CB-161: match a pid's ancestry against a pane, not just its shell/foreground pid

paneOwnsPid only compared a pid directly against a pane's shell_pid and
foreground_processes pids, so a grandchild process a member spawns (a python3
or curl helper opening its own MCP connection) matched no pane. Connection
identity then fell through to loopback-trust and resolved that connection as
the primary -- a worker->primary privilege escalation.

terminalForPid now walks the caller's ancestry once (bounded at 32
generations, with a cycle guard) via an injectable ParentResolver seam, and
paneOwnsPid checks pane pids against that ancestor set instead of the raw
pid. Production wiring defaults to ProcessHandle; tests drive a fake
pid->parent map.

REPORT-cb161.md

@@ -0,0 +1,131 @@
+# CB-161: fix the pane-ownership ancestry gap in PaneLocator
+
+## The bug
+
+`PaneLocator.paneOwnsPid` matched a pid against only two things: a pane's `shell_pid`, and
+the pids in `foreground_processes`. A grandchild process a member spawns (for example a
+`python3` or `curl` helper that opens its own connection to `127.0.0.1:8765`) matched no
+pane. `ConnectionIdentity.resolve` then fell through to loopback-trust and resolved that
+connection as the **primary** — a worker→primary privilege escalation.
+
+## The fix
+
+`fleetd/src/main/java/dev/ltms/fleet/herdr/PaneLocator.java`:
+
+- `terminalForPid` now builds the caller's **ancestor pid set once** (the pid itself, then its
+  parents up the tree) before scanning any pane, and reuses that same set across every `HerdrClient`
+  searched (the CB-185 two-daemon path). It does not walk the tree once per pane.
+- The walk is bounded at 32 generations (`MAX_ANCESTRY_DEPTH`) and also stops the moment it revisits
+  a pid it has already recorded (cycle guard), so a cycle or a pathologically deep tree cannot hang
+  identity resolution, which runs on every MCP call.
+- `paneOwnsPid` (renamed `paneOwnsAnyOf`) now checks whether a pane's `shell_pid` or any
+  `foreground_processes` pid is a **member of that ancestor set**, instead of comparing the raw pid
+  directly. A pid that IS the shell pid or a foreground pid still matches (ancestry sets always
+  contain the pid itself) — no regression there.
+- A vanished ancestor (`ParentResolver.parentOf` returning empty) ends the walk quietly, not as an
+  error — matches the brief.
+
+### The seam: `ParentResolver`
+
+New file `fleetd/src/main/java/dev/ltms/fleet/herdr/ParentResolver.java` — a one-method interface
+(`OptionalLong parentOf(long pid)`) so the ancestry walk is testable without spawning real OS
+processes. `ParentResolver.PROCESS_HANDLE` is the production implementation, backed by
+`ProcessHandle.of(pid)` / `.parent()`. `PaneLocator` gained two new constructor overloads
+(`PaneLocator(HerdrClient, ParentResolver)` and `PaneLocator(HerdrClient, HerdrClient,
+ParentResolver)`) that accept an injected resolver; the existing constructors delegate to these with
+`ParentResolver.PROCESS_HANDLE`, so every existing call site (`Fleetd.java`, `ConnectionIdentity`
+tests, the contract test) is unchanged and compiles as-is.
+
+## Tests
+
+New file `fleetd/src/test/java/dev/ltms/fleet/herdr/FakeParentResolver.java` — a fake `ParentResolver`
+backed by an explicit pid→parent `Map`.
+
+New tests added to `fleetd/src/test/java/dev/ltms/fleet/herdr/PaneLocatorTest.java` (using a new
+small `OnePaneHerdr` fake nested in that test class, purpose-built so shell_pid and a foreground pid
+can be given distinct values — the shared `FakeHerdr` fixture happens to use the same pid for both,
+which would not isolate the two cases):
+
+1. `stillResolvesAPidThatIsExactlyThePaneShellPid` — regression, no ancestry walk needed.
+2. `stillResolvesAPidThatIsExactlyAForegroundPid` — regression, via the foreground-processes list.
+3. `resolvesAGrandchildPidTwoLevelsBelowTheShellPid` — **the bug.** grandchild → child → shell_pid.
+4. `nullForAPidWhoseAncestryMatchesNoPane` — a pid whose ancestry never reaches any pane still
+   resolves to `null`, so the real primary is not demoted to a worker.
+5. `ancestryWalkTerminatesOnACycleInsteadOfHanging` — a 2-cycle fake parent map (100→101→100)
+   terminates and returns `null` instead of hanging.
+6. `ancestrySetIsComputedOnceAcrossBothClientsInTheTwoDaemonConstructor` — wraps the fake resolver
+   with a call counter, uses the two-arg (CB-185) constructor with one client reporting no panes,
+   and asserts exactly 3 `parentOf` calls (not 6) — the ancestor set is walked once and reused
+   across both clients, not recomputed per client.
+
+All existing `PaneLocatorTest` tests (the CB-185 two-daemon fallback tests) still pass unchanged.
+
+### Proof that tests 3 and 5 fail without the fix
+
+I temporarily reverted `ancestorsOf` twice, ran the specific test, then restored the real fix
+(`git diff` is clean of these — they were never committed):
+
+**Test 3, reverted to "no ancestry walk at all" (`return Set.of(pid);`):**
+
+```
+mvn -Dtest=PaneLocatorTest#resolvesAGrandchildPidTwoLevelsBelowTheShellPid test
+...
+org.opentest4j.AssertionFailedError: expected: <term_x> but was: <null>
+[ERROR]   PaneLocatorTest.resolvesAGrandchildPidTwoLevelsBelowTheShellPid:100 expected: <term_x> but was: <null>
+[ERROR] Tests run: 1, Failures: 1, Errors: 0, Skipped: 0
+[INFO] BUILD FAILURE
+```
+
+**Test 5, reverted to a naive walk (no `MAX_ANCESTRY_DEPTH` bound, no "already seen" cycle guard —
+just `while (current > 0) { ancestry.add(current); ... }`):**
+
+Ran `mvn -Dtest=PaneLocatorTest#ancestryWalkTerminatesOnACycleInsteadOfHanging test` in the
+background and polled it. It was still running (stuck inside `PaneLocatorTest`, no test-run summary
+line ever printed) after 20 seconds and had to be force-killed — confirming the naive walk hangs on
+the 100↔101 cycle fixture. The real fix's depth bound and cycle guard are what make this test pass
+in ~0.25s instead.
+
+Both reverts were made only in-memory in my worktree (I kept a copy of the correct file at
+`/tmp/PaneLocator.java.fixed` beforehand) and restored via `cp` before running the full build below.
+`git status` / `git diff` at commit time show only the intended fix, not either revert.
+
+## Full build
+
+```
+cd fleetd && mvn clean install
+```
+
+Ran to completion, unpiped. Final lines:
+
+```
+[INFO] Tests run: 1043, Failures: 0, Errors: 0, Skipped: 0
+[INFO] BUILD SUCCESS
+[INFO] Total time:  35.061 s
+```
+
+(main was 1037 tests; this branch adds 6 new tests in `PaneLocatorTest` = 1043.)
+
+## Scope discipline — what I did NOT touch
+
+Per the brief: only `PaneLocator`, its tests, and the minimal `ParentResolver` seam + its fake.
+`Authz`, `ConnectionIdentity`'s fallthrough, and the loopback-trust policy are unchanged — those
+stay the deliberate primary-only decision they were.
+
+One thing spotted but out of scope, noted only: `terminalForPid` still issues one
+`pane.process_info` herdr call **per pane** on every resolution (no caching) — the class javadoc
+already flags this as "the obvious optimization once wired into `ClaudeCodeLauncher`." Not touched.
+
+## What I could NOT check
+
+- No IDE tooling (no `ide_diagnostics` / IntelliJ inspections) — `mvn clean install` is my only
+  verification, as the worker charter expects.
+- Cannot restart or query the live `fleetd` daemon — this fix is unverified against a real herdr
+  process tree. The pre-existing `PaneLocatorContractTest` (tagged `contract`, run with
+  `-Pcontract`) exercises `PaneLocator` against a real herdr daemon and a real shell pid (not a
+  grandchild), but I did not run it — it requires a live herdr socket, which I don't have in this
+  worktree, and it wasn't part of the standard `mvn clean install` run above (it's a separate
+  Maven profile). I did not add a grandchild-pid variant of it, since the brief scoped tests to
+  unit tests against a fake resolver.
+- I did not attempt to reproduce the original privilege-escalation scenario end-to-end (spawning a
+  real grandchild process against a live daemon) — the ticket says that half is already measured
+  and confirmed, and I have no way to drive a live daemon from this worktree.

