());
+        assertNull(roster.getFirst().agentSessionId(), "the plain roster must not resolve the id");
+        assertEquals(1, handle.callCount(),
+                "roster() must never call agentSessionId() again — it sits on the heartbeat/health timers");
+    }
+
+    @Test
+    void rosterResolvedResolvesALateAgentSessionIdFromTheRetainedHandle() {
+        LazyIdHandle handle = new LazyIdHandle("p1", "t1", 1, "oc-session-1");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+
+        MemberSession acquired = sessions.acquire("lazy", "/cwd", "/caller", null);
+        assertNull(acquired.agentSessionId(),
+                "opencode has not written its session row yet at spawn time");
+
+        List<MemberSession> roster = sessions.rosterResolved();
+        assertEquals(1, roster.size());
+        assertEquals("oc-session-1", roster.getFirst().agentSessionId(),
+                "fleet_list must see the id once the adapter can answer it");
+
+        Map<String, Object> view = SessionManager.rosterView(roster.getFirst(), null);
+        assertEquals("oc-session-1", view.get("agentSessionId"),
+                "rosterView renders whatever rosterResolved() resolved");
+    }
+
+    @Test
+    void getResolvesALateAgentSessionIdFromTheRetainedHandle() {
+        LazyIdHandle handle = new LazyIdHandle("p2", "t2", 1, "oc-session-2");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        MemberSession acquired = sessions.acquire("lazy", "/cwd", "/caller", null);
+
+        MemberSession resolved = sessions.get(acquired.paneId()).orElseThrow();
+
+        assertEquals("oc-session-2", resolved.agentSessionId(),
+                "fleet_status (single-session lookup) must also see the late-resolved id");
+    }
+
+    @Test
+    void releaseCarriesALateResolvedAgentSessionIdIntoTheReleaseDetail() {
+        LazyIdHandle handle = new LazyIdHandle("p3", "t3", 1, "oc-session-3");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        MemberSession acquired = sessions.acquire("lazy", "/cwd", "/caller", null);
+        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
+        sessions.onRelease(detail -> released.add(detail.agentSessionId()));
+
+        sessions.release(acquired.paneId());
+
+        assertEquals(java.util.List.of("oc-session-3"), released,
+                "a released member's detail carries the id it has since resolved, not the null "
+                        + "frozen in at spawn time");
+    }
+
+    @Test
+    void aThrowingHandleDoesNotBreakRosterResolved() {
+        LazyIdHandle handle = new LazyIdHandle("p4", "t4", 1, "oc-session-4")
+                .throwing(new RuntimeException("sqlite locked"));
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        sessions.acquire("lazy", "/cwd", "/caller", null);
+
+        List<MemberSession> roster = assertDoesNotThrow(sessions::rosterResolved,
+                "a handle that throws resolving its id must not break the roster read");
+
+        assertEquals(1, roster.size());
+        assertNull(roster.getFirst().agentSessionId(), "the id stays unresolved when the lookup throws");
+    }
+
+    @Test
+    void aResolvedAgentSessionIdIsNotLookedUpAgain() {
+        LazyIdHandle handle = new LazyIdHandle("p5", "t5", 1, "oc-session-5");
+        SessionManager sessions = new SessionManager(new LazyIdLauncher().queue(handle));
+        sessions.acquire("lazy", "/cwd", "/caller", null);
+        assertEquals(1, handle.callCount(), "sanity: only the spawn-time call happened so far");
+
+        sessions.rosterResolved();
+        assertEquals(2, handle.callCount(), "the first rosterResolved() read resolves the id");
+
+        sessions.rosterResolved();
+        assertEquals(2, handle.callCount(), "once resolved, the id must not be looked up again");
+    }
 }
@@ -95,10 +95,9 @@ class WorktreeSessionManagerTest {
                null, "/caller/proj", null, null);
        assertEquals("architect:architect", members.slotForTerminal(replacement.terminalId()));

-        MemberSession overflow = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
-                null, "/caller/proj", null, null);
-        assertNull(members.slotForTerminal(overflow.terminalId()),
-                "a full slot pool must not stop the architect spawn");
+        assertThrows(IllegalArgumentException.class, () -> sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, null),
+                "a full slot pool must stop the spawn before it can receive an architect charter");
    }

    @Test
@@ -163,6 +162,37 @@ class WorktreeSessionManagerTest {
                "tracked copied paths are --skip-worktree'd");
    }

+    /**
+     * fleetd #185 stage 3, THE TRAP: {@code overlayParity} copies more files into the worktree
+     * AFTER {@code add} returns, so {@code shareWithGroup} must run after it, not folded into
+     * {@code add()} — otherwise every overlay file lands operator-owned and unwritable for a
+     * different-uid member, with a green test suite hiding it.
+     */
+    @Test
+    void shareWithGroupRunsAfterOverlayParityNotBeforeIt() {
+        FakeHerdr herdr = new FakeHerdr();
+        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
+                .track(".envrc");
+        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
+
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-185", null));
+
+        assertEquals(1, worktrees.overlayCalls().size(), "overlayParity ran exactly once");
+        assertEquals(1, worktrees.shareCalls().size(), "shareWithGroup ran exactly once");
+        FakeWorktrees.OverlayCall overlay = worktrees.lastOverlay();
+        FakeWorktrees.ShareCall share = worktrees.lastShare();
+        assertEquals(s.worktree(), overlay.worktreePath());
+        assertEquals(s.worktree(), share.worktreePath());
+
+        List<String> order = worktrees.overlayShareOrder();
+        int overlayIndex = order.indexOf("overlay:" + s.worktree());
+        int shareIndex = order.indexOf("share:" + s.worktree());
+        assertTrue(overlayIndex >= 0 && shareIndex >= 0, "both calls must be recorded: " + order);
+        assertTrue(overlayIndex < shareIndex,
+                "shareWithGroup MUST run after overlayParity, not before/inside add(): " + order);
+    }
+
    @Test
    void releaseRemovesWorktreeButDoesNotDeleteBranch() {
        FakeHerdr herdr = new FakeHerdr();