fleetd/pom.xml

@@ -28,7 +28,6 @@
         <testcontainers.version>1.20.4</testcontainers.version>
         <commons-compress.version>1.27.1</commons-compress.version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
-        <sqlite-jdbc.version>3.53.4.0</sqlite-jdbc.version>
     </properties>
 
     <!--
@@ -45,12 +44,6 @@
           3.0-rc5; bumping Jackson 3 to the patched 3.2.x breaks the SDK (annotation mismatch).
           Only the loopback /mcp endpoint parses this JSON, from trusted local Claude clients.
       The 11.0.23 -> 11.0.25 bump did clear jetty CVE-2024-8184 (5.9) and CVE-2024-6763.
-
-      fleetd #206: org.xerial:sqlite-jdbc 3.53.4.0 (added for OpenCodeSessionDiscovery) — the
-      only known advisory against this artifact is CVE-2023-32697 (RCE via an attacker-controlled
-      JDBC URL), fixed in 3.41.2.2; 3.53.4.0 is well past that fix and OSV.dev reports no open
-      advisory against it. Checked via the OSV.dev API (no Mend.io/JetBrains IDE MCP mount
-      available from this worktree) on 2026-08-31.
     -->
 
     <!-- Force the latest patched Jetty 11.x across all Javalin-pulled Jetty modules (no version
@@ -130,17 +123,6 @@
             <version>${amqp.version}</version>
         </dependency>
 
-        <!-- fleetd #206: opencode moved its session store from a JSON tree to SQLite
-             (opencode.db). This is the JDBC driver OpenCodeSessionDiscovery uses to read it
-             read-only. Ships bundled native libraries (linux/mac/windows, several archs), so it
-             is a heavier jar than most deps here — see the pom's dependency-security note below
-             for the size/CVE tradeoff actually measured. -->
-        <dependency>
-            <groupId>org.xerial</groupId>
-            <artifactId>sqlite-jdbc</artifactId>
-            <version>${sqlite-jdbc.version}</version>
-        </dependency>
-
         <!-- Logging -->
         <dependency>
             <groupId>org.slf4j</groupId>

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -177,14 +177,14 @@ public final class Fleetd {
                     claudeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                     () -> config.get().fleet(),
-                    () -> config.get().memberCredentials(), null, config::get));
+                    () -> config.get().memberCredentials()));
         }
         if (!opencodeProfiles.isEmpty()) {
             adapters.add(new OpenCodeLauncher(router.memberAgents(), router.memberSpaces(),
                     opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                     () -> config.get().fleet(),
-                    () -> config.get().memberCredentials(), config::get));
+                    () -> config.get().memberCredentials()));
         }
         AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
         // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -94,26 +94,13 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
                               Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                               Function<String, String> env,
-                               long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                               Supplier<FleetConfig.Fleet> fleet,
-                               Supplier<FleetConfig.MemberCredentials> memberCredentials) {
-        this(agents, spaces, guard, profiles, defaultProfile, env, spawnReadyTimeoutMs, spawnReadyPollMs,
-                fleet, memberCredentials, null, null);
-    }
-
-    /** Production constructor, plus the live config for URI environment exclusions. */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                               Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                               Function<String, String> env,
-                               long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                               Supplier<FleetConfig.Fleet> fleet,
-                               Supplier<FleetConfig.MemberCredentials> memberCredentials,
-                               Supplier<Set<String>> hostEnvNames,
-                               Supplier<FleetConfig> config) {
+                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
         this(agents, spaces, guard, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs,
                 System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                fleet, memberCredentials, hostEnvNames, config);
+                fleet, memberCredentials);
     }
 
     /**
@@ -166,22 +153,10 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
                               Function<String, String> env,
                               long spawnReadyTimeoutMs,
                               LongSupplier nowMillis, Runnable sleeper,
-                               Supplier<FleetConfig.Fleet> fleet,
-                               Supplier<FleetConfig.MemberCredentials> memberCredentials) {
-        this(agents, spaces, guard, profiles, defaultProfile, env, spawnReadyTimeoutMs, nowMillis, sleeper,
-                fleet, memberCredentials, null, null);
-    }
-
-    /** Full testability constructor, plus the live config for URI environment exclusions. */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                               Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                               Function<String, String> env, long spawnReadyTimeoutMs,
-                               LongSupplier nowMillis, Runnable sleeper, Supplier<FleetConfig.Fleet> fleet,
-                               Supplier<FleetConfig.MemberCredentials> memberCredentials,
-                               Supplier<Set<String>> hostEnvNames,
-                               Supplier<FleetConfig> config) {
+                              Supplier<FleetConfig.Fleet> fleet,
+                              Supplier<FleetConfig.MemberCredentials> memberCredentials) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, hostEnvNames, config);
+                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
         this.guard = guard;
     }
 
@@ -199,7 +174,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
                               Supplier<FleetConfig.MemberCredentials> memberCredentials,
                               Supplier<Set<String>> hostEnvNames) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, hostEnvNames, null);
+                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, hostEnvNames);
         this.guard = guard;
     }
 

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -170,8 +170,6 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
 
     /** Guards {@link #warnNonZsh} to one WARN per launcher instance, not one per spawn. */
     private final AtomicBoolean nonZshShellWarned = new AtomicBoolean();
-    /** Live config provides URI environment names that must never enter member panes. */
-    private final Supplier<FleetConfig> config;
 
     /**
      * @param namePrefix          label prefix for this peer kind (drives naming and reap)
@@ -240,19 +238,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
                                 long spawnReadyTimeoutMs,
                                 LongSupplier nowMillis, Runnable sleeper,
                                 Supplier<FleetConfig.Fleet> fleet,
-                                 Supplier<FleetConfig.MemberCredentials> memberCredentials,
-                                 Supplier<Set<String>> hostEnvNames) {
-        this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, nowMillis,
-                sleeper, fleet, memberCredentials, hostEnvNames, null);
-    }
-
-    /** As above, plus the live full config for secret-bearing URI environment names. */
-    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                                Function<String, String> env, long spawnReadyTimeoutMs,
-                                LongSupplier nowMillis, Runnable sleeper, Supplier<FleetConfig.Fleet> fleet,
                                 Supplier<FleetConfig.MemberCredentials> memberCredentials,
-                                Supplier<Set<String>> hostEnvNames, Supplier<FleetConfig> config) {
+                                Supplier<Set<String>> hostEnvNames) {
         this.fleet = fleet;
         this.namePrefix = namePrefix;
         this.agents = agents;
@@ -265,7 +252,6 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         this.sleeper = sleeper;
         this.memberCredentials = memberCredentials;
         this.hostEnvNames = hostEnvNames != null ? hostEnvNames : () -> System.getenv().keySet();
-        this.config = config;
     }
 
     // --- adapter seams -------------------------------------------------------------------------
@@ -1042,11 +1028,9 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     }
 
     /** Put {@link #BLOCKED_CREDENTIAL_SENTINEL} over every blocked name in the pane-creation env map. */
-    private void overlayBlockedCredentials(Map<String, String> workerEnv,
-                                          FleetConfig.MemberCredentials creds) {
-        Set<String> blocked = new java.util.TreeSet<>(creds.blockedSet());
-        blocked.addAll(brokerUriEnvNames());
-        for (String name : blocked) {
+    private static void overlayBlockedCredentials(Map<String, String> workerEnv,
+                                                  FleetConfig.MemberCredentials creds) {
+        for (String name : creds.blockedSet()) {
             workerEnv.put(name, BLOCKED_CREDENTIAL_SENTINEL);
         }
     }
@@ -1113,21 +1097,15 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * ssh-agent handle when explicitly allowed, and the exact keys of THIS launch's own env map.
      */
     private Set<String> derivedAllowedNames(FleetConfig.MemberCredentials creds, Launch launch) {
-        Set<String> brokerUriEnvNames = brokerUriEnvNames();
         Set<String> allowed = new java.util.TreeSet<>(
-                MemberEnvAllowList.derive(profiles.values(), creds.allowSet(), brokerUriEnvNames));
+                MemberEnvAllowList.derive(profiles.values(), creds.allowSet()));
         if (creds.sshAuthSockAllowed()) {
             allowed.add(SSH_AUTH_SOCK);
         } // blocked by default: absent from the set ⇒ blanked by the scrub like any other name
         allowed.addAll(launch.env().keySet());
-        allowed.removeAll(brokerUriEnvNames);
         return allowed;
     }
 
-    private Set<String> brokerUriEnvNames() {
-        return MemberEnvAllowList.brokerUriEnvNames(config == null ? null : config.get());
-    }
-
     /**
      * CB-633 follow-up: one INFO line per allow-list spawn WHOSE SCRUB ACTUALLY RUNS, so an operator
      * can read a single log line and know the scrub ran and how much of the visible environment it

fleetd/src/main/java/dev/ltms/fleet/member/MemberEnvAllowList.java

@@ -40,9 +40,8 @@ import java.util.TreeSet;
  * operator's own explicit list. Before this, {@code policy: allow-list} silently ignored every name
  * an operator wrote under {@code allow:} unless a profile happened to carry it too, which meant
  * turning the policy on could blank credentials working members already depended on. {@code
- * SSH_AUTH_SOCK} and configured broker URI environment names are exceptions: even when the operator
- * lists them under {@code allow:}, they are excluded here. {@code SSH_AUTH_SOCK} is added back ONLY
- * by the caller when {@code sshAuthSock: allow} is explicitly set
+ * SSH_AUTH_SOCK} is the one exception: even when the operator lists it under {@code allow:}, it is
+ * excluded here and added back ONLY by the caller when {@code sshAuthSock: allow} is explicitly set
  * (see {@link #SSH_AUTH_SOCK}'s javadoc) — it is a live handle to the operator's own ssh-agent, not
  * a value, so treating it like any other allow-listed name would hand a member every key the
  * operator's agent holds the moment they typed the name under {@code allow:} for an unrelated
@@ -107,16 +106,6 @@ public final class MemberEnvAllowList {
      * run-to-run.
      */
     public static Set<String> derive(Collection<FleetConfig.Profile> profiles, Set<String> configuredAllow) {
-        return derive(profiles, configuredAllow, Set.of());
-    }
-
-    /**
-     * As {@link #derive(Collection, Set)}, while excluding names that fleetd knows carry credentials.
-     * A configured broker URI contains its AMQP password inline, so it must never reach a member,
-     * even when an operator put its variable name in {@code memberCredentials.allow:}.
-     */
-    public static Set<String> derive(Collection<FleetConfig.Profile> profiles, Set<String> configuredAllow,
-                                     Set<String> excludedNames) {
         Set<String> derived = new TreeSet<>(INFRASTRUCTURE_PASSTHROUGH);
         if (profiles != null) {
             for (FleetConfig.Profile p : profiles) {
@@ -135,37 +124,9 @@ public final class MemberEnvAllowList {
                 }
             }
         }
-        if (excludedNames != null) {
-            derived.removeAll(excludedNames);
-        }
         return Set.copyOf(derived);
     }
 
-    /**
-     * The host environment names whose values are AMQP URIs with inline passwords. Both broker
-     * connections belong to fleetd, never to a member pane. Blank and absent configuration changes
-     * nothing.
-     *
-     * <p><b>How strong this exclusion is depends on the policy, and the difference matters.</b>
-     * Under {@code policy: allow-list} it is enforced by the generated ZDOTDIR scrub, which runs
-     * AFTER the pane's shell has sourced the operator's chain — so a login shell that re-exports the
-     * name is still blanked. Under the deny-list policy there is no scrub: the name is only removed
-     * from the pre-shell env map, and a login shell that sources the operator's secret store
-     * re-exports it. That is the long-standing weakness of deny-list (a sourced file can undo it),
-     * not something this exclusion introduces, but it means deny-list deployments do NOT get this
-     * guarantee. The same caveat applies to the non-zsh path, which has no scrub at all — see
-     * {@code HerdrPeerLauncher#applyEnvironmentAllowListPolicy}.
-     */
-    public static Set<String> brokerUriEnvNames(FleetConfig config) {
-        if (config == null) {
-            return Set.of();
-        }
-        Set<String> names = new TreeSet<>();
-        addUriEnvIfPresent(names, config.broker());
-        addUriEnvIfPresent(names, config.coordinator());
-        return Set.copyOf(names);
-    }
-
     /**
      * Whether {@code name} survives the scrub when {@code allowedNames} is the derived set: an exact
      * match, or an infrastructure-prefixed name ({@code LC_*}). Prefix rules live ONLY here and in
@@ -185,16 +146,4 @@ public final class MemberEnvAllowList {
             into.add(name);
         }
     }
-
-    private static void addUriEnvIfPresent(Set<String> into, FleetConfig.Broker broker) {
-        if (broker != null && broker.hasUriEnv()) {
-            into.add(broker.uriEnv());
-        }
-    }
-
-    private static void addUriEnvIfPresent(Set<String> into, FleetConfig.Coordinator coordinator) {
-        if (coordinator != null && coordinator.hasUriEnv()) {
-            into.add(coordinator.uriEnv());
-        }
-    }
 }

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -116,23 +116,12 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
                             Function<String, String> env,
-                             long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                             Supplier<FleetConfig.Fleet> fleet,
-                             Supplier<FleetConfig.MemberCredentials> memberCredentials) {
-        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, spawnReadyPollMs,
-                fleet, memberCredentials, null);
-    }
-
-    /** Production constructor, plus the live config for URI environment exclusions. */
-    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                             Function<String, String> env, long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                             Supplier<FleetConfig.Fleet> fleet,
-                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
-                             Supplier<FleetConfig> config) {
+                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                            Supplier<FleetConfig.Fleet> fleet,
+                            Supplier<FleetConfig.MemberCredentials> memberCredentials) {
         this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                 System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials, config);
+                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials);
     }
 
     /**
@@ -193,20 +182,8 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                             Path configRoot, Path discoveryRoot,
                             Supplier<FleetConfig.Fleet> fleet,
                             Supplier<FleetConfig.MemberCredentials> memberCredentials) {
-        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, nowMillis, sleeper,
-                configRoot, discoveryRoot, fleet, memberCredentials, null);
-    }
-
-    /** Full testability constructor, plus the live config for URI environment exclusions. */
-    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
-                             Function<String, String> env, long spawnReadyTimeoutMs,
-                             LongSupplier nowMillis, Runnable sleeper, Path configRoot, Path discoveryRoot,
-                             Supplier<FleetConfig.Fleet> fleet,
-                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
-                             Supplier<FleetConfig> config) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, null, config);
+                spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials);
         this.configRoot = configRoot;
         this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
     }

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeSessionDiscovery.java

@@ -1,87 +1,58 @@
 package dev.ltms.fleet.member;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.sqlite.SQLiteConfig;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 
+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.sql.Connection;
-import java.sql.PreparedStatement;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.stream.Stream;
 
 /**
  * Resolves the opencode session id for a fleetd worker from opencode's on-disk storage — the
  * only place this adapter touches opencode's private layout, and deliberately the <em>only</em>
  * class that does.
  *
- * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not
- * a stable contract: opencode persists its session state in a SQLite database at
- * {@code <storageRoot>/opencode.db} (a {@code session} table, one row per session, keyed by id and
- * carrying a {@code directory} column). That schema can move between opencode releases exactly
- * like the JSON-file layout it replaced did (opencode migrated off a one-JSON-file-per-session
- * tree under {@code <storageRoot>/storage/session/<projectID>/ses_*.json} in January 2026 — that
- * tree is now a frozen migration artefact nothing writes, which is why this class no longer reads
- * it). opencode also ships a headless HTTP server that may supersede both of these entirely.
- * Everything this adapter knows about that private storage — its shape and column names — lives
- * here, so a layout change, or a switch to the HTTP server, changes exactly one class and nothing
- * in {@link OpenCodeLauncher}.
+ * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not a
+ * stable contract: opencode writes one JSON file per session under
+ * {@code <storageRoot>/session/<projectID>/<ses_*.json>}, and each record carries a
+ * {@code "version"} field (e.g. {@code "1.1.31"}), so the exact directory shape, file naming, and
+ * field names can move between opencode releases. opencode also ships a headless HTTP server that
+ * may supersede file scanning entirely. Everything this adapter knows about that private storage —
+ * its shape, naming, and field names — lives here, so a layout change, or a switch to the HTTP
+ * server, changes exactly one class and nothing in {@link OpenCodeLauncher}.
  *
  * <p>The determinism that makes this useful is structural, not a guess: every fleetd worker runs
- * in its own unique git worktree, so the row's {@code directory} (its project root) equals the
+ * in its own unique git worktree, so the record's {@code directory} (its project root) equals the
  * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
  * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
  * the CLI listing does not even show the directory.
  *
- * <p>All reads are best-effort and never throw: a missing or unreadable database, a query that
- * fails, or a directory with no row yet all yield {@code null}, and the caller (the session
- * handle) treats that as "identity not resolved yet" and retries later. The database is opened
- * read-only and never written to: opencode itself may be running and writing it concurrently (WAL
- * mode), and this class must never disturb that.
+ * <p>All reads are best-effort and never throw: a missing or unreadable storage root, a record that
+ * fails to parse, or a directory with no record yet all yield {@code null}, and the caller (the
+ * session handle) treats that as "identity not resolved yet" and retries later.
  */
 final class OpenCodeSessionDiscovery {
 
-    private static final Logger log = LoggerFactory.getLogger(OpenCodeSessionDiscovery.class);
-
     private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
-    private final Path databasePath;
-    private final AtomicBoolean warnedMissingDatabase = new AtomicBoolean(false);
+    private final ObjectMapper json;
 
     OpenCodeSessionDiscovery(Path storageRoot) {
         this.storageRoot = storageRoot;
-        this.databasePath = storageRoot.resolve("opencode.db");
+        this.json = new ObjectMapper();
     }
 
     /**
-     * A connection to {@link #databasePath} opened with SQLite's {@code SQLITE_OPEN_READONLY}
-     * flag: it never creates the file, never writes, and never touches WAL or journal mode.
-     * opencode may be running and writing this database concurrently, and this class must never
-     * disturb it.
-     *
-     * <p>Package-private so a test can hold the connection and prove it refuses a write. That is
-     * the only way to pin this property: making the file unwritable does <em>not</em> work,
-     * because SQLite silently downgrades a read-write open of an unwritable file to read-only, so
-     * such a test passes whether or not the flag is set.
-     */
-    Connection openReadOnly() throws SQLException {
-        SQLiteConfig config = new SQLiteConfig();
-        config.setReadOnly(true);
-        return config.createConnection("jdbc:sqlite:" + databasePath);
-    }
-
-    /**
-     * The opencode session id whose row references {@code directory} (the worker's cwd), or
-     * {@code null} when no row matches yet. When several rows share the directory — e.g. repeated
-     * spawns into the same worktree — the row with the highest {@code time_updated} wins: it is
+     * The opencode session id whose record references {@code directory} (the worker's cwd), or
+     * {@code null} when no record matches yet. When several records share the directory — e.g.
+     * repeated spawns into the same worktree — the <em>most recently modified</em> one wins: it is
      * the session the pane most likely corresponds to.
      *
-     * <p>Never throws: a missing {@code opencode.db}, a locked/unreadable database, a query
-     * failure, or a directory that has not been persisted yet all resolve to {@code null} rather
-     * than failing a spawn. A fleetd worker's session row is written lazily (when the session is
-     * first persisted), so {@code null} here is the normal answer right after the pane is ready,
-     * and the caller retries later.
+     * <p>Never throws: a missing {@code storageRoot}, an unreadable/malformed record, or a
+     * directory that has not been persisted yet all resolve to {@code null} rather than failing a
+     * spawn. A fleetd worker's session record is written lazily (when the session is first
+     * persisted), so {@code null} here is the normal answer right after the pane is ready, and the
+     * caller retries later.
      *
      * @param directory the worker's cwd, as resolved for this spawn
      * @return the matching session id, or {@code null} if none is known yet
@@ -90,31 +61,62 @@ final class OpenCodeSessionDiscovery {
         if (directory == null || directory.isBlank()) {
             return null;
         }
-        if (!Files.isRegularFile(databasePath)) {
-            if (warnedMissingDatabase.compareAndSet(false, true)) {
-                log.warn("opencode session database not found at {} — opencode's on-disk layout "
-                        + "may have moved again; session discovery will keep returning null",
-                        databasePath);
-            }
+        Path sessionRoot = storageRoot.resolve("session");
+        if (!Files.isDirectory(sessionRoot)) {
             return null;
         }
-        String sql = "SELECT id FROM session WHERE directory = ? ORDER BY time_updated DESC LIMIT 1";
-        try (Connection connection = openReadOnly();
-             PreparedStatement statement = connection.prepareStatement(sql)) {
-            statement.setString(1, directory);
-            try (ResultSet rows = statement.executeQuery()) {
-                if (rows.next()) {
-                    return rows.getString("id");
+        String best = null;
+        long bestMtime = Long.MIN_VALUE;
+        try (Stream<Path> projectDirs = Files.list(sessionRoot)) {
+            for (Path projectDir : projectDirs.filter(Files::isDirectory).toList()) {
+                try (Stream<Path> records = Files.list(projectDir)) {
+                    for (Path record : records.toList()) {
+                        String id = matchId(record, directory);
+                        if (id == null) {
+                            continue;
+                        }
+                        long mtime = lastModifiedEpochMillis(record);
+                        if (mtime > bestMtime) {
+                            bestMtime = mtime;
+                            best = id;
+                        }
+                    }
+                } catch (IOException ignored) {
+                    // one project dir unreadable — skip it; another may still match
                 }
             }
-        } catch (SQLException e) {
-            // Locked, corrupt, or otherwise unreadable — never fatal to a spawn. Not the
-            // "database moved" signal (the file exists), so this stays below WARN.
-            log.debug("opencode session database unreadable at {}: {}", databasePath, e.toString());
+        } catch (IOException ignored) {
+            // storage root vanished or became unreadable — "no session known yet"
             return null;
         }
-        log.debug("no opencode session row for directory (root={}, directory={})",
-                storageRoot, directory);
-        return null;
+        return best;
+    }
+
+    /**
+     * The record's session id when it references {@code directory}, else {@code null}. A record
+     * that is not JSON, lacks {@code id}/{@code directory}, or points at a different directory is
+     * simply not our session; a malformed one is skipped, never fatal.
+     */
+    private String matchId(Path record, String directory) {
+        try {
+            JsonNode node = json.readTree(record.toFile());
+            JsonNode id = node == null ? null : node.get("id");
+            JsonNode dir = node == null ? null : node.get("directory");
+            if (id == null || dir == null || !directory.equals(dir.asText())) {
+                return null;
+            }
+            return id.asText();
+        } catch (IOException e) {
+            return null;
+        }
+    }
+
+    /** The record's last-modified epoch ms, or {@code Long.MIN_VALUE} if unreadable (never wins). */
+    private static long lastModifiedEpochMillis(Path record) {
+        try {
+            return Files.getLastModifiedTime(record).toMillis();
+        } catch (IOException e) {
+            return Long.MIN_VALUE;
+        }
     }
 }

fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -366,40 +366,21 @@ public final class MessageService {
     }
 
     /**
-     * Route a worker's explicit {@code fleet_reply}: resolve an open send, complete an async ticket
-     * still parked waiting on this exact turn's answer, or — only once neither applies — queue it in
-     * the inbox. Unlike the bare {@link Rendezvous#resolve}, a no-waiter result is <em>not</em> a
-     * failure — the reply is held for later drain.
+     * Route a worker's explicit {@code fleet_reply}: resolve an open send, or queue it in the
+     * inbox if no send is currently open. Unlike the bare {@link Rendezvous#resolve}, a no-waiter
+     * result is <em>not</em> a failure — the reply is held for later drain.
      *
      * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code fleet_ask} /
      * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
      * are interactive and must never be queued.
      *
-     * @return always {@code true} — the reply resolved a live send, completed a parked ticket, or
-     *         was queued
+     * @return always {@code true} — the reply either resolved a live send or was queued
      */
     public boolean reply(String session, String content) {
         if (rendezvous.resolve(session, content)) {
             count(FleetMetrics.REPLIES, "path", "rendezvous");
             return true;                       // a live send took it — unchanged fast path
         }
-        // #137: no live rendezvous waiter, but this may be the worker's real fleet_reply resuming a
-        // turn that {@link #answer} already gave up waiting on. answer()'s own bounded wait (the
-        // primary's fleet_send{turnId} call, capped well under a minute) can time out and close its
-        // waiter long before the worker — now actually resuming real work — finishes and replies. That
-        // reply used to have nowhere to land but the session inbox, leaving the async ticket's future
-        // unresolved forever: fleet_poll{ticket} stayed PENDING until fleet_stop's abandon() forced it
-        // FAILED with a misleading "session released before it replied" reason, even though the reply
-        // had, in fact, arrived. Completing the matching ticket directly here means fleet_poll{ticket}
-        // sees the real reply instead.
-        Task orphan = askAnsweredAsyncTask(session);
-        if (orphan != null && orphan.future.complete(new Reply(Outcome.REPLIED, content))) {
-            if (orphan.turnId != null) {
-                asyncTasksByTurn.remove(orphan.turnId, orphan);
-            }
-            count(FleetMetrics.REPLIES, "path", "async-recovered");
-            return true;                       // the ticket itself took it — no inbox stranding at all
-        }
         inbox.publish(session, UUID.randomUUID().toString(), content);
         // CB-640: record the stranding itself (not just the reply text) so fleet health can see a
         // worker whose replies keep missing their waiter, not only the queue depth this leaves behind.
@@ -413,24 +394,6 @@ public final class MessageService {
         return true;                           // held, not lost
     }
 
-    /**
-     * The still-open async task on {@code target} whose {@code fleet_ask} was already answered — its
-     * {@link Task#turnId} is stamped but its {@link Task#question} was cleared by {@link #answer} —
-     * yet whose future is not resolved yet (#137). {@code null} if no such task exists, including the
-     * common case where {@code target}'s worker never used {@code fleet_ask} at all (a task that was
-     * never asked has {@code turnId == null}, so it can never match here and only ever completes
-     * through the ordinary rendezvous fast path in {@link #reply}).
-     */
-    private Task askAnsweredAsyncTask(String target) {
-        for (Task task : tasks.values()) {
-            if (target.equals(task.target) && task.question == null && task.turnId != null
-                    && !task.future.isDone()) {
-                return task;
-            }
-        }
-        return null;
-    }
-
     /** Record a counter sample when a registry is wired; a no-op in unit tests. */
     private void count(String name, String... labels) {
         if (metrics != null) {
@@ -472,43 +435,19 @@ public final class MessageService {
      * <p>Resolving the waiter as a failure — rather than letting it time out — also means the
      * outcome is counted, so a torn-down delegation stops being invisible to {@code /metrics}.
      *
-     * <p><strong>#137 defence in depth.</strong> {@link #reply} already hands a worker's real
-     * {@code fleet_reply} straight to the async ticket it belongs to whenever one is still parked
-     * waiting for it (see {@link #askAnsweredAsyncTask}), so by the time a session is released its
-     * tasks are normally already resolved — this loop's {@code complete} calls are then harmless
-     * no-ops (a {@link CompletableFuture} can only resolve once). But should some other path someday
-     * strand a reply in the inbox without completing its ticket, checking
-     * {@link #hasStrandedReply(String)} here — before ever writing a failure — means a torn-down
-     * session whose worker in fact replied is still reported {@code REPLIED} with that reply's own
-     * text, never the misleading "the worker session was released before it replied" (which also
-     * means the snapshot/worktree recovery hint that follows it never prints once a reply exists).
-     *
-     * @return true if a live waiter or an async task was failed (never true for one recovered as a
-     *         reply — see the note above)
+     * @return true if a live waiter was failed
      */
     public boolean abandon(String target, String reason) {
-        boolean hadStrandedReply = hasStrandedReply(target);
         // CB-640: the session is gone — nothing will ever accept or deliver into it now.
         strandedReplies.remove(target);
         queuedDeliveries.remove(target);
         CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
         boolean failed = waiter != null && !waiter.isDone() && rendezvous.resolveFailure(waiter, reason);
         boolean asyncFailed = false;
-        Reply recovered = null; // lazily drained at most once, only if a task actually needs it
         for (Task task : tasks.values()) {
-            if (!target.equals(task.target) || task.question != null || task.future.isDone()) {
-                continue;
-            }
-            if (hadStrandedReply && recovered == null) {
-                recovered = recoverStrandedReply(target);
-            }
-            Reply outcome = recovered != null ? recovered : new Reply(Outcome.WORKER_FAILED, reason);
-            if (task.future.complete(outcome)) {
-                if (outcome.outcome() == Outcome.WORKER_FAILED) {
-                    asyncFailed = true;
-                } else if (task.turnId != null) {
-                    asyncTasksByTurn.remove(task.turnId, task);
-                }
+            if (target.equals(task.target) && task.question == null
+                    && task.future.complete(new Reply(Outcome.WORKER_FAILED, reason))) {
+                asyncFailed = true;
             }
         }
         if (failed) {
@@ -517,21 +456,6 @@ public final class MessageService {
         return failed || asyncFailed;
     }
 
-    /**
-     * Drain {@code target}'s inbox and hand its content back as a {@link Outcome#REPLIED} result
-     * (#137 defence in depth for {@link #abandon}) — {@code null} if it turned out empty (the
-     * stranding fact raced away, e.g. a lead's own {@code fleet_poll} on the raw session already
-     * drained it first). When more than one message is queued, only the newest is the worker's actual
-     * final answer ({@link #drainReplies} returns them oldest-first).
-     */
-    private Reply recoverStrandedReply(String target) {
-        var messages = drainReplies(target);
-        if (messages.isEmpty()) {
-            return null;
-        }
-        return new Reply(Outcome.REPLIED, messages.get(messages.size() - 1).content());
-    }
-
     /**
      * Acknowledge a specific reply by {@code msgId} for {@code target}. Removes it from the inbox
      * so that a subsequent drain or peek no longer returns it.

fleetd/src/test/java/dev/ltms/fleet/member/HerdrPeerLauncherAllowListWiringTest.java

@@ -161,34 +161,6 @@ class HerdrPeerLauncherAllowListWiringTest {
                         + "it under allow: — sshAuthSock is unset here, so it defaults to block");
     }
 
-    @Test
-    void brokerUriEnvStaysBlockedWhenListedInMemberCredentialsAllow() {
-        FakeHerdr herdr = new FakeHerdr();
-        WiringLauncher launcher = new WiringLauncher(herdr,
-                allowListWithAllow(List.of("BROKER_CONNECTION_URI")), "/bin/zsh", null,
-                () -> config("BROKER_CONNECTION_URI"));
-
-        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
-
-        Path dir = Path.of(launcher.env.get("ZDOTDIR"));
-        assertFalse(readAll(dir.resolve(EnvAllowListScrub.SCRUB_FILE)).contains("'BROKER_CONNECTION_URI'"),
-                "broker.uriEnv must not reach a member even when listed in memberCredentials.allow:");
-    }
-
-    @Test
-    void brokerUriEnvIsDeniedUnderTheDenyListPolicyEvenWhenAllowed() {
-        FakeHerdr herdr = new FakeHerdr();
-        WiringLauncher launcher = new WiringLauncher(herdr,
-                () -> new FleetConfig.MemberCredentials(null, List.of("BROKER_CONNECTION_URI"), List.of(), null),
-                "/bin/bash", null,
-                () -> config("BROKER_CONNECTION_URI"));
-
-        launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
-
-        assertEquals("blocked-by-fleetd-cb596-see-gitea-issue-82", launcher.env.get("BROKER_CONNECTION_URI"),
-                "the deny-list overlay must deny broker.uriEnv even when allow: names it");
-    }
-
     /**
      * CB-633 follow-up criterion 3: on every allow-list spawn the daemon logs one INFO line, shaped
      * "member credentials: allowed N of M", with real counts — not constants. Real path: the count
@@ -288,24 +260,15 @@ class HerdrPeerLauncherAllowListWiringTest {
 
         /** Plus an injectable {@code hostEnvNames} source, for the "allowed N of M" log line test. */
         WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell,
-                       Supplier<Set<String>> hostEnvNames) {
-            this(herdr, creds, shell, hostEnvNames, null);
-        }
-
-        WiringLauncher(FakeHerdr herdr, Supplier<FleetConfig.MemberCredentials> creds, String shell,
-                       Supplier<Set<String>> hostEnvNames, Supplier<FleetConfig> config) {
+                      Supplier<Set<String>> hostEnvNames) {
             super("test", new AgentControl(herdr), new WorkspaceControl(herdr),
                     Map.of("test", profile()), "test",
                     name -> "SHELL".equals(name) ? shell : null,
-                    0, () -> 0L, () -> { }, null, creds, hostEnvNames, config);
+                    0, () -> 0L, () -> { }, null, creds, hostEnvNames);
         }
 
         @Override
         protected Launch buildLaunch(FleetConfig.Profile cfg, LaunchSpec spec) {
-            Map<String, String> launchEnv = baseEnv(cfg);
-            launchEnv.putAll(env);
-            env.clear();
-            env.putAll(launchEnv);
             return new Launch(env, List.of("test"));
         }
 
@@ -315,12 +278,6 @@ class HerdrPeerLauncherAllowListWiringTest {
         }
     }
 
-    private static FleetConfig config(String brokerUriEnv) {
-        return new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
-                new FleetConfig.Broker(null, brokerUriEnv, null), null, null, null, null, null,
-                null, null, null, null, null).withDefaults();
-    }
-
     /** The generated directory is a temp directory; make sure the test does not leave a pile. */
     @Test
     void theGeneratedDirectoryIsRemovedWhenThePaneIsStopped() {

fleetd/src/test/java/dev/ltms/fleet/member/MemberEnvAllowListTest.java

@@ -121,34 +121,6 @@ class MemberEnvAllowListTest {
         assertTrue(derived.contains("OTHER_NAME"), "other allow: names are unaffected");
     }
 
-    @Test
-    void configuredBrokerAndCoordinatorUriEnvNamesAreExcludedEvenWhenAllowed() {
-        FleetConfig config = config("BROKER_CONNECTION_URI", "COORDINATOR_CONNECTION_URI");
-        Set<String> excluded = MemberEnvAllowList.brokerUriEnvNames(config);
-
-        Set<String> derived = MemberEnvAllowList.derive(List.of(),
-                Set.of("BROKER_CONNECTION_URI", "COORDINATOR_CONNECTION_URI", "OTHER_NAME"), excluded);
-
-        assertFalse(derived.contains("BROKER_CONNECTION_URI"),
-                "broker.uriEnv is secret-bearing and must not ride in on allow:");
-        assertFalse(derived.contains("COORDINATOR_CONNECTION_URI"),
-                "coordinator.uriEnv has the same inline-password shape");
-        assertTrue(derived.contains("OTHER_NAME"), "unrelated allow: entries are unaffected");
-    }
-
-    @Test
-    void absentOrBlankBrokerUriEnvAddsNoExclusions() {
-        assertTrue(MemberEnvAllowList.brokerUriEnvNames(config(null, null)).isEmpty());
-        assertTrue(MemberEnvAllowList.brokerUriEnvNames(config(" ", "")).isEmpty());
-    }
-
-    private static FleetConfig config(String brokerUriEnv, String coordinatorUriEnv) {
-        return new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
-                new FleetConfig.Broker(null, brokerUriEnv, null), null, null, null, null, null,
-                null, null, null, null,
-                new FleetConfig.Coordinator(null, coordinatorUriEnv, null, null)).withDefaults();
-    }
-
     /** {@code LC_*} categories are infrastructure by prefix; everything else needs an exact match. */
     @Test
     void keepsMatchesExactlyPlusTheLocalePrefixRule() {

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeLauncherTest.java

@@ -334,7 +334,8 @@ class OpenCodeLauncherTest {
         assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
         // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
         // session id matches its own worktree, not another's.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", "/work/dir", 1000L);
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "p1", "ses_a.json",
+                "ses_resolved", "/work/dir", 1000L);
         assertEquals("ses_resolved", handle.agentSessionId(),
                 "agentSessionId() re-scans and picks up a record that has since been written");
     }

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeSessionDiscoveryTest.java

@@ -5,89 +5,68 @@ import org.junit.jupiter.api.io.TempDir;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.sql.Connection;
-import java.sql.DriverManager;
-import java.sql.PreparedStatement;
-import java.sql.SQLException;
-import java.sql.Statement;
+import java.nio.file.attribute.FileTime;
 
 import static org.junit.jupiter.api.Assertions.*;
 
 /**
- * {@link OpenCodeSessionDiscovery} matches an opencode session row by the worker's cwd (its
- * {@code directory}) against opencode's {@code opencode.db} SQLite database. These tests build a
- * SYNTHETIC database themselves, in a JUnit temp directory — never the operator's real
- * {@code ~/.local/share/opencode/opencode.db}, which a live opencode process may be writing.
+ * {@link OpenCodeSessionDiscovery} matches an opencode session record by the worker's cwd (its
+ * {@code directory}) against opencode's on-disk storage. These tests populate a TEMP storage root
+ * themselves — never the operator's real {@code ~/.local/share/opencode}.
  */
 class OpenCodeSessionDiscoveryTest {
 
     /**
-     * Create {@code <root>/opencode.db} with a minimal {@code session} table (just the columns
-     * {@link OpenCodeSessionDiscovery} reads: {@code id}, {@code directory}, {@code time_updated})
-     * and insert one row. Static so {@link OpenCodeLauncherTest} can reuse it.
+     * Write a session record {@code {"id":..., "directory":...}} under
+     * {@code <root>/session/<projectID>/<fileName>} and stamp it with a known last-modified time,
+     * so "most recently modified wins" is deterministic. Static so the launcher test can reuse it.
      */
-    static void writeRecord(Path root, String id, String directory, long timeUpdated) throws Exception {
-        Path db = root.resolve("opencode.db");
-        try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + db)) {
-            try (Statement statement = connection.createStatement()) {
-                statement.execute("CREATE TABLE IF NOT EXISTS session ("
-                        + "id TEXT PRIMARY KEY, directory TEXT, time_updated INTEGER)");
-            }
-            // Bound parameters, not string interpolation: the class under test uses a
-            // PreparedStatement, and a hand-escaped INSERT here is a pattern someone copies out.
-            try (PreparedStatement insert = connection.prepareStatement(
-                    "INSERT INTO session (id, directory, time_updated) VALUES (?, ?, ?)")) {
-                insert.setString(1, id);
-                insert.setString(2, directory);
-                insert.setLong(3, timeUpdated);
-                insert.executeUpdate();
-            }
-        }
+    static void writeRecord(Path root, String projectId, String fileName, String id,
+                            String directory, long lastModifiedEpochMillis) throws Exception {
+        Path dir = root.resolve("session").resolve(projectId);
+        Files.createDirectories(dir);
+        Path file = dir.resolve(fileName);
+        Files.writeString(file, "{\"id\":\"" + id + "\",\"directory\":\"" + directory
+                + "\",\"projectID\":\"" + projectId + "\",\"version\":\"1.1.31\"}");
+        Files.setLastModifiedTime(file, FileTime.fromMillis(lastModifiedEpochMillis));
     }
 
     @Test
-    void findsTheRowWhoseDirectoryEqualsTheCwd(@TempDir Path root) throws Exception {
-        writeRecord(root, "ses_aaa", "/w/a", 1000L);
-        writeRecord(root, "ses_bbb", "/w/b", 2000L);
+    void findsTheRecordWhoseDirectoryEqualsTheCwd(@TempDir Path root) throws Exception {
+        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
+        writeRecord(root, "p2", "ses_b.json", "ses_bbb", "/w/b", 2000L);
 
         assertEquals("ses_bbb", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/b"),
-                "the row whose directory equals the cwd is the one found");
+                "the record whose directory equals the cwd is the one found");
         assertEquals("ses_aaa", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
     }
 
     @Test
     void aNonMatchingDirectoryYieldsNullRatherThanAMismatch(@TempDir Path root) throws Exception {
-        writeRecord(root, "ses_aaa", "/w/a", 1000L);
+        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
 
         assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/other"),
-                "no row for this cwd yet → null, not a wrong session");
+                "no record for this cwd yet → null, not a wrong session");
     }
 
     @Test
-    void prefersTheMostRecentlyUpdatedRowWhenSeveralMatch(@TempDir Path root) throws Exception {
-        writeRecord(root, "ses_old", "/w/a", 1000L);
-        writeRecord(root, "ses_new", "/w/a", 5000L);
+    void prefersTheMostRecentlyModifiedRecordWhenSeveralMatch(@TempDir Path root) throws Exception {
+        writeRecord(root, "p1", "old.json", "ses_old", "/w/a", 1000L);
+        writeRecord(root, "p2", "new.json", "ses_new", "/w/a", 5000L);
 
         assertEquals("ses_new", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
-                "the row with the highest time_updated for the cwd wins");
+                "the freshest record for the cwd wins");
     }
 
     @Test
-    void aMissingDatabaseYieldsNullWithoutThrowing(@TempDir Path root) {
-        // No opencode.db at all under the root.
+    void aMissingOrEmptyStorageRootYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
+        // Missing: no session dir at all under the root.
         assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
-    }
 
-    @Test
-    void anEmptyDatabaseYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
-        Path db = root.resolve("opencode.db");
-        try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + db);
-             Statement statement = connection.createStatement()) {
-            statement.execute("CREATE TABLE session (id TEXT PRIMARY KEY, directory TEXT, "
-                    + "time_updated INTEGER)");
-        }
-
-        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
+        // Present but empty: a session dir with nothing in it produces no match, not a throw.
+        Path emptyRoot = root.resolve("empty");
+        Files.createDirectories(emptyRoot.resolve("session"));
+        assertNull(new OpenCodeSessionDiscovery(emptyRoot).sessionIdForDirectory("/w/a"));
     }
 
     @Test
@@ -97,41 +76,15 @@ class OpenCodeSessionDiscoveryTest {
         assertNull(discovery.sessionIdForDirectory("   "));
     }
 
-    /**
-     * The one line standing between fleetd and writing the operator's live {@code opencode.db} —
-     * 841MB, with a running opencode writing it — is {@code config.setReadOnly(true)} in
-     * {@link OpenCodeSessionDiscovery#openReadOnly()}. Delete it and every other test in this class
-     * still passes, so this is the test that guards it.
-     *
-     * <p>It asks the connection to write, and requires a refusal. The obvious alternative — make
-     * the database file unwritable and check the read still works — proves nothing: SQLite silently
-     * downgrades a read-write open of an unwritable file to read-only, so that test passes either
-     * way. It was tried and watched pass with the flag removed.
-     */
     @Test
-    void theDatabaseIsOpenedReadOnly(@TempDir Path root) throws Exception {
-        writeRecord(root, "ses_aaa", "/w/a", 1000L);
+    void aMalformedRecordIsSkippedRatherThanFatal(@TempDir Path root) throws Exception {
+        // A record that fails to parse must not abort the scan of its siblings.
+        Path dir = root.resolve("session").resolve("p1");
+        Files.createDirectories(dir);
+        Files.writeString(dir.resolve("broken.json"), "{not valid json");
+        writeRecord(root, "p1", "good.json", "ses_good", "/w/a", 1000L);
 
-        try (Connection connection = new OpenCodeSessionDiscovery(root).openReadOnly();
-             Statement statement = connection.createStatement()) {
-            SQLException refused = assertThrows(SQLException.class,
-                    () -> statement.executeUpdate("INSERT INTO session (id, directory, time_updated) "
-                            + "VALUES ('ses_zzz', '/w/z', 1)"),
-                    "the connection must REFUSE a write — opencode is writing this database live");
-            assertTrue(refused.getMessage().toLowerCase().contains("readonly")
-                            || refused.getMessage().toLowerCase().contains("read-only"),
-                    "the refusal must be about read-only, not some other error: " + refused.getMessage());
-        }
-    }
-
-    @Test
-    void aCorruptDatabaseFileYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
-        // A file at opencode.db that is not a SQLite database at all — the open/query must fail
-        // safe, never fatal to a spawn.
-        Path db = root.resolve("opencode.db");
-        Files.writeString(db, "this is not a sqlite database");
-
-        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
-                "an unreadable database resolves to null, not an exception");
+        assertEquals("ses_good", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
+                "an unreadable record is skipped; a later valid one still matches");
     }
 }

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -710,68 +710,6 @@ class MessageServiceTest {
         assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome());
     }
 
-    // --- #137: a fleet_ask round-trip must not orphan the ticket's own reply -------------------
-    //
-    // The primary's fleet_send{turnId} answer call is itself bounded (a real MCP call, capped well
-    // under a minute) — far shorter than a resumed turn can genuinely take to finish real work. These
-    // drive the exact real delegation path (async send -> worker asks -> primary answers -> primary's
-    // own wait gives up -> worker's real fleet_reply arrives afterwards) rather than calling a reply
-    // sink directly, since the bug is specifically about which sink the resumed turn's reply reaches.
-
-    @Test
-    void aReplyAfterAnswerTimesOutStillCompletesTheAsyncTicket() throws Exception {
-        String ticket = messages.sendAsync(T, "task that asks");
-        awaitWaiting();
-        injectDelivery();
-
-        CompletableFuture<MessageService.AskResult> ask =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 5000));
-        MessageService.TaskView asking = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
-
-        // The primary answers, but its own bounded wait for the worker's resumed turn is short and
-        // expires before the worker (still genuinely working) gets back to it.
-        MessageService.Reply answerReply = messages.answer(asking.turnId(), "config.yaml", 150);
-        assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
-        assertEquals(MessageService.Outcome.TIMED_OUT_WORKING, answerReply.outcome(),
-                "the primary's own bounded wait gives up before the worker finishes resuming");
-
-        // The worker keeps working past that window and only now calls fleet_reply.
-        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
-
-        MessageService.TaskView done = awaitTicketPhase(ticket, MessageService.Phase.DONE);
-        assertEquals("PR opened: https://example/pulls/42", done.reply(),
-                "fleet_poll{ticket} must return the worker's real reply, not stay pending forever");
-        assertEquals("reply", done.replySource());
-        assertFalse(messages.hasStrandedReply(T),
-                "the reply completed its own ticket directly and never touched the inbox");
-    }
-
-    @Test
-    void fleetStopAfterAnOrphanedReplyDoesNotFailTheTicket() throws Exception {
-        String ticket = messages.sendAsync(T, "task that asks");
-        awaitWaiting();
-        injectDelivery();
-
-        CompletableFuture<MessageService.AskResult> ask =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 5000));
-        MessageService.TaskView asking = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
-
-        MessageService.Reply answerReply = messages.answer(asking.turnId(), "config.yaml", 150);
-        assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
-        assertEquals(MessageService.Outcome.TIMED_OUT_WORKING, answerReply.outcome());
-
-        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
-
-        // fleet_stop tears the worker's session down right after the reply landed — this must never
-        // report the misleading "the worker session was released before it replied": a reply is
-        // exactly what happened.
-        assertFalse(messages.abandon(T, "the worker session was released before it replied"),
-                "a reply already arrived, so nothing here is a genuine failure");
-
-        MessageService.TaskView view = awaitTicketPhase(ticket, MessageService.Phase.DONE);
-        assertEquals("PR opened: https://example/pulls/42", view.reply());
-    }
-
     @Test
     void unansweredAsyncQuestionReturnsTheTicketToPendingAndReleasesItsTarget() throws Exception {
         String ticket = messages.sendAsync(T, "task that asks");